Program experiences should request only the information needed for a clear business purpose. Access should follow defined roles, and operational actions should be attributable to the people or systems responsible for them.
- ✓Purpose-limited information
- ✓Role-based access
- ✓Traceable operational actions