IT sets Bob up with his account and walks him through the three pillars of access security — called AAA. First: Authentication. This is proving you are who you say you are. A strong password plus a second factor — an OTP, an authenticator app, a fingerprint. One factor alone is never enough. Second: Authorisation. Being logged in does not mean you can access everything. Bob can only see the systems and data his role actually needs — nothing more. This is called Least Privilege, and it limits the