What is the principle of least privilege and how do you apply it?

Summary

Least privilege means every user, service and process gets only the permissions it needs, for only as long as it needs them. It limits the blast radius of mistakes and compromises.

Longer Answer

Apply it with narrowly scoped roles, separate read/write permissions, short-lived elevated access (just-in-time admin with approval), scoped API keys and tokens, per-service database users, and regular access reviews that remove unused permissions.

Key Points

• Minimal permissions
• Time-bound elevation
• Scoped credentials
• Regular access reviews