Perhaps also asy that while no access needed from Foreman->client, access is instead required from client->Foreman?