threat scope reduction

Letting each request reach only the one resource it needs, so a stolen account opens one door, not the whole building.