As a template admin, I only want certain users to access specific templates. For example, I have experimental templates I want to use myself. I also have contractors that should only use one template for security reasons.

The RBAC system has to be built with groups in mind since this feature is for large deployments. I suggest we implement #2791 simultaneously.

Related #2950