Users should have access to all resources by default

Users should only have the minimum access necessary to perform their tasks

All access permissions should be granted permanently

Access control policies should be defined by the users