1. A system, comprising a plurality of virtualization platforms and one or more management clients for said virtualization platforms, the virtualization platforms and the management clients being communicatively coupled to one another via a control layer logically disposed therebetween and configured to proxy virtualization management commands from the one or more management clients to said virtualization platforms, but only after successful authentication of users issuing said commands and privileges of those users as defined by access control information accessible to said control layer.