diff --git a/pkg/object/objmetadata.go b/pkg/object/objmetadata.go
index bc46cc38..d7627edc 100644
--- a/pkg/object/objmetadata.go
+++ b/pkg/object/objmetadata.go
@@ -91,18 +91,20 @@ func ParseObjMetadata(s string) (ObjMetadata, error) {
 	// Finally, second field name. Name may contain colon transcoded as double underscore.
 	name := s[:index]
 	name = strings.ReplaceAll(name, colonTranscoded, ":")
-	// Check that there are no extra fields by search for fieldSeparator.
-	if strings.Contains(name, fieldSeparator) {
-		return NilObjMetadata, fmt.Errorf("too many fields within: %s", s)
+	gk := schema.GroupKind{Group: group, Kind: kind}
+	// RBAC resources may contain a literal underscore in their name, so the
+	// extra-fields check below would reject otherwise valid identifiers.
+	if _, isRBAC := RBACGroupKind[gk]; !isRBAC {
+		// Check that there are no extra fields by search for fieldSeparator.
+		if strings.Contains(name, fieldSeparator) {
+			return NilObjMetadata, fmt.Errorf("too many fields within: %s", s)
+		}
 	}
 	// Create the ObjMetadata object from the four parsed fields.
 	id := ObjMetadata{
 		Namespace: namespace,
 		Name:      name,
-		GroupKind: schema.GroupKind{
-			Group: group,
-			Kind:  kind,
-		},
+		GroupKind: gk,
 	}
 	return id, nil
 }
diff --git a/pkg/object/objmetadata_test.go b/pkg/object/objmetadata_test.go
index 8c6fb681..f6138fb6 100644
--- a/pkg/object/objmetadata_test.go
+++ b/pkg/object/objmetadata_test.go
@@ -75,6 +75,18 @@ func TestParseObjMetadata(t *testing.T) {
 			},
 			isError: false,
 		},
+		"RBAC resources can have a literal underscore in their name": {
+			invStr: "test-namespace_roles_ops_rbac.authorization.k8s.io_ClusterRole",
+			inventory: &ObjMetadata{
+				Namespace: "test-namespace",
+				Name:      "roles_ops",
+				GroupKind: schema.GroupKind{
+					Group: rbacv1.GroupName,
+					Kind:  "ClusterRole",
+				},
+			},
+			isError: false,
+		},
 		"Test double underscore (colon) at end of name": {
 			invStr: "test-namespace_leader-locking-kube-scheduler___rbac.authorization.k8s.io_RoleBinding",
 			inventory: &ObjMetadata{