From Evernote:

Authorisation for deploying from a Process Centre to a Process Server

Users with read access to the process app can deploy to dev Process Servers

Users with write access to the process app can deploy to test Process Servers

Users with admin access to the process app can deploy to prod Process Servers

This can be overridden by adding a group (ldap based or local) to 100Config.xml on the Process Server

(note, this even overrides tw_admin's ability to deploy) 

<server merge="mergeChildren">

        <process-center-install-group merge="replace">uk_bpm_foo_users</process-center-install-group>

</server>  

Note that in the example above uk_bpm_foo_users is an LDAP group but that the full DN is not required