A "required execution authorization", called a class, is permanently assigned to each AMO action. A user can only start an AMO action if the class of the AMO action is included in the set of his or her execution rights. If the authorizations are not sufficient, an error message appears and the user cannot perform the AMO action.

The system administrator assigns one or more of the execution rights to each user ID; these authorize the user of the ID to execute specific MML commands (AMO actions) (see Figure 1).

It is possible to use the AMO AUTH at any time to grant and change the AMO authorizations for individual actions if the user has the authorization needed to do this (see chapter with log in concept).