Risk of not using principle of least privilege