Ok, after chatting with Dominic, I'm thinking like this:

(1) Makes perfect sense - if I'm in the Israel/TLV context, I expect to see the Hosts in Israel/TLV/Rack7 - so here, with the User as the subject, we're expecting to use `subtree_ids`
(2) Dominic's analysis works for me, so we're saying that for non-host taxonomix objects, we're doing something like `subtree_ids + ancestor_ids`
(3) This is the slightly tricky one - ensuring that we render the Host#new form correctly. My feeling is that we either:

a) restrict Hosts to being created in a leaf-node Taxonomy, or
b) use the same `subtree_ids + ancestor_ids` code to look both ways along the tree and allow Hosts to be created with resources for either direction.

I'm leaning towards (b) for greater flexibility. It may be that a user wishes to create a host in Israel/TLV that uses an Install Media in Israel/TLV/Rack7.