Least privilege is a statement about effective access: each identity holds what its role requires and nothing else. In a group-based directory, effective access is decided by structure, so least privilege is achieved or lost in the hierarchy, not in individual grants.
Why group structure defeats least privilege quietly#
Three structural mechanisms inflate privilege without anyone granting it:
- Nesting a broad group into a narrow one sweeps its whole population into the narrow group's grants.
- Movers accumulate memberships across roles, holding the union of every role they have had.
- Overlapping groups grant the same access through parallel paths, so removals do not remove.
Reducing privilege without breaking work#
Privilege reduction is a sequence of membership removals, and each is safe only if the effective-access delta is known: what does this user actually lose, and does their role require it. Computed blast radius per removal is what separates a least-privilege program from a ticket-generating machine.
VisualizerEngine
How VisualizerEngine helps
The graph shows every path behind a user's effective access, structural search finds the inflation patterns, like users whose memberships are supersets of their peers, and what-if simulation previews each removal's real effect. Policies then hold the structure to the rules that keep privilege from re-inflating.