What is a common mistake with Kubernetes RBAC and security?

Granting cluster-admin broadly, using default service accounts for applications, or allowing privileged Pods weakens cluster security. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.