The system administrator at installation time.
> What defines which resources they are given?
Applications just have a request list of what they require.
If the administrator doesn't allow them for the given application modules (executable, dynamic library, function call,...), bad luck.