How can CSS3 be configured with least-privilege principles to minimize security risk?

When designing a web application, developers often seek to limit the capabilities of CSS to only those styles necessary for presentation, reducing the attack surface that could be exploited through malicious stylesheets or inline styles. However, determining which CSS features can be safely disabled without breaking layout or theming remains unclear, especially when considering dynamic class additions, third-party components, and the need for responsive design. How can a least-privilege policy be defined for CSS3 features such as animations, transforms, and external imports? What mechanisms exist to enforce such restrictions at build time or runtime? Are there established guidelines for auditing CSS usage to verify compliance with a least-privilege approach?