{
  "code": null,
  "collection": "architecture",
  "href": "https://banes-lab.com/ontology#architecture-least-privilege",
  "id": "least-privilege",
  "kind": "principle",
  "layer": {
    "href": "https://banes-lab.com/ontology/schema#layer-security-core",
    "json": "https://banes-lab.com/json/records/layer/security-core",
    "label": "Security Core",
    "markdown": "https://banes-lab.com/records/layer/security-core.md",
    "ref": "layer:security-core"
  },
  "name": "Least Privilege",
  "ref": "architecture:least-privilege",
  "relations": [
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-access-control",
          "json": "https://banes-lab.com/json/records/architecture/access-control",
          "label": "Access Control",
          "markdown": "https://banes-lab.com/records/architecture/access-control.md",
          "ref": "architecture:access-control"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-minimal-permissions",
          "json": "https://banes-lab.com/json/records/lexicon/minimal-permissions",
          "label": "Minimal Permissions",
          "markdown": "https://banes-lab.com/records/lexicon/minimal-permissions.md",
          "ref": "lexicon:minimal-permissions"
        }
      ],
      "relation": "requires"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-zero-trust-architecture",
          "json": "https://banes-lab.com/json/records/architecture/zero-trust-architecture",
          "label": "Zero Trust Architecture",
          "markdown": "https://banes-lab.com/records/architecture/zero-trust-architecture.md",
          "ref": "architecture:zero-trust-architecture"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-damage-limitation",
          "json": "https://banes-lab.com/json/records/lexicon/damage-limitation",
          "label": "Damage Limitation",
          "markdown": "https://banes-lab.com/records/lexicon/damage-limitation.md",
          "ref": "lexicon:damage-limitation"
        }
      ],
      "relation": "reinforces"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-reduced-blast-radius",
          "json": "https://banes-lab.com/json/records/lexicon/reduced-blast-radius",
          "label": "Reduced Blast Radius",
          "markdown": "https://banes-lab.com/records/lexicon/reduced-blast-radius.md",
          "ref": "lexicon:reduced-blast-radius"
        }
      ],
      "relation": "enables"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-broad-admin-access",
          "json": "https://banes-lab.com/json/records/lexicon/broad-admin-access",
          "label": "Broad Admin Access",
          "markdown": "https://banes-lab.com/records/lexicon/broad-admin-access.md",
          "ref": "lexicon:broad-admin-access"
        }
      ],
      "relation": "conflicts-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-operational-convenience",
          "json": "https://banes-lab.com/json/records/lexicon/operational-convenience",
          "label": "Operational Convenience",
          "markdown": "https://banes-lab.com/records/lexicon/operational-convenience.md",
          "ref": "lexicon:operational-convenience"
        }
      ],
      "relation": "tensions-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#tension-least-privilege-operational-convenience",
          "json": "https://banes-lab.com/json/records/tension/least-privilege-operational-convenience",
          "label": "Least Privilege / Operational Convenience",
          "markdown": "https://banes-lab.com/records/tension/least-privilege-operational-convenience.md",
          "ref": "tension:least-privilege-operational-convenience"
        }
      ],
      "relation": "tensions"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/algorithms#algorithms-no-broad-privilege",
          "json": "https://banes-lab.com/json/records/algorithms/no-broad-privilege",
          "label": "Least Privilege Over Broad Privilege",
          "markdown": "https://banes-lab.com/records/algorithms/no-broad-privilege.md",
          "ref": "algorithms:no-broad-privilege"
        }
      ],
      "relation": "contracts"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-broad-admin-access",
          "json": "https://banes-lab.com/json/records/lexicon/broad-admin-access",
          "label": "Broad Admin Access",
          "markdown": "https://banes-lab.com/records/lexicon/broad-admin-access.md",
          "ref": "lexicon:broad-admin-access"
        }
      ],
      "relation": "violated-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-least-privilege-credential",
          "json": "https://banes-lab.com/json/records/lexicon/least-privilege-credential",
          "label": "Least-Privilege Credential",
          "markdown": "https://banes-lab.com/records/lexicon/least-privilege-credential.md",
          "ref": "lexicon:least-privilege-credential"
        }
      ],
      "relation": "refactored-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#vocabulary-severity-mandatory",
          "json": "https://banes-lab.com/json/records/vocabulary/severity-mandatory",
          "label": "mandatory",
          "markdown": "https://banes-lab.com/records/vocabulary/severity-mandatory.md",
          "ref": "vocabulary:severity-mandatory"
        }
      ],
      "relation": "severity"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-security-privacy-compliance-governance",
          "json": "https://banes-lab.com/json/records/architecture-category/security-privacy-compliance-governance",
          "label": "Security / Privacy / Compliance / Governance",
          "markdown": "https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md",
          "ref": "architecture-category:security-privacy-compliance-governance"
        }
      ],
      "relation": "category"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-authorization",
          "json": "https://banes-lab.com/json/records/architecture/authorization",
          "label": "Authorization",
          "markdown": "https://banes-lab.com/records/architecture/authorization.md",
          "ref": "architecture:authorization"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-session-management",
          "json": "https://banes-lab.com/json/records/architecture/session-management",
          "label": "Session Management",
          "markdown": "https://banes-lab.com/records/architecture/session-management.md",
          "ref": "architecture:session-management"
        }
      ],
      "relation": "reinforced-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/disciplined-methodology/ship#the-deploy-is-a-file-operation",
          "json": "https://banes-lab.com/json/disciplined-methodology/ship/the-deploy-is-a-file-operation",
          "label": "The deploy is a file operation",
          "markdown": "https://banes-lab.com/disciplined-methodology/ship/the-deploy-is-a-file-operation.md",
          "ref": "chapter:/disciplined-methodology/ship#the-deploy-is-a-file-operation"
        },
        {
          "href": "https://banes-lab.com/software-architecture/principles#the-canon-is-grouped-twice",
          "json": "https://banes-lab.com/json/software-architecture/principles/the-canon-is-grouped-twice",
          "label": "The canon is grouped twice",
          "markdown": "https://banes-lab.com/software-architecture/principles/the-canon-is-grouped-twice.md",
          "ref": "chapter:/software-architecture/principles#the-canon-is-grouped-twice"
        },
        {
          "href": "https://banes-lab.com/software-architecture/scale#systems-built-around-a-model",
          "json": "https://banes-lab.com/json/software-architecture/scale/systems-built-around-a-model",
          "label": "Systems built around a model",
          "markdown": "https://banes-lab.com/software-architecture/scale/systems-built-around-a-model.md",
          "ref": "chapter:/software-architecture/scale#systems-built-around-a-model"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-category-security-privacy-compliance-governance",
          "json": "https://banes-lab.com/json/ontology/principles/architecture-category-security-privacy-compliance-governance",
          "label": "Security / Privacy / Compliance / Governance",
          "markdown": "https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md",
          "ref": "chapter:/ontology#architecture-category-security-privacy-compliance-governance"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-category-core-vocabulary",
          "json": "https://banes-lab.com/json/ontology/lexicon/lexicon-category-core-vocabulary",
          "label": "Core Vocabulary",
          "markdown": "https://banes-lab.com/ontology/lexicon/lexicon-category-core-vocabulary.md",
          "ref": "chapter:/ontology/lexicon#lexicon-category-core-vocabulary"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-category-security-privacy-compliance",
          "json": "https://banes-lab.com/json/ontology/lexicon/lexicon-category-security-privacy-compliance",
          "label": "Security Privacy Compliance",
          "markdown": "https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md",
          "ref": "chapter:/ontology/lexicon#lexicon-category-security-privacy-compliance"
        },
        {
          "href": "https://banes-lab.com/ontology/algorithms#algorithms-domain-architectural-rules",
          "json": "https://banes-lab.com/json/ontology/algorithms/algorithms-domain-architectural-rules",
          "label": "Architectural Rules",
          "markdown": "https://banes-lab.com/ontology/algorithms/algorithms-domain-architectural-rules.md",
          "ref": "chapter:/ontology/algorithms#algorithms-domain-architectural-rules"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-vocabulary-severity",
          "json": "https://banes-lab.com/json/ontology/schema/the-vocabulary-severity",
          "label": "Severity levels",
          "markdown": "https://banes-lab.com/ontology/schema/the-vocabulary-severity.md",
          "ref": "chapter:/ontology/schema#the-vocabulary-severity"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-resolutions",
          "json": "https://banes-lab.com/json/ontology/schema/the-resolutions",
          "label": "The resolutions",
          "markdown": "https://banes-lab.com/ontology/schema/the-resolutions.md",
          "ref": "chapter:/ontology/schema#the-resolutions"
        }
      ],
      "relation": "linked-from"
    }
  ],
  "summary": "A design rule that each user, service and process holds only the permissions its task needs.",
  "siblings": {
    "next": {
      "href": "https://banes-lab.com/ontology#architecture-zero-trust-architecture",
      "json": "https://banes-lab.com/json/records/architecture/zero-trust-architecture",
      "label": "Zero Trust Architecture",
      "markdown": "https://banes-lab.com/records/architecture/zero-trust-architecture.md",
      "ref": "architecture:zero-trust-architecture"
    },
    "previous": {
      "href": "https://banes-lab.com/ontology#architecture-defense-in-depth",
      "json": "https://banes-lab.com/json/records/architecture/defense-in-depth",
      "label": "Defense in Depth",
      "markdown": "https://banes-lab.com/records/architecture/defense-in-depth.md",
      "ref": "architecture:defense-in-depth"
    }
  },
  "up": {
    "href": null,
    "json": "https://banes-lab.com/json/api/records/architecture",
    "label": "Architecture principles",
    "markdown": "https://banes-lab.com/api/records/architecture.md",
    "ref": "api:records/architecture"
  },
  "aliases": [
    "Principle of Least Privilege",
    "PoLP"
  ],
  "exemplar": {
    "after": "interface FooWriter { insert(foo: Foo): Promise<void>; }\nclass FooJob {\n  constructor(private readonly foos: FooWriter) {}\n  run(foo: Foo) { return this.foos.insert(foo); }\n}",
    "before": "class FooJob {\n  constructor(private readonly db: AdminDatabase) {}\n  run(foo: Foo) { return this.db.execute(`insert into foo values (?)`, foo); }\n}",
    "lang": "ts",
    "medium": "code"
  },
  "formedBy": null,
  "scope": [
    "user",
    "service",
    "process",
    "data"
  ],
  "severity": "mandatory"
}