This policy governs how we provision and manage access to systems and data.
Least privilege, role-based access, and periodic reviews.