Security for production reports

Recently I was asked a question in an interview: In a SAP BO-BI integration project, where do we define the security: WEBI ? Universe ? CMC ? BEx ? Where and why ?

I told him that row level security needs to be done at BEx. He asked me how ? I could not answer properly. He was not at all convinced. I think he asked me to explain all types of security and Why ?

He again asked me, for the best practices, how will you model your security and why ?

I am also curious to know about defining the security ? Would anybody please explain me in details ? Is there any documentation for this ?

How about security in X-Celsius..like Live Office, QWAAS ?

I would really really appreciate the detail answer.

Thanks