Temporary adoption instead of a permanent presence
Role assumption lets a principal temporarily adopt a different, scoped set of permissions — often in an entirely different account or trust boundary — for the duration of a specific task, rather than being issued a standing credential in that other account that persists indefinitely. The assumed role's permissions apply only while actively assumed and typically expire automatically after a bounded duration, rather than requiring someone to remember to explicitly revoke them later.
This directly applies just-in-time access to the specific problem of crossing account boundaries: instead of provisioning a permanent credential in every account a principal might occasionally need to act within, a single identity can assume a temporary, narrowly scoped role in whichever account a specific task actually requires, with the access disappearing again automatically once the task is complete.
Why this matters more as the number of accounts grows
An organization operating a handful of accounts might reasonably get away with standing cross-account credentials managed carefully by hand. That approach doesn't scale: as the number of accounts grows, so does the number of standing credentials that would otherwise need provisioning, tracking, and periodically reviewing — exactly the kind of accumulating, rarely-revisited access that's cheap to set up once and expensive later, when one of those long-forgotten standing credentials turns out to be exactly what an incident needed to spread further than it should have.