BPC 10.0 - How can I control security at Environment level?

Dear All,

How can I control environment level security in BPC?

i.e.

User1 can work on only ENV01

User2 can work on only ENV02 & ENV03

etc...

I believe this has to be done at BW level, right? If so, how can I do that in BW? Else, how can I achieve this?

Thanks,

Peri