In order to follow the principle of least privilege, we should start the compositor and all user applications/services as the user itself.

This can be achieved by creating a user session through systemd, and a system service for automatically starting this session.

Moreover, any user service needed to run in the background can easily be setup as a dependency to the session target.