Least privilege
Granting only the permissions needed for a task and its resources, rather than broad access by default.
On this page
Source content checked . English translation published 2026-10-27.
In business automation
Limiting permissions reduces the potential impact of a failure or incorrect request. Permissions should be defined for the action itself, even when a person or agent has already been authenticated.
Examples
These examples illustrate a possible workflow. Adapt the connections and rules to your own systems.
Business process example
A bot that displays order status gets read-only access. Changing an address goes through a separate tool that checks ownership and order status, rather than giving the bot administrative access to the entire store.
Relevant tools
- Supabase
- Permissions and RLS can restrict data access. Implement and check policies suited to the user and service.
What to check
- Do not use an administrator key for every process just because it is easy to connect. Check permissions for subprocesses and connected services too.