1. A computer-implemented method for controlling access to on-demand application programs, the method comprising: defining a support user class in a user profile database for an application installed as part of organization resources, wherein a support user is granted read only privileges to metadata of the application; enabling an administrator to grant access by a third party to the application as a support user; enabling the administrator to grant access by the third party to the application as an organization user for a limited term, wherein the organization user is granted user privileges of the application; and allowing the third party to login to the organization and use the application as the organization user for the limited term if the administrator has granted access to the third party as both a support user and as the organization user.