What Is Least Privilege?

Least privilege holds that any identity should have the minimum access required to perform its function, and no more. It is the most widely endorsed and least consistently implemented principle in security.

The reason is economic rather than intellectual. Granting broad access is fast and unblocks work; granting narrow access requires understanding what is actually needed, which takes time nobody has at the moment the request arrives.

Why it matters more than it used to

Because credential compromise is now the dominant intrusion route. When an attacker arrives holding a valid credential, every preventive control upstream has already been passed, and the only remaining question is what that credential can reach.

Least privilege is the control that determines the answer. It does not prevent compromise; it decides whether a compromise is an incident or a breach.

The practical obstacles

Nobody knows what is actually needed. Permissions were granted years ago, requirements were never documented, and removing access risks breaking something with no way to predict what.

Requests arrive under time pressure, frequently from people senior to whoever would narrow them. And the cost of over-granting is invisible and deferred, while the cost of under-granting is immediate and attributed to the person who said no.

What makes it achievable

Start at provisioning. Getting the initial grant right is far cheaper than reclaiming access later, and it is the only point where nobody is inconvenienced by the decision.

Use access data. Cloud platforms and identity tools can report which permissions an identity has actually used. Removing permissions unused in ninety days is evidence-based rather than speculative.

Make elevation easy. People hoard standing access because requesting it is slow. Just-in-time access that grants elevation in seconds removes the incentive to keep permissions permanently.

Cloud permissions need boundaries, not just smaller grants

Cloud identity models allow permissions to be scoped by action, by resource and by condition, which makes genuinely narrow access achievable in a way that traditional group membership never did. It also makes accidental over-permission easy, because a wildcard is shorter to write than an enumeration.

Permission boundaries and service control policies are the useful safeguard: rather than getting every individual grant right, they cap what any identity in a given scope can do regardless of what its own policies say. That converts least privilege from an exercise in perfect grants into a containment design, which is considerably more robust to the exceptions that will inevitably be made.

Where to start

Pull the permissions actually used by your most privileged cloud roles over the last ninety days and compare with what they are granted. The difference is removable with evidence rather than argument.

See just-in-time access. GuardsArm runs security risk assessments.