Home / Knowledge hub / Privilege creep
Knowledge hub
Privilege creep
People collecting more access over time than their current job needs.
What it means
Privilege creep is what happens when people keep their old access as they take on new work. Someone moves from support to finance, is given the new permissions, and nobody removes the old ones. Years later they can do the work of three jobs.
Nobody decides this. It builds from small, reasonable requests: a temporary grant that never ends, a copied set of permissions, a shared group everyone joins. By the time anyone looks, the access has been there so long that no one remembers why.
Why it matters
The damage shows up when an account is stolen or misused. An account takeover of a person with accumulated access is far worse than one with only what their job needs. It also breaks separation of duties, because one person ends up holding both sides of a control.
It is a regular audit finding. Reviewers compare who has access with who should, and the gap is usually found in people who changed roles. Cleaning up under pressure, with no record of why access was granted, is slow and risky.
How it shows up
You meet it in directories, cloud permissions, admin consoles and your own product's customer accounts, where an owner added a user as an administrator once and never changed it. Look for old groups, dormant accounts and service accounts with broad rights. It is the opposite of least privilege.
What works: give access to roles, not people; set an end date on temporary access, see just-in-time access; remove access when someone moves; and run a regular access review. For your own product, let customers see and trim who holds what.
Questions people ask
Privilege creep, answered
What causes privilege creep?
Job changes without access clean-up, temporary grants that never expire, permissions copied from another person, and nobody owning the question of what a person still needs.
How is it different from privilege escalation?
Privilege escalation is gaining access you were not given, usually by a flaw. Creep is gaining access you were given legitimately and kept past its need.
How do we find it?
Compare current permissions with the person's current job, list accounts unused for months, and flag people who hold access from several past roles. Reports from your directory or cloud provider help.
Can it be fully prevented?
Not entirely, but it can be kept small with expiring grants, role-based access, automatic removal on role change and regular reviews. Perfect prevention is not realistic, so the aim is to catch and remove extra access quickly.
Does it apply to customers' accounts in my product?
Yes. Customer administrators accumulate users and rights as well. Give them a clear view of who has access, and make removal easy. Customer administrators need to see and prune who has access, and your support team should not be the only ones who can.
Sources
Where this comes from
Related
Terms that sit next to this one
Least privilege
Giving every person and service the minimum access the job requires.
Access review
A regular check that each person still needs the access they hold.
Separation of duties
Splitting a sensitive task so no single person can complete it alone.
Just-in-time access
Granting elevated access only when needed, and removing it soon after.
Identity and access management (IAM)
The tools and rules that manage who your people and services are and what they reach.
Who holds more than they need?
We test what each signed-in account can reach that it should not, which shows the access that has accumulated in practice, with the request and response as proof. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.