Permissions based on Group of Group showing resources outside of permissions

I've kicked the tires a few times over the years and every time I try I always end up finding that account permissions doesn't properly cover all of the available object types. It seems that the default behavior is that if the object CAN be controlled via account/view limitations and your group has no rules about those objects then you would see all of them, so if i have a group with only nodes in it then any application widgets i add will show all applications, but nodes would be properly filtered. If i add a member definition that includes apps then it will filter node and app widgets. But there are some object types that disregard those rules completely, i know in the past I was trying to limit WPM transactions based on some logic I had come up with, but ultimately the OOTB widgets just ignored my filters so I had to do overly complicated stuff like use a script to add filters to the WPM widgets every time a new dashboard was added. I wouldn't be surprised at all if it turned out that the limitations aren't able to properly filter against VIM objects like vcenters and VM's.