Least privilege
Also known as: principle of least privilege · minimal permissions
Least privilege means granting each person, service or agent only the rights strictly needed for their task, and not one more.
Its effect is to bound the damage: a compromised account only reaches what that account could do. Without it, a single foothold opens everything.
The enemy of the principle is accumulation. Rights get added project after project and never removed, so that after two years everyone can do roughly anything. Periodic access review exists for that.
It now applies to AI agents, with a new difficulty: an agent often acts under the identity of whoever launched it, and so inherits all their rights, including those its task has no need for.
What it means for a small business
The most cost-effective concrete step is to count the accounts holding administrative rights, and reduce that number. It is free and immediate.
So what actually applies to you?
A definition tells you what a term means, not what your organization must do. The assessment answers the second question — free, no credit card.
Updated September 1, 2026 · Educational definition; not legal advice.