The post makes a huge leap which doesn't make sense to me. They claim that it makes sense to not test the use of security privileges in CI, and instead route "reports" to a separate security team, who will then somehow know whether this app should or should not be using the key. And then even block access when the app isn't known to use the privileges. Shouldn't this just be a declarative configuration alongside the app, and then allow the security team to audit which apps are given what privileges? That seems like an actual "least privilege" implementation. This seems more aligned with the first two Ways.