What is Least Privilege?

A digital identity used by software or a workload to authenticate without a person signing in for each request. Examples include service accounts and workload identities; API keys and tokens are credentials these identities may use. Check who owns the identity, which resources it can access, and how its credentials expire or are revoked.

The discipline of managing digital identities (human and non-human) and controlling what each identity can do. In cloud context (AWS IAM, GCP IAM), it refers specifically to the policy and role systems that govern resource access.

An architectural pattern that treats every request as untrusted by default, regardless of network location, and verifies identity and authorization on every call. For NHIs, this means continuous verification instead of "once issued, always trusted."

A service account is an account used by an application, script or workload to authenticate to another service. Its permissions, owner, credential lifetime and usage logs need review just like those of a human account.

Workload identity federation lets a workload in one environment, such as GitHub Actions, exchange a trusted identity assertion for access in another, such as AWS or Google Cloud. When configured for the workload, it can replace a stored long-lived cloud key; the trust policy and resulting permissions still need review.

Systems and processes that control, monitor, and audit privileged human access to critical systems. PAM does not generally cover NHIs; machine identities need their own lifecycle tooling, which is where Cremit Platform focuses.