CSPM privilege requirements