Principle of least privilege

What it means

The principle of least privilege is the security rule that every user, application and system has only the access strictly needed for its work, and only for as long as needed. It limits the damage from a compromised account, an employee's mistake or abuse by an insider.

It is the basis of access control and of the zero trust approach. Instead of giving everyone access to everything just in case, permissions follow roles and tasks. The accountant sees the books, not personnel files; a salesperson sees their own customers, not the whole database.

The principle also applies to technical accounts and applications. An integration that only needs to read invoices should not be able to delete them, and a backup script should not have admin rights to the whole server. Privileged accounts are handled under privileged access management.

How it works in practice

Implementation starts with mapping who has which access and why. Roles with the necessary permissions are then defined and people assigned to them. Exceptions are approved and time-limited so that temporary access does not become permanent.

Processes for joiners, movers and leavers are crucial. When someone changes role, old access is removed, not just new access added; otherwise a long-serving employee ends up seeing everything. When someone leaves, access is revoked the same day.

A regular review, for example quarterly, checks that access still matches needs. Together with network segmentation and a password policy, least privilege forms the core of basic cyber hygiene and of NIS2 requirements.

What to watch out for

Overly restrictive settings slow work down and encourage workarounds such as sharing passwords with colleagues. The principle should not stop people doing their jobs but limit what is unrelated to them, and requesting needed access must be quick.

The most common failure is privilege creep. An intern given broad access so they would not have to ask, or an employee who has moved through three departments and kept access from all of them, are typical weak spots in both attacks and audits.