MENTAL MODEL · M3777

Principle of Least Privilege

BusinessHigh supportManagement

Included

Version 1.0.0 · Updated 2026-07-30

CORE DEFINITION

Each module (or user) in the system can only access the minimum information and resources necessary for its legitimate purpose. No more privileges are granted. Scaffolding role: loss containment and isolation. It applies not only to IT but also to management. Do not give an intern CEO-level database permissions. This is not only to prevent insider threats, but also to limit the damage to the smallest possible scope when an account is compromised (explosion-proof cabin).

SCAFFOLDING EFFECT

psychology

Reduce cognitive load

Loss containment and isolation. It applies not only to IT but also to management. Do not give an intern CEO-level database permissions. This is not only to prevent insider threats, but also to limit the damage to the smallest possible scope when an account is compromised (explosion-proof cabin).

anchor

Anchor fast decisions

Security design principle (Least Privilege): Each subject is granted only the minimum permissions necessary to complete its tasks. The mechanism is to limit the blast radius of a single point of compromise.

MINIMUM ACTION

In progress 0/3

Practice this model in one real situation:

In system and service design, segment permissions by role
default to no permissions, grant on demand, and periodically revoke
run processes with least privilege.

Check to track your progress (stored locally)

Learning progress0%

account_treeGenealogyexpand_more

menu_bookReferencesexpand_more

Source support: Explicit

link
en.wikipedia.orghttps://en.wikipedia.org/wiki/Principle_of_least_privilegeZH · Explicit
verified

RELATED MODELS