Least privilege is a security principle that gives each user, process or system only the access it needs to do its job, and no more. NIST defines it as restricting access privileges to the minimum necessary to accomplish assigned tasks. It limits how much damage a mistake or a compromised account can cause.
- Also Called3other namesprinciple of least privilege · PoLP · minimum privilege
- Related Terms3linked entriesZero trust · Non-human identity · Insider threat
What Is Least Privilege?
NIST cites CNSSI 4009 and SP 800-12 for its definition. A system should restrict the access of users, or processes acting for users, to the minimum needed for their tasks. NIST SP 800-53 words it as a security architecture in which each entity is granted the minimum system resources and authorizations it needs to perform its function. OWASP puts it in plain terms: assign users only the minimum privileges necessary to complete their job.
How Do You Apply Least Privilege to an Application?
OWASP describes a path that starts in design and carries on after launch.
- Define trust boundariesDo this in the design phase.
- List users, resources and operationsName each user type, the resources exposed and actions such as read, write or update.
- Map who may do whatFor every user type and resource, decide which operations are allowed, if any.
- Test the mappingWrite tests that check the permissions are enforced as designed.
- Deny by defaultBe able to justify why each permission was granted.
- Review after launchCheck regularly for privilege creep.
A simple illustration: a person who only reads reports gets read access to reports, not the ability to change settings or see payroll.
What Does Narrow Access Protect Against?
An account with narrow access can often expose less if it is misused or taken over. It can also mean an attacker who gains one account finds fewer doors open. Least privilege therefore supports other controls rather than replacing them. Services that run as SYSTEM make a path bug costly. The Zero Day Initiative says the Quest Foglight file path flaw CVE-2026-92189 gives code execution in that context.
What Is Privilege Creep, and How Do You Find It?
OWASP advises reviewing permissions regularly after launch, to find privilege creep. Privilege creep means current privileges have grown beyond what was originally intended. OWASP also notes that granting extra access later is simpler than taking back access already given, which is a reason to start narrow.
Is Least Privilege the Same as Zero Trust?
No. Least privilege is a single principle about how much access an identity gets. Zero trust is a wider security approach. The two fit together, since limited access is useful under any model, but this page does not claim a source ties them as one.
Is Least Privilege the Same as Privilege Escalation?
No. They are opposites in effect. Least privilege keeps access small. Privilege escalation is an attacker gaining higher permissions than they started with.
Terms Close to Least Privilege
See also zero trust, non-human identity, insider threat and network segmentation, which limits access by network path.
Broad read access can leak more than build output. Jenkins missing permission check CVE-2026-117625 shows Overall/Read exposing proxy settings that only administrators should see. Chartbrew’s own cross-tenant takeover flaw is a recent case; see the Chartbrew CVE bundle.
Related Pages in the Knowledge Hub
Sources
Also Called.
- Nameprinciple of least privilege
- NamePoLP
- Nameminimum privilege
Questions.
-
What is least privilege?
Least privilege is a security principle that gives each user, process or system only the access it needs to do its job, and no more. NIST defines it as restricting access privileges to the minimum necessary to accomplish assigned tasks.
-
How do you apply the principle of least privilege?
OWASP describes defining trust boundaries, listing user types, the resources they can reach and the operations they need, then mapping who may do what. It also says to deny by default and justify every permission granted.
-
What is privilege creep?
OWASP describes privilege creep as current privileges growing beyond what was originally intended. It advises reviewing permissions regularly after launch, and notes that granting extra access later is simpler than taking back access already given.
-
Is least privilege the same as zero trust?
No. Least privilege is a single principle about how much access an identity gets. Zero trust is a wider security approach. The two fit together, since limiting access supports other controls rather than replacing them.
In Our Research
- 1 Six Chartbrew CVEs, One Playbook: Patch, Rotate, Check November 2026
- 2 LXD and Incus: Six Advisories Trace How a Trusted Image Breaks Out November 2026
- 3 Agentic AI and Exposed Secrets: How ARTEX Turns a Leaked Key Into Cloud Access November 2026
- 4 GPT-6 Cyber: How OpenAI’s Kernel Pipeline Works and What Defenders Should Change November 2026
- 5 ThisBash Escape Explained: How a Browser Extension Reached Claude Desktop November 2026
- 6 Kyverno 1.19.2: Seven Critical Flaws Compared by Who Can Exploit Them November 2026