Overview
The principle of least privilege (PoLP) says every user, process, and account should have only the minimum access needed to do its job — nothing more. It is one of the most important and widely applicable ideas in all of security.
Learning objectives
- State the principle of least privilege.
- Explain how it limits the damage of a compromise.
- Recognize where over-privilege commonly creeps in.
Core concept
Least privilege means default to the minimum. A user who only needs to read reports should not have permission to delete them. A web application connecting to a database should use an account that can run only the queries it needs — not a full administrator. Access is granted deliberately, scoped tightly, and removed when no longer needed.
A close relative is need-to-know: access to information is limited to those who require it for their role.
How it works
Least privilege shrinks the blast radius of any compromise. If an attacker takes over a low-privilege account, they can do little; if that account had administrator rights "just in case," the same compromise becomes catastrophic. Practically, teams apply it through scoped roles, just-in-time elevation (grant admin only when needed, then revoke), and regular access reviews to strip permissions that are no longer justified.
Practical example
A company gives every employee local administrator rights on their laptop for convenience. When one employee opens malware, it runs with admin rights and can disable security tools and spread. Had the employee been a standard user, the same malware would have been far more contained. Removing standing admin rights is a direct application of least privilege that measurably reduces impact.
Cybersecurity relevance
Least privilege underpins access control, cloud IAM, database security, and Zero Trust architectures. It is also central to limiting privilege escalation — attackers work to gain more rights precisely because most accounts were (correctly) given few.
Common mistakes
- Granting broad access "to save time" and never tightening it.
- Permission creep — access accumulates as people change roles but old grants are never removed.
- Running services or apps as full administrators when a scoped account would do.
Key takeaways
- Least privilege grants only the minimum access required, and revokes it when no longer needed.
- It shrinks the blast radius of any compromised account or process.
- Fight permission creep with scoped roles, just-in-time elevation, and regular access reviews.
Check your understanding
- How does giving standard (non-admin) accounts to users limit malware damage?
- What is "permission creep," and what practice counteracts it?