Least Privilege
Definition
The principle of least privilege grants individuals, services, and agents only the rights necessary for their task.
Rights should be limited in time, function, and data scope. This reduces the impact of compromised accounts, misconfigurations, or agent errors.
Simply explained
Like issuing only the key for the room that is actually needed.
Why it matters in practice
Highly relevant for AI agents, APIs, cloud systems, and admin access.
Example from business
An agent may read invoices and create drafts but may not execute payments.
Limits and pitfalls
- Passing full personal rights to agents; service accounts without owners; never reviewing rights.
Origin & history
Least Privilege is a fundamental security principle embedded in NIST standards.
Use in mid-sized companies
- Possible application in SMEs: explicitly minimize agent and integration rights and regularly recertify them.
Frequently asked questions
Does an admin tool always need admin rights?
Only if specific functions require it. Is read-only risk-free? No, sensitive data can be affected.
Sources
- Least Privilege · NIST CSRC Glossary, Least Privilege
Sources verified on 10.10.2026.
Editorially reviewed on: