Why can't I install software on my own work laptop? Why did my access to that shared drive vanish when I changed teams? Why does the admin have a separate second account just for admin work? One principle answers all of these, and it's arguably the most consequential idea in practical security: least privilege — every account, person, and program gets the minimum access needed to do its job, and nothing more.
The reasoning: assume compromise, limit the damage
The naive framing is that privilege restrictions exist because employees aren't trusted. The professional framing is different and more interesting: eventually, some account will be compromised. Someone will be phished, some laptop stolen, some password leaked — at sufficient scale this is a certainty, not a risk. The design question therefore isn't "how do we prevent all compromise" but "when an account falls, how much falls with it?" Security people call this the blast radius. Least privilege is blast-radius engineering: an attacker who phishes a standard user gets a standard user's reach. An attacker who phishes a domain admin gets everything. The entire point is making the first scenario overwhelmingly more likely than the second.
Where you'll see it in the wild
- No local admin rights — the classic. Most malware runs with the privileges of whoever executed it; a user who can't install software is a user whose malware often can't either.
- Separate admin accounts — engineers browse email as a normal user and switch to a privileged account only for admin tasks. The account that reads phishing emails is not the account that can delete the company.
- Role-based access — permissions attached to job roles rather than hand-granted to individuals, so moving teams swaps your access cleanly instead of accumulating it.
- Just-in-time access — the modern refinement: admin rights granted for a task, for hours, then automatically revoked. Standing privilege becomes temporary privilege.
The quiet enemy of least privilege is privilege creep: access accumulating over years of role changes, "temporary" grants nobody revoked, permissions copied from a colleague "to save time." It's why access reviews exist — that tedious quarterly exercise is the system fighting entropy. When you're the one running them someday, this is what you're actually doing: shrinking blast radii.
Least privilege applies to software, too — service accounts, applications, and cloud workloads should each hold only their minimum permissions, because programs get compromised exactly like people do. Read enough incident reports and one refrain repeats: the breach was bad because some account had far more access than its job required. The principle is boring. Its absence is spectacular.