Directory permission graph
Label: original fictional directory club.lab.invalid. No directory was built and no account was changed.

Job for group readers: read document-7. Nothing else.

E-1 readers -> document-7: read. Matches the job.
E-4 readers -> admin-mina: reset password. Larger than the job.
E-6 service-notes -> files-3: may present a client's identity onward. That is delegation, named here and not used.
Membership: lea is in readers. Membership matters only with the rights the group has.

Least privilege, from Microsoft's administrative-model article: the minimum permissions for the current task, and nothing more.
E-4 is the overbroad edge for this job. Removing it is a recommendation on paper. Do not remove it here.