SECAI Core · phase 10 of 15
Least privilege
A basic principle of security stating that something should be allocated the minimum necessary rights, privileges, or information to perform its role. Also referred to as the principle of least privilege.
The Explain card
- Plain English
- Least privilege says any user, process or system should get only the minimum rights, permissions or information needed to do its job, and nothing more.
- Example
- An AI agent that books meetings is given a token that can read and write calendar events only. When a prompt injection tries to make it email the contact list or delete files, the actions fail because the agent never had those permissions.
- Why it matters
- You cannot fully control what a language model decides to do. You can control what it is able to do. Least privilege limits the blast radius when the model is tricked.
- Hook
- Give the intern the key to the stationery cupboard, not the vault.
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
