Give users the least amount of permissions required to do the job