Sorry, re-reading this, it's actually restricting the options listed to the users if they're editing a host and have a security group selected.. seems that instead it should use `multiple_selects` instead of `selectable_f` + `multiple: true`, then you're able to pass in the currently selected value.  Have a look at `app/views/taxonomies/_form.html.erb` for how they work.

If it's not possible (or sensible?) to change this on the fly, it should probably be disabled too.