#principle of least privilege #security policy #access rules #minimum necessary access #cybersecurity rule