# Least Privilege

Record: `arch:least-privilege`
Kind: principle
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: user, service, process, data
Canonical: https://banes-lab.com/ontology#arch-least-privilege

## Repair

- Refactored by: Narrow Role, Split Permission
- Detected by: overbroad roles/scopes
- Violated by: excessive permissions
- Measured by: privilege excess count
- Enforced by: IAM policy checks

## requires

- [Access Control](https://banes-lab.com/records/arch/access-control.md)
- [Minimal Permissions](https://banes-lab.com/records/lex/minimal-permissions.md)

## reinforces

- [Zero Trust](https://banes-lab.com/records/lex/zero-trust.md)
- [Damage Limitation](https://banes-lab.com/records/lex/damage-limitation.md)

## enables

- [Reduced Blast Radius](https://banes-lab.com/records/lex/reduced-blast-radius.md)

## conflicts-with

- [Broad Admin Access](https://banes-lab.com/records/lex/broad-admin-access.md)

## tensions-with

- [Operational Convenience](https://banes-lab.com/records/lex/operational-convenience.md)

## tensions

- [Least Privilege Operational Convenience](https://banes-lab.com/records/tension/least-privilege-operational-convenience.md)

## contracts

- [Least Privilege Over Broad Privilege](https://banes-lab.com/records/algo/no-broad-privilege.md)

## referenced-by

- [Zero Trust Architecture](https://banes-lab.com/records/arch/zero-trust-architecture.md)
- [Authorization](https://banes-lab.com/records/arch/authorization.md)
- [Access Control](https://banes-lab.com/records/arch/access-control.md)
- [Session Management](https://banes-lab.com/records/arch/session-management.md)