Least privilege is the principle that an identity, whether a person, a service account or an AI agent, should have only the access it needs to do its job, and no more. It applies to what can be reached, what can be done and for how long.

Why does least privilege matter?

A credential is only as dangerous as the access behind it. When access is narrow, an attacker who steals a login reaches little. When it is wide, the same login can open critical systems. Least privilege reduces the blast radius of every identity, and limits how far an insider can go.

How is least privilege applied?

• Start from no access and add what a role needs.
• Design roles around real jobs, not around individuals.
• Separate administrative accounts from everyday ones.
• Grant elevated rights only when needed, and for a limited time.
• Review access regularly and remove what is unused.
• Apply the same rules to service accounts, keys and agents.

What is privilege creep?

Over time people change roles and keep their old permissions, and temporary exceptions become permanent. Access accumulates until an account holds far more than its job requires. Least privilege erodes unless it is actively maintained.

How do you know what access is needed?

Use real usage rather than job titles. Permissions that have not been used for a defined period, for example several months, are the first candidates to remove. Ask the owners of resources to confirm what is still required.

How does least privilege relate to zero trust and RBAC?

Zero trust assumes no request is trusted by default, and least privilege limits what a verified identity can do. Role-based access control is one way to implement it, by tying permissions to roles. Without regular review, roles themselves grow too broad.

What about non-human identities?

Service accounts, API keys and AI agents often hold broad, long-lived access, because it is easier to give too much than to work out what is needed. They deserve the same discipline as people: an owner, a narrow scope and regular review.

What is the difference between least privilege and need to know?

Need to know limits access to information to those who require it for their work. Least privilege applies the same idea to permissions and actions, including administrative rights, system changes and the time for which access lasts. They support each other.

How often should access be reviewed?

It depends on risk. Privileged accounts and sensitive systems deserve more frequent reviews, and a change of role should trigger a review immediately instead of waiting for the next cycle.

How do you measure least privilege?

Look at the share of granted permissions that are actually used, the number of accounts with administrative rights, the number of dormant accounts and how quickly unused access is removed. The trend matters more than any single number.

What are the challenges?

• Removing access can break applications nobody has mapped.
• It is hard to know what is truly needed.
• Business teams may see it as friction.
• Access drifts back unless reviews continue.

What does least privilege look like in practice?

A finance analyst needs to read reports and approve payments up to a limit. They do not need administrative rights on the finance system, access to the HR database or permission to change payment limits. If their account is phished, the attacker can see reports and little else.

Does least privilege solve everything?

No. It limits what an attacker or insider can do, but not what they do inside the access that remains. A valid account that acts within its permissions looks legitimate to the policy, so monitoring behaviour matters as much as narrowing access.

How does it support compliance?

NIS2 and DORA expect access control and the ability to justify who has access to critical systems. Least privilege is the working principle behind that expectation.

Sharelock shows where access is excessive or unused, so least privilege can be applied where it reduces risk most, and monitors behaviour after login, down to individual transactions and queries on critical applications.