A method comprising: providing , by an application manager of a distributed computing system to a user authentication module of the distributed computing system, a request to authenticate a user; receiving , by the application manager from the user authentication module , a de-privileged token authenticating the user, wherein the de-privileged token includes partial access rights associated with the user; characterized by : providing , by the application manager to an application framework of the distributed computing system , information characterizing the user, an application, and an action, and the de-privileged token; providing , by the application framework to a cloud controller of the distributed computing system, the de-privileged token ; submitting , by the cloud controller to the user authentication module , a request to enhance the de-privileged token and authentication information confirming identity of the cloud controller ; receiving , by the cloud controller from the user authentication module , information on one or more privileges directed to system operations of the cloud controller and associated with the user that are not represented in the de-privileged token; and providing , by the cloud controller to the application framework , the information on one or more associated privileges. providing , by an application manager of a distributed computing system to a user authentication module of the distributed computing system, a request to authenticate a user; receiving , by the application manager from the user authentication module , a de-privileged token authenticating the user, wherein the de-privileged token includes partial access rights associated with the user; characterized by : providing , by the application manager to an application framework of the distributed computing system , information characterizing the user, an application, and an action, and the de-privileged token; providing , by the application framework to a cloud controller of the distributed computing system, the de-privileged token ; submitting , by the cloud controller to the user authentication module , a request to enhance the de-privileged token and authentication information confirming identity of the cloud controller ; receiving , by the cloud controller from the user authentication module , information on one or more privileges directed to system operations of the cloud controller and associated with the user that are not represented in the de-privileged token; and providing , by the cloud controller to the application framework , the information on one or more associated privileges. providing , by the application manager to an application framework of the distributed computing system , information characterizing the user, an application, and an action, and the de-privileged token; providing , by the application framework to a cloud controller of the distributed computing system, the de-privileged token ; submitting , by the cloud controller to the user authentication module , a request to enhance the de-privileged token and authentication information confirming identity of the cloud controller ; receiving , by the cloud controller from the user authentication module , information on one or more privileges directed to system operations of the cloud controller and associated with the user that are not represented in the de-privileged token; and providing , by the cloud controller to the application framework , the information on one or more associated privileges. <EOS>