For client-side operations, iControl offers access control based on individual user credentials and the role assigned to that user.

A user is an individual registered in iControl, usually attached to a single domain. A user is designated by a UID, followed by the @ symbol, followed by a domain (e.g. joeuser@montreal.myCompany).

A user can access resources in his/her own domain or any domain below on the condition that permission is given to that user at the domain level. To access a domain, the user has to be authenticated by providing a password.