Glossary
Least Common Mechanism
Least common mechanism holds that the amount of infrastructure shared between different users or processes should be minimized, because anything shared is a potential channel through which one can affect, observe, or interfere with another — even unintentionally, and even when neither party's individual access control is misconfigured. A shared cache, a shared queue, or a shared resource pool can each leak information or create contention across a boundary that every individual access-control check otherwise treats as solid.
This is a subtler failure mode than a straightforward permission error, because each side's access control can be entirely correct in isolation while the shared mechanism between them still creates a path neither side's own configuration accounts for. Reducing what's actually shared closes that path structurally, rather than trying to police every possible interaction across it after the fact.