A least-privilege policy giving users enough access for them to do their job. Each job role will have a different access policy. Accountants only have access to reading,writing and sharing/