> You start really locked down, and you read and approve every request for access. Or you start out with almost every permission granted always, but the entire

> You start really locked down, and you read and approve every request for access. Or you start out with almost every permission granted always, but the entire thing runs in a sandbox with the minimum amount of credentials needed to do its work… Sounds preferable to me to catastrophic failures :-)