Access should match the work and the risk. Finance, sales, marketing, and operations do not all need the same tools, permissions, or guardrails.