Least privilege is the principle that an identity should have only the minimum access necessary to perform authorized tasks, for no longer than necessary. It applies to human users, administrators, services, workloads, devices and AI agents.
IGA operationalizes least privilege through eligibility rules, narrow entitlements, time limits, access reviews, usage analysis, JIT access and removal after lifecycle changes.