A method to provide layered security for interface access control in a process control system, the method comprising: receiving a connect message in a first server from a client application to access at least one server endpoint, wherein the at least one server endpoint includes at least one of: an address, a binding element, or a contract element wherein the address of the endpoint is a location that an application hosting a service uses to advertise the service, wherein the binding element specifies at least one of: a transport mechanism, or a protocol that is used to access a service, and wherein the contract element indicates at least one of: operations that are accessed within a service, or parameters required to access resources accessible through the server endpoint; in response to receiving the connect message, opening a session between the at least one server endpoint and the client application if the session is authorized to be opened; receiving a request from the client application to open a resource endpoint that provides at least one type of access selected from the group of: read access, write access, or subscribe access to at least one process control resource, the resource endpoint being organized by security requirements based on the type of access provided by the resource endpoint; opening the resource endpoint within the open session after determining that the client application is authorized to access the at least one process control resource via the resource endpoint; receiving a request from the client application to assign a selection of the at least one authorized resource to the resource endpoint; assigning the at least one selected process control resource to the resource endpoint; and granting the client application access to the at least one process control resource via the resource endpoint. receiving a connect message in a first server from a client application to access at least one server endpoint, wherein the at least one server endpoint includes at least one of: an address, a binding element, or a contract element wherein the address of the endpoint is a location that an application hosting a service uses to advertise the service, wherein the binding element specifies at least one of: a transport mechanism, or a protocol that is used to access a service, and wherein the contract element indicates at least one of: operations that are accessed within a service, or parameters required to access resources accessible through the server endpoint; in response to receiving the connect message, opening a session between the at least one server endpoint and the client application if the session is authorized to be opened; receiving a request from the client application to open a resource endpoint that provides at least one type of access selected from the group of: read access, write access, or subscribe access to at least one process control resource, the resource endpoint being organized by security requirements based on the type of access provided by the resource endpoint; opening the resource endpoint within the open session after determining that the client application is authorized to access the at least one process control resource via the resource endpoint; receiving a request from the client application to assign a selection of the at least one authorized resource to the resource endpoint; assigning the at least one selected process control resource to the resource endpoint; and granting the client application access to the at least one process control resource via the resource endpoint.