An information handling system may include a host system and a management controller configured to provide out-of-band management of the information handling system. The management controller may be configured to: receive, via a management bus of the management controller, a user login request for access to a first user account associated with the management controller; determine a second user account corresponding to the first user account, wherein the second user account is associated with a security policy; and provide the user access to the management controller via the first user account, wherein a privilege level of the provided access is based on a set of privileges associated with the second account.