The Altiris Software Virtualization Solution (SVS) development team wrote a nice article detailing security approach they took in SVS, describing rights, file system permissions and antivirus solutions interaction.

Read it here.