I have been in IT for 30 years, and in security for the last 16.

You’ll find lots of arguments from a productivity and removing barriers point of view that say don’t bother with strict user access controls, just layer on other security measures. Others (usually older-school sysadmins) preach “doing the work”, meaning secure your users well and audit access often. There are advantages and disadvantages to both approaches.

I personally do a bit of both. The old way of being meticulous with access works, but not without diligence and self-audit. The newer devops way if doing things with secrets management and treating everyone as untrusted works too, as long as you document the automation.

Maybe one suggestion about user control in a homelab setting is not to use the same username across multiple services, but rather name your users something like name.of.service.admin so that you a) don’t forget where you are and b) if you start collecting logs centrally, you can easily identify which system the logs came from.