Least privilege
In short: Least privilege is the principle that an identity should hold only the permissions its task needs, and nothing more. For agents it means narrow tool lists, narrow data scopes and short credentials, granted at creation and checked again at every scheduled access review.
Which controls use this term?
- GOV-04Least privilege at creation. Grant each new agent only the permissions its documented purpose needs, at the moment its identity is created.
- GOV-18Delegation bounded by the person's permissions. Ensure an agent acting for a person can never do more than that person is allowed to do.
Which terms are related?
Purpose statement, Chain of custody, Delegation, On-behalf-of.
Reviewed by The Register desk