---
title: "Dynamic least privilege model"
slug: "dynamic-least-privilege-model-v6-5"
description: "Appgate SDP enables fine-grained access control with dynamic firewall rules and Live Entitlements, enhancing security through real-time access decisions."
updated: 2026-01-13T20:20:43Z
published: 2026-01-13T20:20:43Z
canonical: "support.appgate.com/dynamic-least-privilege-model-v6-5"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dynamic least privilege model

When a user signs in to Appgate SDP, Claims information is harvested and used by the Controller to provide fine-grained control over which Policies are granted to the user or device. These Policies will be used to create Entitlement tokens which in turn create the firewall rules required for that user as they sign in. With a few thousand users signed in, the Appgate SDP system can easily create several million dynamic firewall rules.

As well as the Entitlement tokens, the claims information is passed to the Gateways in the claims Token. These tokens, combined with any additional claims collected by the Gateways, are used to manage which hosts should be allowed at the time of use. During use, dynamic and conditional re-evaluations continue, providing an ongoing degree of real-time [access control](/v1/docs/applying-access-controls).

This combination of fine-grained access rights and dynamic controls delivers timely and precise access decisions. This concept, called Live , results in a radically improved security posture.

Admins set access rules by defining [Entitlements](/v1/docs/entitlements) which include Actions. Within the Action, hosts can be defined by a range of means: IP addresses, subnets, hostnames, URLs, resource names (Cloud resolvers), and host Entitlement scripts.

There are several different elements within Appgate SDP which underpin the concept of Live Entitlements.

***Resource names and Entitlement scripts*** support the dynamic least-privilege access model which is a key part of Appgate SDP. These extend the capabilities of the system allowing it to adapt in near real-time to changes in the infrastructure.

Entitlements include [access controls](/v1/docs/access-control-modes-1) which can be set to “always allow” or require one or more access criteria to determine when a given Entitlement will be allowed.

Entitlements can contain static Actions or alternatively contain more dynamic elements such as resource names or scripts. These allow the Appgate SDP system to decide WHICH hosts to connect to based on dynamic information, such as the number of auto-scaled hosts that are in use at the time.

Appgate SDP (Software Defined Perimeter) is a security solution that provides secure access to resources based on user identity and context, leveraging a zero trust security model.

Key-value pairs related to the identity and content of the user or device and are specific to each session.

The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration.

A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system.

A digital key used to authenticate and authorize users or devices, enabling secure access to resources.