The principle of least privilege (PoLP) says that every user, program and system should have only the minimum access rights needed to do its job – and only for as long as needed.
How least privilege works
The idea was formulated by Jerome Saltzer and Michael Schroeder in 1975 and remains one of the core principles of secure design. In practice it means:
- employees work with standard accounts and use separate admin accounts only for admin tasks;
- access to systems and data is granted by role and reviewed regularly;
- service accounts, API keys and cloud roles get only the permissions they actually use;
- privileged access is “just in time”: granted for a specific task and expired automatically;
- applications run without root or administrator rights and with restricted file and network access.
Privileged access management (PAM) tools, cloud IAM policies and role-based access control help enforce these rules at scale.
Why it matters
Least privilege does not stop attackers from getting in, but it limits what they can do once inside. A compromised account without admin rights cannot easily disable security tools, dump credentials or deploy ransomware across the domain. It slows lateral movement, makes privilege escalation necessary (and therefore detectable) and reduces the damage that malicious or careless insiders can cause. Over-privileged cloud identities and service accounts are among the most common causes of large data breaches.
Least privilege is a cornerstone of the Zero Trust model, which grants access per request rather than trusting users by default.
Best practices
- Remove local admin rights from everyday user accounts.
- Run periodic access reviews and delete unused accounts and permissions.
- Use separate, protected accounts for domain and cloud administration.
- Start new roles with minimal permissions and add only what is requested and justified.
