Most breaches I have seen up close did not start with some genius exploit. They started with an account that had far more access than it ever needed, and nobody noticed until an attacker used it. The contractor whose credentials still worked eight months after the engagement ended. The service account with domain admin because that was the fastest way to make something work on a deadline. The read-only dashboard user who quietly had write access to production.
Least privilege gets treated as a project. Someone runs an access review, cleans up a spreadsheet of permissions, declares victory, and moves on. Six months later the entropy has crept back in, because every day people are granted access to solve an urgent problem and almost nobody ever asks for access to be removed. Grants are visible and celebrated. Revocations are invisible and forgotten.
The fix is to make removal as routine as granting. On teams I run, access has an expiry by default. If you need production database credentials for a migration, you get them for the migration window, not forever. If someone changes roles, their old permissions are pulled in the same change, not left dangling as a courtesy. This feels bureaucratic until the first time an audit takes an afternoon instead of a fortnight.
The other half is resisting the reflex to over-grant for convenience. When someone asks for admin because a narrower role is fiddly to configure, that narrower role is exactly what you should invest in. Every broad grant you hand out to save five minutes today is a liability you carry until someone remembers to unwind it, and nobody remembers.
I also stopped trusting my own memory here. Standing access should be small enough to review in your head, and everything else should be temporary and logged. If I cannot answer "who can touch production right now and why" in under a minute, we have a problem regardless of what any firewall is doing.
None of this is glamorous. It is not a shiny tool you can buy. It is a discipline you practice on ordinary Tuesdays, so that on the bad day the blast radius of one stolen credential is as small as you can make it.
– Serguey Shinder
