Least privilege was policy long before it was enforced practice. I spent years arguing to close that gap. Being right about scope doesn't move a roadmap.

Then people holding privileged access started running coding agents on their machines daily. One misstep could put us in the newspaper, not just the security incident tracker. Suddenly, it mattered to everyone with org admin privileges.

So we cut it. And cleaned up a lot more standing privileges while we were at it.

AI made the cost of not securing it unpayable. After years, that turned out to be the only argument that ever worked.