Principle of least privilege
A security principle holding that each user, process, or system should be granted only the minimum access required to perform its function, and no more.
In more detail
The principle of least privilege says that any user, process, or system should have only the access it genuinely needs and nothing beyond that. The reasoning is about limiting blast radius: if an account or component is compromised, misused, or simply makes a mistake, minimal privileges mean the potential damage is minimal too.
It applies with particular force to automation and AI agents, which can act quickly and at scale. An agent granted broad access can do broad harm if it is manipulated or malfunctions; an agent scoped to exactly the actions its task requires cannot exceed that scope no matter what goes wrong. Scoping access tightly is a foundational control, not an optional hardening step.
Where this shows up at Ceven
Least privilege is built into how Ceven operates: each workflow step is scoped to the specific actions it needs across the connected tools rather than granted broad access, and consequential actions still pass through human-approval gates. Combined with the full audit trail, this means an agent cannot quietly exceed its intended scope, and if anything goes wrong the damage is bounded.