Enterprises that desire enhanced security can use the CloudBees Role-Based Access Control plugin from CloudBees. Typically, enterprise sandbox teams use the Folders plugin and tie access control rights to a particular folder.
For a typical deployment-to-production phase, organizations prefer to lock down the build agent to a particular operations team because the build agent has security credentials within production environments. This is achieved through the Folders Plus plugin from CloudBees.