Underpermissioning

Underpermissioning is an access control condition in which users or processes are granted fewer permissions than needed to perform legitimate tasks. This can result in blocked operations, workflow delays, or incomplete work, and it is often discussed alongside over-permissioning in the context of least privilege and IAM design.

Causes include rigid or poorly defined roles, lack of task-based access analysis, conservative default permissions during provisioning, changes in job responsibilities without updating permissions, and aggressive separation-of-duties controls that restrict legitimate activity.

Impacts include higher helpdesk ticket volumes, workarounds that bypass controls, degraded productivity, and potential business risk when critical tasks stall. Unlike over-permissioning, underpermissioning concentrates on restricting access, which can mask risk but create operational friction and potential compliance issues if tasks require documented access controls.

Mitigation involves aligning permissions with actual job requirements through role mining or task-based access modeling, implementing time-bound or approval-based access, regular access reviews, and automating provisioning to adjust permissions as roles evolve. Balancing least privilege with operational efficiency is key to avoiding underpermissioning.

In practice, underpermissioning is considered a design and governance concern in IAM and RBAC frameworks. It is typically addressed by ongoing access governance, dynamic access controls, and clear task-based permission requirements.