What it means
Least privilege limits access to what a person, device, or workload needs for its current task. Describe the necessary action, the relevant resource, and the period of need. “Can view one clinic's appointments during this assignment” is more precise than “standard user,” because role names alone do not describe the effective permission.
The principle applies inside systems as well as between users. A reporting service should not need to delete production records merely because it reads them. Permissions should change when work changes, and temporary elevation should expire. Good implementation also provides a usable way to request additional access so routine work does not depend on shared administrator credentials.
The idea at a glance / Access
Allow the task, within its scope.
A small role has an exact boundary: view and scan Pad 3 during one shift. Test each part of that boundary.
Fictional testbench account YD-7 belongs to Dax Mercer. Assume an already authenticated session and an owner-approved Contractor-Pad3 role for Friday, 25 September 2026, from 09:00 inclusive to 14:00 exclusive, UTC.
READ THE PICTURE
Read the scope
At 10:00, viewing or scanning Pad 3 is allowed. Exporting Pad 3 is refused. Viewing Pad 9 is refused. At exactly 14:00, scanning Pad 3 is refused. The same account and policy govern these independent requests.
Keep in mindThese are independent controlled request tests against one application policy. They do not prove that every interface, nested group, direct grant, or existing token is equally constrained. A small role name is insufficient evidence.
Read the complete example
- Read the scope. At 10:00, viewing or scanning Pad 3 is allowed. Exporting Pad 3 is refused. Viewing Pad 9 is refused. At exactly 14:00, scanning Pad 3 is refused. The same account and policy govern these independent requests. The application owner approved view and scan operations on Pad 3 only for YD-7, during the stated UTC window. The account is already authenticated; this is an authorization comparison, not a sign-in. The testbench evaluates the requested action, target pad, and current time for each request. Two positive tests at 10:00 allow viewing and scanning Pad 3. Three negative tests isolate the boundaries: export Pad 3 at 10:00 changes the action; view Pad 9 at 10:00 changes the resource; scan Pad 3 at 14:00 changes the time. Each is refused before the action executes. There is no inherited permission from the earlier successful case. The right edge is exclusive: the approved window ends at 14:00, even if the session remains authenticated. An exceptional export would need a separate owner-approved, scoped grant. Review all effective access paths and verify both needed tasks and expected refusals; this drawing demonstrates only the listed tests.
These are independent controlled request tests against one application policy. They do not prove that every interface, nested group, direct grant, or existing token is equally constrained. A small role name is insufficient evidence.
Diagram references: NIST SP 800-53 Rev. 5 - AC-6 Least Privilege and privilege review · OWASP Authorization Cheat Sheet
AN ILLUSTRATIVE SCENARIO
A retailer inventory report
A retailer introduces a nightly inventory report. The developer initially requests a broad database administrator account, but the report only needs to read a specific set of inventory fields. The team creates a separate workload identity with read access to those records, tests the report, and confirms it cannot modify stock or read staff payroll data. An owner is assigned to review the access if the report's purpose changes.
Put it to work
- Translate the task into permitted actions and resources, including data scope, environment, and duration; avoid using a broad role as the requirement.
- Grant the smallest workable permission set and separate administrative activity from routine use, with a controlled path for additional access.
- Test legitimate work and deliberately disallowed actions using synthetic data, then review effective access after role changes and temporary assignments.
How to check your work
Show that the intended task succeeds while a meaningful adjacent action fails, such as modifying a record the report only needs to read. Confirm that the same limits apply through alternate interfaces.
Connect the ideas
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- PAM
Controls that broker, record, and constrain powerful administrative identities and sessions.
- IGA
Processes and tools for reviewing who should have which access and removing what is no longer justified.
- Privilege creep
The slow accumulation of standing access after the original job that justified it has ended.