Worked for me only after I added the same permissions on the cluster level.
1. Create role as Doug mentioned above.
2. Assign permission to appropriate VM(s).
3. Assign permission to each host, no propagation.
4. Assign permission to cluster, no propagation.
5. Assign permission to Datatcenter, no propagation.
Thank you a lot, Doug!
Regards,
Varvara