The Spool File Retrieval command can be secured by using the AGENTMSG resource profile. For example a user would need read access to the following resource before being allowed to issue the WSF command in CSF against any ESP Agent.
AGENTMSG.CONTROLGETSPOOLFILE.*
This Frequently Asked Question applies to all supported releases of ESP Workload Manager beginning with 5.x.