What is a fundamental principle of Security Operations & Monitoring in Access Control Lists practice?