cloud iam, least privilege or operational ease? its a tough balance, dont you think?

hey folks im wrestling with a common cloud iam challenge and wanted to get your thoughts on one hand we all know the principle of least privilege is paramount for security but on the other hand constantly refining policies and managing temporary access can add a ton of operational overhead esp in dynamic environments whats your teams approach do you lean heavily towards strict least privilege and accept the operational cost or do you find a balance that prioritizes ease of use while still maintaining acceptable security any specific tools or strategies youve found effective for managing this trade off