Principle of Least Privilege
A security principle that gives every user, service or process only the minimum access needed for its task, for no longer than required.
When an account or integration is compromised, the attacker inherits its permissions; limiting those permissions contains breaches, reduces insider risk and simplifies audits that ask who can reach sensitive client data.
A marketing team replaces shared admin logins in its ad and analytics platforms with named accounts: 3 admins, 8 editors and 15 read-only users, plus admin access requested through a ticket and revoked after 4 hours.
Permissions creep back as roles change unless access is reviewed regularly. Overly strict settings slow work and push users toward workarounds, and many SaaS tools offer only coarse roles that make true least privilege hard to reach.
NIST describes least privilege as designing a security architecture so each entity receives only the minimum resources and authorizations needed to perform its function. It is applied through Role-Based Access Control (RBAC), separation of duties, scoped API tokens, just-in-time elevation and periodic access reviews. Zero Trust extends it with per-session access decisions, and for AI agents it limits tool and data permissions to reduce the impact of Excessive Agency.
AI Governance, Systems Architecture
NIST CSRC — Glossary: least privilege — https://csrc.nist.gov/glossary/term/least_privilege; Microsoft Learn — What is Zero Trust? — https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-overview