Provisioning unique access to only 1 or 2 people AOR? Person Security Profile?

Summary:

What is the best way to provision security access to some page / functionality only 1 or two people?

• AOR?
• Person Security Profile?

How do organizations best handle this without ending up creating a custom role for each ad-hoc security access request that you get from the business?

Thanks