Glossary / Principle of Least Privilege
Principle of Least Privilege
The security principle that a user, account, or process should hold only the minimum access required to do its specific job — not broader access held "just in case" it's useful later.
Least privilege applies equally to human accounts, service accounts, and automated processes — the default habit of over-provisioning access because it's easier than requesting more later is exactly the pattern the principle exists to push back against.
The related idea of just-in-time access takes this further: instead of an account holding admin rights permanently, it gets elevated only for the specific task and time window that needs it, then drops back down. An account that's always privileged is a bigger, more attractive target than one that's privileged for ten minutes a month.
Most real-world lateral-movement attacks — an intruder moving from an initial low-value foothold to something that actually matters — abuse standing, over-provisioned access rather than a novel exploit. Least privilege is one of the few controls that directly shrinks that specific attack path, which is part of why it shows up in nearly every security framework in some form.
How Nexus handles this
Nexus's remote-job capability registry is default-deny — a capability like script execution isn't available to run at all until it's explicitly enabled — and the credential vault scopes every credential by role rather than handing out broad standing access by default.
More terms
MSP (Managed Service Provider)
A company that remotely manages a client's IT infrastructure and end-user systems on an ongoing, proactive basis — usually a flat-fee contract, not break-fix billing.
RMM (Remote Monitoring and Management)
Software that lets an MSP monitor device health and perform remote management tasks — patching, scripting, remote control — across every client site from one console.
PSA (Professional Services Automation)
Software that runs the business side of MSP operations — ticketing, SLAs, billing, contracts, and client records — the system of record most MSP work flows through.
Ready to see it in the platform?
Join the design-partner cohort and we'll show you exactly where this lives.