An old supervisor of mine used to say "it is better to lock them down in the beginning, because you can always get them more permissions but it becomes nearly impossible to take them a way".

I find that to be true more often then not.