Kubernetes RBAC is your first line of defense against lateral movement inside a cluster. This guide walks through creating custom Roles, ClusterRoles, and ServiceAccounts with least privilege — including verification steps and common pitfalls to avoid.