For multiibranch projects we use the role-strategy plugin to grant a group of users read-only access for the entire project, and build permissions for certain branches (PR-* pull request branches) so they can rerun failed builds for their pull requests.

When viewing the run details in Blue Ocean, this group of users cannot see the replay button on builds for which they have build permissions. It appears the RunDetails react component is checking permissions against the pipeline (which they have default read-only permissions) and not the specific branch/build.