Least privilege
Giving every person, service and integration only the access its job needs and nothing more, so a single mistake or breach stays small.
Updated October 2026 · with examples from our own builds
What does least privilege mean in practice?
Least privilege reaches well beyond staff roles. A reporting service should read, not write. An integration should reach one bucket, not a whole cloud account. A browser automation should look, not click Save. Each narrowing limits the damage if that piece misbehaves or is compromised.
It also answers the question enterprise buyers ask most: what exactly can your product do in our account? A short, scoped list of permissions is far easier to approve than 'admin access'.
Working out exactly which permissions are needed takes effort, and the boundary should be tested: try the thing that ought to be refused and confirm that it is.
Least privilege at a glance
- Applies to
- Staff, services, integrations and automations
- Helps sell to
- Security reviewers at enterprise customers
- Prove it with
- A test that must be refused
Where has least privilege come up in our builds?
For AWS, a CloudFormation stack in the customer's own account creates an IAM role scoped to one bucket, which Storafleet assumes with a per-connection ExternalId. Before saving, the server tries to assume the role without the ExternalId and refuses the connection if that succeeds.
The admin service's database role can read user collections but write only its own, and on the audit log it is granted insert and read but not update or remove.
The app explorer works behind a deny-list of words for deleting, paying, reaching other people, changing access and committing anything. On its first real run it still pressed three buttons that start work, so the list gained a starts-work group.
Common questions about least privilege
What access should I give a vendor's tool to my cloud account?
A role limited to the resources it needs, ideally created in your own account so you can delete it at any time, rather than long-lived keys with broad access.
How do I check that a restriction actually works?
Try the forbidden action and confirm it fails. Storafleet's connection check does exactly that: assuming the customer's role without the ExternalId must fail before the connection is saved.
Related terms
Sources
Planning a product and not sure where least privilege fits? Ask us, or browse all 116 terms in the glossary.