Least Privilege
Least privilege is the principle that every identity — human or service — gets the minimum access required for its role, for the minimum time necessary. It sounds like common sense; operationally it’s a discipline, because access accumulates by default and only shrinks on purpose.
Where it shows up in audits
Nearly everywhere access does. Access reviews exist to detect drift from it; admin inventories test whether privilege maps to need; offboarding samples test whether access ends with the role; service-account audits test whether machines got broad keys because scoping them was inconvenient. When an auditor asks “why does this person have this access,” least privilege is the standard your answer is measured against.
The drift mechanics
Three forces erode it: role changes (people transfer, permissions don’t), urgency (broad access granted during an incident, never revoked), and convenience (admin-for-everyone beats designing roles). None are malice; all are entropy. That’s why the counterforce has to be scheduled — reviews on a cadence, expiring elevated access, role templates instead of copy-the-last-hire.
The pragmatic version for startups
Perfect role architecture at 20 people is over-engineering. The honest minimum: no shared accounts, admin access enumerable on one hand with a reason each, production access granted by role template, offboarding that revokes same-day, and a quarterly review that actually executes its revocations. That’s least privilege at startup scale — and it covers the audit.
Access Review — An access review is the periodic check that everyone's system access matches their role — the most-sampled SOC 2 control and the most common exception.
Shared Responsibility Model — The shared responsibility model splits security duties between cloud provider and customer — and misreading the split is a classic audit and breach root cause.