Watch this video on YouTube
What is the MOST important security principle to follow when implementing access control for a new system?