Creating a new hostgroup with included puppet Classes as an non admin user fails with below trace:
ActiveRecord::RecordNotSaved
ActiveRecord::RecordNotSaved
app/controllers/hostgroups_controller.rb:61:in `create'
app/models/concerns/foreman/thread_session.rb:33:in `clear_thread'

And below is from production log:
Started POST "/hostgroups" for 192.168.122.10 at 2013-11-06 13:20:35 +0100
Processing by HostgroupsController#create as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"pvYwrj4pU1xLv221N4oIa1GUOV2sCluMpJoaf0lsuIk=", "hostgroup"=>{"parent_id"=>"98", "name"=>"pgustafs1 ", "environment_id"=>"4", "puppet_ca_proxy_id"=>"1", "puppet_proxy_id"=>"1", "puppetclass_ids"=>["", "40", "380", "32", "80", "15", "97", "85", "55"], "domain_id"=>"2", "subnet_id"=>"", "architecture_id"=>"1", "operatingsystem_id"=>"1", "medium_id"=>"6", "ptable_id"=>"11", "root_pass"=>"[FILTERED]", "location_ids"=>["", "1", ""], "organization_ids"=>["", "2", ""]}, "commit"=>"Submit"}
Operation FAILED: ActiveRecord::RecordNotSaved
Rendered common/500.html.erb within layouts/application (3.5ms)
Completed 500 Internal Server Error in 74ms (Views: 5.8ms | ActiveRecord: 21.9ms)

The user is assigned an role with all permissions selected.

However if i do it in two steps it works:
1. Create a new hostgroup with no included puppet classes.
2. Edit the newly created hostgroup and include puppet classes.