# Reflection: Least Privilege Is a Habit, Not a One-Time Fix

## Reflection questions

1. Before this module, what would you have done the first time you hit a "permission denied"
   error? How does that compare to what you'd do now?
2. Name one place outside of file permissions where you'd expect "grant only what's needed" to
   matter (a user account, an API key, a service's network access — anything).

## Real Ops takeaway

**Least privilege is the single idea from this entire module that reappears the most across
the rest of ROOT_.** File permissions are just the first, most concrete place you'll apply it —
ROOT 09 applies the exact same principle to Kubernetes RBAC (what can a user or workload
actually DO) and SecurityContext (what can a container actually access). Getting comfortable
asking "what's the minimum this actually needs" now, on a file you can see and touch, makes that
same question much easier to ask later about something more abstract, like a ServiceAccount's
permissions.

This module is complete. This is the end of ROOT 01 — continue to ROOT 02: Linux
Administration & Networking.

## Instructor Notes

**Discussion questions for a live classroom:** question 2 works well as a round-robin — the
variety of answers (API keys, database credentials, network firewall rules) is itself useful
evidence of how far this one principle travels.

**Approximate timing:** 5-8 minutes live discussion; 5 minutes self-paced writing.

**Milestone note:** this is the last module of ROOT 01 — consider a short recap of the whole
course's arc (hardware → shell → filesystem → files/text → processes → permissions) before
moving on, so students see it as one coherent foundation rather than six separate topics.