Principle of Least Privilege (PoLP)

Grant the minimum rights needed for a legitimate task, for the minimum time needed, then remove them. The sentence is short on purpose. The practice is continuous: hire, role change, contractor end date, app install, API token mint, cloud share link — each moment is a privilege decision.

PoLP applies to humans and non-humans equally. A marketing intern should not export payroll. A web app that displays products should not hold DROP DATABASE rights. A CI token that deploys frontend assets should not be able to wipe production backups. Identity without scoped authorization is how "small" compromises become company-wide incidents.

Blast radius is what an attacker (or a mistaken click) can reach after they control one identity. If a phishing email steals a designer's login and that account only reaches design files, the incident is painful but contained. If that same designer somehow has domain admin "because IT was busy," the blast radius becomes the company.

Privilege creep is the slow disease. People change teams and keep old folders. Apps request "all the permissions" on day one and never get re-reviewed. Shared links stay open for years. Routine access reviews — quarterly for work, whenever you notice clutter on personal devices — trim the fat before an incident turns clutter into catastrophe.

Healthy PoLP starts from zero and adds rights intentionally. Unhealthy access starts from "admin everywhere" and hopes people behave. On personal devices, that means a daily Standard User account (or non-root), elevating only to install software. On phones, that means denying Contacts, Microphone, and always-on Location until an app proves it needs them for a function you actually want.

The same pattern appears in cloud IAM and API tokens: prefer scoped roles, short-lived credentials, and separate identities for separate jobs. One compromised forever-admin key is an infinite blast radius. Many tiny keys with expiry dates are recoverable incidents.

When you must elevate — install a trusted app, approve a payment, grant a contractor a folder — elevate on purpose, log or note why, and drop back down. Standing privilege is convenient until the day malware, phishing, or a stolen laptop inherits every unused right you left lying around.

This audit is defensive hygiene on devices and accounts you own. You are removing excess privilege — not hacking, not escalating on systems you do not control, and not disabling security tools to "feel freer." Smaller access windows mean smaller breaches.

# YOUR phone / tablet / laptop only
1. Settings → Apps → pick 5 apps you rarely use
2. For each: Permissions → revoke anything not required
   (Contacts / Mic / Location / Photos / Nearby devices especially)
3. Location: prefer While Using / Ask every time over Always
4. App store / family shares: remove people who no longer need access
5. Cloud drives: audit shared links — expire or delete stale ones
6. Work profile / school account: keep separate from personal play apps
7. Laptop habit: daily Standard User; Admin only when installing software
8. Browser: remove old logged-in sessions on shared machines

# PoLP checklist line (memorize)
"Does this identity need this permission THIS WEEK?"
If no → remove, expire, or never grant.

# Examples of healthy "no"
Flashlight → Contacts? NO
Puzzle game → Microphone? NO
Recipe app → Always-on Location? NO
Random quiz site → Camera? NO

You can now apply PoLP to people, apps, tokens, and your own phone — shrinking blast radius before an identity is abused. Next — Quiz — Identity Access Concepts — lock in AuthN/AuthZ, passwords, MFA, biometrics, and least privilege so Module 3 sticks under pressure.