Currently, any user with an ability to create a new host can assign any proxy exists in the system. It means that multi-branch organisation with multiple zabbix-proxy (e.g. one zabbix-proxy per-branch) can't assign RW privileges to branch administrators because they can create a host with any proxy exists in the system and use this security hole to scan another's branch infrastructure

The proposal is to add group attribute to Proxy object to split proxies between users like it's done for templates and hosts.