Exercise 1: Why Least Privilege Matters Even Without Any Intent to Misuse — Possible Solution ==================================================================== WHAT THIS CHAPTER SAYS ------------------------------ Per this chapter, "least privilege isn't (only) about not trusting yourself. A broadly-privileged account is a bigger target and a bigger blast radius the moment something goes wrong with your access specifically - a stolen credential, a phished session, a compromised laptop - entirely independent of your own intentions." THE REAL QUESTION THIS CHAPTER ASKS ------------------------------ Per this chapter, "the real question isn't 'would I misuse this,' it's 'what's the maximum damage if something goes wrong with my access, regardless of why.'" The risk being managed isn't the engineer's own future behavior - it's what happens if their credentials or session end up controlled by someone else entirely, through no fault of their own intentions. WHY THIS MEANS TRUSTWORTHINESS DOESN'T ELIMINATE THE RISK ------------------------------ An engineer could be completely trustworthy and still have their laptop stolen, their session hijacked, or their credentials phished - none of these depend on the engineer's own honesty or judgment at all. Once any of those happen, whoever now controls that access inherits whatever privilege the account actually has - which is exactly why the account's own privilege level matters regardless of how trustworthy its legitimate owner is. WHY THIS WORKS AS AN ANSWER ------------------------------ It states the chapter's own explicit reframing (blast radius under compromise, not misuse) and explains specifically why a person's own trustworthiness doesn't protect against the scenarios (theft, phishing, compromise) the chapter is actually concerned with.