According to one aspect of the concepts and technologies disclosed herein, a role-based access control (“RBAC”) system can mark all granular roles in a granular role group as non-tested to create a non-tested granular role set. The RBAC system can randomly select a granular role from the non-tested granular role set. The RBAC system can assign both the non-tested granular role set and a tested-keep granular role set to the granular role group. Each granular role in the tested-keep granular role set has been tested an approved for inclusion in the complete granular role set. The RBAC system can determine whether a user assigned to the granular role group has access to a protected function. In response to determining that the user does not have access to the protected function, the RBAC system can mark the granular role for inclusion in the tested-keep granular role set.