# CAIQ IAM-05: Least privilege By The Citesheet team · Published October 20, 2026 Short answer IAM-05 asks whether you apply the least privilege principle when you grant access: each person, service and token gets the minimum access its job needs. An access control policy that says so is the starting proof. Strong answers add how it is applied, such as role-based groups, separate admin accounts and narrowly scoped tokens. ## What the control asks **IAM-05.1:** Is the least privilege principle employed when implementing information system access? NIST defines [least privilege](https://csrc.nist.gov/glossary/term/least%5Fprivilege) as restricting access privileges "to the minimum necessary to accomplish assigned tasks." The question applies to people _and_ to the processes acting for them: service accounts, CI jobs and API tokens. ## Which policy usually proves it The _Access Control Policy_. Most include a sentence naming the principle. Reviewers then look for how it is applied: access by role or group rather than one by one, admin rights only where needed, and narrow scopes for tokens. Those details often sit in engineering docs rather than in the policy. ## Quoted evidence from public policies Tailscale states the principle in the policy's first line: > Tailscale limits access control based on job requirements, following the principle of least privilege. > > _Tailscale, [Access control policy](https://tailscale.com/security-policies/access-control), CC0._ and applies it to admins: > Personnel who have administrative system access must use other less powerful accounts for performing non-administrative tasks. > > _Tailscale, [Access control policy](https://tailscale.com/security-policies/access-control), CC0._ GitLab applies it to a specific, sensitive data set: > Access to audit log data must be limited based on the principle of least privilege. > > _GitLab Handbook, [Audit Logging Policy](https://handbook.gitlab.com/handbook/security/security-and-technology-policies/audit-logging-policy/), CC BY-SA 4.0._ PostHog's engineering handbook shows least privilege for machine identities, which many policies forget: > Classic PATs are blocked org-wide. > > _PostHog Handbook, [Engineering security](https://posthog.com/handbook/engineering/security), MIT._ (PATs are GitHub personal access tokens. The same section tells engineers to use a narrowly scoped GitHub App for each job instead.) ## How GitLab answered **Yes**, in its CAIQ v4.0.3 submission on the [CSA STAR Registry](https://cloudsecurityalliance.org/star/registry/services/gitlab). Its explanation for the neighboring control IAM-06 says it runs access management under the principle of least privilege. ## A good answer, if your policy supports it > **IAM-05.1: Yes.** Access is granted by role through groups in \[identity provider\], limited to what each role needs. Administrators use separate admin accounts for admin tasks. CI and service tokens are scoped to a single repository or service. See Access Control Policy, section 2. ## When N/A is honest Never for your own staff and systems. If the question is read as being about your customers' users inside your product, that part is the customer's responsibility (mark the ownership column accordingly), but your own access still needs a Yes, Partially or No. ## Where answers usually go wrong * **Everyone is an admin.** Common in early teams. If every engineer has full production access, answer Partially and say what limits exist (for example, logging and a short list of people). * **Only the principle, no practice.** One sentence naming least privilege is proof that a rule exists. Reviewers increasingly ask _how_ it is applied, so a second sentence about roles or groups is worth adding to your policy. ## Sources 1. [Cloud Security Alliance: Cloud Controls Matrix (CCM)](https://cloudsecurityalliance.org/ccm/) (accessed October 20, 2026) 2. [CSA STAR Registry: GitLab.com (CAIQ v4.0.3 submission, 2025-03-25)](https://cloudsecurityalliance.org/star/registry/services/gitlab) (accessed October 20, 2026) 3. [NIST CSRC Glossary: least privilege](https://csrc.nist.gov/glossary/term/least%5Fprivilege) (accessed October 20, 2026) 4. [Tailscale security policies: Access control policy (CC0)](https://tailscale.com/security-policies/access-control) (accessed October 20, 2026) 5. [GitLab Handbook: Audit Logging Policy (CC BY-SA 4.0)](https://handbook.gitlab.com/handbook/security/security-and-technology-policies/audit-logging-policy/) (accessed October 20, 2026) 6. [PostHog Handbook: Engineering security (MIT)](https://posthog.com/handbook/engineering/security) (accessed October 20, 2026) ## Related * [CAIQ IAM-04: Separation of dutiesCAIQ v4 control IAM-04 asks whether no one person can both make and approve a risky change. What proves it in a small company, quoted examples, and honest answers.](https://citesheet.com/caiq/iam-04-separation-of-duties/) * [CAIQ IAM-08: User access reviewCAIQ v4 control IAM-08 asks whether you regularly re-check who has access. What proves it, why the frequency matters, quoted examples, and sample answers.](https://citesheet.com/caiq/iam-08-user-access-review/) * [CAIQ IAM-10: Management of privileged access rolesCAIQ v4 control IAM-10 asks whether admin rights are granted for a limited time and can't quietly pile up. What proves it, what public policies show, and honest answers.](https://citesheet.com/caiq/iam-10-management-of-privileged-access-roles/) * [CAIQ questionnaire automationFill the CSA's CAIQ in Excel from your own policies. Every answer has a word-for-word quote, and questions without proof say "No proof found".](https://citesheet.com/caiq-questionnaire-automation/) ## Send one questionnaire. See the proof. First questionnaire free. Same-day turnaround. Tell us where to send it back and we'll reply with next steps. Send your first questionnaire free Takes about 15 seconds. Or email [hello@citesheet.com](mailto:hello@citesheet.com). Need an NDA first? Ask, and we'll sign before you send anything.