What is least privilege, and how would you apply it to a database-backed application?

Grant each identity only the permissions needed for its purpose and duration. A web application usually should not connect as a database administrator. Give its runtime account the necessary data operations, use a separate migration identity for schema changes, and restrict administrative access. Apply the same idea to file permissions, cloud roles, and support tools. Review permissions as responsibilities change, and log sensitive actions. Least privilege reduces the impact of mistakes and compromise, but still needs secure authentication, monitoring, and a working recovery process.