It started with one engineer needing quick access to debug. Then more accounts got the same power. One day, a single command wiped out an entire staging environment. No one meant to break it. But the doors were wide open. That’s how privilege creep works—slow, quiet, and dangerous.
The principle of least privilege stops this. It means every account, every process, and every service gets only the permissions it needs—no more, no less. On Unix-like systems, the manpages tell the truth here. Search man sudo, man chmod, man setfacl, and you’ll see the system expects discipline. These tools exist to enforce limits. Used right, they keep damage small and access tight. Used wrong, they turn into loaded weapons.
Least privilege manpages are more than documentation. They’re a map. Each command—sudo, chmod, setfacl, capsh—tells you how to strip rights, define clear boundaries, and isolate power. Pair that with careful user management through /etc/passwd, /etc/group, and /etc/sudoers, and you start building a system that resists accidents and intrusions.