Least-Privilege Access
Least privilege gives an implementation only the access it needs for the agreed work.
Also called: least privilege, scoped access
Definition
Least privilege is the practice of limiting permissions to the smallest practical set required to perform the agreed task.
Why it matters to the business
Narrow access reduces the number of systems and actions exposed if an account, token or workflow is misused.
How it works
The implementation identifies required actions, selects a vendor role or permission set that covers them, and reviews temporary access again at handoff.
Where it appears in real systems
Read-only CRM audit roles, scoped collaborators, OAuth permissions and separate test environments are common examples.
Common failure modes
- An administrator role is used because it is convenient.
- Temporary access is never removed.
- Permissions expand without a scope change.
- A workflow silently depends on an unrelated account owner's access.
Implementation considerations
- Prefer read-only for audits.
- Separate build access from long-term maintenance access.
- Review permissions at handoff.
- Document any unavoidable elevated access.
When it is appropriate
Use least privilege for audits, integrations, reporting and ongoing maintenance wherever the vendor permission model allows it.
When it is not appropriate
Do not reduce permissions below what is required to test or operate the written scope reliably.
Relationship to BYFORCE
BYFORCE explicitly prefers scoped roles, read-only audit access and review of temporary access at handoff.
Source basis
- docs/website/BYFORCE_SELF_SERVICE_INTAKE_SPEC_2026-09-23.json