The idea predates every compliance framework: grant the minimum, deny by default, elevate temporarily when a task genuinely needs more. A compromised account can only do what its permissions allow, so trimming permissions trims the blast radius of phishing, leaked tokens, and ordinary human error alike. The logic extends past people — service accounts, API scopes, and CI pipelines hoard permissions even more enthusiastically than employees do, and they never complain about losing them.
No auditor tests a philosophy; they test artifacts. Expect requests for role definitions, provisioning tickets showing approval before access, results from a recurring access review, and offboarding records proving leavers lost access promptly. The sampling method is blunt and effective: pick a handful of employees, list everything they can touch, and ask the control owner to justify each grant. “That’s left over from their old team” is the answer that turns into a finding.
Permissions accumulate through ordinary motion. People change roles and keep old grants, incident responders receive emergency admin that never expires, and every new integration hands a service account another scope. Least privilege is therefore less a setting than a routine: a joiner-mover-leaver process wired into single sign-on, enforced with MFA, and pruned by reviews that actually revoke. The operational side of that routine is the subject of Policy and Access.
