# What is the principle of least privilege?

Least privilege means each person, and each program acting for a person, gets only the access their assigned work needs. NIST lists it as control AC-6.

Updated: October 16, 2026

The principle of least privilege says that each person, and each program acting for a person, gets only the access their assigned work needs.

## Where does the definition come from?

NIST's Computer Security Resource Center keeps a glossary that collects definitions from official documents. The one from CNSSI 4009-2022, the glossary of the Committee on National Security Systems, says a system should limit users' access privileges to what their assigned tasks require. Processes that run on a user's behalf fall under the same limit. NIST SP 800-53 Rev. 5 states it as a design rule: give each entity only the minimum system resources and authorizations it needs to do its job.

A privilege, in plain terms, is what an account is allowed to do. Reading data, editing it, changing settings and changing other people's access are all separate privileges.

## What do NIST and CISA ask for?

SP 800-53 Rev. 5 is NIST's catalog of security controls, written for federal systems. NIST says other organizations may use it on a voluntary basis. Its control AC-6 asks you to allow "only authorized accesses" that are needed for assigned tasks. Three of its enhancements translate directly to a SaaS team:

- AC-6(5): keep privileged accounts, such as admin accounts, to the people or roles you name.
- AC-6(7): review privileges at a frequency you set, and remove the ones nobody needs anymore.
- AC-6(9): log the use of privileged functions, meaning admin-level actions.

CISA's Cross-Sector Cybersecurity Performance Goals are a voluntary baseline. Version 2.0, from December 2025, added least privilege as goal 3.H. It expects every user account, role and process to run with the minimum privileges its tasks need, and it recommends a quarterly review of access permissions and role assignments.

NIST SP 800-207 makes the same idea part of [zero trust](/guides/access-basics/what-is-zero-trust). Its third tenet grants access to each resource one session (one stretch of use) at a time, with the least privileges needed for the task.

## What does it look like for a SaaS account?

For a web service your team uses, you can narrow access in three ways:

1. By kind of permission. Give a role that does the job, such as one that can post but can't change billing, instead of full admin.
2. By time. Give access for the length of the assignment, and remove it the day the assignment ends.
3. By person. Give each person their own login, so the service's records show who acted.

A shared account breaks the third. Everyone who knows the password gets the same rights, so you can't narrow them one person at a time. How to handle that case is in [Applying least privilege to shared SaaS accounts](/guides/access-basics/least-privilege-for-shared-saas-accounts). For the basics, see [What is a shared account?](/guides/shared-accounts/what-is-shared-account) and, for admin logins, [What is a privileged account?](/guides/privileged-access/what-is-a-privileged-account)

## Where do you start?

For each service, list who holds which role today. Check each person against the work they actually do, and remove what they don't need. Remove people whose assignment has ended. Then put the next review on the calendar.


## Frequently asked questions

**Where is least privilege defined?**

NIST's glossary collects the definitions, from CNSSI 4009-2022 and NIST SP 800-53 Rev. 5. SP 800-53 also makes it a control, AC-6.

**How often should we review who has access?**

NIST AC-6(7) leaves the frequency to you. CISA's performance goal 3.H recommends reviewing access permissions and role assignments every quarter.

**Can a shared account follow least privilege?**

Not by person. Everyone who knows the password gets the same rights, so you can't narrow them one person at a time.

**How does least privilege relate to zero trust?**

NIST SP 800-207 builds it into zero trust. Its third tenet grants access to each resource per session, with the least privileges the task needs.

## Sources

- [NIST Computer Security Resource Center Glossary: least privilege](https://csrc.nist.gov/glossary/term/least_privilege)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (AC-6)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)
- [CISA, Cross-Sector Cybersecurity Performance Goals, Version 2.0 (December 2025)](https://www.cisa.gov/sites/default/files/2025-12/CPG_Report_2.0_508c.pdf)
- [NIST SP 800-207, Zero Trust Architecture](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf)

## How Junify handles this

**Doing this by hand** Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover.

**With Junify** With Junify, an admin decides who may use each account and removes a person as soon as their part of the work ends. Change the password at setup so only Junify holds it. People sign in without ever seeing it, so once they're removed, they have no way back in. Junify records who used which account and when, person by person, so you can review access to shared accounts as well as personal ones.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&from=guide&cluster=access-basics&slug=what-is-least-privilege)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [What's the difference between an audit log and audit evidence?](/guides/access-basics/audit-log-vs-evidence): An audit log is what a system records. Audit evidence is a log you can rely on: tied to a person, protected from change, kept for a set period, and reviewed.
- [What a browser extension can and can't control in access management](/guides/access-basics/browser-extension-access-control-scope): An extension works inside the browser it's installed in, on the sites it's allowed to run on. Other apps, other browsers and other devices are out of its reach.
- [What work data stays on a personal computer, and how to keep it off](/guides/access-basics/byod-leave-no-business-data): History, cookies, saved passwords, password manager copies and downloads. Pair company browser settings with logins that don't show people the password.