work toward "least privilege" setup #1