Least Privilege Is a Verb, Not a Project

“We implemented least privilege” is one of those sentences that sounds like an achievement and is almost always a lie — not a deliberate one, but a lie of tense. Least privilege is not something you implement and then have. It is something you do, continuously, forever, or you don’t have it at all.

The reason most environments are over-permissioned isn’t that nobody set permissions correctly at the start. It’s that access only ever accretes. People change roles and keep the old access. Projects end and the service accounts live on. Someone needs something urgently, gets granted it broadly to unblock them, and nobody ever comes back to narrow it. Entropy has a direction, and it points toward more access.

The project framing is the trap

Treat least privilege as a project — a quarter, a budget, a tiger team — and you will do a heroic access review, produce a clean-looking snapshot, declare victory, and watch it rot the day after. Because the thing that created the sprawl didn’t stop. The grants keep happening. The role changes keep happening. Your beautiful snapshot is out of date by the next onboarding.

A snapshot of least privilege is worth almost nothing. What matters is the rate — whether access is being removed as fast as it’s being added. If you can’t answer how much access you revoked last month, you don’t have least privilege. You have a good week from some time last year.

Build the verb into the plumbing

The organizations that actually hold the line don’t do bigger reviews. They make access expire by default. Time-boxed grants that lapse unless renewed. Access tied to role, so a role change actually moves the permissions instead of stacking them. Just-in-time elevation for the powerful stuff, so standing admin becomes the rare exception it should be. The goal is a system where doing nothing causes access to shrink, not grow.

That inversion is the whole game. In most companies, the path of least resistance adds access — grant and forget. You want the path of least resistance to remove it — grant, and let it fall away unless someone re-justifies it. You will never win a fight against entropy with willpower and quarterly reviews. You win it by changing which direction “do nothing” points.

Measure the motion

Stop reporting how many entitlements you cleaned up in the big review. Start reporting the ongoing rate: grants that expired on their own, elevations that were temporary, accounts that lost access this month because a role changed. Those numbers tell you whether the verb is running. A flat line means it stopped — and the sprawl is already creeping back.

Least privilege isn’t a state you reach. It’s a current you swim against every day. The best programs just make the water push the other way.