A security team wants to ensure that if an attacker compromises one low-privilege user account, they cannot pivot to administrative access simply because that user's account was accidentally granted broad rights. Which principle addresses this directly?

• ALeast privilege: granting each account only the minimum access necessary for its function
• BSecurity through obscurity
• CSingle sign-on
• DIncreasing password length only