If you've ever given a service account admin rights because it was faster than figuring out the exact permissions it needed, this post is for you. (No judgment we've all done it.)
Least privilege is easy to explain and annoyingly easy to skip under deadline pressure. Here's a practical breakdown of how to actually implement it in real systems, not just talk about it in a security review.
Start With Service Accounts, Not Humans
Most teams think of access control as a "which employee can see what" problem. In practice, service accounts and API keys are often the bigger risk — they're long-lived, rarely rotated, and frequently over-permissioned because nobody wants to debug a permissions error in production at 2 AM.
A few habits that actually move the needle:
- Scope tokens narrowly. If a service only reads from one table, it shouldn't have write access to the whole database.
- Rotate credentials on a schedule, not "whenever someone remembers."
- Log every use of a privileged credential. If you can't answer "what did this key touch last week," you don't have visibility, you have hope.
RBAC in Practice
Role-based access control (RBAC) is the standard pattern for scaling permissions without manually managing them per-user. If you're implementing it in your own stack, the pattern usually looks like:
User -> assigned to -> Role -> grants -> Permissions
The trap most teams fall into is creating too many one-off roles ("temp-access-jan-sprint") that never get cleaned up. Treat roles as a small, deliberate set tied to actual job functions, not a dumping ground for exceptions.
Privileged Access Needs a Different Playbook
Admin accounts and elevated service roles deserve stricter controls than regular user access:
- Separate everyday and admin credentials. An engineer's daily login should not be the same account that can modify production infrastructure.
- Use just-in-time elevation where possible request temporary privileged access for a specific task instead of holding it permanently.
- Require MFA on anything privileged, no exceptions, no "it's just internal."
This is the core idea behind privileged access management (PAM), and it's worth treating as a first-class part of your infrastructure, not an afterthought bolted on after an incident.
Access Reviews Should Be a CI Job, Not a Quarterly Panic
Manual access reviews tend to become rubber-stamp exercises — someone gets a spreadsheet of 500 permissions and approves all of them because reading each one takes too long. If you can automate flagging of unused permissions (accounts inactive for 90+ days, roles with no recent activity), your human reviewers can focus on the handful of genuinely risky cases instead of drowning in noise.
For a broader framework covering how least privilege, RBAC, PAM, and governance fit together at an organizational level, this identity and access management guide is a solid reference point if you're setting policy beyond just your own codebase.
