In Summary:

• Control access based on people wherever possible

• If you can't, consider using host names

• If you can't do that, you could use IP addresses

• It's all much harder than it looks!