Principle of minimum privilege