Least Privilege
Granting each identity only the permissions it needs, for only as long as it needs them.
Simple to state, and the thing every real environment drifts away from, because granting a permission solves an immediate problem and removing one risks breaking something nobody can name.
The mechanisms that actually hold the line are procedural rather than technical: start from deny and add, rather than starting from a wildcard and trimming; grant to roles rather than to principals; use short-lived credentials and just-in-time elevation so that standing privilege is small; and review actual usage against granted permissions, since cloud providers now report which grants have never been exercised.
Its value is entirely about blast radius. Least privilege does not prevent compromise. It decides how much a compromise is worth to the attacker.