Least privilege
Do not grant a global permission when a targeted permission is sufficient.
Roles
Separate access to logs, settings, and sensitive actions.
Testing
Use several test accounts to confirm the actual access boundaries.
Review
Remove delegations that are no longer needed.