Least-Privilege Token - CI/CD Glossary Definition

A least-privilege token carries only the scopes a job actually needs and nothing more.

A least-privilege token is a credential granted only the minimum scopes required for a task, so a compromise exposes as little as possible.

In CI, this means setting the workflow permissions: to the smallest set (often contents: read) and elevating only the specific jobs that push, deploy, or publish.

Related guides