How to apply least‑privilege security to Ballerina services using built‑in constructs?

I am looking to harden a Ballerina microservice by limiting its permissions to only what is necessary. Ballerina provides first‑class service constructs and extensible metadata for cloud integration. How can I configure authentication, authorization, and runtime privileges (e.g., user, file system, network) using these language features to achieve a least‑privilege deployment?