How should identity and least privilege be designed for production in Cloud Security?

Use federation, MFA, managed workload identities, role-based access, just-in-time elevation, access reviews, and separation of duties. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.