Try this:
ipa permission-add 'Write Host Certificate' --permissions=write --attrs=usercertificate --type=host
ipa privilege-add 'Disable Host' --desc='Disable Hosts'
ipa privilege-add-permission 'Disable Host' --permissions='retrieve certificates from the ca' --permissions='revoke certificate' --permissions='manage host keytab' --permissions='write host certificate'
ipa privilege-add 'Disable Service' --desc='Disable Services'
ipa privilege-add-permission 'Disable Service' --permissions='modify services' --permissions='manage service keytab'
ipa role-add 'Disable Hosts' --desc='Disable Hosts'
ipa role-add-privilege --privileges='Disable Service' --privileges='Disable Host' 'Disable Hosts'

Then use ipa role-add-member to add your user to this new role.

I've opened an upstream ticket in FreeIPA to add at least the permission and privileges by default so at some point we can simplify the docs. https://fedorahosted.org/freeipa/ticket/4284