Give a process or person only the permissions needed for the job and nothing more, so a mistake or compromise has a small blast radius.