How to apply least‑privilege security when launching MAPDL via PyAnsys on a Slurm HPC cluster?

When starting MAPDL from Python using ansys.mapdl.core.launch_mapdl (as shown in the shared‑topology example), the process is launched with the user's current credentials and environment. In a Slurm‑managed cluster that also uses NFS/BeeGFS storage and MPI over InfiniBand, what specific steps should be taken to restrict the MAPDL process to the minimum required privileges? Consider aspects such as:

• File‑system permissions for the working directory, input files, and output results.
• Environment variables that affect MPI initialization (e.g., MPI_IB_PKEY) to avoid the "multiple pkey found" warnings.
• Any MAPDL or PyAnsys options that reduce the attack surface (e.g., limiting external script execution, disabling unnecessary plugins).

Provide a concise, step‑by‑step checklist that references the launch command and the MPI pkey issue observed in the cluster logs.