A new security architecture principle requires least privilege. What makes the principle operationally useful?

1. Publishing the phrase once on an intranet
2. Measuring only the number of architecture diagrams
3. Allowing every project to define the opposite principle
4. Supporting standards, design reviews, ownership, and evidence of implementation