Least privilege and the cost of asking¶

Least privilege grants each person the access their work needs and no more. The principle is unarguable, and the friction is in the word “needs”, which is not known in advance, changes constantly, and is discovered mostly at the moment access is missing and the work has stopped.

That timing is the cost. An access request raised when the task is already blocked competes with the task’s deadline, and the path of least resistance is to ask for more than today requires, so as not to ask again next week. Standing entitlements accrue this way, granted for a one-off and never removed, until the average account holds the union of every task its owner has ever done. The principle says least; the drift says cumulative.

Just-in-time access answers the drift and sharpens the friction: access is granted for a window and expires, which keeps entitlements clean and puts a request, an approval, and a wait between a person and their job several times a day. Where the approval is slow, the workaround appears, a shared elevated account, a standing exception, a helpdesk that grants broadly to stop the calls, and the workaround is the control quietly switched off.

The seam this opens is the one worth watching. When re-asking is expensive, an organisation accumulates broad standing access and a helpdesk trained to grant it, which is the exact surface a credential thief or a social engineer wants, and the exact lever a hostile policy change can pull. The friction of least privilege is real, and the places it is relieved without being resourced are where the privilege quietly stops being least. Last updated: 12 June 2026