Users and services receive only the minimum access required to perform their function.
The Principle of Least Privilege requires that subjects (users, services, processes) be granted the minimum access rights — both scope and duration — necessary to perform their authorised function. Just-In-Time (JIT) elevation is the modern operational pattern.
Run a free ComplianceIQ audit against SOC 2 and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.