The least permissions principle primarily decreases risk but may require additional approvals.

• A. Decreases risk but may require additional approvals
• B. Increases risk
• C. Has no effect
• D. Breaks authentication

Answer: (A)

The least privilege idea is about giving users and processes only the minimum rights they need to do their jobs. By restricting access, you dramatically reduce what someone can do if their credentials are compromised or if a mistake is made, because they can’t freely access everything in the system.

That’s why it’s paired with the notion that it may require additional approvals. When a task needs privileges beyond the baseline, many environments enforce a workflow to obtain temporary, time-limited access through an approval process. This just-in-time elevation keeps privileges lean most of the time, but allows necessary work to proceed with proper oversight. The result is lower risk overall, even though it introduces some extra steps.

The principle doesn’t increase risk, and it doesn’t have no effect. It’s not about breaking authentication; it’s about controlling authorization—who is allowed to do what.