A basic principle in security that holds that entities (people, processes, devices) should be assigned the fewest privileges consistent with their assigned duties and functions.