Least privilege means: give each role only the privileges it needs for its job, and nothing more. If an attacker steals the password of a role, they get only what that role can do.

Set up Monster Market's roles. Use everything from this chapter.

1. The shop application. Create a role shop_app that can connect. It reads products and categories, reads and inserts orders and order_items, and changes only the stock column of products. Nothing else.
2. The analytics team. Create a group role analytics that cannot connect. It reads orders, order_items, products and categories. Create a role maya that can connect, as a member of analytics, with no privileges of her own.
3. Customers, without personal data. The analysts need each customer's country, not names or emails. Create a view customer_countries with the id and country of every customer, and let analytics read it. analytics must not read customers.
4. Test it. Become maya and count the orders per country: the country of the customer, then the number of orders. Then go back to your own role.