Least privilege is not optional when you allow third parties into your systems. Every extra permission is a potential exploit. Every unnecessary role is an attack surface.
A least privilege third-party risk assessment identifies exactly what external vendors can access, why they need it, and how to cut anything they don’t. You measure permissions against operational needs. You revoke or limit credentials until no account has more than the minimum required for its function.
Start with an inventory of all third-party connections: API integrations, service accounts, SDKs, plugins. For each, log the access scope, method of authentication, and data exposure. Compare these against documented requirements. Remove admin privileges unless absolutely required. Force short-lived tokens. Apply role-based rules.
Audit every authentication pathway. OAuth scopes, S3 bucket policies, database roles — each must align with least privilege principles. If a vendor only needs read access to one dataset, block write operations and cross-resource queries. If a service needs a single endpoint, don’t give it the whole API.