Security experts advocate Least Privilege principle to limit app permissions

The Principle of Least Privilege advises granting users, applications, and services only the minimum permissions necessary to perform their specific tasks. This approach, aligned with NIST guidelines, is a security measure to limit potential damage if credentials are compromised. For example, a service generating sales reports should only have read access to relevant data, not permissions to update or delete records. Security best practices also require enforcing these permission checks at the backend API level, not just the user interface.