“Any resource that can be accessed should be limited.”

Transcript evidence from Erez Yalon — The OWASP API Security Project.