Least Privilege Is a Process, Not a Policy

Most organisations grant access during onboarding and never revisit it. The result is permission sprawl: identities accumulate entitlements they used once, for a project that shipped two years ago. Least privilege written as a policy document is a snapshot; the cloud is a moving target.

Close the loop with usage data

Access logs already tell you which permissions an identity exercises. Comparing granted entitlements against actually-used actions surfaces the gap you can safely reclaim. Treat least privilege as a continuous reconciliation between granted and used, not a one-time approval.

• Right-size roles from observed activity over a rolling 90-day window.
• Default to time-bound, just-in-time elevation for sensitive actions.
• Alert on first use of a dormant high-risk permission — it's often an attacker.

The most dangerous permission is the one nobody remembers granting.