An access system that grants users only those rights necessary for them to perform their work is operating on which security principle?

Discretionary Access Control (DAC) allows resource owners to control access to their resources, which is not about granting only necessary rights but about ownership-based control.

The principle of least privilege dictates that users, programs, and processes should be granted only the essential permissions to perform their intended tasks and nothing more. This minimizes the attack surface and potential damage from misuse or error, significantly reducing the impact of a security breach or system compromise.

Mandatory Access Control (MAC) is a strict access control model where access decisions are based on security labels assigned to subjects and objects, enforced by the system, not merely 'necessary rights'.

Separation of Duties divides critical tasks among multiple individuals to prevent any single person from completing a fraudulent or malicious action alone, which is different from granting minimum necessary rights.