Grant least-privilege access with Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings. Test permissions with impersonation and authorization checks, then avoid common wildcard and namespace mistakes.
