You configure security in the Client on each component, window, or tag. Or you may simply want to make the entire Client read-only without having to setup security on each component.