Least privilege
Least privilege is the practice of granting each account, service or process only the permissions it needs for its task, and nothing more.
Updated 2 Sept 2026
In more detail
The principle predates modern security architecture and applies at every layer: operating system users, database roles, cloud IAM policies, CMS roles and API tokens. Its practical form is usually role-based access plus time-bounded elevation, because permanent administrator rights are the single biggest multiplier on the impact of a stolen credential.
Why Least privilege matters
Least privilege does not prevent compromise; it caps the blast radius. A content editor account that cannot install plugins cannot be used to plant a backdoor, and a scoped deploy token that cannot read secrets is worth far less to an attacker. It also makes anomalous activity easier to spot, since routine work no longer runs as an administrator.
How it works
Permissions are assigned to roles rather than individuals, granted for the narrowest scope that works, and reviewed on a schedule. Elevation is requested when needed and expires automatically. Service accounts get their own identities with distinct, minimal permissions instead of sharing a human's credentials.
Examples
- Giving CMS authors an editor role rather than administrator, so plugin installation is unavailable.
- A deployment token scoped to one repository and one action instead of an organisation-wide personal access token.
- A database user with read access to reporting views only, used by the analytics job.
How it is detected or measured
Review privileged group membership, list unused permissions and dormant accounts, and check whether service accounts hold rights they have never exercised.
Where this matters
- Website Security Checklist
A prioritised checklist covering access, patching, backups, monitoring and response — ordered by how much risk each control removes.
- How to Check if a Website Is Hacked
Eight checks that reliably separate a compromised site from a slow or misconfigured one, in the order that finds problems fastest.
Sources
- Security and Privacy Controls for Information Systems (SP 800-53, AC-6) — NIST
Least privilege as a formal access control requirement.