ideally, every computation resource should have exactly as much access as it needs to do its job, and no more