# Least Privilege

> A design rule that each user, service and process holds only the permissions its task needs.

Record: `architecture:least-privilege`
Kind: principle
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: user, service, process, data
Canonical: https://banes-lab.com/ontology#architecture-least-privilege

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Defense in Depth](https://banes-lab.com/records/architecture/defense-in-depth.md) and before [Zero Trust Architecture](https://banes-lab.com/records/architecture/zero-trust-architecture.md).

## Repair

- Refactored by: Narrow Role, Split Permission
- Detected by: overbroad roles/scopes
- Violated by: excessive permissions
- Measured by: privilege excess count
- Enforced by: IAM policy checks

## Requires

- [Access Control](https://banes-lab.com/records/architecture/access-control.md)
- [Minimal Permissions](https://banes-lab.com/records/lexicon/minimal-permissions.md)

## Reinforces

- [Zero Trust](https://banes-lab.com/records/lexicon/zero-trust.md)
- [Damage Limitation](https://banes-lab.com/records/lexicon/damage-limitation.md)

## Enables

- [Reduced Blast Radius](https://banes-lab.com/records/lexicon/reduced-blast-radius.md)

## Conflicts with

- [Broad Admin Access](https://banes-lab.com/records/lexicon/broad-admin-access.md)

## In tension with

- [Operational Convenience](https://banes-lab.com/records/lexicon/operational-convenience.md)

## Tensions

- [Least Privilege / Operational Convenience](https://banes-lab.com/records/tension/least-privilege-operational-convenience.md)

## Contracts

- [Least Privilege Over Broad Privilege](https://banes-lab.com/records/algorithms/no-broad-privilege.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Reinforced by

- [Zero Trust Architecture](https://banes-lab.com/records/architecture/zero-trust-architecture.md)
- [Authorization](https://banes-lab.com/records/architecture/authorization.md)
- [Session Management](https://banes-lab.com/records/architecture/session-management.md)

## Linked from

- [The deploy is a file operation](https://banes-lab.com/disciplined-methodology/ship/the-deploy-is-a-file-operation.md)
- [The canon is grouped twice](https://banes-lab.com/software-architecture/principles/the-canon-is-grouped-twice.md)
- [Systems built around a model](https://banes-lab.com/software-architecture/scale/systems-built-around-a-model.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Core Vocabulary](https://banes-lab.com/ontology/lexicon/lexicon-category-core-vocabulary.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Architectural Rules](https://banes-lab.com/ontology/algorithms/algorithms-domain-architectural-rules.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)