Least privilege

Why it matters

It limits the damage a single compromised account or credential can do. If every account only holds access to what it strictly requires, a breach of any one of them is contained to that narrow scope, rather than exposing everything that account's holder theoretically could have needed someday. It also simplifies auditing considerably: reviewing who can access what is straightforward when access maps tightly to actual need, and becomes close to impossible when most accounts hold broad, undifferentiated permissions granted 'just in case.' It also pairs naturally with time-limited access: granting elevated permission for a specific task with an automatic expiry, rather than a standing grant, keeps exposure to the narrowest window actually needed.

What goes wrong when it's handled badly

The common failure is granting broad administrative access by default because it is simpler than scoping permissions precisely, then never revisiting it. A former employee's account retaining access to systems unrelated to their actual final role, simply because nobody narrowed it as their responsibilities changed over time, is a routine, avoidable exposure this principle exists to prevent. A concrete example is a marketing team member granted full database access to pull a single report, access that is never revoked afterward, turning a one-time convenience into a standing, unnecessary risk indefinitely. Reviewing access grants on a regular schedule, not only when someone leaves, is what catches privilege that has quietly accumulated beyond what a role currently requires. Building access requests as a documented, approvable workflow, rather than an informal request over chat, is what keeps grants traceable back to an actual, justified need.