A system for securely transferring commands to a recipient device. An access interface allows a user to enter a command for the recipient device. The access interface only allows the user to enter commands within a subset of commands associated with a role assigned to the user. The control interface receives information, i.e., the command entered by the user and the associated user role, from the access interface. The control interface outputs, to the manifest engine, the information and a manifest table which identifies each role and the subset of commands associated with each role. The manifest engine compares the information with the contents of the received manifest table, and, if the command entered by the user corresponds to a command within the set of commands associated with the role assigned to the user, forwards the command to the recipient device.