Least-Privilege Permissions

AI coding tools default to "make it work" — and the fastest way to make it work is to grant full access everywhere. Admin IAM roles, root database users, wildcard API scopes, containers running as root. The code runs, the demo works, and you've just deployed an attack surface the size of a parking lot.

## Key Points

- name: app
- name: app
- name: tmp
1. Deploy with zero permissions
2. Watch it fail
3. Add exactly the permission it needs
4. Repeat until it works
- **AWS**: [iamlive](https://github.com/iann0036/iamlive) — captures API calls and generates least-privilege policies
- **GCP**: IAM Recommender — suggests role reductions based on actual usage
- **Azure**: Azure AD Access Reviews — identifies unused permissions