Cybersecurity Least Privilege

How it works

Least privilege limits access to what a person or service needs for a particular task. Smaller permissions reduce the harm of a stolen credential, but they require lifecycle management: grants should expire or be removed when responsibilities change. Separate administrative work from routine access and review service identities as well as people.

Run the code

Save the complete source as least-privilege.py in a separate learning folder, then run python least-privilege.py. The reviewed runtime is Python 3.12.14 with the standard library; no third-party packages are required. These are local examples, not browser playground programs. Apache, MySQL and PHP are not needed.

Download the complete source

Local lab setup

Example

permissions = {"reminder-worker": {"read_verified_recipient", "send_reminder"}}
assert "delete_loan" not in permissions["reminder-worker"]
assert "send_reminder" in permissions["reminder-worker"]
print("reminders allowed; deletion not granted")

Expected result

reminders allowed; deletion not granted

The worker can read the narrow delivery data and send reminders, but has no deletion grant. This is a policy fixture; a deployed queue and database must enforce the corresponding restriction. Avoid handing a full administrator credential to a job simply because it is easier to configure.