A security principle that grants users, applications, and devices only the minimum access needed to perform their intended tasks. It limits the impact of mistakes, compromised accounts, and unauthorized activity.