Overview
The guiding principle behind good authorization is least privilege — granting each identity only the access it needs. This capstone lesson applies least privilege to authorization design and ties the module together.
Learning objectives
- Apply least privilege to authorization.
- Explain default-deny and minimal roles.
- Connect least privilege to limiting breach impact.
Core concept
Least privilege in authorization means every user, role, service, and token has the minimum permissions required — nothing extra. Applied to web authorization:
- Default deny — access is denied unless explicitly granted.
- Minimal roles/permissions — avoid broad "super" roles; grant narrowly scoped permissions.
- Scoped tokens/service accounts — API tokens and service identities get only the access they need.
- Regular review — remove stale or excessive permissions over time.
How it works
Least privilege shrinks the blast radius of any compromise or flaw: if an account, token, or service is limited, an attacker who obtains it inherits only that limited access. Default-deny ensures new or unmapped actions are blocked rather than accidentally allowed. Minimal, well-scoped roles make authorization decisions clearer and reduce the chance of over-granting. Periodic review counters "privilege creep," where permissions accumulate beyond need. Together these turn authorization from a source of risk into a containment mechanism.
Practical example
An application defines narrow roles: regular users can manage only their own content; an "editor" can publish but not manage users; only a small "admin" role can manage accounts. API integrations use tokens scoped to specific actions (e.g. read-only). If an editor account is phished, the attacker cannot manage users or accounts; if a read-only API token leaks, it cannot modify data. Compare a design where everyone has broad rights — any single compromise would be catastrophic.
Cybersecurity relevance
Least privilege is a foundational security principle and the design philosophy that prevents many access-control failures. Over-privileged accounts, broad roles, and excessively scoped tokens amplify the damage of both attacks and mistakes, and are common findings. Enforcing least privilege with default-deny and minimal roles both reduces the likelihood of authorization flaws and contains those that occur — the defensive counterpart to the privilege-escalation attacks covered in this module.
Common mistakes
- Default-allow instead of default-deny, so unmapped actions slip through.
- Broad "super" roles or over-scoped API tokens granting more than needed.
- Never reviewing permissions, letting privilege creep accumulate.
Key takeaways
- Least privilege grants each identity only the minimum access required, enforced with default-deny and minimal, well-scoped roles and tokens.
- It shrinks the blast radius of any compromise and reduces the chance of over-granting that causes access-control flaws.
- Over-privilege (broad roles, over-scoped tokens, privilege creep) is a common, high-impact issue; least privilege both prevents and contains authorization failures.
Check your understanding
- How does least privilege limit the damage when an account or API token is compromised?
- What does "default deny" contribute to a secure authorization design?