Abstract: One embodiment of the present invention provides a system that allows secure deployment delegation and management of applications in a distributed-computing infrastructure. During operation, the system assigns a deployment-role to a user, which enables the user to deploy an application in the distributed-computing infrastructure. Moreover, by assigning the deployment-role to the user, the system also delegates the privilege to assign a run-time-role to the application. Note that the set of run-time roles a user is allowed to assign (or grant) can depend on the deployment role that has been assigned to the user. Furthermore, assigning the run-time-role to the application grants permission to the application to access a resource in the shared infrastructure, which allows the application to operate properly. Furthermore, note that by delegating to users the privilege of assigning roles to applications simplifies the secure deployment and management of applications in the distributed-computing infrastructure.