Least privilege
Giving every account only the access it needs to do its job, and nothing beyond that.
Privilege accumulates. People change roles, cover for colleagues, and join projects, and the access from each of those tends to stay attached long after the reason has gone. After a few years many staff can reach far more than their role requires.
It is the single most effective limit on blast radius. When an account is compromised, least privilege decides whether the attacker gets one department's files or the entire file server.
Where this comes up
Least privilege sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.