“guest user” access control to qemu/kvm guest OS (via spice)

Question

I feel like I am missing a piece of the puzzle.

Virtualisation with kvm and spice on linux seems to allow all users with libvirt access the same level of access to th