Low privileges means an account has only limited permissions, so it can view or change only the resources that have been explicitly allowed. In a well-designed system, a low-privilege user cannot administer services, read sensitive records, or modify protected settings.
This matters because privilege boundaries are a core defense against misuse and compromise. Attackers often try to start with a low-privilege account through phishing, password theft, or a vulnerable app feature, then look for ways to bypass restrictions, escalate rights, or access data they should not see. Defenders reduce risk by applying least privilege, separating roles, reviewing access regularly, and logging unusual actions. When a bug lets a low-privilege user cross a boundary, the impact can include confidential data exposure or unauthorized changes to configuration and content.