Why the 1975 Principle of Least Privilege No Longer Fits Modern Computing

The Principle of Least Privilege (PoLP) was formally defined by Jerome Saltzer and Michael Schroeder in 1975, requiring every program and user to operate with only the minimum permissions needed to do their job. The principle was designed for 1970s mainframe environments, where software behavior was predictable, system complexity was manageable by a small team, and clear boundaries existed between trusted and untrusted zones. Modern computing — driven by cloud infrastructure, microservices, and AI — has invalidated these foundational assumptions, as tasks are now ephemeral, permissions number in the tens of thousands, and software relies on sprawling dependency chains with hundreds of unknown contributors. Because developers often cannot fully understand AI-generated or deeply nested code, defining a true "least" privilege set becomes guesswork, leading to permission bloat or overly restrictive settings that cause hard-to-diagnose bugs. The article argues that PoLP, rather than being a complete security solution, has become a workaround for the absence of a precise, dynamic specification of what modern software actually needs to do.