How does RBAC actually limit the blast radius of a compromised credential?

A role bundles specific permissions (read a specific database, write to a specific collection) granted to a user or service credential. When that credential is compromised, the attacker is mechanically limited to exactly what the role permits — versus a single shared admin credential across every service, where compromising any one service grants full cluster access regardless of how well that service's own code was written.