What is your experience with implementing IAM least-privilege policies?

Technical