Summary
Now that you have created an extension, you might be wondering how you control access to your new API. By default, all extension requests must be authenticated through the vCloud API, but all users are implicitly granted permission to perform all actions. Through the use of the vCloud Director API
Authorization Framework, you can create granular ACL-based control.