Routine operations should not directly hold cluster-admin privileges; temporary on-demand privilege escalation, revoked immediately after use, can downgrade 'one token compromised equals total compromise' to a localized impact.