Restrict access to the Command Central host machine to Command Central users. This is especially important if you are using Command Central to manage production environments.

Command Central uses users, groups, and roles to authenticate users and determine the actions they can perform. Command Central supports read, write, execute, and password read permissions.

You can define users and groups in Command Central's internal user repository, or you can use users and groups from Lightweight Directory Access Protocol (LDAP) or Microsoft Active Directory (AD) acting as an LDAP server, or both. Command Central can work with multiple LDAP or AD user stores.

The permissions you set up for a Command Central apply across the entire landscape managed by that Command Central, which means that a user or group has the same permissions for all environments managed by that Command Central. If you want a user or group to have different permissions for different environments, install a Command Central to manage each environment.

Software AG recommends defining and implementing your authorization model and then not changing it. In production, the only change that should occur is assigning users to groups, which is normally done when LDAP or AD is implemented.