Should the NIC permissions closely mirror the host ones, e.g. create => create, destroy => destroy, rather than * => edit?