It's entirely doable to manage permissions granularly, but it's not the most natural thing to do. It's FAR easier to broaden permissions.

The more functions you have and the more time they've had to morph, the more likely they are to have far greater permissions than they should.