A method for access control in device management includes: by a terminal, receiving a command that includes a node identifier of a target ID from a server; judging whether the server rights meet preset rights; running the command when the server rights meet the preset rights and the server has an access right (ACL) of the target node identified by the node identifier. The present invention solves the problem that the MOs are beyond control because any server can create any type of MOs in the terminal, thus improving the security of the system. A system and terminal for access control in device management are also provided.