A system, apparatus, and method are provided for entitlement security and control. According to one embodiment, an entitlement request is received from a user seeking entitlement permission, the entitlement request is matched against entitlement rules and roles that are retrieved from a metadata repository, and the entitlement permission is granted if the entitlement request satisfies the entitlement rules and roles.