rmeyer,
As I noted in my original post, the issue was that some users could provision and others could not, even though we had assigned all of them the same roles, scopes and permissions.
The affected users already did have Bare Metal Devices as a scope for their accounts.
For the heck of it, I removed Bare Metal Device scope from their account, re-added it and had them log back into the console to reset their user profile.
I'm not sure exactly why it didn't work initially for them, but now they are able to Provision without any problems.
So, it clearly was related to Bare Metal Devices and it seems that the permission didn't somehow "stick" when we first created their accounts.
In any event, all set now and I appreciate the feedback.
Thanks.