What does least privilege mean in access control?

What does least privilege mean in access control?

• A. Users have the minimum rights needed to perform their tasks.
• B. Users have all rights across the system.
• C. Only administrators have any rights.
• D. Permissions are granted without review.

Answer: (A)

Least privilege means giving each user only the minimum set of permissions needed to perform their duties. This keeps risk low by reducing what a compromised account can do and by limiting accidental changes. In practice, you assign access based on the job role and the exact tasks required. For example, a payroll clerk might view payroll data but not modify system settings or access HR records, while a software developer can access code repositories but not sensitive financial systems. When higher access is truly necessary, you use temporary or approval-based elevation rather than granting broad rights permanently. This approach avoids giving everyone all rights, avoids making only administrators powerful, and relies on governance for granting and reviewing permissions. It ties access to need and accountability, helping protect systems and data while still enabling work to get done.

Least privilege means giving each user only the minimum set of permissions needed to perform their duties. This keeps risk low by reducing what a compromised account can do and by limiting accidental changes. In practice, you assign access based on the job role and the exact tasks required. For example, a payroll clerk might view payroll data but not modify system settings or access HR records, while a software developer can access code repositories but not sensitive financial systems. When higher access is truly necessary, you use temporary or approval-based elevation rather than granting broad rights permanently.

This approach avoids giving everyone all rights, avoids making only administrators powerful, and relies on governance for granting and reviewing permissions. It ties access to need and accountability, helping protect systems and data while still enabling work to get done.