What it means
Privilege creep happens when permissions accumulate while the need for them changes. A person moves teams, covers an absent colleague, or completes a project, yet old access remains. Direct permissions, nested groups, cloud roles, and local application accounts can all contribute. The result may be difficult to see from a job title alone. Managing it combines sound joiner, mover, and leaver processes with access that expires when practical and periodic reviews tied to real tasks. Service accounts can accumulate unnecessary privileges too.
The idea at a glance / Identity
A new job. Three grants remain.
Priya Nair moves to Pad 8, but old Pad 3 permissions remain. A later export confirms that the extra access still works.
Fictional May 2026 records for Priya Nair’s Chronos Hub account FL-26. G3 allows Pad 3 viewing and scanning; GX allows Pad 3 exports; G8 allows Pad 8 viewing and scanning. The application team owns these grants.
READ THE PICTURE
Read the grants
G3 starts with the Pad 3 job. GX is added for an export task ending 10 May. On 17 May, the new Pad 8 job needs G8 only, but G3 and GX remain. A controlled 20 May export succeeds: the account has more access than its current job requires.
Keep in mindThe temporary job’s approved end is not an enforced grant expiry: GX was never configured to expire. The observed export shows excess access in Chronos Hub, not misuse by Priya Nair or proof about all other access paths. Cleanup is not depicted.
Read the complete example
- Read the grants. G3 starts with the Pad 3 job. GX is added for an export task ending 10 May. On 17 May, the new Pad 8 job needs G8 only, but G3 and GX remain. A controlled 20 May export succeeds: the account has more access than its current job requires. On 03 May, the owner grants G3 for Priya Nair’s original Pad 3 duties. On 08 May, a temporary task adds GX; its approved business need ends on 10 May, but no automatic expiry was configured. On 17 May, Priya moves to Pad 8 and receives G8. The owner should replace the obsolete grants; instead, all three remain active. The current approved job needs only G8. On 20 May, a controlled request using a valid FL-26 session exports Pad 3 data through GX. That successful operation confirms the retained authority; a group name alone would not. This is privilege creep caused by accumulated grants, not evidence that Priya deliberately misused access. The application owner must remove G3 and GX, check nested groups, direct grants, other interfaces, and relevant sessions or tokens for equivalent access, then verify that Pad 3 view, scan, and export are refused while the needed Pad 8 tasks still work. No successful cleanup or retest is shown.
The temporary job’s approved end is not an enforced grant expiry: GX was never configured to expire. The observed export shows excess access in Chronos Hub, not misuse by Priya Nair or proof about all other access paths. Cleanup is not depicted.
Diagram references: NIST SP 800-53 Rev. 5 - AC-6 Least Privilege and privilege review · OWASP Authorization Cheat Sheet
AN ILLUSTRATIVE SCENARIO
A nurse changes departments
A hospital moves a nurse from outpatient scheduling to a specialist unit. The new role grants appropriate unit access, but a review finds that the nurse still has an old scheduling-administrator role from temporary holiday cover. The manager confirms the temporary duty ended and the application owner removes that role. They verify that the nurse can still perform current clinical tasks. The team also fixes the temporary-access process so future cover assignments have a documented end date instead of relying on someone's memory.
Put it to work
- For role changes, compare existing access with the new duties rather than only adding permissions. Include application-local accounts, group inheritance, privileged roles, and temporary assignments.
- Use explicit owners, justifications, and expiry for elevated or temporary access. Where practical, provide privilege only for the approved task and duration instead of permanent administrative membership.
- Run focused access reviews with managers and resource owners who can judge business need. Track removals to completion and verify effective access, including nested permissions and sessions that may retain older rights.
How to check your work
Select a test role change or completed project and compare required tasks with effective permissions. Demonstrate that obsolete privileged actions are denied, current duties still work, and the review record identifies who confirmed and implemented the change.
Connect the ideas
- IGA
Processes and tools for reviewing who should have which access and removing what is no longer justified.
- Least privilege
Granting each identity only the actions, objects, and time window required for the current job.
- PAM
Controls that broker, record, and constrain powerful administrative identities and sessions.