Cybersecurity glossary
What is least privilege?
Also known as: principle of least privilege, PoLP
Definition
Least privilege means giving each user, service or AI agent only the access it needs to do its job, and no more, for only as long as it needs it.
Why it matters
It limits how far an attacker can go with any single compromised account. Practical steps include separate admin accounts, removing local admin rights from daily accounts, scoped API keys and reviewing access when roles change.
Common questions about least privilege
- How do I secure Microsoft 365 or Google Workspace for a small business?
- How do I securely offboard an employee who leaves?
- How do I secure an AI chatbot on my website?
- Are AI agents safe to use at work?
- What is zero trust security?
- What is ransomware and how does it get in?
- What is a zero-day vulnerability?
- What is malware and what are the main types?
Sources
Related Guides
GuideAI Security
AI Agent Security: Implementing Least Privilege for Tools
Learn how to enforce least privilege for AI agent security. Control tool calling, scope data access, and prevent unauthorized actions in production.
Read more GuideGRC
How to Run a User Access Review Process: A Step-by-Step Guide
Learn how to execute an effective user access review process. Audit permissions, eliminate privilege creep, and satisfy core compliance controls.
Read more GuideSOC
9 Quick-Win AI Agent Use Cases for Security Operations
Nine high-impact, low-effort SOC tasks to hand to AI agents first, what each agent does and the metric that proves it, plus the tasks to keep human.
Read more GuideSmall Business Security
Small Business Cybersecurity Checklist: The Core Controls
A practical small business cybersecurity checklist covering access controls, patching, backups, encryption, and network defense to secure your business.
Read more