You need to ensure that specific administrators can only manage virtual machines in a specific folder. What is the correct way to implement this in VVF?