What about having different access roles for certain people to certain servers?

Is that covered in the NixOS approach as well?

Sounds interesting!