nice write-up! I discovered some “interesting” issues one would not expect when working with permissions in VC.
If you work with folders in “Hosts & Clusters” and “VMs and Templates” you have to be very careful:
Permissions are always treated differently between these two views, which is OK. Folders created above Datacenters will always share the same permissions. Folders created below Datacenters, even with the same name, will not automatically share the same permissions.

Also people might want to combine roles on one object, e.g. some users are in _create_hosts on Object1 (propagate=yes) but should also be given the right to create VMs on objects somewhere deeper in the hierarchie. Since you can only have on role associated to an object at one time you have to should groups and not single users . VC will then combine all roles/ permissions on that specific object, e.g. create hosts in folder1 and subfolders create VMs in
subfolder xyz…

Hope this helps or someone can comment.

Best,
Michael