Anna, a financial expert, needs to get into a financial management app that has private information on it$.$ Anna starts the process of getting in by scanning her fingerprint through the biometric identification system. After Anna logs in$,$ the system asks for a One$-$Time Password $($OTP$)$ that was sent to the phone she used to register. If Anna's identity is verified, the system lets her use the financial management app. But the rights let her view and analyse the financial information, which is what her job requires. She has no permission outside her duties.

What security design principles are applied in the financial management app? Explain your answer.