diff --git a/addons/api/mirage/factories/scope.js b/addons/api/mirage/factories/scope.js
index e9c5ac09f..afe31e5cd 100644
--- a/addons/api/mirage/factories/scope.js
+++ b/addons/api/mirage/factories/scope.js
@@ -10,7 +10,7 @@ export default factory.extend({
       // groups: ['create', 'list'],
       // roles: ['create', 'list'],
       // 'auth-methods': ['create', 'list'],
-      // sessopms: ['list'],
+      sessions: ['list'],
       // targets: ['create', 'list'],
       // 'host-catalogs': ['create', 'list'],
       // 'credential-stores': ['create', 'list'],
diff --git a/ui/admin/app/templates/scopes/scope.hbs b/ui/admin/app/templates/scopes/scope.hbs
index fd20ca2a2..c0cb0dca7 100644
--- a/ui/admin/app/templates/scopes/scope.hbs
+++ b/ui/admin/app/templates/scopes/scope.hbs
@@ -71,10 +71,12 @@
         </Rose::Nav::Sidebar>
         --}}
         <Rose::Nav::Sidebar @title={{t 'titles.resources'}} as |nav|>
-          <nav.link @route='scopes.scope.sessions'>
-            <Rose::Icon @name='app-icons/action-session' @size='medium' />
-            {{t 'resources.session.title_plural'}}
-          </nav.link>
+          {{#if (can 'navigate collection' @model collection='sessions')}}
+            <nav.link @route='scopes.scope.sessions'>
+              <Rose::Icon @name='app-icons/action-session' @size='medium' />
+              {{t 'resources.session.title_plural'}}
+            </nav.link>
+          {{/if}}
           <nav.link @route='scopes.scope.targets'>
             <Rose::Icon @name='app-icons/target' @size='medium' />
             {{t 'resources.target.title_plural'}}
diff --git a/ui/admin/jsconfig.json b/ui/admin/jsconfig.json
new file mode 100644
index 000000000..f408cac8c
--- /dev/null
+++ b/ui/admin/jsconfig.json
@@ -0,0 +1 @@
+{"compilerOptions":{"target":"es6","experimentalDecorators":true},"exclude":["node_modules","bower_components","tmp","vendor",".git","dist"]}
\ No newline at end of file
diff --git a/ui/admin/tests/acceptance/sessions-test.js b/ui/admin/tests/acceptance/sessions-test.js
index d5f68ffeb..a5dfa25ff 100644
--- a/ui/admin/tests/acceptance/sessions-test.js
+++ b/ui/admin/tests/acceptance/sessions-test.js
@@ -15,13 +15,13 @@ import {
 module('Acceptance | sessions', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
-
   const instances = {
     scopes: {
       global: null,
       org: null,
     },
     sessions: null,
+    orgScope: null,
   };
   const urls = {
     orgScope: null,
@@ -31,6 +31,14 @@ module('Acceptance | sessions', function (hooks) {
   hooks.beforeEach(function () {
     authenticateSession({});
     instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
     instances.scopes.org = this.server.create('scope', {
       type: 'org',
       scope: { id: 'global', type: 'global' },
@@ -66,6 +74,7 @@ module('Acceptance | sessions', function (hooks) {
       },
       'withAssociations'
     );
+    urls.orgScope = `/scopes/${instances.scopes.project.id}`;
     urls.sessions = `/scopes/${instances.scopes.project.id}/sessions`;
   });
 
@@ -81,6 +90,38 @@ module('Acceptance | sessions', function (hooks) {
     await visit(urls.sessions);
   });
 
+  test('Users cannot navigate to sessions without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions.sessions = [];
+    authenticateSession({});
+    later(async () => {
+      run.cancelTimers();
+      assert.notOk(
+        instances.scopes.project.authorized_collection_actions.sessions.includes(
+          'list'
+        )
+      );
+      assert.notOk(find(`[href="${urls.sessions}"]`));
+    }, 750);
+    await visit(urls.orgScope);
+  });
+
+  test('Users can navigate to sessions with proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions.sessions = ['list'];
+    authenticateSession({});
+    later(async () => {
+      run.cancelTimers();
+      assert.ok(
+        instances.scopes.project.authorized_collection_actions.sessions.includes(
+          'list'
+        )
+      );
+      assert.ok(find(`[href="${urls.sessions}"]`));
+    }, 750);
+    await visit(urls.orgScope);
+  });
+
   test('visiting sessions without users or targets is OK', async function (assert) {
     assert.expect(2);
     instances.sessions[0].update({