To meet the requirements of minimizing administrative overhead and adhering to the principle of least privilege in a multi-forest environment, the AGDLP (Accounts, Global, Domain Local, Permissions) strategy is the standard best practice:

1. Organize Users (Domain Global): Users should always be organized into Domain Global groups within their own domain (Contoso). Global groups are designed to group users with similar roles or functions (e.g., "Sales") and their membership is only replicated within the local domain, reducing Global Catalog replication traffic compared to Universal groups.
2. Assign Permissions (Domain Local): Permissions on resources must be assigned to Domain Local groups in the domain where the resources reside (Fabrikam). Because a bidirectional forest trust exists, the Domain Local group in Fabrikam can accept the Domain Global groups from Contoso as members. This satisfies the requirement that permissions are only granted to groups in the Fabrikam forest.

Microsoft Learn. (2023). Active Directory security groups. "Group scope". Retrieved from https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#group-scope

Quote: "Global... Use this scope to organize users who share similar network access requirements."

Quote: "Domain local... Use this scope to grant permissions on domain resources."

Microsoft Learn. (2022). Overview of access control. "Nesting groups". Retrieved from https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory#nesting-groups

Quote: "The recommended strategy for assigning permissions is... Place user accounts into global groups... Place global groups into domain local groups... Assign permissions to the domain local group."