A company uses Huawei Cloud Stack to operate its services.

Developers → Users can only log in to the ECS using VNC. They cannot change the ECS specifications.

O & M personnel → An ECS can be restarted, but the system or software version cannot be upgraded.

Financial personnel → Users can only view cost reports. They cannot perform operations on resources.

This matching follows the least-privilege principle used in HUAWEI CLOUD Stack permission design. Huawei documentation emphasizes separating user responsibilities and assigning permissions based on operational roles, so users receive only the minimum capabilities required for their work. Huawei also describes resource grouping and user-group-based authorization as a standard way to control who can apply for or manage resources.

Based on that model, financial personnel should have the narrowest access, limited to viewing cost reports without operating resources. Developers usually need access to instances for testing or development work, but under minimum-permission security they should not be allowed to alter infrastructure specifications, so VNC-only login without ECS specification changes is the best match. O & M personnel need more operational control than developers, such as basic restart capability, but under minimum permissions they still should not perform higher-risk actions like upgrading the system or software version unless explicitly authorized. This division reduces accidental changes, lowers operational risk, and aligns with Huawei Cloud Stack’s role-based access and tenant/resource governance approach.