It feels a bit odd that this combining step happens in the provider.
I don't know if William agrees, but it seems like MachineConfig *is* the point where we are defining the constraints for the machine, and thus it makes some sense to have Include/Exclude on MachineConfig