What it means
Least privilege limits access to what a person, device, or workload needs for its current task. Describe the necessary action, the relevant resource, and the period of need. “Can view one clinic's appointments during this assignment” is more precise than “standard user,” because role names alone do not describe the effective permission.
The principle applies inside systems as well as between users. A reporting service should not need to delete production records merely because it reads them. Permissions should change when work changes, and temporary elevation should expire. Good implementation also provides a usable way to request additional access so routine work does not depend on shared administrator credentials.
AN ILLUSTRATIVE SCENARIO
A retailer inventory report
A retailer introduces a nightly inventory report. The developer initially requests a broad database administrator account, but the report only needs to read a specific set of inventory fields. The team creates a separate workload identity with read access to those records, tests the report, and confirms it cannot modify stock or read staff payroll data. An owner is assigned to review the access if the report's purpose changes.
Put it to work
- Translate the task into permitted actions and resources, including data scope, environment, and duration; avoid using a broad role as the requirement.
- Grant the smallest workable permission set and separate administrative activity from routine use, with a controlled path for additional access.
- Test legitimate work and deliberately disallowed actions using synthetic data, then review effective access after role changes and temporary assignments.
How to check your work
Show that the intended task succeeds while a meaningful adjacent action fails, such as modifying a record the report only needs to read. Confirm that the same limits apply through alternate interfaces.
Connect the ideas
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- PAM
Controls that broker, record, and constrain powerful administrative identities and sessions.
- IGA
Processes and tools for reviewing who should have which access and removing what is no longer justified.
- Privilege creep
The slow accumulation of standing access after the original job that justified it has ended.