What is the principle of least privilege in access control?

• A. Grant all users full access.
• B. Grant only minimal rights required; implement RBAC/ABAC, need-to-know, just-in-time access, and regularly review permissions.
• C. Only admins get access.
• D. Access is granted based on job title alone.

Answer: (B)

At the heart of access control is giving each user just enough permissions to do their job, no more. This limits what a compromised account or a misused credential can access or do, reducing risk and the potential damage of mistakes. In practice, this means using models like RBAC or ABAC to assign permissions based on roles or attributes, applying need-to-know principles so people only access information essential to their tasks, providing just-in-time access for temporary elevated rights, and regularly reviewing and revoking permissions to prevent privilege creep as roles change.

Why this is the best answer: it captures both the mindset (minimal rights) and practical methods (roles/attributes, need-to-know, temporary access, and ongoing review) that together enforce least privilege. The alternative ideas—granting full access to everyone, restricting access to admins only, or judging access by job title alone—do not align with the principle because they either broaden access unnecessarily or fail to reflect actual task needs and dynamic changes.