I defined a role with the permissions mentioned in README.md. This worked for a while (at least with Satellite 6.3, I observe the issue with 6.4 and 6.5). katello-attach-subscription searches for hypervisors by leverating /api/organizations/1/hosts?search=hypervisor%3Dtrue. This returns an emtpy result when the user only has the described permissions:

{
  "total": 0,
  "subtotal": 0,
  "page": 1,
  "per_page": 50,
  "search": "hypervisor=true",
  "sort": {
    "by": null,
    "order": null
  },
  "results": []
}

This call works with full (Admin) permissions though. The search term hypervisor = true works in the UI with limited permissions, but the UI uses /api/hosts?search=hypervisor%3Dtrue&page=1 (no /organizations/1):

{
  "total": 24,
  "subtotal": 4,
  "page": 1,
  "per_page": 50,
  "search": "hypervisor=true",
  "sort": {
    "by": null,
    "order": null
  },
  "results": [
//elements removed in this example
]

The missing hypervisor list leads doesn't allow kas to attach subscriptions because it is not aware of any hypervisor.

Searching for Hypervisors
Completed hypervisor collection.
Hypervisors entry: 0