How can I apply the principle of least privilege to Bash scripts on a Linux system?

When writing Bash scripts that perform administrative tasks, how can I restrict the script’s capabilities to only the operations it truly needs, following the principle of least privilege? For example, if a script only needs to read specific log files and write to a designated directory, what steps should I take to set up a dedicated non‑root user, adjust file system permissions, and use tools like sudo with restricted command lists or Linux capabilities to confine the script’s execution environment? Please explain the configuration process, verification methods, and rollback procedures in case the restrictions break functionality.

Note: The supplied sources discuss WSL installation and troubleshooting, not Bash least‑privilege hardening, so the answer should rely on general Linux security best practices.