Least privilege
Only the access required, only for as long as required. Standing admin is standing blast radius.
Least privilege is the design rule: default deny, grant by role, expire standing elevation, log use. Need-to-know is the data version of the same idea — only what the job requires.
A privileged user can change security settings, accounts, logs, or applications. That is a tool, not a status. Just-in-time admin beats a permanent Domain Admins club. Break-glass accounts exist, are monitored, and are ugly on purpose.
Apply it to humans, APIs, CI jobs, and cloud roles. A build pipeline with Owner on the subscription is a privileged user with a logo.
Fact source: ASD's ACSC glossary. Wording is Cyberstack's.