The Horizon vCenter Orchestrator plug-in uses a trusted account security model. The administrator provides the credentials to the initial configuration between the View pod and the plug-in, and that trusted account is the security context that all workflows use between vCenter Orchestrator and VMware Horizon 6.
Additional levels of permissions also restrict which users can see and edit the workflows within vCenter Orchestrator. All Horizon vCenter Orchestrator plug-in workflows must be explicitly configured for execution. Access to the workflows requires both the permissions and the vCenter Orchestrator client interaction with the client.
In addition, the third level of security is an access layer between where the workflows are executed, in vCenter Orchestrator, and where they are exposed to delegated administrators and end users, in the vSphere Web Client and vCloud Automation Center.
Administrators use the vCenter Single Sign-On implementation to allow access by users or groups to run workflows within vSphere Web Client.
Administrators use the service catalog and entitlement mechanisms within vCloud Automation Center to manage which workflows are exposed to specific users and groups.