I think we need an additional permission to disable hosts:

    [Thu Mar 27 19:23:43 2014] [error] ipa: INFO: realm-proxy@EXAMPLE.ORG: host_disable(u'realm4.example.org'): ACIError