What is the principle of least privilege, and how does it apply to designing an authorization system for a multi-tenant Node.js SaaS application?

The principle of least privilege states that any user, service, or process should be granted only the minimum access necessary to perform its function, and nothing more -- in a multi-tenant SaaS context, this means enforcing strict tenant isolation (a user from Tenant A should never be able to access Tenant B's data, even accidentally through a missing filter), scoping database queries and API tokens to a specific tenant ID by default, and giving even administrative roles the narrowest permissions actually required for their job rather than blanket superuser access.

// Middleware enforcing tenant scoping on every query automatically
function scopeToTenant(req, res, next) {
  req.tenantId = req.user.tenantId;
  next();
}

async function getOrders(req) {
  // Every query is forced through the authenticated user's own tenant scope
  return db.orders.find({ tenantId: req.tenantId });
}