# What is Least Privilege?

Also called Principle of Least Privilege, PoLP, Minimal Permissions.

Least privilege is the security principle that every component, credential, and process should hold only the permissions required for its specific task, and only for as long as the task runs. Articulated for computer systems in the 1970s, it limits the damage from any single compromise, bug, or manipulation, since a bounded identity can only cause bounded harm.

For AI systems the principle is unusually load-bearing. A model's behavior cannot be fully constrained by instruction, so the practical ceiling on what it can do wrong is the set of credentials and tools it holds. A model with read-only access to one account cannot delete another account's records regardless of what any attacker persuades it to attempt.

Applying it means being specific in several dimensions at once. Scope the operations, so read and write are separate grants. Scope the data, so a token reaches one tenant rather than a shared service account. Scope the time, so credentials are short-lived and elevation is granted just in time. Scope the surface, so a tool exposes one operation instead of a general query interface.

The common anti-pattern is the convenience credential. One long-lived key with broad access is faster to set up, works everywhere, and never causes an outage from a missing permission, which is exactly why it accumulates. It also means any injection, bug, or leaked secret inherits the full set, converting a small incident into a broad one.

Least privilege pairs with denying by default. Permissions are enumerated and granted explicitly rather than inherited from a wide baseline, and unused grants are removed on a schedule rather than left in place. Periodic review matters because permissions granted for a one-off task tend to persist long after the task is finished.

## Key points

- Only the permissions needed, only for as long as needed
- Bounds the blast radius of any compromise or manipulation
- Scope by operation, by data, by time, and by surface
- Broad long-lived keys turn small incidents into large ones
- Deny by default and review unused grants on a schedule

## In practice

An assistant that schedules meetings receives a calendar credential scoped to one workspace, limited to create and read on a single calendar, and valid for the duration of the session. It holds no mail access, so it cannot send messages even if a manipulated document asks it to. Adding a new capability requires a new grant, which is reviewed rather than inherited from the existing token.

## Related terms

- [Tenant Isolation](/en/glossary/tenant-isolation)
- [Approval Gateway](/en/glossary/approval-gateway)
- [Prompt Injection](/en/glossary/prompt-injection)
- [Data Leakage Prevention](/en/glossary/data-leakage-prevention)
- [Audit Trail](/en/glossary/audit-trail)

[Back to the AI Glossary](/en/glossary)