Unfortunately, least privilege access is not common practice in the industry yet. It's coming along, but it's a huge lift to get everything and everyone onboard

Unfortunately, least privilege access is not common practice in the industry yet. It's coming along, but it's a huge lift to get everything and everyone onboarded, especially if you have a bunch of legacy systems you need to retrofit. At companies where least privilege is a thing you can just revoke most of a person's permissions while leaving them access to, say, internal email and Slack. Without pervasive RBAC or ABAC that's basically impossible.