Taming Access Creep: Strategies to Rein in Unnecessary Privileges