Security
What is Least privilege?
Least privilege is the practice of granting each person, process, or credential only the access needed for its defined task. It reduces the damage a compromised account can cause, provided permissions are scoped, reviewed, and removed when they are no longer needed.
For payment systems, separate read, simulation, approval, and signing capabilities. A developer sandbox should not inherit production signing credentials, and a telemetry exporter should not be able to alter learner progress.
Review privileges as code and test denied actions as carefully as allowed ones. Service accounts should have an owner, expiration or review date, and a documented reason for each elevated permission.
Related
Definitions are educational and general. Nothing here is financial, legal or tax advice, and regulatory descriptions summarise frameworks that change — check the current rules for your jurisdiction before relying on them.