Tom,
You need to create a NEW Custom Access Right with the functionality you require to the CMS and other applications. Then you would create NEW group and assign the Access Rights to this group to the applications.
All the information you need on creating and assigning access rights are within the Admin Guide.
http://help.sap.com/businessobject/product_guides/sbo41/en/sbo41sp7_bip_admin_en.pdf
Regards,
Ajay