That sounds like just a group permissions issue in their model, and a shared mount model in the VM guy's model.

These are pretty creative approaches using the built-in access control Unix has. I like it.