Least privilege is fundamental to a Zero Trust posture. The idea is that limiting access to the bare minimum will reduce your exposure if something goes wrong. This must be, at a minimum, proof of identity & assignment (employment, active contract & function). The principle of least privilege is an information security concept, dictating that only the minimum amount of access required should be granted to a user or entity to conduct their work. Right to Know: the person or group which is requesting permissions presents the qualities necessary to perform their intended action. This is tied to a recognizable business outcome and can be vetted by the system owner, the requestors management, project leadership or other source of authority. The principle of least privilege, or least privilege access, ensures that users only have the access they truly need. Need to Know: a business justification for some group gaining access to some system for some purpose.

In practice privileges are assigned in bundles in the form of a role such as: administrator, super-user, user, auditor, etc. The principle of least privilege is an information security concept, dictating that only the minimum amount of access required should be granted to a user or entity to conduct their work. The principle of least privilege (POLP) is a concept in computer security that limits users access rights to only what are strictly required to do their jobs.

Where the blank may be 'read some sensitive data', 'write to a file', 'delete a record', 'log in with some level of administrative capability'. Least Privilege is a determination based on two key points of evaluation (at least) for what is necessary to perform a specific action and the appropriateness of that grant.

Principle of least privilege policy