For restricted users, I filter job templates on category ( job_category ^ (Packages, Power))
This filter is used for Template invocation, Job template and Job invocation. If I go into Foreman settings and change Remote Execution/Form Job Template, my restricted user can access the job templates that are in the same Job Category as the job in that field, nothing else.
Is there a more appropriate way to implement this? FYI, works for legacy form, not the new form.