Principles of least privilege and access control