Ah I understand the source of confusion now. For displaying and allowing to perform some action we use permission map defined in ```app/services/foreman/access_permissions.rb``` where clone actions are allowed by create_* permissions.

```action_permission``` method you're referring to is used to authorize resource objects collection within this action. It say what permission should be used to search objects if user has been already allowed to perform that action (based on permissions map, not this permission).

So if users do not have create permission they do not see clone button/link and they would not be allowed to even trigger this action. View permission could probably fail only if they have create permission and view permission for only some objects. They could modify id of link they see (or forges url any other way).