Principle of Least Privilege

If

Every component granted more authority than it strictly needs enlarges the blast radius of any bug, compromise, or accident, and multiplies the interactions an auditor must reason about.

Then

Default every process, service account, and token to deny, then add only the minimal scopes the job provably needs; re-audit the grants whenever the job changes.

Unless

Psychological Acceptability — over-restriction that users route around defeats itself