Principle of least privilege
Japanese 最小権限の原則
The principle of least privilege means giving a person, program or AI only the permissions it needs for its job. If an account is taken over or an AI misbehaves, the damage stays small.
It is like not handing a new employee the keys to every room on day one, but giving the keys the job needs first. Permissions are the keys, and the rule covers programs and AI accounts as well as people. With fewer keys, a lost or stolen key opens fewer rooms. NIST's glossary describes it as limiting access privileges to the minimum needed for assigned tasks.
For example (example) let AI read order emails and sort them into a table, but have a person press send and approve payment. OWASP advises limiting the permissions given to AI extensions to the minimum necessary and requiring a human to approve high-impact actions. First check whether a read-only account is enough for the job.
Source: least privilege · Least Privilege Principle · LLM06:2025 Excessive Agency · Let's check app access permissions (checked 2026-10-26)