A financial services company hires a new intern who will only need to view read-only reports in a single accounting application. During onboarding, the IT administrator is deciding what level of access to grant. Which security principle should guide the administrator to assign only the minimum permissions required for the intern to perform their job?