how can this be extended to subusers of the VM in the web interface who are given group control over a collection of VMs?
this would be fine if hardware could be removed after it gets stuck in BIOS, but it seems to not be possible, even after CTRL-ALT-DEL (hmm, maybe more hardware can be added...