Least privilege is a blast-radius argument. It does not assume a component will be compromised; it assumes that if one is, the damage should be bounded by what it was allowed to do.

In practice it means separate credentials per environment, tokens scoped to one repository rather than an account, database roles that cannot read columns they never need, and public keys that authorize nothing on their own.

It is also a design constraint on features. If a feature would require broader access than the product needs, that is an argument against the feature, not for the access.

Why it matters

Most breaches are not exotic. They are an over-scoped credential doing exactly what it was permitted to do.