How to configure BrowserStack with least‑privilege access for automated testing pipelines

When integrating BrowserStack into a CI/CD pipeline, what are the recommended steps to configure the account and associated credentials using the principle of least privilege? Please outline how to identify the minimal set of BrowserStack API permissions needed for test execution, how to create and restrict a dedicated user or service account, how to store and rotate secrets securely, and what verification or rollback procedures should be in place if excessive privileges are detected. Include any relevant BrowserStack dashboard settings or CLI flags that enforce these restrictions.