Least privilege

Giving each program only the access its job needs. The shop API gets `readWrite` on `kc` only, and Sam's reports get just `read`.