Protect by default
Apply least privilege
Give people, processes, tokens, and services only the access they need for the task and only for as long as needed.
8 minute lesson
Every permission increases what a mistake or compromise can damage. Start with no access, then add the narrow capability the task needs.
A reporting job may read invoices but should not delete them. A deployment token may publish one project but should not administer the account. Review privileges when roles, services, and projects change.
A nightly reporting job needs to read invoice totals. If its token can also delete invoices, one leaked CI log turns a reporting failure into data loss.
Narrow access can make operations less convenient. Keep a separate, audited recovery path instead of leaving routine credentials permanently powerful.
Run one normal reporting task with a read-only credential and capture the successful result. Then attempt a delete with the same credential and keep the denied response as evidence.
Lesson completed