What is Least Privilege?

Least privilege applies at every layer of the environment, not just user accounts. Human accounts should reach only the systems and data their specific job requires, not a department-wide default. Service accounts running applications should hold the narrow set of permissions that application needs, never domain admin granted once "to make things work" and never revisited. Network segmentation should limit which systems can even reach which other systems, so a compromised host cannot simply route to anything on the network. File system permissions should restrict processes to read and write only the directories they actually need, so a compromised web application process cannot walk the file system looking for credentials or configuration files elsewhere.

The cost of a violation compounds with the privilege level attached to the compromised identity. A phished standard user account with access to personal files and a handful of line-of-business applications causes contained, recoverable damage. That same phished account with domain admin rights, granted at some point for troubleshooting convenience and never revoked, gives the attacker a path to every system in the domain from a single stolen credential.

Implementing least privilege in practice takes ongoing work, not a one-time configuration pass. Privilege audits periodically surface accumulated excess access, the admin rights nobody remembers granting, the stale group memberships from a role someone left two years ago. Privileged access management (PAM) tools vault credentials for admin accounts, require checkout, and log every use rather than leaving standing admin sessions active. Just-in-time (JIT) provisioning grants elevated permissions only for a defined time window tied to a specific task, then automatically revokes them, replacing the older pattern of permanent standing access that sits unused and unmonitored most of the time. Regular access reviews catch drift before it accumulates into the kind of over-privileged account that turns a routine phishing compromise into a domain-wide incident.

Least privilege and Zero Trust reinforce each other but are not the same thing: Zero Trust is about continuously verifying identity and context on every access request regardless of network location, while least privilege is about what that verified identity is actually allowed to do once granted access. A Zero Trust architecture with poorly scoped permissions still lets a verified, authenticated attacker do far more damage than necessary.