In a corporate environment implementing a Zero Trust Security Model, a security analyst is tasked with evaluating the access controls for a sensitive database. The database is accessed by various departments, including finance, HR, and IT. Each department has different access needs, and the analyst must ensure that access is granted based on the principle of least privilege. Given that the finance department requires access to financial records, the HR department needs access to employee data, and the IT department requires administrative access for maintenance, which approach should the analyst take to ensure compliance with the Zero Trust principles while minimizing potential security risks?