For the deb we won't be changing the logic at this point and it's in line with what's done for libvirt, changing behavior at this point would cause more harm than good.
For the snap, we don't auto-add users and as mentioned earlier, have updated our various documentations (those we maintain anyway) to be clearer about the privileges granted to those with access to the API (and mentioning RBAC for those wanting a safer option).
For the deb we won't be changing the logic at this point and it's in line with what's done for libvirt, changing behavior at this point would cause more harm than good.
For the snap, we don't auto-add users and as mentioned earlier, have updated our various documentations (those we maintain anyway) to be clearer about the privileges granted to those with access to the API (and mentioning RBAC for those wanting a safer option).