Security principle granting users only the minimum permissions necessary to perform their job functions. Reduces attack surface and limits damage from compromised accounts.