Security baseline: least privilege, explicit tool governance, and audit trails.
