A single serverless function sits at the center of a cloud account's resource graph — surrounded by databases, storage buckets, queues, secrets and other functions it could potentially reach. Its actual job only ever needs one of them. Grant it an over-privileged, admin-style IAM role and a code-injection exploit lets an attacker pivot straight through every other resource in the account. Scope the same function down to least-privilege — access to only the table it legitimately touches — and the identical exploit is contained to that one node. Toggle the permission scope, inject the exploit, and watch the live resources-accessible-to-attacker counter tell the story.