How do I restrict over-broad access permissions?
This graph shows the 5 recommended controls for solving this problem