Restrict access for cloud manager users | AEMasCS

@georhe6 , 

- create a user in the Adobe admin console for a specific product profile example stage author  and the created user would flow to the stage author instance 

- once the user in the stage author instance  restrict using OOTB WCM role and permission or add user to a user group created in stage author WCM instance control and apply restriction to group

Regarding the question on restricting the users from accessing specific paths (assuming you need it on author instance), I can think of achieving it in the following way

1. Create product profiles on admin console. These profiles will be synced to the author and appear as user groups
2. On AEM author, create another set of user groups that map 1 to 1 to these product profile groups
3. Assign the required path permissions to the user groups created AEM author (/content/xyz, /apps/xyz). For applying permissions on \apps, you will have to use repoinit scripts
4. Now make product profile group a member of user group created on AEM

When a new user is added to a specific product profile in Admin Console, by virtue of the above group relationship, the user will automatically inherit the permissions defined in the user group created on AEM