Ah yes, it's the retrieval route.  I'd probably just add it to view_hosts in that case.  Otherwise we should probably check if the user is authorised for the bmc action in the view, before trying to render the BMC block which relies on the bmc AJAX route.