For logical separation of duties, Enterprise Control Room divides automation
users into two broad categories: Bot Creators (development) users and Bot Runners (run-time) users.
Bot Creators exist on a separate Microsoft Windows system with its own
credentialing system to create, update, and unit test the bots on the Bot Creator. Bot Creators only upload and download bots to and from the version control system on the Enterprise Control Room. Users on the Enterprise Control Room users have
privileges to execute bots on Bot Runners but have no
access to the Bot Creators. This separation of duty constitutes a dual
authorization by requiring both the developer and the business user to create and
execute the bot in conformance with NIST AC-3 best