AZ-900 Question 322

Which principle should you follow to minimize security risks by granting users only the permissions they need to perform their job?