Providing only the minimum privileges needed for a specific task. Combined with JIT access to minimize both the duration and scope of elevated permissions.