Principle of least privilege.
also: least privilege · least-privilege · principle of least privilegeGiving every person and service only the access it needs for its job, so a compromise exposes as little as possible.
the two-minute refresher
- Wrong: developer laptops with production admin credentials and every API key.
- Right: dev-only access, read-only production, a bastion with MFA.
- Services too: the app reads the DB but can't change the schema; analytics gets a read-only replica.