Tiered administration
Separating administrative accounts by the sensitivity of what they manage, so high-value credentials never touch low-trust machines.
The classic model uses three tiers: domain and identity infrastructure at the top, servers and applications in the middle, and user workstations at the bottom. An account from a higher tier is never used to sign in to a lower one.
This directly breaks credential theft chains. If a domain administrator never logs into a laptop, compromising that laptop cannot yield domain administrator credentials from memory.
Where this comes up
Tiered administration sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.