In the user environment, the Engineering is creating the puppet modules. Then the Engineering team creates a profile for hosts using Config Groups where the necessary puppet modules are included. The Operation team itself should then only select the Config Group to apply the provide and should not have access to specific puppet modules.

Therefore the user would like to have the ability to restrict access to puppet modules in HostGroup and Host to only allow a specific role to access those. Users without that role should only see the Config Groups and be able to assign those to the HostGroup or Host.

Operators should not need to care about puppet modules and also don't have the option to add specific modules to a host. Engineering is providing profiles via Config Groups that should be used to setup and configure a host (that way, things can be standarized)