Access is set up based on user roles and rights, so that only authorised people can view or modify flows.