Locking Down Kubernetes RBAC in a Multi-Tenant Cluster

Design least-privilege Kubernetes RBAC with Roles vs ClusterRoles, ServiceAccount lockdown, audit commands, and the verbs that open privilege-escalation paths.