Serguey Asael Shinder – IT Professional

by Serguey Shinder

Early in my career I set up a service account to run a small automated job, and I gave it far more access than it needed. Not out of malice or laziness, exactly, but out of a very human impulse: I didn’t want to come back later and grant more permissions when something failed. So I gave it broad access up front, told myself I’d tighten it eventually, and moved on. Eventually never came.

That account sat there for a long time, doing its one small job, holding the keys to far more than that job ever touched. I didn’t think about it again until a security review surfaced it, and I had to explain why a script that only needed to read one folder could, on paper, delete half the system. I didn’t have a good answer. The honest answer was that granting less had felt like more work at the moment I set it up.

The lesson wasn’t really about that one account. It was about a principle I’d heard and never taken seriously: give every account, every service, every person exactly the access they need to do their job, and not one permission more. It sounds obvious. It’s quietly ignored everywhere, because the broad grant is always the path of least resistance in the moment.

The reason it matters has nothing to do with distrust. It’s that access is a blast radius. The day something goes wrong — a leaked credential, a compromised script, a mistake by a tired human — the damage is bounded by exactly how much that identity was allowed to do. An over-permissioned account turns a small incident into a large one. A tightly-scoped one turns the same incident into a shrug.

What I learned to do was invert my old instinct. Start from nothing, and grant only what breaks without it. Yes, it means occasionally coming back to add a permission when something legitimately needs it. That small, visible cost is the whole point: it keeps you honest about what actually needs access, instead of handing out power by default and hoping it’s never misused.

The convenient over-grant never announces itself as a problem. It just sits quietly, doing its small job, right up until the day it becomes the reason a minor mistake turns into a headline. I’d rather do the extra work up front.

– Serguey Asael Shinder