Principle of Least Privilege

Least privilege is the conservatism of security: every person, program and key gets exactly the access needed to do its job, and nothing more. It sounds administrative; it is in fact the single design principle that most determines how bad your worst day will be — because breaches are survivable in proportion to what the attacker can reach.

What It Is

The principle of least privilege (least authority) grants each user, system and credential the minimum permissions required for its function, for the minimum duration. In practice: role-based access scoped to actual duties, just-in-time elevation rather than standing administrative rights, separate credentials per environment and per system (so a compromised test key cannot touch production), service accounts limited to their purpose, and periodic access reviews to claw back accumulated permissions — because access, everywhere and always, drifts toward excess in the absence of deliberate removal.

Why It Matters to You

Least privilege is blast-radius insurance: it converts compromise from catastrophe into contained incident. The attacker who obtains one user's credentials reaches that user's data; the attacker who obtains the shared admin account reaches everything — the difference is architectural, decided long before either event. Its corporate cousins extend the logic to people systems: maker-checker on payments, segregation of duties in finance, approval gates on data exports. For executives, the posture question in any review: if a single credential leaked tonight, how far does it reach? — and its corollary in the access review: whose access would we struggle to explain?

When You'll Meet It

In access reviews, audit findings, and system design. The once-a-quarter question for every critical system: list the accounts that can touch everything, and justify each.