Permissions. Per user, per group, per application. Permissions can be by HTTP method, parameters. Fine-grained.