In practice, I've see access controls typically as being too loose creating risk in areas such as admin access or with wild cards as in the Capital One breach.

In practice, I've see access controls typically as being too loose creating risk in areas such as admin access or with wild cards as in the Capital One breach. The alternative is often too tight in which case developers struggle with ops to manage the things they need access to. Just in time access controls (and change logs) and isolating resources through the concept of a project or tenant is one approach, and, if you will pardon the plug, the approach we’ve chosen with our no code, infrastructure as code platform www.duplocloud.com.