Least privilege is the security principle that every user, device and application should have only the access it needs to do its job, and no more. A till operator does not need administrator rights, and a casual staff member does not need to export the customer database.
It is applied through user roles and permissions in each system, separate admin accounts used only when needed, and regular reviews of who has access to what. Time-limited access for contractors and quick removal of accounts for leavers are part of it. The Essential Eight includes restricting administrative privileges for the same reason.
In retail and hospitality, it means POS roles that limit refunds, voids and price changes, back-office permissions that separate ordering from payments, restricted access to staff and payroll data, and fewer people holding the keys to the website, domain and accounting system.
Common problems are staff who change roles but keep old access, shared admin logins, and owners who use admin accounts for daily work. Reviewing access every few months catches most of it. It can feel inconvenient, so keep roles simple and fit them to real jobs.
Limiting access reduces fraud, accidental damage and the impact if an account is hijacked, which also supports privacy obligations.