We have a subset of VMs that a group of users needs readonly and console access.  This is not difficult with RBAC using categories.  However, when we clone these systems for testing  or new deployment, the assigned categories don’t get inherited from the source VM.  Since we do this often,  this is a management headache.

Is this standard behavior?  If so, any ideas on how to do this easily?

I was hoping projects might be helpful, but I can’t find much useful documentation or examples to guide me.