Follow the Principle of Least Privilege

The principle of least privilege states that users should be given the least amount of privilege to perform their jobs. Over ambitious granting of responsibilities, roles, and permissions, especially when people are few and work needs to be done quickly, often leaves a system wide open for abuse. You should initially establish a policy to determine and assign least privileges to users. Periodically review user privileges to determine relevance to current job responsibilities.