Grant least- privilege access.
A dashboard that only reads data needs only read permits. Scope every credential to the action and the record it serves, so a leaked key opens a few endpoints — not your whole platform.
1. Least privilege, precisely
Least privilege is the discipline of granting each identity exactly the access it needs to do its job, and nothing more — then scoping that access as narrowly as the system allows. The measure of the principle is not how access is granted on a good day; it is the blast radius on a bad one. When a credential leaks — and credentials leak — least privilege is the difference between an incident and a catastrophe.
2. Blast radius is the metric
A reporting dashboard that needs to read account summaries should hold a credential that can do exactly that. If that key appears in a log, a repo, or a phished employee’s inbox, the attacker inherits read access to a handful of summary endpoints — not write access, not access to sensitive fields, and not access to other tenants. The same leak under a broad “admin” key is a full compromise. Designing for blast radius means assuming the leak and minimizing what it yields.
3. Scope to the action and the record
True least privilege goes below the endpoint to the data. It is not enough that an identity may call “read account”; it must be entitled to read this account. This is activity-data authorization: permissions resolve against the specific record and, where needed, the specific fields, so a partner integration scoped to its own customers cannot widen a query to everyone else’s.
// Endpoint-level checks are necessary but not sufficient
[Permission("account.read")] // can call read-account...
public Account Get(string accountId) // ...but for WHICH account?
// B5 ADA resolves the permit against the record and caller
ada.Authorize(caller, "account.read", accountId); // fails closed4. How B5 Secure enforces it
B5 Secure makes scoped credentials and data-element authorization first-class. Service keys grant an integration only the endpoints it needs; activity-data authorization decides whether the authenticated caller may act on the specific record and field in play, with conventions that derive permission codes and flag sensitive fields automatically. Least privilege stops being a policy people remember to apply and becomes the path of least resistance.