Least-privilege for Kubernetes workloads — own ServiceAccount + no auto-mounted API token, then non-root + dropped caps, then Pod Security as the enforced floor. Adds a matching house-style SVG diagram (workload-least-privilege).
jwright