A method of operating a computing system to facilitate protecting control system content used in an industrial automation environment, the method comprising: receiving control system content provided by a primary entity; receiving a primary security authority provided by the primary entity, wherein the primary security authority defines primary usage rights for the control system content granted to a secondary entity; receiving a secondary security authority provided by the secondary entity, wherein the secondary security authority defines secondary usage rights for the control system content that further restrict the primary usage rights granted to the secondary entity by the primary entity in the primary security authority; receiving a request from a user associated with the secondary entity to perform an action associated with the control system content; processing the request with the primary security authority to determine if the secondary entity is authorized to perform the action associated with the control system content based on the primary usage rights; if the secondary entity is not authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then denying the request to perform the action; if the secondary entity is authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then processing the request with the secondary security authority to determine if the user is authorized to perform the action associated with the control system content based on the secondary usage rights; if the user is authorized by the secondary security authority to perform the action associated with the control system content based on the secondary usage rights, then granting the request to perform the action; and if the user is not authorized by the secondary security authority to perform the action associated with the control system content based on the secondary usage rights, then denying the request to perform the action, characterized in that the control system content comprises controller program code that directs an industrial controller to drive a machine system, receiving the primary security authority comprises storing and enforcing the primary security authority on the industrial controller, receiving the secondary security authority comprises storing and enforcing the secondary security authority on the industrial controller, wherein the primary security authority grants permissions for the control system content to one or more user groups associated with the primary entity, and wherein the secondary security authority restricts one or more of the permissions for the control system content granted to the one or more user groups associated with the primary entity in the primary security authority. receiving control system content provided by a primary entity; receiving a primary security authority provided by the primary entity, wherein the primary security authority defines primary usage rights for the control system content granted to a secondary entity; receiving a secondary security authority provided by the secondary entity, wherein the secondary security authority defines secondary usage rights for the control system content that further restrict the primary usage rights granted to the secondary entity by the primary entity in the primary security authority; receiving a request from a user associated with the secondary entity to perform an action associated with the control system content; processing the request with the primary security authority to determine if the secondary entity is authorized to perform the action associated with the control system content based on the primary usage rights; if the secondary entity is not authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then denying the request to perform the action; if the secondary entity is authorized by the primary security authority to perform the action associated with the control system content based on the primary usage rights, then processing the request with the secondary security authority to determine if the user is authorized to perform the action associated with the control system content based on the secondary usage rights; if the user is authorized by the secondary security authority to perform the action associated with the control system content based on the secondary usage rights, then granting the request to perform the action; and if the user is not authorized by the secondary security authority to perform the action associated with the control system content based on the secondary usage rights, then denying the request to perform the action, characterized in that the control system content comprises controller program code that directs an industrial controller to drive a machine system, receiving the primary security authority comprises storing and enforcing the primary security authority on the industrial controller, receiving the secondary security authority comprises storing and enforcing the secondary security authority on the industrial controller, wherein the primary security authority grants permissions for the control system content to one or more user groups associated with the primary entity, and wherein the secondary security authority restricts one or more of the permissions for the control system content granted to the one or more user groups associated with the primary entity in the primary security authority.