Least privilege

The principle of least privilege states that every identity should hold only the access required to perform its current job, and nothing more. It is simple to state, universally recommended, and genuinely hard to sustain, because access naturally accumulates faster than it is removed. Driving an organisation toward least privilege and keeping it there is one of the core reasons identity governance programmes exist.

Two forces make it essential:

• Breach blast-radius. When an account is compromised, the attacker inherits exactly that account's access. An over-privileged account turns a small compromise into a large breach; a least-privileged one contains the damage.
• Audit and insider risk. Excess and unused access is the single most common audit finding, and standing privilege is the raw material of insider threat. Regulators increasingly expect demonstrable least privilege, not just good intentions.

People change teams, cover for colleagues, run one-off projects and get temporary access that never gets removed. Over a few years the average long-tenured employee accumulates a sediment of entitlements no one remembers granting. This "privilege creep" is the natural entropy of access, and least privilege is the discipline that fights it.

No single feature delivers least privilege; it emerges from several working together:

Well-designed business roles encode exactly what a job function needs. Granting the role gives the minimum baseline; anything beyond it becomes a visible, request-and-approve exception rather than an invisible accumulation.

Lifecycle events are where creep is actually reversed. A mover event should remove access tied to the old role, not just add the new; a leaver event should remove everything. Automating these transitions is the highest-leverage least-privilege control most organisations can implement.

Periodic access certifications force owners to look at what people actually hold and revoke what is no longer justified. Targeted micro-certifications, triggered by a risky change, catch drift faster than annual campaigns.

Access that has never been used is a prime candidate for removal. Analytics and, increasingly, AI-driven recommendations highlight outliers, one person in a team of forty holding an entitlement none of the others do, so reviewers can act on the risk instead of rubber-stamping.

• Start by automating the leaver process; removing departed users' access is the fastest risk reduction.
• Automate mover-driven revocation next, so transfers do not leave a trail of stale access.
• Introduce role-based birthright access to shrink ad-hoc grants.
• Layer certifications and outlier analytics to grind down the remaining excess.

• Adding without removing: mover events that only grant new access defeat the purpose.
• Over-broad roles: a role that bundles far more than a job needs simply institutionalises over-privilege.
• Rubber-stamped certifications: reviewers approving everything provide audit theatre, not least privilege; give them context and outlier flags so decisions are real.