To me I would like to be able to assign a specific machine or group to a user to allow them to access machines. In my particular instance I am trying to give one of our software vendors access to look at issues on a few servers. I don't want them to see all our clients, just the ones pertaining to them.

This also goes for our internal support personnel. If they support one product they don't need to see the others.