A cloud computing system, comprising: a plurality of computing nodes; an application programming interface associated with the plurality of computing nodes; at least one storage unit; a controller configured to operate on each of the plurality of computing nodes and to select software operating on the associated node; a distributed control plane in communication with the controller and the storage unit, and configured to provide a platform to launch and manage one or more instances on one or more of the plurality of computing nodes; and a permissions (902, 950) system configured to associate one or more permissions (902, 950) to one or more instances and authorize the launching and managing of one or more instances on the distributed control plane, wherein the permissions system includes being configured to determine, from a plurality of permissions (902, 950), at least one user permission to authorize the at least one user (105, 804, 1004) to act upon an object of the one or more instances, each user permission comprising a key-value pair defining a delegation path for the user, and wherein the permissions system includes being configured to determine, from the plurality of permissions (902, 950), an object permission for an object upon which an action is to be performed, each object permission comprising a key-value pair defining a delegation path for the object, and wherein the permission system authorizes the launching and managing of the one or more instances based on the user permission and object permission and only if both the user permission and object permission exist, and wherein to perform an action on an object, a delegation path should exist within the object permissions for the action being performed, and a delegation path should exist within the user permissions for the action to be performed, wherein a delegation path exists if there is a path from a permission with authorizer 'POLICY' to a permission for which: the user (requester) or groups that the user belongs to is the same as, or a descendant of the subject specified in the permission; the object on which the action to be performed is the same as, or a descendant of the object specified in the permission; and/or the action in the permission is unspecified, or the same as the action requested, wherein a system policy is a set of initial permissions granted at customer creation, the said permissions being policy assertions and being indicated by an authorizer set to 'POLICY'. a plurality of computing nodes; an application programming interface associated with the plurality of computing nodes; at least one storage unit; a controller configured to operate on each of the plurality of computing nodes and to select software operating on the associated node; a distributed control plane in communication with the controller and the storage unit, and configured to provide a platform to launch and manage one or more instances on one or more of the plurality of computing nodes; and a permissions (902, 950) system configured to associate one or more permissions (902, 950) to one or more instances and authorize the launching and managing of one or more instances on the distributed control plane, wherein the permissions system includes being configured to determine, from a plurality of permissions (902, 950), at least one user permission to authorize the at least one user (105, 804, 1004) to act upon an object of the one or more instances, each user permission comprising a key-value pair defining a delegation path for the user, and wherein the permissions system includes being configured to determine, from the plurality of permissions (902, 950), an object permission for an object upon which an action is to be performed, each object permission comprising a key-value pair defining a delegation path for the object, and wherein the permission system authorizes the launching and managing of the one or more instances based on the user permission and object permission and only if both the user permission and object permission exist, and wherein to perform an action on an object, a delegation path should exist within the object permissions for the action being performed, and a delegation path should exist within the user permissions for the action to be performed, wherein a delegation path exists if there is a path from a permission with authorizer 'POLICY' to a permission for which: the user (requester) or groups that the user belongs to is the same as, or a descendant of the subject specified in the permission; the object on which the action to be performed is the same as, or a descendant of the object specified in the permission; and/or the action in the permission is unspecified, or the same as the action requested, wherein a system policy is a set of initial permissions granted at customer creation, the said permissions being policy assertions and being indicated by an authorizer set to 'POLICY'.