diff --git a/addons/api/mirage/factories/host-catalog.js b/addons/api/mirage/factories/host-catalog.js
index 4cd7423ae..776d8cdfa 100644
--- a/addons/api/mirage/factories/host-catalog.js
+++ b/addons/api/mirage/factories/host-catalog.js
@@ -11,6 +11,11 @@ const pluginTypes = ['aws', 'azure', 'foobar'];
 let pluginTypeCounter = 1;
 
 export default factory.extend({
+  id: (i) => `host-catalog-id-${i}`,
+
+  // Cycle through available types
+  type: (i) => types[i % types.length],
+
   authorized_actions: () =>
     permissions.authorizedActionsFor('host-catalog') || [
       'no-op',
@@ -18,18 +23,15 @@ export default factory.extend({
       'update',
       'delete',
     ],
-  authorized_collection_actions: () => {
+  authorized_collection_actions: function () {
+    const isStatic = this.type === 'static';
     return {
-      hosts: ['create', 'list'],
+      // only static catalogs allow host create at this time
+      hosts: isStatic ? ['create', 'list'] : ['list'],
       'host-sets': ['create', 'list'],
     };
   },
 
-  id: (i) => `host-catalog-id-${i}`,
-
-  // Cycle through available types
-  type: (i) => types[i % types.length],
-
   plugin: function (i) {
     if (this.type === 'plugin') {
       return {
diff --git a/addons/api/mirage/factories/host-set.js b/addons/api/mirage/factories/host-set.js
index 4bb6ad7bb..35b26e560 100644
--- a/addons/api/mirage/factories/host-set.js
+++ b/addons/api/mirage/factories/host-set.js
@@ -2,19 +2,17 @@ import factory from '../generated/factories/host-set';
 import permissions from '../helpers/permissions';
 
 export default factory.extend({
-  authorized_actions: () =>
-    permissions.authorizedActionsFor('host-set') || [
-      'no-op',
-      'read',
-      'update',
-      'delete',
-      'add-hosts',
-      'remove-hosts',
-    ],
   id: (i) => `host-set-id-${i}`,
   type() {
     return this.hostCatalog?.type || factory.attrs.type;
   },
+  authorized_actions: function () {
+    const isStatic = this.type === 'static';
+    const defaults = ['no-op', 'read', 'update', 'delete'];
+    // Only static allows host management at this time.
+    if (isStatic) defaults.push('add-hosts', 'remove-hosts');
+    return permissions.authorizedActionsFor('host-set') || defaults;
+  },
   plugin() {
     if (this.type === 'plugin') {
       return this.hostCatalog.plugin;
diff --git a/addons/api/mirage/factories/host.js b/addons/api/mirage/factories/host.js
index 980a5b26d..9386fc15b 100644
--- a/addons/api/mirage/factories/host.js
+++ b/addons/api/mirage/factories/host.js
@@ -2,17 +2,17 @@ import factory from '../generated/factories/host';
 import permissions from '../helpers/permissions';
 
 export default factory.extend({
-  authorized_actions: () =>
-    permissions.authorizedActionsFor('host') || [
-      'no-op',
-      'read',
-      'update',
-      'delete',
-    ],
   id: (i) => `host-id-${i}`,
   type() {
     return this.hostCatalog?.type || factory.attrs.type;
   },
+  authorized_actions: function () {
+    const isStatic = this.type === 'static';
+    const defaults = ['no-op', 'read'];
+    // Only static allows update/delete at this time.
+    if (isStatic) defaults.push('update', 'delete');
+    return permissions.authorizedActionsFor('host') || defaults;
+  },
   plugin() {
     if (this.type === 'plugin') {
       return this.hostCatalog.plugin;
diff --git a/ui/admin/app/abilities/host-catalog.js b/ui/admin/app/abilities/host-catalog.js
new file mode 100644
index 000000000..9c6805a8a
--- /dev/null
+++ b/ui/admin/app/abilities/host-catalog.js
@@ -0,0 +1,17 @@
+import HostCatalogAbility from 'api/abilities/host-catalog';
+
+export default class OverrideHostCatalogAbility extends HostCatalogAbility {
+  /**
+   * Navigating to a resource is allowed if either list or create grants
+   * are present, except in the following case.  Navigating to hosts directly
+   * from a dynamic host catalog is not allowed, since this might present more
+   * hosts than is practical or useful.
+   * @type {boolean}
+   */
+  get canNavigate() {
+    const { isPlugin } = this.model;
+    const isHostsCollection = this.collection === 'hosts';
+    const isDynamicHostsNavigation = isPlugin && isHostsCollection;
+    return !isDynamicHostsNavigation && (this.canList || this.canCreate);
+  }
+}
diff --git a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs
index d16d10efb..8feffd7dd 100644
--- a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs
+++ b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs
@@ -2,12 +2,12 @@
   <nav.link @route='scopes.scope.host-catalogs.host-catalog.index'>
     {{t 'titles.details'}}
   </nav.link>
-  {{#if (can 'navigate model' @model collection='hosts')}}
+  {{#if (can 'navigate host-catalog' @model collection='hosts')}}
     <nav.link @route='scopes.scope.host-catalogs.host-catalog.hosts'>
       {{t 'resources.host.title_plural'}}
     </nav.link>
   {{/if}}
-  {{#if (can 'navigate model' @model collection='host-sets')}}
+  {{#if (can 'navigate host-catalog' @model collection='host-sets')}}
     <nav.link @route='scopes.scope.host-catalogs.host-catalog.host-sets'>
       {{t 'resources.host-set.title_plural'}}
     </nav.link>