RBAC answers “what role does this person have?”. It works well for broad permissions: admin, analyst, auditor. Once the rule depends on the resource, as in “who can see this request?”, the number of roles explodes.
ReBAC, popularized by Google's Zanzibar, models permissions as relationships between objects: the person is on the team, the team owns the folder, the folder contains the document. A check becomes a traversal of that graph, and that is where cardinality and fanout turn into cost.
In practice a hybrid model tends to work: roles for what is broad and stable, relationships for what is per resource. OpenFGA and SpiceDB implement the idea, but the real work is designing the model and measuring query cost before going to production.