Do: allow each connection only the actions and data needed for its bounded task, with enforcement outside the prompt. Example: a report tool may read three approved rows but cannot write records or list the database. Check: list every granted permission, remove one unused permission, and verify an attempted write or extra read is denied.