PrivilegeCreep

Privilege creep is the gradual accumulation of unnecessary privileges or access rights beyond what a person or system needs to perform its duties. It is commonly described as permission creep. It often results from transfers, role changes, and incomplete revocation of old permissions, leaving users with broader access than required.

It is observed in IT and cybersecurity, cloud platforms, data repositories, and enterprise applications, as well as in physical access controls. Common causes include infrequent access reviews, reliance on static role assignments, temporary elevated rights becoming permanent, and onboarding or offboarding gaps.

The consequences include increased security risk from insider threats and data breaches, higher chance of accidental data modification, compliance violations, and greater attack surface. Operational complexity and audit findings may also rise as permissions diverge from documented policies.

Mitigation strategies emphasize least privilege and continuous access governance. Key measures include regular access reviews, automated provisioning and deprovisioning, just-in-time or time-bound elevations, role-based or attribute-based access controls, separation of duties, and continuous monitoring for anomalous permissions.

Related concepts include privilege escalation, permission creep in the context of vendor or contractor access, and governance frameworks that mandate periodic attestation of rights. Effective management relies on clear ownership, auditable processes, and alignment with organizational risk appetite.