Least privilege — Cyberstack

Standing admin is a standing blast radius. People get a role for a job, for a time, logged. Break-glass is sealed. The same rule applies to APIs, CI, and cloud roles.

First principles

Privilege is the ability to change a system or to read what others cannot. Least privilege means a person, a token, or a workload holds only what the current job needs. Admin is a tool you pick up. It is not a rank, a job title, or a group you stay in because onboarding was easier that way.

Standing admin is a blast radius that is always on: malware, a phish, a stolen laptop, a bored afternoon. Just-in-time (JIT) privilege is time-boxed and logged: you ask, you are approved, it expires. Break-glass is the sealed path for when JIT is on fire — dual control, an alarm, a review the next morning. If break-glass is just the admin group with a different name, you do not have break-glass.

Not only humans

APIs, CI jobs, and cloud roles are identities. A pipeline with a cloud key that can create further keys is an admin. A service principal that can read every mailbox is an admin. They do not get a pass because nobody logs into them. Scope them. Expire them. Do not share them across products.

What an admin actually does

Separate admin identities from daily-driver identities. Mail and web on the unprivileged one.
Remove standing admin groups. Replace with JIT or with a role that expires. Log every elevation.
Keep a break-glass account: hardware key, sealed process, unused except in a declared incident, reviewed when used.
Inventory machine identities the same way: CI, Terraform, functions, agents. One job, one role, no leftover keys.