@domcleal I agree with everything you said. It's not possible to change the security groups a host is in after its launched so existing hosts need to have re-selection disabled when being edited.