A system, comprising a plurality of virtualization platforms, and one or more administration clients for said plurality of virtualization platforms, each of the plurality of virtualization platforms and the one or more administration clients being communicatively coupled to one another via a control layer logically disposed therebetween, said control layer being instantiated as a software application running on a physical appliance logically disposed between the plurality of virtualization platforms and the one or more administration clients and configured to transparently control execution of virtualization administration commands from the one or more administration clients to said plurality of virtualization platforms, but only after successful authentication of system administrators issuing said virtualization administration commands and privileges of those system administrators, as defined by access control information accessible to said control layer, wherein each of the one or more administration clients is a computer-based resource through which virtualization management commands are issued to the plurality of virtualization platforms, the virtualization platforms comprise computer-based resources configured to abstract resources of a computer system or network from one or more operating systems and/or applications executing thereon or therein, and characterized by: the control layer comprising a software application, which when executed by a processor causes the processor to inspect and log each attempted access, including failed attempts, to perform administration operations by the one or more administration clients to determine whether or not an asserted virtualization administration command is one that is valid and authorized for a respective one of the system administrators issuing the asserted virtualization administration command. a plurality of virtualization platforms, and one or more administration clients for said plurality of virtualization platforms, each of the plurality of virtualization platforms and the one or more administration clients being communicatively coupled to one another via a control layer logically disposed therebetween, said control layer being instantiated as a software application running on a physical appliance logically disposed between the plurality of virtualization platforms and the one or more administration clients and configured to transparently control execution of virtualization administration commands from the one or more administration clients to said plurality of virtualization platforms, but only after successful authentication of system administrators issuing said virtualization administration commands and privileges of those system administrators, as defined by access control information accessible to said control layer, wherein each of the one or more administration clients is a computer-based resource through which virtualization management commands are issued to the plurality of virtualization platforms, the virtualization platforms comprise computer-based resources configured to abstract resources of a computer system or network from one or more operating systems and/or applications executing thereon or therein, and characterized by: the control layer comprising a software application, which when executed by a processor causes the processor to inspect and log each attempted access, including failed attempts, to perform administration operations by the one or more administration clients to determine whether or not an asserted virtualization administration command is one that is valid and authorized for a respective one of the system administrators issuing the asserted virtualization administration command.