Least privilege limits users, services, and systems to the minimum access needed for their legitimate work.
Least privilege is the security principle that people, applications, and services should receive only the access they actually need. In plain language, it means not handing out broad permissions “just in case” when a smaller, more specific level of access will do the job.
Least privilege matters because excessive permissions turn small mistakes into bigger incidents. A compromised help-desk account should not be able to delete production data. A script that only needs to read one storage location should not also have administrator rights across the environment.
It also matters because access sprawl is common. Over time, organizations add temporary permissions, forget to remove them, and accumulate broad standing access. Least privilege is one of the clearest ways to reduce unnecessary exposure and shrink the blast radius of misuse or compromise.
This principle appears in IAM design, cloud role assignments, database permissions, endpoint administration, API authorization, and privileged account review. Teams apply it when they define Role-Based Access Control, when they limit service-account scopes, and when they require elevation only for specific administrative tasks.
It also appears during audits and incident investigations. Reviewers often ask whether an account had more access than it should have, and whether that excess access increased the damage of an event.
A finance analyst needs access to monthly reporting dashboards and export tools but does not need the ability to manage payroll roles or approve administrator changes. By giving the analyst only the reporting permissions required for daily work, the company reduces the chance that one compromised account can affect unrelated sensitive systems.
Least privilege does not mean giving people so little access that they cannot work. The point is right-sized access, not arbitrary restriction. Good implementations pair limited permissions with a clear process for temporary elevation when it is genuinely needed.
It is also different from authentication. Authentication proves who someone is. Least privilege is mostly about Authorization: deciding what that authenticated identity should be allowed to do.