Minimum Access Controls for AI-Assisted BI: Least Privilege and Separation of Duties