Least privilege limits the blast radius

The fastest way to lose an argument about least privilege is to make it about trust.

You scope a senior engineer’s service account down and they hear “we don’t think you’re careful.” So the scoping never happens. Nobody wants to imply their colleagues are a liability.

That framing is wrong from the first word. Least privilege has nothing to do with whether you trust the person or the service. You can trust them completely. The point is that the credential gets stolen separately from the person: phished session, token committed to a repo, RCE in a service holding its own keys. In every case the trustworthy human stayed trustworthy. What changed is who’s holding the credential.

Trust is about the human. Blast radius is about the credential. Only one of them is in your control after something goes wrong.

And blast radius is decided at grant time, not incident time. A DB user with GRANT ALL vs. three tables. A token with full-org scope vs. one project. An SSH key on every host vs. one box. Same compromise, wildly different mornings, and the attacker’s skill barely enters into it.

So scope services and people to what the job actually needs. Not because you distrust them. Because you’re protecting them, and you, from their own future bad day.

What’s the widest standing grant in your stack right now that nothing actually uses?