Need-to-know
Access only to the data the role actually requires. Broad file shares are a rumour mill with NTFS.
Need-to-know restricts a person to the information their duties require. It is least privilege applied to data, not just admin rights.
Open shared drives, 'everyone' groups, and forwarded mailboxes are how you fail it without a hostile actor in the building.
Fact source: ASD's ACSC glossary.