Least Privilege Access

A privileged access management practice that eliminates standing privileges—permissions that are always active. Instead, administrative or sensitive permissions are granted on-demand for a limited, specific time window, often minutes or hours, and then automatically revoked.

• Mechanism: Integrates with ticketing systems or CI/CD pipelines to broker elevation
• Key Benefit: Drastically reduces the attack surface by ensuring no permanent high-risk accounts exist
• Example: A database administrator requests read-only access to a production schema for a 30-minute debugging session; the access is automatically removed after expiration

An access control paradigm that evaluates attributes (characteristics) of the subject, object, and environment against a policy to make an authorization decision. Unlike static Role-Based Access Control (RBAC), ABAC enables dynamic, context-aware enforcement of least privilege.

• Subject Attributes: User clearance, department, job function
• Resource Attributes: Data classification, owner, creation date
• Environment Attributes: Time of day, network location, device posture
• Policy Example: "Allow read if user.clearance >= resource.sensitivity AND environment.location == 'HQ'"

The architectural brain of a zero-trust authorization system. The PDP evaluates incoming access requests against the organization's policy-as-code and real-time attribute data to issue a binary Allow or Deny decision. It is logically separated from the Policy Enforcement Point (PEP) that executes the decision.

• Input: Subject claims, resource identifiers, environmental signals
• Output: A signed authorization token or a simple boolean decision
• Protocols: Often implements standards like XACML or custom OPA (Open Policy Agent) rules
• Separation of Concerns: Allows security logic to be updated centrally without touching application code

A security technique that divides a data center or cloud network into distinct logical segments down to the individual workload level. It enforces granular security controls for east-west traffic (server-to-server communication), which is often unmonitored in traditional perimeter-based models.

• Implementation: Uses host-based firewalls or service mesh sidecars to apply policies
• Zero-Trust Alignment: Prevents lateral movement by default; a compromised web server cannot freely talk to the database server
• Granularity: Policies can be defined based on workload identity (SPIFFE), not just IP addresses, enabling dynamic environments like Kubernetes

The principle that trust is never static. Instead of a single authentication event at login, the system continuously re-evaluates the user's or device's security posture throughout the active session. If the posture degrades, access is immediately revoked.

• Signals Monitored: Device health (endpoint detection and response alerts), geolocation changes, user behavior anomalies (UEBA)
• Mechanism: Short-lived tokens with frequent re-issuance or streaming telemetry to the PDP
• Contrast: Replaces the brittle "authenticate once, trust forever" model of traditional VPNs

A cryptographically verifiable identity assigned to a specific software process, container, or pod, not a human user. This enables machine-to-machine authentication for least privilege in microservices architectures without relying on network-level identifiers like IP addresses.

• Standard: SPIFFE (Secure Production Identity Framework for Everyone) defines a universal format: spiffe://trust-domain/workload
• Implementation: The SPIRE agent issues and rotates short-lived X.509 certificates or JWTs to workloads
• Benefit: Allows a payment service to cryptographically prove its identity to a ledger service, enabling fine-grained mTLS authorization policies