Identity and Access Management: Enforcing Least Privilege and RBAC