[libvirt] managing libvirt users in a one-server context

I have a single KVM server on which I want to allow co-workers the ability to create vm's. Here are my criteria in order of importance: 1. I do not want to have to grant all users root privileges. 2. I would like the vm's to use the host's bridge (br0) by default. 3. I do not want one user to be able to start, stop, or (re)define the vm's created by another user by default. 4. I would like a user to be able grant access to another user. Mostly for viewing. Can I do all this with hardcoded usernames and passwords? If not, what is my best option? -- /jm