MDS provides security and permission based on active directory users and groups. Each user/group can be defined to have access to different functions of WebUI, such as system administration and explorer. A user/group can be defined to have read-only, update, or deny access for different models and even entities. Access to hierarchies can be defined too.