Which rule states that a user should only get the access they need to do their job and nothing more?

The correct answer is D. Least Privilege.

The Principle of Least Privilege is a security concept that states users should only have the minimum level of access necessary to perform their job functions. This approach minimizes the risk of accidental or malicious damage to the system, as it limits user permissions to only what is essential.