non-privileged access
163594·updated Sep 1, 2026A category of system access in which the account, role, or session carries only standard user permissions and is explicitly excluded from administrative, security-function, or other elevated capabilities reserved for privileged users. It is distinguished from privileged access by the absence of authorizations to execute security-relevant operations such as modifying system configurations, managing accounts, or administering cryptographic functions. In practice, frameworks use it both as a classification of access type and as an operational requirement — mandating that even users who hold privileged accounts switch to non-privileged accounts or roles whenever they perform ordinary, non-security functions, thereby limiting the attack surface exposed during routine work.
Source
, non-the sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- SP_800-53_v5_1_XML.xml
- NIST Cybersecurity White Paper csrc.nist.gov Best Practices for
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A category of system access rights in which the account or role carries only standard user permissions — no administrative, security-configuration, or elevated-execution capabilities. Its distinguishing attribute is the *absence* of privilege: it cannot alter security controls, modify other users' access, execute privileged functions, or change system configuration in ways that are reserved for administrative accounts. In practice, standards bodies use it in two related ways: (1) as the normal operating posture that even administrators must drop to when performing routine, non-security work (enforcing least-privilege separation of duties), and (2) as the baseline authorization level against which privileged access is contrasted when classifying account types and defining access authorizations.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- non-privileged accesses
- possessive
- non-privileged access's
- pluralpossessive
- non-privileged accesses'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A category of system access in which the account, role, or session carries only standard user permissions and is explicitly excluded from administrative, security-function, or other elevated capabilities reserved for privileged users. It is distinguished from privileged access by the absence of authorizations to execute security-relevant operations such as modifying system configurations, managing accounts, or administering cryptographic functions. In practice, frameworks use it both as a classification of access type and as an operational requirement — mandating that even users who hold privileged accounts switch to non-privileged accounts or roles whenever they perform ordinary, non-security functions, thereby limiting the attack surface exposed during routine work.DR-088 backfill from the noun definition column