Work out least privilege score instantly with clear inputs, formula shown and shareable results.
The clearest measure of least privilege is the gap between permissions granted and permissions exercised, since anything unused for a full review period is a candidate for removal. Cloud access analysers report usage ratios in the low tens of percent as typical. Administrative role share is the second axis, because a small number of over-privileged accounts dominates blast radius.
Least-privilege score
usage ratio = used / granted; score = 0.7 x usage ratio + 0.3 x (100 - 10 x admin share), clamped to 0-100
At least 90 days, and longer where quarterly or annual processes exist. Revoking a permission used only at financial year end will break something twelve months later.
Stage it. Alert, then move to a deny-with-override, then remove. Immediate automated revocation of anything unused causes outages and destroys trust in the programme.