Even if vm is locked, or owner currently has no rights to manage/admin or even use(by lock) the VM, user can schedule action, e.g. resume, and turn his vm on.
Steps:
Lock VM
login as user
schedule action, like resume
wait
vm is going to be resumed
Expected: nothing should happen or/and action should have message, like cannot resume vm, because it’s locked/user has no rights [manage]