The Principle of Least Privilege, Explained

The principle of least privilege says every user, process, and service should hold only the access it genuinely needs, and nothing more. Its purpose is blast-radius control: when something is inevitably compromised, least privilege decides whether the attacker inherits a single low-value account or the keys to everything.

Why does least privilege matter so much?#

Because compromise is a question of when, not if, and the damage from a compromise is bounded almost entirely by what the compromised identity could do. A stolen credential for an account that can read one report is an incident; the same theft against an over-privileged admin account is a breach. Least privilege is the difference between those two outcomes.

It also shrinks the attack surface: fewer privileges mean fewer things an attacker can do even after getting in.

How do you actually apply it?#

Least privilege is a habit applied everywhere access is granted:

• Users: grant roles, not blanket admin; review access regularly and remove what is unused.
• Services: give each service its own identity scoped to exactly the resources it touches.
• Databases: separate read and write credentials; never let the web app connect as the database owner.
• Time: grant elevated access just in time and revoke it automatically (just-in-time access).

Least privilege is a core building block of defense in depth and pairs directly with authentication vs authorization. See the Security Fundamentals hub for the full set.