There's no "show_compute_resources_vms" permission seeded in Foreman, which is used when browsing a compute resource and trying to view details about an individual VM. This prevents a user from navigating to the VM's console, unless it happens to be associated to a host.
view_compute_resources_vms is mapped to allow access to both the index and show pages for individual VMs when browsing via the CR, but the links on the index aren't present (internally Foreman's looking for that "show" permission).