diff --git a/ui/admin/app/abilities/host-catalog.js b/ui/admin/app/abilities/host-catalog.js
new file mode 100644
index 000000000..9c6805a8a
--- /dev/null
+++ b/ui/admin/app/abilities/host-catalog.js
@@ -0,0 +1,17 @@
+import HostCatalogAbility from 'api/abilities/host-catalog';
+
+export default class OverrideHostCatalogAbility extends HostCatalogAbility {
+  /**
+   * Navigating to a resource is allowed if either list or create grants
+   * are present, except in the following case.  Navigating to hosts directly
+   * from a dynamic host catalog is not allowed, since this might present more
+   * hosts than is practical or useful.
+   * @type {boolean}
+   */
+  get canNavigate() {
+    const { isPlugin } = this.model;
+    const isHostsCollection = this.collection === 'hosts';
+    const isDynamicHostsNavigation = isPlugin && isHostsCollection;
+    return !isDynamicHostsNavigation && (this.canList || this.canCreate);
+  }
+}
diff --git a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs
index d16d10efb..8feffd7dd 100644
--- a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs
+++ b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs
@@ -2,12 +2,12 @@
   <nav.link @route='scopes.scope.host-catalogs.host-catalog.index'>
     {{t 'titles.details'}}
   </nav.link>
-  {{#if (can 'navigate model' @model collection='hosts')}}
+  {{#if (can 'navigate host-catalog' @model collection='hosts')}}
     <nav.link @route='scopes.scope.host-catalogs.host-catalog.hosts'>
       {{t 'resources.host.title_plural'}}
     </nav.link>
   {{/if}}
-  {{#if (can 'navigate model' @model collection='host-sets')}}
+  {{#if (can 'navigate host-catalog' @model collection='host-sets')}}
     <nav.link @route='scopes.scope.host-catalogs.host-catalog.host-sets'>
       {{t 'resources.host-set.title_plural'}}
     </nav.link>