@BenAveling that's not a hot take. It's #LeastPrivilege and #SeparationOfDuties. It's temporary #StepUpAuthentication and timeouts.
A particular user should only be able to do what they need to do for a particular job function, but only when they need to do it, and only for as long as it takes to do the thing.