A computer-implemented method for providing task-based access to inventory objects (210-212) in a computer-based virtualization environment , the method comprising: generating, by a computer system , one or more proxy task objects for performing a plurality of activities on the inventory objects (210-212) managed by the virtualization environment , wherein the inventory objects (210-212) include virtual machines and the plurality of activities include at least creating, deploying, powering on/off or moving the virtual machines; wherein each proxy task object represents at least one activity through one or more designated privileges (201-204) associated with one or more of the inventory objects (210-212), and wherein each designated privilege (201-204) of each activity of each proxy task object is associated with a designated one of the one or more inventory objects (210-212); storing the generated one or more proxy task objects in a memory of the computer system ; and assigning, by the computer system , to one or more delegate users , an encapsulated task bundle which comprises at least one of the proxy task objects , wherein the one or more delegate users are automatically permitted, under control of the computer-based virtualization environment , to perform the at least one activity represented by the at least one proxy task object of the encapsulated task bundle, on the one or more associated designated inventory objects (210-212), and wherein the generating and assigning are implemented on top of an existing role-based access permissions mechanism . generating, by a computer system , one or more proxy task objects for performing a plurality of activities on the inventory objects (210-212) managed by the virtualization environment , wherein the inventory objects (210-212) include virtual machines and the plurality of activities include at least creating, deploying, powering on/off or moving the virtual machines; wherein each proxy task object represents at least one activity through one or more designated privileges (201-204) associated with one or more of the inventory objects (210-212), and wherein each designated privilege (201-204) of each activity of each proxy task object is associated with a designated one of the one or more inventory objects (210-212); wherein the inventory objects (210-212) include virtual machines and the plurality of activities include at least creating, deploying, powering on/off or moving the virtual machines; wherein each proxy task object represents at least one activity through one or more designated privileges (201-204) associated with one or more of the inventory objects (210-212), and wherein each designated privilege (201-204) of each activity of each proxy task object is associated with a designated one of the one or more inventory objects (210-212); storing the generated one or more proxy task objects in a memory of the computer system ; and assigning, by the computer system , to one or more delegate users , an encapsulated task bundle which comprises at least one of the proxy task objects , wherein the one or more delegate users are automatically permitted, under control of the computer-based virtualization environment , to perform the at least one activity represented by the at least one proxy task object of the encapsulated task bundle, on the one or more associated designated inventory objects (210-212), and wherein the generating and assigning are implemented on top of an existing role-based access permissions mechanism . <EOS>