Giving users, services, and agents only the permissions needed to do their job — and no more. Applied to service accounts, tool scopes, and agent permissions.