Restrict Team Foundation Build permissions

This post details a specific security configuration for on-premises Team Foundation Server (TFS) to restrict access to code via build processes. It outlines the creation of custom collection-level and project-level groups, and the precise denial of permissions to the 'Project Collection Build Service Accounts' group for work items, builds, and version control (TFVC and Git). This is presented as a solution to a problem where TFBuild controllers, by default, have collection-scoped permissions that could allow unauthorized access to code in different team projects.