For logical separation of duties, Control Room divides automation users into two broad categories: Bot Creators (development) users and Bot Runners (run-time) users.

Bot Creators exist on a separate Microsoft Windows system with its own credentialing system to create, update, and unit test the bots on the Bot Creator. Bot Creators only upload and download bots to and from the version control system on the Control Room. Users on the Control Room users have privileges to execute bots on Bot Runners but have no access to the Bot Creators. This separation of duty constitutes a dual authorization by requiring both the developer and the business user to create and execute the bot in conformance with NIST AC-3 best practices.