A new intern in the purchasing department requires read access to shared documents. Permissions are normally controlled through a group called "Purchasing", however, the purchasing group permissions…

Modifying individual files with read-only permissions for the intern is inefficient, not scalable, and circumvents the benefits of managing access through security groups.

Creating a new security group with only read permissions for the shared documents adheres to the principle of least privilege, ensuring the intern receives only the necessary access. This method provides a scalable and manageable approach to permission assignment, allowing for easy updates or additions of other users with similar access requirements in the future.

Removing all permissions for the shared files would deny access to everyone, including existing users who require access, disrupting normal operations.

Adding the intern to the existing "Purchasing" group would grant them unintended write access, violating the requirement for read-only access and the principle of least privilege.