[libvirt] libvirt authorization

Is there any authorization mechanism in libvirt? I've got TLS going so that only those with a cert signed by my CA are allowed in, but there appears to be no way for me to only allow them access to certain VMs. Can I limit folks to specific VMs or VNC ports? Ideally I can allow access only to those VMs which they own. This is really not _that_ big of a deal because I'm advising all my admins to log out of their systems but it would give me and them peace of mind. Thoughts? Scott