Please see the errors below. I'm seeing this in the engine.log when as a user I'm trying to activate either a VM console or reboot a VM which I have access to as a user ("UserRole permission assigned to VM).
2018-07-18 10:51:33,554+01 INFO [org.ovirt.engine.core.bll.aaa.CreateUserSessionCommand] (default task-9) [557ca876] Running command
: CreateUserSessionCommand internal: false.
2018-07-18 10:51:33,575+01 INFO [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (default task-9) [557ca876] E
VENT_ID: USER_VDC_LOGIN(30), User callum@Biomedical Research Computing connecting from '192.168.1.241' using session 'wiWA25wdaRP1zay
iyTSGBJKpvi89LdzgKqeX12BcZhNVhpV2BIA+zkAnT50xOSDglxnhfAi3S2ZiODls8JYFUA==' logged in.
2018-07-18 10:51:34,135+01 ERROR [org.ovirt.engine.core.bll.GetSystemStatisticsQuery] (default task-5) [8d830cdb-fc11-4e68-94e6-73309
65c4488] Query execution failed due to insufficient permissions.
2018-07-18 10:51:34,205+01 ERROR [org.ovirt.engine.core.bll.GetPermissionsForObjectQuery] (default task-26) [ba1825f1-60fb-44cd-8b57-
ea701cf698c0] Query execution failed due to insufficient permissions.
2018-07-18 10:51:34,242+01 ERROR [org.ovirt.engine.api.restapi.resource.AbstractBackendResource] (default task-26) [] Operation Faile
d: query execution failed due to insufficient permissions.
2018-07-18 10:51:34,389+01 ERROR [org.ovirt.engine.core.bll.storage.domain.GetStorageDomainListByIdQuery] (default task-17) [02965366
-44b0-4370-ab83-4781065e46c2] Query execution failed due to insufficient permissions.
2018-07-18 10:51:34,393+01 ERROR [org.ovirt.engine.core.bll.storage.domain.GetStorageDomainListByIdQuery] (default task-17) [02965366
-44b0-4370-ab83-4781065e46c2] Query execution failed due to insufficient permissions.
2018-07-18 10:51:34,394+01 ERROR [org.ovirt.engine.core.bll.storage.domain.GetStorageDomainListByIdQuery] (default task-17) [02965366
-44b0-4370-ab83-4781065e46c2] Query execution failed due to insufficient permissions.
2018-07-18 10:51:34,396+01 ERROR [org.ovirt.engine.core.bll.storage.domain.GetStorageDomainListByIdQuery] (default task-17) [02965366
-44b0-4370-ab83-4781065e46c2] Query execution failed due to insufficient permissions.
2018-07-18 10:51:59,195+01 WARN [org.ovirt.engine.core.bll.SetVmTicketCommand] (default task-18) [7881a832] User '9386d6f5-f172-4cdb
-abca-62492a357888' is trying to take the console of virtual machine 'ddb23e0a-01d5-403c-89ab-37c400d2c938', but the console is alrea
dy taken by user 'd021fc10-4f7c-11e8-88cb-00163e6a7aff'.
2018-07-18 10:51:59,197+01 INFO [org.ovirt.engine.core.bll.SetVmTicketCommand] (default task-18) [7881a832] No permission found for
user '9386d6f5-f172-4cdb-abca-62492a357888' or one of the groups he is member of, when running action 'SetVmTicket', Required permiss
ions are: Action type: 'USER' Action group: 'RECONNECT_TO_VM' Object type: 'VM' Object ID: 'ddb23e0a-01d5-403c-89ab-37c400d2c938'.
2018-07-18 10:51:59,197+01 WARN [org.ovirt.engine.core.bll.SetVmTicketCommand] (default task-18) [7881a832] Validation of action 'Se
tVmTicket' failed for user callum@Biomedical Research Computing. Reasons: VAR__ACTION__SET,VAR__TYPE__VM_TICKET,USER_CANNOT_FORCE_REC
ONNECT_TO_VM
2018-07-18 10:51:59,198+01 ERROR [org.ovirt.engine.api.restapi.resource.BackendVmGraphicsConsoleResource] (default task-18) [] Operat
ion Failed: USER_CANNOT_FORCE_RECONNECT_TO_VM
