diff --git a/edit/provisioning.cattle.io.cluster/MachinePool.vue b/edit/provisioning.cattle.io.cluster/MachinePool.vue
index a4e23217c4..6029db5109 100644
--- a/edit/provisioning.cattle.io.cluster/MachinePool.vue
+++ b/edit/provisioning.cattle.io.cluster/MachinePool.vue
@@ -97,7 +97,7 @@ export default {
           :mode="mode"
           label="Pool Name"
           :required="true"
-          :disabled="!!value.config.id"
+          :disabled="!value.config || !!value.config.id"
         />
       </div>
       <div class="col span-2">
@@ -133,13 +133,14 @@ export default {
     <hr class="mt-10" />
 
     <Banner
-      v-if="showWarning"
+      v-if="showWarning && value.config"
       color="info"
       :label="t('cluster.machineConfig.banner.updateInfo')"
     />
 
     <component
       :is="configComponent"
+      v-if="value.config"
       ref="configComponent"
       :uuid="uuid"
       :mode="mode"
@@ -149,6 +150,7 @@ export default {
       :disabled="!!value.config.id"
       @error="e=>errors = e"
     />
+    <Banner v-else color="info" label="You do not have access to see this machine pool's configuration." />
 
     <AdvancedSection :mode="mode" class="advanced">
       <portal-target :name="'advanced-' + uuid" multiple />
diff --git a/edit/provisioning.cattle.io.cluster/rke2.vue b/edit/provisioning.cattle.io.cluster/rke2.vue
index ec44398ff8..ca21887e19 100644
--- a/edit/provisioning.cattle.io.cluster/rke2.vue
+++ b/edit/provisioning.cattle.io.cluster/rke2.vue
@@ -107,7 +107,7 @@ export default {
         k3sVersions:  this.$store.dispatch('management/request', { url: '/v1-k3s-release/releases' }),
       };
 
-      if ( this.$store.getters['management/schemaFor'](MANAGEMENT.POD_SECURITY_POLICY_TEMPLATE) ) {
+      if ( this.$store.getters['management/canList'](MANAGEMENT.POD_SECURITY_POLICY_TEMPLATE) ) {
         hash.allPSPs = await this.$store.dispatch('management/findAll', { type: MANAGEMENT.POD_SECURITY_POLICY_TEMPLATE });
       }
 
@@ -715,10 +715,19 @@ export default {
 
       if ( existing?.length ) {
         for ( const pool of existing ) {
-          const config = await this.$store.dispatch('management/find', {
-            type: `${ CAPI.MACHINE_CONFIG_GROUP }.${ pool.machineConfigRef.kind.toLowerCase() }`,
-            id:   `${ this.value.metadata.namespace }/${ pool.machineConfigRef.name }`,
-          });
+          const type = `${ CAPI.MACHINE_CONFIG_GROUP }.${ pool.machineConfigRef.kind.toLowerCase() }`;
+          let config;
+
+          if ( this.$store.getters['management/canList'](type) ) {
+            try {
+              config = await this.$store.dispatch('management/find', {
+                type,
+                id: `${ this.value.metadata.namespace }/${ pool.machineConfigRef.name }`,
+              });
+            } catch (e) {
+              // Some users can't see the config, that's ok.
+            }
+          }
 
           // @TODO what if the pool is missing?
           const id = `pool${ ++this.lastIdx }`;
@@ -729,7 +738,7 @@ export default {
             create:  false,
             update: true,
             pool:    clone(pool),
-            config:  await this.$store.dispatch('management/clone', { resource: config }),
+            config:  config ? await this.$store.dispatch('management/clone', { resource: config }) : null,
           });
         }
       }