Least Privilege Calculator

excess rate = (granted − used) ÷ granted, and the score is 100 minus 0.8 × the excess rate minus an administrative-permission penalty, scaled by how long you observed usage. Cloud access analysers give you both numbers: what a principal could do and what it did. The gap is the unused privilege you can remove, weighted upward for administrative actions because those carry the largest blast radius, and discounted when a short observation window may simply have missed seasonal work.

Unused permissions are the raw material of every privilege-escalation path and lateral-movement step, and they cost nothing to remove compared with the incident they enable.

This calculator takes 4 inputs: Permissions granted, Permissions actually used, Of those granted, administrative ones, Usage observation window. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Ninety days is the common default because it covers a quarter-end and most monthly batch jobs. Shorter windows over-report excess — a permission used once a year looks unused in 30 days — which is why the score here is discounted for windows under 90 days rather than treated as equally trustworthy.

Revoke in tranches and keep a rollback path. Start with administrative and data-destructive actions that were never used, move the identity to a scoped-down policy behind a permissions boundary, and keep the old policy detached but intact for a cycle so a break-fix restore is one attach away.