non-privileged user
163586·updated Sep 1, 2026A category of system account or role whose authorization scope is bounded to ordinary, task-specific functions and explicitly excludes security-relevant or administrative operations such as establishing accounts, configuring access controls, performing system integrity checks, or circumventing protective mechanisms. As defined in NIST SP 800-171, non-privileged users are individuals that do not possess appropriate authorizations — that is, they lack the elevated trust granted to privileged users. A privileged user, by contrast, is one "authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform" (NIST SP 800-53 Rev. 5 / CNSSI 4009-2022), so a non-privileged user occupies the complementary set. In practice, the field uses the expression to enforce the principle of least privilege: non-privileged user accounts must be used by default and elevated to root or administrator only when necessary, so that routine and daily activities are performed under non-privileged accounts, with Administrator/Root reserved for specific administrative actions. Controls such as NIST SP 800-53 AC-6 and NIST SP 800-171 3.1.7 operationalize th
Source
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- privileged user - Glossary | CSRC
- 3.1.7: Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs - CSF Tools
- AC-6: Least Privilege - CSF Tools
- Privileged Identity Playbook - IDManagement
- NIST SP 800-53 AC-6(2): Non-Privileged Access for Nonsecurity Functions Explained - Anchor Defense
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A category of system principal whose access rights are bounded to standard, everyday functions and explicitly exclude the elevated capabilities — such as security-relevant operations, administrative configuration, or system-control functions — that require formal authorization to exercise. The distinguishing feature is not the absence of any access, but the absence of *elevated* access: nonprivileged users hold only the baseline entitlements that ordinary task performance demands, in contrast to privileged users who are authorized (and therefore trusted) to perform functions ordinary users are not permitted to perform. Across NIST SP 800-53, SP 800-171, and related federal standards, the expression anchors access-control requirements — particularly least-privilege controls — that prohibit such users from executing privileged functions, mandate separate accounts when the same individual holds both roles, and identify security-sensitive resources that must be shielded from them.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- non-privileged usersnonprivileged users
- possessive
- non-privileged user'snonprivileged user's
- pluralpossessive
- non-privileged users'nonprivileged users'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · legacy_primary
- A category of system account or role whose authorization scope is bounded to ordinary, task-specific functions and explicitly excludes security-relevant or administrative operations such as establishing accounts, configuring access controls, performing system integrity checks, or circumventing protective mechanisms. As defined in NIST SP 800-171, non-privileged users are individuals that do not possess appropriate authorizations — that is, they lack the elevated trust granted to privileged users. A privileged user, by contrast, is one "authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform" (NIST SP 800-53 Rev. 5 / CNSSI 4009-2022), so a non-privileged user occupies the complementary set. In practice, the field uses the expression to enforce the principle of least privilege: non-privileged user accounts must be used by default and elevated to root or administrator only when necessary, so that routine and daily activities are performed under non-privileged accounts, with Administrator/Root reserved for specific administrative actions. Controls such as NIST SP 800-53 AC-6 and NIST SP 800-171 3.1.7 operationalize thDR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A category of system principal whose access rights are bounded to standard, everyday functions and explicitly exclude the elevated capabilities — such as security-relevant operations, administrative configuration, or system-control functions — that require formal authorization to exercise. The distinguishing feature is not the absence of any access, but the absence of *elevated* access: nonprivileged users hold only the baseline entitlements that ordinary task performance demands, in contrast to privileged users who are authorized (and therefore trusted) to perform functions ordinary users are not permitted to perform. Across NIST SP 800-53, SP 800-171, and related federal standards, the expression anchors access-control requirements — particularly least-privilege controls — that prohibit such users from executing privileged functions, mandate separate accounts when the same individual holds both roles, and identify security-sensitive resources that must be shielded from them.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.