Least privilege is a security principle that gives each user, account, and system only the access needed to perform its job, and nothing more. A payroll clerk should not have administrator rights to a file server, and a service account should not be able to read every client record unless that access is required.
This matters because stolen credentials, malicious insiders, and misconfigured tools become far less useful when permissions are tightly limited. In real attacks, threat actors often try to escalate from a low-value foothold to email, finance systems, backups, or shared cloud drives. Least privilege helps slow that movement and reduces the amount of data that can be exposed if one account is compromised. Defenders enforce it with role-based access control, separate admin accounts, just-in-time elevation, and regular permission reviews. It is one of the simplest ways to limit the blast radius of extortion and data theft.