1. A method, in a data processing system, for managing input/output (I/O) virtualization, comprising: creating one or more client partitions in the data processing system, each client partition having an associated portion of resources of the data processing system; performing I/O virtualization management operations with an I/O endpoint associated with the data processing system, wherein the I/O virtualization management operations operate to configure at least one of a physical function or a virtual function of the I/O endpoint; creating an I/O virtualization management partition (IMP) in the data processing system, wherein the IMP performs a subset of the I/O virtualization management operations with the I/O endpoint to thereby manage a set of physical functions, comprising one or more physical functions of the I/O endpoint, and wherein the one or more client partitions are not permitted to perform I/O virtualization management operations on the set of physical functions but are permitted to perform I/O virtualization management operations on the client partitions' associated virtual functions in the I/O endpoint; and controlling access of the I/O virtualization management operations to resources of the I/O endpoint using a virtual intermediary separate from the I/O virtualization management partition (IMP), wherein the virtual intermediary prevents a client partition from accessing resources of the I/O endpoint that are not assigned to that client partition.