Need-to-Know Access Control
Why not everyone should see all the information
The need-to-know principle establishes that a person should only have access to the information strictly necessary to do their job, not a bit more, even if you fully trust the rest of the team or it seems more practical to share everything openly. This isn't about distrust, but about reducing the impact if something goes wrong, because the fewer people with access to sensitive data, the lower the probability that it leaks by mistake, is shared improperly or is exposed if someone's account is compromised. In everyday practice, this means asking yourself before granting access to a folder or document whether the person really needs it for their current role, and removing that access when the project ends or the person's role changes, instead of letting it accumulate indefinitely. Applying this principle consistently, even if it sometimes means an additional administrative step when sharing information, is one of the most effective ways to limit the potential damage of any security incident.