Least Privilege
Grant the minimum access required, for the minimum time — the principle every breach postmortem cites and every deadline erodes.
What is least privilege?
Least privilege says every identity — human, service, agent — should hold exactly the permissions its task requires, no more, and ideally only while it requires them. It’s the principle that turns a compromised credential from a catastrophe into an incident: the blast radius of stolen access is whatever that access could touch, and least privilege is blast-radius engineering.
Why everyone endorses it and few achieve it
Privilege accumulates through rational local decisions: the deadline demands AdministratorAccess “temporarily”; the wildcard s3:* makes the error go away; the role copied from another team carried its history along. Each grant is defensible; the sum is an account where dozens of identities can delete everything. The empirical signature shows up in access analysis everywhere: most granted permissions are never used. That gap — granted minus used — is pure risk, purchased for convenience.
Making it real rather than aspirational
The practices that survive contact with deadlines: start from generated policies, not from scratch (IAM Access Analyzer builds policies from actual CloudTrail usage — retrofit least privilege from evidence); time-bound elevation instead of standing admin (just-in-time access, approval-gated, auto-expiring); permission boundaries and SCPs as ceilings so even over-granted roles hit guardrails; and scheduled pruning of unused permissions as routine hygiene, not a post-breach project. For AI systems the principle is newly urgent: an LLM agent’s tool credentials define what a prompt injection can steal — least privilege is the primary containment.
What people get wrong
- Treating it as a one-time setup — privilege drifts; only continuous review holds the line.
- Applying it to humans but not workloads: service accounts and CI roles are where the god-mode credentials actually live.
- All-or-nothing thinking — cutting the unused 80% of permissions is achievable this quarter; perfection is not the bar.
Primary source: NIST SP 800-53 — AC-6, Least Privilege
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.