# What is Least Privilege?

> Least privilege is the principle of giving a user, service, device, or process only the permissions and resources needed to perform its authorized function.

- Canonical URL: https://yellowcube.eu/glossary/least-privilege/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The scope should be narrow enough for the task and should last no longer than required. It applies to everyday accounts as well as administrators, applications, automation, and machine identities.

Implementing the principle requires more than assigning roles once. Organizations need to understand actual job and system functions, separate privileged from routine activity, remove unused rights, review inherited and combined permissions, and create controlled routes for exceptional access. Access should change when responsibilities, systems, or risks change.

### Key points

- **Scope dimensions:** Which resources, actions, data, environments, identities, locations, and time periods are authorized.
- **Practical controls:** Granular roles, separate admin accounts, approval for elevation, access reviews, service-account ownership, and prompt removal of stale permissions.
- **Verification:** Test effective permissions rather than relying only on role names or policy intent, and monitor how privileged capabilities are actually used.
- **Important limitation:** A narrowly named role can still be overpowered through inheritance, group nesting, permission combinations, or weak downstream controls. Least privilege is an ongoing state to verify.

### Related terms

[Just-in-time access (JIT access)](<https://yellowcube.eu/glossary/just-in-time-access/>) · [Privileged access management (PAM)](<https://yellowcube.eu/glossary/privileged-access-management/>) · [Access control](<https://yellowcube.eu/glossary/access-control/>) · [Separation of duties](<https://yellowcube.eu/glossary/separation-of-duties/>) · [Zero trust architecture (ZTA)](<https://yellowcube.eu/glossary/zero-trust-architecture/>)

### Sources

[NIST glossary: least privilege](https://csrc.nist.gov/glossary/term/least_privilege) · [NIST SP 800-53 Rev. 5, Control AC-6](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.