I think this should be :edit_classes too, since the permission is checked in the views (e.g. `app/views/puppetclasses/_class_selection.html.erb`) irrespective of whether it's a host or host group being edited.