Least Privilege for Humans, Not Just Services

This post started as a note to my future self. Every few months I relearn the same lessons about least privilege, so this time I'm writing them down.

The setup was ordinary: Sigstore at the edges, Semgrep doing most of the heavy lifting, and a handful of scripts nobody wanted to own. It worked well until usage roughly doubled over a single quarter.

Some background

The first symptom was subtle. Nothing failed outright, but least privilege kept drifting in the wrong direction, and every fix seemed to make the next one harder.

When we finally measured, the numbers were worse than anyone guessed. Around 43% of the time spent on a typical change went into working around least privilege rather than building anything.

A simpler approach

The key insight was to treat least privilege as part of the interface rather than an implementation detail. Once we did that, most of the other decisions followed naturally.

Stripped of the project-specific bits, it looks like this:

cosign sign --yes ghcr.io/acme/api@sha256:3f1c...
cosign verify \
  --certificate-identity-regexp 'https://github.com/acme/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/acme/api@sha256:3f1c...

Nothing about this is clever, and that's the point. Anyone on the team can read it in a minute and know exactly what it does.

A few things that helped along the way:

• Pair on the first few changes so the knowledge doesn't live in one head.
• Delete dead code aggressively; it's the cheapest refactor there is.
• Make the default the safe choice, not just the documented one.

Where this breaks down

None of this is free. The new approach is a bit more verbose, and newcomers occasionally ask why we don't just use OpenSSL for everything. That's a fair question with a boring answer: we tried, and it made least privilege harder to reason about.

We still haven't solved dependency pinning. That's a post for another day, and honestly, I'm not sure we'll get it right the first time either.

Takeaways

Six months in, nobody on the team wants to go back. That's about the best review a change like this can get.