What is the principle of least privilege in software?