A method comprising: providing, by an application manager of a distributed computing system to a user authentication module of the distributed computing system, a request to authenticate a user; receiving, by the application manager from the user authentication module, a de-privileged token authenticating the user, wherein the de-privileged token includes partial access rights associated with the user; characterized by: providing, by the application manager to an application framework of the distributed computing system, information characterizing the user, an application, and an action, and the de-privileged token; providing, by the application framework to a cloud controller of the distributed computing system, the de-privileged token; submitting, by the cloud controller to the user authentication module, a request to enhance the de-privileged token and authentication information confirming identity of the cloud controller; receiving, by the cloud controller from the user authentication module, information on one or more privileges directed to system operations of the cloud controller and associated with the user that are not represented in the de-privileged token; and providing, by the cloud controller to the application framework, the information on one or more associated privileges. providing, by an application manager of a distributed computing system to a user authentication module of the distributed computing system, a request to authenticate a user; receiving, by the application manager from the user authentication module, a de-privileged token authenticating the user, wherein the de-privileged token includes partial access rights associated with the user; characterized by: providing, by the application manager to an application framework of the distributed computing system, information characterizing the user, an application, and an action, and the de-privileged token; providing, by the application framework to a cloud controller of the distributed computing system, the de-privileged token; submitting, by the cloud controller to the user authentication module, a request to enhance the de-privileged token and authentication information confirming identity of the cloud controller; receiving, by the cloud controller from the user authentication module, information on one or more privileges directed to system operations of the cloud controller and associated with the user that are not represented in the de-privileged token; and providing, by the cloud controller to the application framework, the information on one or more associated privileges. providing, by the application manager to an application framework of the distributed computing system, information characterizing the user, an application, and an action, and the de-privileged token; providing, by the application framework to a cloud controller of the distributed computing system, the de-privileged token; submitting, by the cloud controller to the user authentication module, a request to enhance the de-privileged token and authentication information confirming identity of the cloud controller; receiving, by the cloud controller from the user authentication module, information on one or more privileges directed to system operations of the cloud controller and associated with the user that are not represented in the de-privileged token; and providing, by the cloud controller to the application framework, the information on one or more associated privileges.