diff --git a/addons/api/addon/abilities/target.js b/addons/api/addon/abilities/target.js
index 977266d63..fb6b30d33 100644
--- a/addons/api/addon/abilities/target.js
+++ b/addons/api/addon/abilities/target.js
@@ -13,6 +13,13 @@ export default class TargetAbility extends ModelAbility {
     return this.hasAuthorizedAction('authorize-session');
   }
 
+  /**
+   * @type {boolean}
+   */
+  get canAddHostSources() {
+    return this.hasAuthorizedAction('add-host-sources');
+  }
+
   /**
    * @type {boolean}
    */
@@ -20,6 +27,13 @@ export default class TargetAbility extends ModelAbility {
     return this.hasAuthorizedAction('remove-host-sources');
   }
 
+  /**
+   * @type {boolean}
+   */
+  get canAddCredentialSources() {
+    return this.hasAuthorizedAction('add-credential-sources');
+  }
+
   /**
    * @type {boolean}
    */
diff --git a/addons/api/mirage/factories/target.js b/addons/api/mirage/factories/target.js
index 7f093115d..6056352d7 100644
--- a/addons/api/mirage/factories/target.js
+++ b/addons/api/mirage/factories/target.js
@@ -15,10 +15,8 @@ export default factory.extend({
       'delete',
       'authorize-session',
       'add-host-sources',
-      'set-host-sources',
       'remove-host-sources',
       'add-credential-sources',
-      'set-credential-sources',
       'remove-credential-sources',
     ],
 
diff --git a/addons/api/tests/unit/abilities/target-test.js b/addons/api/tests/unit/abilities/target-test.js
index 4fe4dc23d..bbba31cd8 100644
--- a/addons/api/tests/unit/abilities/target-test.js
+++ b/addons/api/tests/unit/abilities/target-test.js
@@ -15,6 +15,17 @@ module('Unit | Abilities | Target', function (hooks) {
     assert.notOk(service.can('connect target', model));
   });
 
+  test('it reflects when a given target may add host sources', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['add-host-sources'],
+    };
+    assert.ok(service.can('addHostSources target', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('addHostSources target', model));
+  });
+
   test('it reflects when a given target may remove host sources', function (assert) {
     assert.expect(2);
     const service = this.owner.lookup('service:can');
@@ -26,6 +37,17 @@ module('Unit | Abilities | Target', function (hooks) {
     assert.notOk(service.can('removeHostSources target', model));
   });
 
+  test('it reflects when a given target may add crednetial sources', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['add-credential-sources'],
+    };
+    assert.ok(service.can('addCredentialSources target', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('addCredentialSources target', model));
+  });
+
   test('it reflects when a given target may remove crednetial sources', function (assert) {
     assert.expect(2);
     const service = this.owner.lookup('service:can');
diff --git a/ui/admin/app/templates/scopes/scope/targets/target/-actions.hbs b/ui/admin/app/templates/scopes/scope/targets/target/-actions.hbs
index 3e32c0848..064bdff34 100644
--- a/ui/admin/app/templates/scopes/scope/targets/target/-actions.hbs
+++ b/ui/admin/app/templates/scopes/scope/targets/target/-actions.hbs
@@ -3,14 +3,20 @@
   @dropdownRight={{true}}
   as |dropdown|
 >
-  <dropdown.link @route='scopes.scope.targets.target.add-host-sources'>
-    {{t 'resources.target.actions.add-host-sources'}}
-  </dropdown.link>
-  {{#if (feature-flag 'credential-store')}}
-    <dropdown.link @route='scopes.scope.targets.target.add-credential-sources'>
-      {{t 'resources.target.actions.add-credential-sources'}}
+  {{#if (can 'addHostSources target' @model)}}
+    <dropdown.link @route='scopes.scope.targets.target.add-host-sources'>
+      {{t 'resources.target.actions.add-host-sources'}}
     </dropdown.link>
   {{/if}}
+  {{#if (feature-flag 'credential-store')}}
+    {{#if (can 'addCredentialSources target' @model)}}
+      <dropdown.link
+        @route='scopes.scope.targets.target.add-credential-sources'
+      >
+        {{t 'resources.target.actions.add-credential-sources'}}
+      </dropdown.link>
+    {{/if}}
+  {{/if}}
   {{#if (can 'delete model' @model)}}
     <dropdown.separator />
     <dropdown.button
diff --git a/ui/admin/tests/acceptance/targets/credential-sources-test.js b/ui/admin/tests/acceptance/targets/credential-sources-test.js
index 9402006d1..902ce67a8 100644
--- a/ui/admin/tests/acceptance/targets/credential-sources-test.js
+++ b/ui/admin/tests/acceptance/targets/credential-sources-test.js
@@ -117,6 +117,16 @@ module('Acceptance | targets | credential-libraries', function (hooks) {
     assert.equal(findAll('tbody tr').length, 1);
   });
 
+  test('cannot add credential sources without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.target.authorized_actions =
+      instances.target.authorized_actions.filter(
+        (item) => item !== 'add-credential-sources'
+      );
+    await visit(urls.credentialSources);
+    assert.notOk(find(`[href="${urls.addCredentialSources}"]`));
+  });
+
   test('can select and cancel credential sources to add', async function (assert) {
     assert.expect(4);
     instances.target.update({ credentialLibraries: [] });
diff --git a/ui/admin/tests/acceptance/targets/host-sources-test.js b/ui/admin/tests/acceptance/targets/host-sources-test.js
index 93a6b166e..a1abc9e72 100644
--- a/ui/admin/tests/acceptance/targets/host-sources-test.js
+++ b/ui/admin/tests/acceptance/targets/host-sources-test.js
@@ -131,6 +131,16 @@ module('Acceptance | targets | host-sources', function (hooks) {
     assert.equal(findAll('tbody tr').length, 1);
   });
 
+  test('cannot add host sources without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.target.authorized_actions =
+      instances.target.authorized_actions.filter(
+        (item) => item !== 'add-host-sources'
+      );
+    await visit(urls.targetHostSources);
+    assert.notOk(find(`[href="${urls.addHostSources}"]`));
+  });
+
   test('select and cancel host sets to add', async function (assert) {
     assert.expect(4);
     const targetHostSetCount = instances.target.hostSets.length;