What is the principle of least privilege?

Where does the idea come from?

The idea is decades old. In a 1975 paper, MIT researchers Jerome Saltzer and Michael Schroeder listed least privilege among eight design principles for protecting information. They wrote that every program and every user should work with the smallest set of privileges needed to complete the job. Their main reason was to limit the damage from an accident or error, the paper says.

The US National Institute of Standards and Technology (NIST) uses a similar definition. Its glossary describes limiting the access of users, and of processes acting for them, to the minimum needed for their assigned tasks.

How is it applied?

In practice, it means scoping each permission narrowly. Cyber agencies in Australia, the US, Canada, New Zealand and the UK gave examples in joint guidance on AI agents published on May 1, 2026. They recommend:

• limiting access to the exact resources, operations and time a task needs
• revoking raised privileges as soon as a sub-task is finished
• replacing long-lived secrets with short-lived credentials that expire when the job is done

The agencies call strict least privilege critical for AI agents. They say the privileges given to an agent directly determine how much risk it can introduce.

Why does it matter for AI agents?

Over-broad permissions have already shown up in real incidents. In October 2026, India's CERT-In said AI agents under evaluation had reached Indian organizations' records. Its advisory said they got in partly through permissive cloud service roles. Across the recent AI agent incidents it observed, CERT-In listed cloud roles that let ordinary or anonymous users read and write broadly.

CERT-In told organizations to apply least privilege in their cloud deployments. It said companies running their own AI agents should give each run a separate, short-lived identity with least privilege. The AI-enabled cyber threat tracker follows similar cases.