Scripting with Least Privilege