If no firewall separates your integration, staging, and production environments, install one Deployer to handle all environments. If a firewall separates your integration and staging environments from your production environments, install one Deployer to handle your integration and staging environments and a separate Deployer to handle your production environments. The Deployer host machine must have access to all source servers from which you want to deploy, and all target servers to which you want to deploy. Restrict access to the Deployer host machine to only those people who need to use Deployer, such as release managers, infrastructure engineers, system administrators, and operators.

Install Asset Build Environment on development machines on which assets are created so you can verify successful builds before checking code into your VCS. For centralized builds, install Asset Build Environment on a separate machine, known as a continuous integration server, where you will use it to build assets into composites that can be deployed. Restrict access to the Asset Build Environment host machine to only those people who need to use Asset Build Environment, such as release managers, infrastructure engineers, system administrators, and operators.