Least privilege

Least privilege means giving somebody only what they need for the job in front of them. Not a master key because once a month they need the stationery cupboard.

It is not about trusting people less. It is that accounts get stolen, and whatever that account could do, whoever took it can now do. Every permission nobody is using is one somebody else gets for free on a bad day. It also piles up quietly: people change jobs, pick up new access and keep the old. Taking it away has to be as deliberate as handing it out.