This is something that i've had to face in some of my applications too. And the only answer i can give is "it depends." There are a few questions that might help you to get to thinking about approaching the problem.

• How do you anticipate doling out the privileges? Is it a situation where each user will fall into a category of user that will require access to only a certain subset of applications? This kind of scheme would be easily implemented in database tables (a scheme i've used often).
• Conversely, is every user going to have unique set of applications which they can access? If so, maybe some kind of centralized file could be used that keeps tabs of whether or not each user can access each application ( could just be 0 or 1 to indicate denied or allowed).
• Is it necessary to hide the applications from all users, or can the applications themselves do user authentication? In other words, is a centralized authentication system necessary?

Hopefully something useful to think about here.