It's acceptable (albeit a terrible practice) to MITM traffic on your own network. It's not at all acceptable for any CA certificate accepted by default in all browsers (not just those on your network), no matter whether root or intermediate, to ever issue a certificate for a domain to anyone other than the owner of that domain. Issuing such a certificate is grounds for immediate revocation of browser trust.
If you want to MITM traffic on your network, have clients install your MITM certificate, which gives them ample warning about what you're doing.
It may be acceptable in certain states and jurisdictions, but it is throughly illegal in others. Remember you aren't just MITMing your own network, if someone from your network connects to my server you are MITMing me too and you have not obtained my consent for that. Even if your state is a one party consent state, mine may not be or have laws that heavily restrict interception.
I'd argue that it doesn't give ample warning. I've seen a number of corporate networks where a MITM trusted root cert is installed on machines via an AD policy and the end users have no clue that their IT department can see things like their banking passwords. Unless you examine the cert by hand or connect a device without the cert to the network, you would have no idea this is going on.
Assuming that Symantec doesn't manage to deflect onto Bluecoat, and assuming that browser vendors are willing to actually revoke one of the largest CAs for misuse rather than wagging their finger.
The last time Symantec made a "mistake" with their CA (https://security.googleblog.com/2015/10/sustaining-digital-c...), Google said "Therefore we are firstly going to require that as of June 1st, 2016, all certificates issued by Symantec itself will be required to support Certificate Transparency." Interesting wording, "by Symantec itself". And now, a few days before June 1st, Symantec issues an intermediate CA certificate to a known vendor of MITM systems, so that Bluecoat can issue certificates themselves rather than having their "certificates issued by Symantec itself".
I wonder if Bluecoat will support Certificate Transparency?
If you want to MITM traffic on your network, have clients install your MITM certificate, which gives them ample warning about what you're doing.