Least privilege

Giving each user only the permissions needed for their role is called least privilege. It reduces accidental changes and deliberate damage. If a student's account is compromised, restricted permissions limit which data the attacker can reach or alter.