Exercise 2: Why Least Exposure for Data Is the Same Principle as remote1's Least Privilege — Possible Solution
====================================================================

WHAT remote1's LEAST PRIVILEGE ACTUALLY SAYS
------------------------------
Per this chapter, "remote1's own Chapter 6 established least privilege
for access - only reaching for the permissions a task actually needs."
The underlying idea isn't specific to permissions as a technical
mechanism - it's a general principle about scope: use only what the
task in front of you genuinely requires, not everything you happen to
be capable of using.

WHY THE SAME LOGIC APPLIES DIRECTLY TO DATA
------------------------------
During a remote session or while pulling records, a technician often
has the *technical ability* to view far more than the ticket needs -
other files, other tabs, other unrelated records sitting in the same
system. Per this chapter, "the fact that access is technically
available doesn't make looking at it appropriate." That's structurally
identical to remote1's own point about standing root access versus a
single needed command - having broader capability available is not,
by itself, a reason to use all of it.

WHY THIS ISN'T A COINCIDENTAL SIMILARITY
------------------------------
Both principles solve the same underlying problem: broader access or
visibility than a task requires increases what could go wrong (data
exposed, an unrelated system touched) without adding anything useful
to actually completing the task. Whether the "extra" thing available
is a permission or a piece of visible data, the same blast-radius
reasoning applies - keep what's actually exercised as close as
possible to what's actually needed.

WHY TREATING THEM AS THE SAME PRINCIPLE, NOT TWO RULES, MATTERS
------------------------------
Recognizing this as one underlying idea, rather than a coincidental
parallel, makes it easier to apply consistently - a technician who
already understands least privilege for access has already learned
the reasoning needed to apply least exposure to data, rather than
needing to memorize it as an entirely separate rule.

WHY THIS WORKS AS AN ANSWER
------------------------------
It restates remote1's own principle, explains specifically how the
"technical ability isn't a reason to use it" reasoning transfers
unchanged from access to data, and explains why recognizing this as
one principle rather than two separate rules is itself useful.