If you apply principle of least privilege to developers then ideally you should have a whitelist of every software package that they need to use. What happens t

If you apply principle of least privilege to developers then ideally you should have a whitelist of every software package that they need to use. What happens then when a productive developer, instead of developing from scratch, searches for a solution to some problem and discovers that there is already a module that may solve it? Do they go to some central committe to get approval to add it to the whitelist? What are their criteria? How long will it take them to approve it? Suppose it takes a couple of days. Then the developer tries the module. Discovers immediately that the module doesn't solve the problem. That's two days wasted for nothing. Suppose some module that has dependencies on a huge list of other modules. How long will it take now? I'm not saying polp isn't valid. But is it practical?