Permissions needed to allow CloudClient to deploy a IaaS catalog item????

Hello.  I can't seem to get the CloudClient to work with a standard user account.  It seems like they need at least some sort of elevated access its just not immediately obvious what.  If I try to login to IaaS with my normal user account I get a refusal.  I'm assuming this is because they are not allowed as a business group manager or some role that would need access to the IaaS piece.  This is a simple user that can only deploy what they are entitled to in the catalog.  I haven't attempted to see if they can do other actions like power off their vm yet.  Any guidance would be appreciated.