> a CS prof I once had always insisted we dropped permissions and capabilities as soon as we were done with them

Only once?? Doing this should be muscle memory for working devs.