>
>        Authorization rules are intended for two specific audiences
>
>        ·   System Administrators
>

Well one could argue with good conscience that starting, stopping and so on of VMs is a system administration function and this viable for policykit based configuration...

Policykit as already used for local KVM (which naturally includes SSH transport) if available so it keeps things consistent as well...