Grant minimum necessary access for specific tasks. When permissions are bound too broadly, an attacker who compromises an account gains sweeping access.