Hello tdo
As far as I know you need adminstrator right on the level (Datacenter, Host, VM) where you want to edit the firewall, but you can see it in any case.
Yes, I agree something like "VM.Firewall" would be useful.
So it´s hereby a request to development.
Do I understand it correctly...