What each model is good at
Role-based access control assigns permissions to named roles and principals to those roles. It reads clearly — 'this role can do this' — and scales well when real access needs map cleanly onto a stable, manageable set of roles. Attribute-based access control instead evaluates a policy against live attributes of a request: who is asking, what they're asking for, and under what circumstances. It handles nuance roles can't easily express, at the cost of being harder to summarize at a glance.
Neither is strictly better. Roles tend to work well where job functions are relatively fixed and well understood. Attributes tend to work better where access legitimately depends on context that a fixed role can't capture — the sensitivity of the specific record being requested, the time of day, the device making the request.
Where role-based systems tend to break down
The common failure mode for role-based systems is role sprawl: real access needs rarely map perfectly onto a fixed set of roles, so teams either create an ever-growing number of narrow, one-off roles to cover edge cases, or assign a broader existing role that grants more than a given person actually needs. Attribute-based policy avoids this specific failure by evaluating the actual request rather than checking membership in a predefined bucket — but introduces its own failure mode, where the policy itself becomes complex enough that nobody can quickly answer 'who can do what' without running it.