In order that users can launch an Application in a Cloud Resource Zone, it is sufficient to have the Zone User role assigned to them. It is not necessary for them to also have the Application User role assigned.
This isn't the correct wording. I'll open another bug.