Don't grant privileges to users that should not have those privileges?

The gating here is at the cloud level...