It can be hard to fully understand and manage permissions in VirtualCenter. It is often unclear what consequences a change will have and you need a lot of testing to not oversee any side effects of permission changes.
We use permissions on folders only. You can also set permissions on resource pools but I would be very careful about mixing both, because this will add even more complexity.
What setup you use depends on what you want to achieve: Folders are for organizational hierarchies only. Inside a datacenter they work independently from the technical hierarchy of hosts, clusters and resource pools. We use folders to group VMs per system type (Unix servers, Windows servers, workstations) and assign folder based permissions to the various teams that need to manage the various machine types.
A common usage scenario for resource pool based permissions is a delegation model where you want other people to manage a pool of (typically limited) CPU and RAM resources completely on their own. This is what the built-in "Resource Pool Administrator" role is for. This way you can e.g. allow someone else to create a theoretically unlimited number of new VMs, but keep them all in the same limited resource pool without touching the resources of all other VMs.
If you want to dive into this subject take a look at these white papers:
Managing VMware VirtualCenter Roles and Permissions[/url]
Resource Management with VMware DRS[/url]
\- Andreas
Twitter: @VFrontDe, @ESXiPatches | https://esxi-patches.v-front.de | https://vibsdepot.v-front.de
