SECAI Core · phase 10 of 15 · noun
Least privilege
A basic principle of security stating that something should be allocated the minimum necessary rights, privileges, or information to perform its role. Also referred to as the principle of least privilege.
The Explain card
- Plain English
- Least privilege says any user, process or system should get only the minimum rights, permissions or information needed to do its job, and nothing more.
- Example
- An AI agent that books meetings is given a token that can read and write calendar events only. When a prompt injection tries to make it email the contact list or delete files, the actions fail because the agent never had those permissions.
- Why it matters
- You cannot fully control what a language model decides to do. You can control what it is able to do. Least privilege limits the blast radius when the model is tricked.
- Hook
- Give the intern the key to the stationery cupboard, not the vault.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
The inference service follows least privilege by giving its model process read access only to the weights and configuration files it needs.
Why these words
- least Old English lǣst, smallest marks the lowest degree in the phrase
- privilege Latin privilegium, private law names the access or authority being limited
Where it came from
- Origin
- English phrase combining Old English lǣst with privilege, from Old French privilege and Latin privilegium
- Entered the language
- 1970s
- What changed
- Least developed as the superlative related to little and less; privilege shifted from a private law or special right to an authorization in computing.
How it is spelled
- Pattern
- The phrase is normally written as two lowercase words without a hyphen.
- Pattern
- In least, ea represents the long vowel /iː/.
- Breaks the pattern
- Least is an inherited irregular superlative rather than a form made with most.
- Breaks the pattern
- Privilege ends in -lege, not the commonly mistaken -ledge.
Spelled like
- beast
- feast
- sacrilege
Broken into chunks
-
least
- less
- lesser
-
priv
- private
- privacy
-
leg
- legal
- legislation
What it sits beside
Same subject
- access control
- privilege escalation
- zero trust
- sandboxing
security principles
- least privilege
- separation of duties
- defense in depth
- secure by default
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
