Privilege sprawl is the gradual buildup of access beyond what an application, service, or AI agent truly needs. It happens when permissions are added over time for convenience, troubleshooting, or new features, but are never fully removed. The result is an identity that can reach more systems, data, or actions than intended.
In cyber security, privilege sprawl matters because excessive access increases blast radius. If an agent with broad credentials is compromised, copied, or misconfigured, an attacker can reuse that access to move laterally, read sensitive data, or trigger destructive actions. Defenders reduce privilege sprawl by using least privilege, short-lived scoped tokens, separate service identities, and regular permission reviews. In modern identity systems, this also means tightly classifying workloads and revoking permissions as soon as they are no longer required.