No matter how good our users are, there is always a need for restrictions on various resources both within the supercomputer as a whole and within an access node. This task breaks down into two: a rigid "can/can’t" restriction and a flexible "can do no more than" restriction. The first restriction, as a rule, is realized by means of user and/or group rights to certain files and devices. The second one is realized with the help of quota mechanisms that are built into some subsystems.