diff --git a/addons/api/mirage/factories/host-catalog.js b/addons/api/mirage/factories/host-catalog.js
index b01ffc065..c08d2786a 100644
--- a/addons/api/mirage/factories/host-catalog.js
+++ b/addons/api/mirage/factories/host-catalog.js
@@ -13,6 +13,7 @@ export default factory.extend({
   authorized_collection_actions: () => {
     return {
       hosts: ['create', 'list'],
+      'host-sets': ['create', 'list'],
     };
   },
   withChildren: trait({
diff --git a/addons/api/mirage/factories/scope.js b/addons/api/mirage/factories/scope.js
index d67c66456..edd0aeb11 100644
--- a/addons/api/mirage/factories/scope.js
+++ b/addons/api/mirage/factories/scope.js
@@ -1,9 +1,18 @@
 import factory from '../generated/factories/scope';
 import { trait } from 'ember-cli-mirage';
+import permissions from '../helpers/permissions';
 
 export default factory.extend({
   type: 'global',
 
+  authorized_actions: () =>
+    permissions.authorizedActionsFor('scope') || [
+      'no-op',
+      'read',
+      'update',
+      'delete',
+    ],
+
   authorized_collection_actions: () => {
     return {
       users: ['create', 'list'],
@@ -11,11 +20,9 @@ export default factory.extend({
       groups: ['create', 'list'],
       roles: ['create', 'list'],
       targets: ['create', 'list'],
-      // 'auth-methods': ['create', 'list'],
-      // sessopms: ['list'],
+      'credential-stores': ['create', 'list'],
       'auth-methods': ['create', 'list'],
       'host-catalogs': ['create', 'list'],
-      // 'credential-stores': ['create', 'list'],
     };
   },
 
diff --git a/addons/core/translations/resources/en-us.yaml b/addons/core/translations/resources/en-us.yaml
index 52bd07d03..4d373e26d 100644
--- a/addons/core/translations/resources/en-us.yaml
+++ b/addons/core/translations/resources/en-us.yaml
@@ -346,3 +346,8 @@ credential-library:
       help: The body of the HTTP request the library sends to Vault when requesting credentials. Only allowed when HTTP method is set to POST.
   types:
     vault: Vault
+scope:
+  title: Scope
+  title_plural: Scopes
+  messages:
+    cannot_read: While you do not have permission to read this scope, you may have permission to view resources within it.
diff --git a/ui/admin/app/components/form/scope/index.hbs b/ui/admin/app/components/form/scope/index.hbs
index a0c3230ef..d86d409b3 100644
--- a/ui/admin/app/components/form/scope/index.hbs
+++ b/ui/admin/app/components/form/scope/index.hbs
@@ -46,11 +46,13 @@
     {{/if}}
   </form.textarea>
 
-  <form.actions
-    @disabled={{if @model.cannotSave @model.cannotSave}}
-    @enableEditText={{t 'actions.edit-form'}}
-    @submitText={{t 'actions.save'}}
-    @cancelText={{t 'actions.cancel'}}
-  />
+  {{#if (can 'save model' @model)}}
+    <form.actions
+      @disabled={{if @model.cannotSave @model.cannotSave}}
+      @enableEditText={{t 'actions.edit-form'}}
+      @submitText={{t 'actions.save'}}
+      @cancelText={{t 'actions.cancel'}}
+    />
+  {{/if}}
 
 </Rose::Form>
\ No newline at end of file
diff --git a/ui/admin/app/routes/scopes/scope/credential-stores.js b/ui/admin/app/routes/scopes/scope/credential-stores.js
index 8bfce1b1d..d49379fcf 100644
--- a/ui/admin/app/routes/scopes/scope/credential-stores.js
+++ b/ui/admin/app/routes/scopes/scope/credential-stores.js
@@ -1,4 +1,5 @@
 import Route from '@ember/routing/route';
+import { inject as service } from '@ember/service';
 import { action } from '@ember/object';
 import loading from 'ember-loading/decorator';
 import { confirm } from 'core/decorators/confirm';
@@ -6,14 +7,21 @@ import { notifySuccess, notifyError } from 'core/decorators/notify';
 
 export default class ScopesScopeCredentialStoresRoute extends Route {
   // =methods
-
+  @service can;
   /**
    * Load all credential stores under current scope
    * @returns {Promise[CredentialStoreModel]}
    */
   async model() {
-    const { id: scope_id } = this.modelFor('scopes.scope');
-    return this.store.query('credential-store', { scope_id });
+    const scope = this.modelFor('scopes.scope');
+    const { id: scope_id } = scope;
+    if (
+      this.can.can('list collection', scope, {
+        collection: 'credential-stores',
+      })
+    ) {
+      return this.store.query('credential-store', { scope_id });
+    }
   }
 
   // =actions
diff --git a/ui/admin/app/routes/scopes/scope/credential-stores/index.js b/ui/admin/app/routes/scopes/scope/credential-stores/index.js
index 99ced4658..57fea4b74 100644
--- a/ui/admin/app/routes/scopes/scope/credential-stores/index.js
+++ b/ui/admin/app/routes/scopes/scope/credential-stores/index.js
@@ -1,3 +1,10 @@
 import Route from '@ember/routing/route';
+export default class ScopesScopeCredentialStoresIndexRoute extends Route {
+  // =methods
 
-export default class ScopesScopeCredentialStoresIndexRoute extends Route {}
+  setupController(controller) {
+    const scope = this.modelFor('scopes.scope');
+    super.setupController(...arguments);
+    controller.setProperties({ scope });
+  }
+}
diff --git a/ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets.js b/ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets.js
index beb0aa93a..36d341bc4 100644
--- a/ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets.js
+++ b/ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets.js
@@ -10,7 +10,7 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsRoute extends Rou
 
   @service intl;
   @service notify;
-
+  @service can;
   // =methods
 
   /**
@@ -18,10 +18,18 @@ export default class ScopesScopeHostCatalogsHostCatalogHostSetsRoute extends Rou
    * @return {Promise{[HostSetModel]}}
    */
   model() {
-    const { id: host_catalog_id } = this.modelFor(
+    const hostCatalog = this.modelFor(
       'scopes.scope.host-catalogs.host-catalog'
     );
-    return this.store.query('host-set', { host_catalog_id });
+
+    const { id: host_catalog_id } = hostCatalog;
+    if (
+      this.can.can('list collection', hostCatalog, {
+        collection: 'host-sets',
+      })
+    ) {
+      return this.store.query('host-set', { host_catalog_id });
+    }
   }
 
   // =actions
diff --git a/ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets/index.js b/ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets/index.js
index e62c9f95e..1f49ad3af 100644
--- a/ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets/index.js
+++ b/ui/admin/app/routes/scopes/scope/host-catalogs/host-catalog/host-sets/index.js
@@ -1,3 +1,11 @@
 import Route from '@ember/routing/route';
-
-export default class ScopesScopeHostCatalogsHostCatalogHostSetsIndexRoute extends Route {}
+export default class ScopesScopeHostCatalogsHostCatalogHostSetsIndexRoute extends Route {
+  // =methods
+  setupController(controller) {
+    const hostCatalog = this.modelFor(
+      'scopes.scope.host-catalogs.host-catalog'
+    );
+    super.setupController(...arguments);
+    controller.setProperties({ hostCatalog });
+  }
+}
diff --git a/ui/admin/app/templates/scopes/scope.hbs b/ui/admin/app/templates/scopes/scope.hbs
index 60011d064..ea4ad5347 100644
--- a/ui/admin/app/templates/scopes/scope.hbs
+++ b/ui/admin/app/templates/scopes/scope.hbs
@@ -73,7 +73,7 @@
         <Rose::Nav::Sidebar @title={{t 'titles.resources'}} as |nav|>
           {{#if (can 'navigate collection' @model collection='sessions')}}
             <nav.link @route='scopes.scope.sessions'>
-              <Rose::Icon @name='app-icons/action-session' @size='medium' />
+              <Rose::Icon @name='flight-icons/entry-point-16' @size='medium' />
               {{t 'resources.session.title_plural'}}
             </nav.link>
           {{/if}}
@@ -89,11 +89,15 @@
               {{t 'resources.host-catalog.title_plural'}}
             </nav.link>
           {{/if}}
-          {{#if (feature-flag 'credential-store')}}
-            <nav.link @route='scopes.scope.credential-stores'>
-              <Rose::Icon @name='flight-icons/key-16' @size='medium' />
-              {{t 'resources.credential-store.title_plural'}}
-            </nav.link>
+          {{#if
+            (can 'navigate collection' @model collection='credential-stores')
+          }}
+            {{#if (feature-flag 'credential-store')}}
+              <nav.link @route='scopes.scope.credential-stores'>
+                <Rose::Icon @name='flight-icons/key-16' @size='medium' />
+                {{t 'resources.credential-store.title_plural'}}
+              </nav.link>
+            {{/if}}
           {{/if}}
         </Rose::Nav::Sidebar>
       {{/if}}
diff --git a/ui/admin/app/templates/scopes/scope/credential-stores/index.hbs b/ui/admin/app/templates/scopes/scope/credential-stores/index.hbs
index d59f3c41e..8c7a002d0 100644
--- a/ui/admin/app/templates/scopes/scope/credential-stores/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/credential-stores/index.hbs
@@ -14,13 +14,16 @@
   </page.header>
 
   <page.actions>
-    {{#if @model}}
-      <Rose::LinkButton
-        @route='scopes.scope.credential-stores.new'
-        @style='primary'
-      >
-        {{t 'titles.new'}}
-      </Rose::LinkButton>
+
+    {{#if (can 'create collection' this.scope collection='credential-stores')}}
+      {{#if @model}}
+        <Rose::LinkButton
+          @route='scopes.scope.credential-stores.new'
+          @style='primary'
+        >
+          {{t 'titles.new'}}
+        </Rose::LinkButton>
+      {{/if}}
     {{/if}}
   </page.actions>
 
@@ -79,12 +82,35 @@
           as |message|
         >
           <message.description>
-            {{t 'resources.credential-store.description'}}
+            {{#if
+              (can 'list collection' this.scope collection='credential-stores')
+            }}
+              {{! can list (at least):  show default welcome message}}
+              {{t 'resources.credential-store.description'}}
+            {{else if (can
+              'create collection' this.scope collection='credential-stores'
+            )}}
+              {{! can create (only):  show create-but-not-list welcome message}}
+              {{t
+                'descriptions.create-but-not-list'
+                resource=(t 'resources.credential-store.title_plural')
+              }}
+            {{else}}
+              {{! can neither list nor create }}
+              {{t
+                'descriptions.neither-list-nor-create'
+                resource=(t 'resources.user.title_plural')
+              }}
+            {{/if}}
           </message.description>
-          <message.link @route='scopes.scope.credential-stores.new'>
-            <Rose::Icon @name='flight-icons/plus-circle-16' />
-            {{t 'titles.new'}}
-          </message.link>
+          {{#if
+            (can 'create collection' this.scope collection='credential-stores')
+          }}
+            <message.link @route='scopes.scope.credential-stores.new'>
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
+              {{t 'titles.new'}}
+            </message.link>
+          {{/if}}
         </Rose::Message>
       </Rose::Layout::Centered>
 
diff --git a/ui/admin/app/templates/scopes/scope/edit.hbs b/ui/admin/app/templates/scopes/scope/edit.hbs
index 9e3898e0f..d8f6dc683 100644
--- a/ui/admin/app/templates/scopes/scope/edit.hbs
+++ b/ui/admin/app/templates/scopes/scope/edit.hbs
@@ -28,40 +28,54 @@
     </Copyable>
   </page.header>
 
-  <page.navigation>
-    <Rose::Nav::Tabs as |nav|>
-      <nav.link @route='scopes.scope'>
-        {{t 'titles.details'}}
-      </nav.link>
-    </Rose::Nav::Tabs>
-  </page.navigation>
+  {{#if (can 'read model' @model)}}
+    <page.navigation>
+      <Rose::Nav::Tabs as |nav|>
+        <nav.link @route='scopes.scope'>
+          {{t 'titles.details'}}
+        </nav.link>
+      </Rose::Nav::Tabs>
+    </page.navigation>
+  {{/if}}
 
-  <page.actions>
-    <Rose::Dropdown
-      @text='{{t 'actions.manage'}}'
-      @dropdownRight={{true}}
-      as |dropdown|
-    >
-      <dropdown.button
-        @style='danger'
-        @disabled={{@model.canSave}}
-        {{on 'click' (route-action 'delete' @model)}}
+  {{#if (can 'delete model' @model)}}
+    <page.actions>
+      <Rose::Dropdown
+        @text='{{t 'actions.manage'}}'
+        @dropdownRight={{true}}
+        as |dropdown|
       >
-        {{#if @model.isOrg}}
-          {{t 'resources.org.actions.delete'}}
-        {{else}}
-          {{t 'resources.project.actions.delete'}}
-        {{/if}}
-      </dropdown.button>
-    </Rose::Dropdown>
-  </page.actions>
+        <dropdown.button
+          @style='danger'
+          @disabled={{@model.canSave}}
+          {{on 'click' (route-action 'delete' @model)}}
+        >
+          {{#if @model.isOrg}}
+            {{t 'resources.org.actions.delete'}}
+          {{else}}
+            {{t 'resources.project.actions.delete'}}
+          {{/if}}
+        </dropdown.button>
+      </Rose::Dropdown>
+    </page.actions>
+  {{/if}}
 
   <page.body>
-    <Form::Scope
-      @model={{@model}}
-      @submit={{route-action 'save' @model}}
-      @cancel={{route-action 'cancel' @model}}
-    />
+    {{#if (can 'read model' @model)}}
+      <Form::Scope
+        @model={{@model}}
+        @submit={{route-action 'save' @model}}
+        @cancel={{route-action 'cancel' @model}}
+      />
+    {{else}}
+      <Rose::Layout::Centered>
+        <Rose::Message as |message|>
+          <message.description>
+            {{t 'resources.scope.messages.cannot_read'}}
+          </message.description>
+        </Rose::Message>
+      </Rose::Layout::Centered>
+    {{/if}}
   </page.body>
 
 </Rose::Layout::Page>
\ No newline at end of file
diff --git a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-actions.hbs b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-actions.hbs
index 4f70d7987..696c9e35e 100644
--- a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-actions.hbs
+++ b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-actions.hbs
@@ -4,7 +4,6 @@
   as |dropdown|
 >
   {{#if (can 'create collection' @model collection='hosts')}}
-
     <dropdown.link
       @route='scopes.scope.host-catalogs.host-catalog.hosts.new'
       @model={{@model}}
@@ -12,12 +11,14 @@
       {{t 'resources.host.actions.create'}}
     </dropdown.link>
   {{/if}}
-  <dropdown.link
-    @route='scopes.scope.host-catalogs.host-catalog.host-sets.new'
-    @model={{@model}}
-  >
-    {{t 'resources.host-set.actions.create'}}
-  </dropdown.link>
+  {{#if (can 'create collection' @model collection='host-sets')}}
+    <dropdown.link
+      @route='scopes.scope.host-catalogs.host-catalog.host-sets.new'
+      @model={{@model}}
+    >
+      {{t 'resources.host-set.actions.create'}}
+    </dropdown.link>
+  {{/if}}
   {{#if (can 'delete model' @model)}}
     <dropdown.separator />
     <dropdown.button
diff --git a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs
index 3a532ec9c..e9b06a636 100644
--- a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs
+++ b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/-navigation.hbs
@@ -2,14 +2,14 @@
   <nav.link @route='scopes.scope.host-catalogs.host-catalog.index'>
     {{t 'titles.details'}}
   </nav.link>
-
   {{#if (can 'navigate collection' @model collection='hosts')}}
-
     <nav.link @route='scopes.scope.host-catalogs.host-catalog.hosts'>
       {{t 'resources.host.title_plural'}}
     </nav.link>
   {{/if}}
-  <nav.link @route='scopes.scope.host-catalogs.host-catalog.host-sets'>
-    {{t 'resources.host-set.title_plural'}}
-  </nav.link>
+  {{#if (can 'navigate collection' @model collection='host-sets')}}
+    <nav.link @route='scopes.scope.host-catalogs.host-catalog.host-sets'>
+      {{t 'resources.host-set.title_plural'}}
+    </nav.link>
+  {{/if}}
 </Rose::Nav::Tabs>
\ No newline at end of file
diff --git a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/host-sets/index.hbs b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/host-sets/index.hbs
index 1b0a18cb8..c814c749e 100644
--- a/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/host-sets/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/host-catalogs/host-catalog/host-sets/index.hbs
@@ -51,14 +51,36 @@
       as |message|
     >
       <message.description>
-        {{t 'resources.host-set.description'}}
+
+        {{#if (can 'list collection' this.hostCatalog collection='host-sets')}}
+          {{! can list (at least):  show default welcome message}}
+          {{t 'resources.host-set.description'}}
+
+        {{else if (can
+          'create collection' this.hostCatalog collection='host-sets'
+        )}}
+          {{! can create (only):  show create-but-not-list welcome message}}
+          {{t
+            'descriptions.create-but-not-list'
+            resource=(t 'resources.host-set.title_plural')
+          }}
+        {{else}}
+          {{! can neither list nor create }}
+          {{t
+            'descriptions.neither-list-nor-create'
+            resource=(t 'resources.host-set.title_plural')
+          }}
+        {{/if}}
       </message.description>
-      <message.link
-        @route='scopes.scope.host-catalogs.host-catalog.host-sets.new'
-      >
-        <Rose::Icon @name='flight-icons/plus-circle-16' />
-        {{t 'titles.new'}}
-      </message.link>
+
+      {{#if (can 'create collection' this.hostCatalog collection='host-sets')}}
+        <message.link
+          @route='scopes.scope.host-catalogs.host-catalog.host-sets.new'
+        >
+          <Rose::Icon @name='flight-icons/plus-circle-16' />
+          {{t 'titles.new'}}
+        </message.link>
+      {{/if}}
     </Rose::Message>
   </Rose::Layout::Centered>
 
diff --git a/ui/admin/tests/acceptance/credential-stores-test.js b/ui/admin/tests/acceptance/credential-store/create-test.js
similarity index 82%
rename from ui/admin/tests/acceptance/credential-stores-test.js
rename to ui/admin/tests/acceptance/credential-store/create-test.js
index 54764b5a3..e651a641b 100644
--- a/ui/admin/tests/acceptance/credential-stores-test.js
+++ b/ui/admin/tests/acceptance/credential-store/create-test.js
@@ -5,7 +5,7 @@ import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
 import { authenticateSession } from 'ember-simple-auth/test-support';
 import { Response } from 'miragejs';
 
-module('Acceptance | credential-stores', function (hooks) {
+module('Acceptance | credential-stores | create', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
@@ -21,7 +21,6 @@ module('Acceptance | credential-stores', function (hooks) {
 
   const urls = {
     globalScope: null,
-    orgScope: null,
     projectScope: null,
     credentialStores: null,
     credentialStore: null,
@@ -45,7 +44,6 @@ module('Acceptance | credential-stores', function (hooks) {
     });
     // Generate route URLs for resources
     urls.globalScope = `/scopes/global/scopes`;
-    urls.orgScope = `/scopes/${instances.scopes.org.id}/scopes`;
     urls.projectScope = `/scopes/${instances.scopes.project.id}`;
     urls.credentialStores = `${urls.projectScope}/credential-stores`;
     urls.credentialStore = `${urls.credentialStores}/${instances.credentialStore.id}`;
@@ -58,7 +56,7 @@ module('Acceptance | credential-stores', function (hooks) {
     authenticateSession({});
   });
 
-  test('can create a new credential stores', async function (assert) {
+  test('Users can create a new credential stores', async function (assert) {
     assert.expect(1);
     const count = getCredentialStoresCount();
     await visit(urls.newCredentialStore);
@@ -67,7 +65,7 @@ module('Acceptance | credential-stores', function (hooks) {
     assert.equal(getCredentialStoresCount(), count + 1);
   });
 
-  test('can cancel create new credential stores', async function (assert) {
+  test('Users can cancel create new credential stores', async function (assert) {
     assert.expect(2);
     const count = getCredentialStoresCount();
     await visit(urls.newCredentialStore);
@@ -77,6 +75,20 @@ module('Acceptance | credential-stores', function (hooks) {
     assert.equal(getCredentialStoresCount(), count);
   });
 
+  test('Users cannot navigate to new credential stores route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions[
+      'credential-stores'
+    ] = [];
+    await visit(urls.projectScope);
+    assert.notOk(
+      instances.scopes.project.authorized_collection_actions[
+        'credential-stores'
+      ].includes('create')
+    );
+    assert.notOk(find(`[href="${urls.credentialStores}"]`));
+  });
+
   test('saving a new credential store with invalid fields displays error messages', async function (assert) {
     assert.expect(2);
     this.server.post('/credential-stores', () => {
diff --git a/ui/admin/tests/acceptance/credential-store/list-test.js b/ui/admin/tests/acceptance/credential-store/list-test.js
new file mode 100644
index 000000000..e4d6cda15
--- /dev/null
+++ b/ui/admin/tests/acceptance/credential-store/list-test.js
@@ -0,0 +1,84 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | credential-stores | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+      project: null,
+    },
+  };
+
+  const urls = {
+    scopes: {
+      org: null,
+    },
+    projectScope: null,
+    credentialStores: null,
+    credentialStore: null,
+  };
+
+  hooks.beforeEach(function () {
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.scopes.project = this.server.create('scope', {
+      type: 'project',
+      scope: { id: instances.scopes.org.id, type: 'org' },
+    });
+    instances.credentialStore = this.server.create('credential-store', {
+      scope: instances.scopes.project,
+    });
+    urls.projectScope = `/scopes/${instances.scopes.project.id}`;
+    urls.credentialStores = `${urls.projectScope}/credential-stores`;
+    authenticateSession({});
+  });
+
+  test('Users can navigate to credential-stores with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.projectScope);
+    assert.ok(
+      instances.scopes.project.authorized_collection_actions[
+        'credential-stores'
+      ].includes('list')
+    );
+    assert.ok(find(`[href="${urls.credentialStores}"]`));
+  });
+
+  test('Users cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions[
+      'credential-stores'
+    ] = [];
+    await visit(urls.projectScope);
+    assert.notOk(
+      instances.scopes.project.authorized_collection_actions[
+        'credential-stores'
+      ].includes('list')
+    );
+    assert.notOk(find(`[href="${urls.credentialStores}"]`));
+  });
+
+  test('Users can navigate to index with only create action', async function (assert) {
+    assert.expect(1);
+    instances.scopes.project.authorized_collection_actions[
+      'credential-stores'
+    ] = ['create'];
+    await visit(urls.projectScope);
+    assert.ok(find(`[href="${urls.credentialStores}"]`));
+  });
+});
diff --git a/ui/admin/tests/acceptance/host-catalogs/host-sets-test.js b/ui/admin/tests/acceptance/host-catalogs/host-sets/create-test.js
similarity index 78%
rename from ui/admin/tests/acceptance/host-catalogs/host-sets-test.js
rename to ui/admin/tests/acceptance/host-catalogs/host-sets/create-test.js
index 33465e7ce..a7ede23ed 100644
--- a/ui/admin/tests/acceptance/host-catalogs/host-sets-test.js
+++ b/ui/admin/tests/acceptance/host-catalogs/host-sets/create-test.js
@@ -10,7 +10,7 @@ import {
   //invalidateSession,
 } from 'ember-simple-auth/test-support';
 
-module('Acceptance | host-catalogs | host sets', function (hooks) {
+module('Acceptance | host-catalogs | host sets | create', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
@@ -70,7 +70,7 @@ module('Acceptance | host-catalogs | host sets', function (hooks) {
     authenticateSession({});
   });
 
-  test('can create new host', async function (assert) {
+  test('can create new host sets', async function (assert) {
     assert.expect(1);
     const count = getHostSetCount();
     await visit(urls.newHostSet);
@@ -79,6 +79,30 @@ module('Acceptance | host-catalogs | host sets', function (hooks) {
     assert.equal(getHostSetCount(), count + 1);
   });
 
+  test('Users cannot create a new host set without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.hostCatalog.authorized_collection_actions['host-sets'] = [];
+    await visit(urls.hostCatalog);
+    assert.notOk(
+      instances.hostCatalog.authorized_collection_actions['host-sets'].includes(
+        'create'
+      )
+    );
+    assert.notOk(find(`.rose-layout-page-actions [href="${urls.newHostSet}"]`));
+  });
+
+  test('Users cannot navigate to new host sets route without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.hostCatalog.authorized_collection_actions['host-sets'] = [];
+    await visit(urls.hostCatalog);
+    assert.notOk(
+      instances.hostCatalog.authorized_collection_actions['host-sets'].includes(
+        'create'
+      )
+    );
+    assert.notOk(find(`[href="${urls.hostSets}"]`));
+  });
+
   test('can cancel create new host', async function (assert) {
     assert.expect(2);
     const count = getHostSetCount();
diff --git a/ui/admin/tests/acceptance/host-catalogs/host-sets/list-test.js b/ui/admin/tests/acceptance/host-catalogs/host-sets/list-test.js
new file mode 100644
index 000000000..6e092398b
--- /dev/null
+++ b/ui/admin/tests/acceptance/host-catalogs/host-sets/list-test.js
@@ -0,0 +1,98 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | host-catalogs | host sets | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+      project: null,
+      hostCatalog: null,
+      host: null,
+    },
+  };
+  const urls = {
+    globalScope: null,
+    orgScope: null,
+    projectScope: null,
+    hostCatalogs: null,
+    hostCatalog: null,
+    hostSets: null,
+    hostSet: null,
+    newHostSet: null,
+  };
+
+  hooks.beforeEach(function () {
+    // Generate resources
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.scopes.project = this.server.create('scope', {
+      type: 'project',
+      scope: { id: instances.scopes.org.id, type: 'org' },
+    });
+    instances.hostCatalog = this.server.create('host-catalog', {
+      scope: instances.scopes.project,
+    });
+    instances.hostSet = this.server.create('host-set', {
+      scope: instances.scopes.project,
+      hostCatalog: instances.hostCatalog,
+    });
+    // Generate route URLs for resources
+    urls.globalScope = `/scopes/global/scopes`;
+    urls.orgScope = `/scopes/${instances.scopes.org.id}/scopes`;
+    urls.projectScope = `/scopes/${instances.scopes.project.id}`;
+    urls.hostCatalogs = `${urls.projectScope}/host-catalogs`;
+    urls.hostCatalog = `${urls.hostCatalogs}/${instances.hostCatalog.id}`;
+    urls.hostSets = `${urls.hostCatalog}/host-sets`;
+    urls.hostSet = `${urls.hostSets}/${instances.hostSet.id}`;
+    urls.newHostSet = `${urls.hostSets}/new`;
+    authenticateSession({});
+  });
+
+  test('Users can navigate to host-sets with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(urls.hostCatalog);
+    assert.ok(
+      instances.hostCatalog.authorized_collection_actions['host-sets'].includes(
+        'list'
+      )
+    );
+    assert.ok(find(`[href="${urls.hostSets}"]`));
+  });
+
+  test('Users cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.hostCatalog.authorized_collection_actions['host-sets'] = [];
+    await visit(urls.hostCatalog);
+    assert.notOk(
+      instances.hostCatalog.authorized_collection_actions['host-sets'].includes(
+        'list'
+      )
+    );
+    assert.notOk(find(`[href="${urls.hostSets}"]`));
+  });
+
+  test('Users can navigate to index with only create action', async function (assert) {
+    assert.expect(2);
+    instances.hostCatalog.authorized_collection_actions['host-sets'] = [
+      'create',
+    ];
+    await visit(urls.hostCatalog);
+    assert.ok(find(`[href="${urls.hostSets}"]`));
+    assert.ok(find(`.rose-layout-page-actions [href="${urls.newHostSet}"]`));
+  });
+});
diff --git a/ui/admin/tests/acceptance/scopes-test.js b/ui/admin/tests/acceptance/scopes-test.js
index df294416b..87a2e5656 100644
--- a/ui/admin/tests/acceptance/scopes-test.js
+++ b/ui/admin/tests/acceptance/scopes-test.js
@@ -4,8 +4,6 @@ import { setupApplicationTest } from 'ember-qunit';
 import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
 import a11yAudit from 'ember-a11y-testing/test-support/audit';
 import { Response } from 'miragejs';
-import { resolve, reject } from 'rsvp';
-import sinon from 'sinon';
 import {
   authenticateSession,
   // These are left here intentionally for future reference.
@@ -202,157 +200,4 @@ module('Acceptance | scopes', function (hooks) {
       'Name is required.'
     );
   });
-
-  test('can save changes to existing scope', async function (assert) {
-    assert.expect(3);
-    assert.notEqual(instances.scopes.org.name, 'random string');
-    await visit(urls.orgScopeEdit);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'random string');
-    await click('.rose-form-actions [type="submit"]');
-    assert.equal(currentURL(), urls.orgScopeEdit);
-    assert.equal(
-      this.server.schema.scopes.where({ type: 'org' }).models[0].name,
-      'random string'
-    );
-  });
-
-  test('can cancel changes to existing scope', async function (assert) {
-    assert.expect(2);
-    await visit(urls.orgScopeEdit);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'random string');
-    await click('.rose-form-actions [type="button"]');
-    assert.notEqual(instances.scopes.org.name, 'random string');
-    assert.equal(find('[name="name"]').value, instances.scopes.org.name);
-  });
-
-  test('saving an existing scope with invalid fields displays error messages', async function (assert) {
-    assert.expect(2);
-    this.server.patch('/scopes/:id', () => {
-      return new Response(
-        400,
-        {},
-        {
-          status: 400,
-          code: 'invalid_argument',
-          message: 'The request was invalid.',
-          details: {
-            request_fields: [
-              {
-                name: 'name',
-                description: 'Name is required.',
-              },
-            ],
-          },
-        }
-      );
-    });
-    await visit(urls.orgScopeEdit);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'random string');
-    await click('[type="submit"]');
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'The request was invalid.'
-    );
-    assert.ok(
-      find('.rose-form-error-message').textContent.trim(),
-      'Name is required.'
-    );
-  });
-
-  test('can discard unsaved scope changes via dialog', async function (assert) {
-    assert.expect(5);
-    const confirmService = this.owner.lookup('service:confirm');
-    confirmService.enabled = true;
-    assert.notEqual(instances.scopes.org.name, 'random string');
-    await visit(urls.orgScopeEdit);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'random string');
-    assert.equal(currentURL(), urls.orgScopeEdit);
-    try {
-      await visit(urls.globalScope);
-    } catch (e) {
-      assert.ok(find('.rose-dialog'));
-      await click('.rose-dialog-footer button:first-child');
-      assert.equal(currentURL(), urls.globalScope);
-      assert.notEqual(
-        this.server.schema.scopes.where({ type: 'org' }).models[0].name,
-        'random string'
-      );
-    }
-  });
-
-  test('can cancel discard unsaved scope changes via dialog', async function (assert) {
-    assert.expect(5);
-    const confirmService = this.owner.lookup('service:confirm');
-    confirmService.enabled = true;
-    assert.notEqual(instances.scopes.org.name, 'random string');
-    await visit(urls.orgScopeEdit);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'random string');
-    assert.equal(currentURL(), urls.orgScopeEdit);
-    try {
-      await visit(urls.globalScope);
-    } catch (e) {
-      assert.ok(find('.rose-dialog'));
-      await click('.rose-dialog-footer button:last-child');
-      assert.equal(currentURL(), urls.orgScopeEdit);
-      assert.notEqual(
-        this.server.schema.scopes.where({ type: 'org' }).models[0].name,
-        'random string'
-      );
-    }
-  });
-
-  test('can delete scope', async function (assert) {
-    assert.expect(1);
-    const orgScopeCount = getScopeCount('org');
-    await visit(urls.orgScopeEdit);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    assert.equal(getScopeCount('org'), orgScopeCount - 1);
-  });
-
-  test('can accept delete scope via dialog', async function (assert) {
-    assert.expect(2);
-    const confirmService = this.owner.lookup('service:confirm');
-    confirmService.enabled = true;
-    confirmService.confirm = sinon.fake.returns(resolve());
-    const orgScopeCount = getScopeCount('org');
-    await visit(urls.orgScopeEdit);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    assert.equal(getScopeCount('org'), orgScopeCount - 1);
-    assert.ok(confirmService.confirm.calledOnce);
-  });
-
-  test('cannot cancel delete scope via dialog', async function (assert) {
-    assert.expect(2);
-    const confirmService = this.owner.lookup('service:confirm');
-    confirmService.enabled = true;
-    confirmService.confirm = sinon.fake.returns(reject());
-    const orgScopeCount = getScopeCount('org');
-    await visit(urls.orgScopeEdit);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    assert.equal(getScopeCount('org'), orgScopeCount);
-    assert.ok(confirmService.confirm.calledOnce);
-  });
-
-  test('deleting a scope which errors displays error messages', async function (assert) {
-    assert.expect(1);
-    this.server.del('/scopes/:id', () => {
-      return new Response(
-        490,
-        {},
-        {
-          status: 490,
-          code: 'error',
-          message: 'Oops.',
-        }
-      );
-    });
-    await visit(urls.orgScopeEdit);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    assert.ok(find('[role="alert"]').textContent.trim(), 'Oops.');
-  });
 });
diff --git a/ui/admin/tests/acceptance/scopes/delete-test.js b/ui/admin/tests/acceptance/scopes/delete-test.js
new file mode 100644
index 000000000..6b35ae24d
--- /dev/null
+++ b/ui/admin/tests/acceptance/scopes/delete-test.js
@@ -0,0 +1,136 @@
+import { module, test } from 'qunit';
+import { visit, find, click } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import { Response } from 'miragejs';
+import { resolve, reject } from 'rsvp';
+import sinon from 'sinon';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | scopes | delete', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  let getScopeCount;
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+      org2: null,
+      project: null,
+      project2: null,
+    },
+  };
+  const urls = {
+    globalScope: null,
+    orgScope: null,
+    org2Scope: null,
+    orgScopeEdit: null,
+    org2ScopeEdit: null,
+    projectScope: null,
+    project2Scope: null,
+    projectScopeEdit: null,
+    project2ScopeEdit: null,
+  };
+
+  hooks.beforeEach(function () {
+    // Generate resources
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.scopes.org2 = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.scopes.project = this.server.create('scope', {
+      type: 'project',
+      scope: { id: instances.scopes.org.id, type: 'org' },
+    });
+    instances.scopes.project2 = this.server.create('scope', {
+      type: 'project',
+      scope: { id: instances.scopes.org.id, type: 'org' },
+    });
+    // Generate route URLs for resources
+    urls.globalScope = `/scopes/global/scopes`;
+    urls.newOrgScope = `/scopes/global/new`;
+    urls.orgScope = `/scopes/${instances.scopes.org.id}/scopes`;
+    urls.org2Scope = `/scopes/${instances.scopes.org2.id}/scopes`;
+    urls.orgScopeEdit = `/scopes/${instances.scopes.org.id}/edit`;
+    urls.org2ScopeEdit = `/scopes/${instances.scopes.org2.id}/edit`;
+    urls.newProjectScope = `/scopes/${instances.scopes.org.id}/new`;
+    urls.projectScope = `/scopes/${instances.scopes.project.id}`;
+    urls.project2Scope = `/scopes/${instances.scopes.project2.id}`;
+    urls.projectScopeEdit = `/scopes/${instances.scopes.project.id}/edit`;
+    urls.project2ScopeEdit = `/scopes/${instances.scopes.project2.id}/edit`;
+    // Generate resource couner
+    getScopeCount = (type) => this.server.schema.scopes.where({ type }).length;
+    authenticateSession({});
+  });
+
+  test('can delete scope', async function (assert) {
+    assert.expect(1);
+    const orgScopeCount = getScopeCount('org');
+    await visit(urls.orgScopeEdit);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    assert.equal(getScopeCount('org'), orgScopeCount - 1);
+  });
+
+  test('cannot delete scope without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.scopes.org.update({ authorized_actions: [] });
+    await visit(urls.orgScopeEdit);
+    assert.notOk(
+      find('.rose-layout-page-actions .rose-dropdown-button-danger')
+    );
+  });
+
+  test('can accept delete scope via dialog', async function (assert) {
+    assert.expect(2);
+    const confirmService = this.owner.lookup('service:confirm');
+    confirmService.enabled = true;
+    confirmService.confirm = sinon.fake.returns(resolve());
+    const orgScopeCount = getScopeCount('org');
+    await visit(urls.orgScopeEdit);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    assert.equal(getScopeCount('org'), orgScopeCount - 1);
+    assert.ok(confirmService.confirm.calledOnce);
+  });
+
+  test('cannot cancel delete scope via dialog', async function (assert) {
+    assert.expect(2);
+    const confirmService = this.owner.lookup('service:confirm');
+    confirmService.enabled = true;
+    confirmService.confirm = sinon.fake.returns(reject());
+    const orgScopeCount = getScopeCount('org');
+    await visit(urls.orgScopeEdit);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    assert.equal(getScopeCount('org'), orgScopeCount);
+    assert.ok(confirmService.confirm.calledOnce);
+  });
+
+  test('deleting a scope which errors displays error messages', async function (assert) {
+    assert.expect(1);
+    this.server.del('/scopes/:id', () => {
+      return new Response(
+        490,
+        {},
+        {
+          status: 490,
+          code: 'error',
+          message: 'Oops.',
+        }
+      );
+    });
+    await visit(urls.orgScopeEdit);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    assert.ok(find('[role="alert"]').textContent.trim(), 'Oops.');
+  });
+});
diff --git a/ui/admin/tests/acceptance/scopes/read-test.js b/ui/admin/tests/acceptance/scopes/read-test.js
new file mode 100644
index 000000000..1ddd1e5a4
--- /dev/null
+++ b/ui/admin/tests/acceptance/scopes/read-test.js
@@ -0,0 +1,55 @@
+import { module, test } from 'qunit';
+import { visit, currentURL, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import a11yAudit from 'ember-a11y-testing/test-support/audit';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | scopes | read', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+  };
+  const urls = {
+    orgScopeEdit: null,
+  };
+
+  hooks.beforeEach(function () {
+    // Generate resources
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    // Generate route URLs for resources
+    urls.orgScopeEdit = `/scopes/${instances.scopes.org.id}/edit`;
+    // Generate resource couner
+    authenticateSession({});
+  });
+
+  test('visiting org scope edit', async function (assert) {
+    assert.expect(2);
+    await visit(urls.orgScopeEdit);
+    await a11yAudit();
+    assert.equal(currentURL(), urls.orgScopeEdit);
+    assert.ok(find('main .rose-form'));
+  });
+
+  test('visiting org scope edit without read permission results in no form displayed', async function (assert) {
+    assert.expect(2);
+    instances.scopes.org.update({ authorized_actions: [] });
+    await visit(urls.orgScopeEdit);
+    assert.equal(currentURL(), urls.orgScopeEdit);
+    assert.notOk(find('main .rose-form'));
+  });
+});
diff --git a/ui/admin/tests/acceptance/scopes/update-test.js b/ui/admin/tests/acceptance/scopes/update-test.js
new file mode 100644
index 000000000..4ddb8085d
--- /dev/null
+++ b/ui/admin/tests/acceptance/scopes/update-test.js
@@ -0,0 +1,181 @@
+import { module, test } from 'qunit';
+import { visit, currentURL, find, click, fillIn } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import { Response } from 'miragejs';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | scopes | update', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+      org2: null,
+      project: null,
+      project2: null,
+    },
+  };
+  const urls = {
+    globalScope: null,
+    orgScope: null,
+    org2Scope: null,
+    orgScopeEdit: null,
+    org2ScopeEdit: null,
+    projectScope: null,
+    project2Scope: null,
+    projectScopeEdit: null,
+    project2ScopeEdit: null,
+  };
+
+  hooks.beforeEach(function () {
+    // Generate resources
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.scopes.org = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.scopes.org2 = this.server.create('scope', {
+      type: 'org',
+      scope: { id: 'global', type: 'global' },
+    });
+    instances.scopes.project = this.server.create('scope', {
+      type: 'project',
+      scope: { id: instances.scopes.org.id, type: 'org' },
+    });
+    instances.scopes.project2 = this.server.create('scope', {
+      type: 'project',
+      scope: { id: instances.scopes.org.id, type: 'org' },
+    });
+    // Generate route URLs for resources
+    urls.globalScope = `/scopes/global/scopes`;
+    urls.newOrgScope = `/scopes/global/new`;
+    urls.orgScope = `/scopes/${instances.scopes.org.id}/scopes`;
+    urls.org2Scope = `/scopes/${instances.scopes.org2.id}/scopes`;
+    urls.orgScopeEdit = `/scopes/${instances.scopes.org.id}/edit`;
+    urls.org2ScopeEdit = `/scopes/${instances.scopes.org2.id}/edit`;
+    urls.newProjectScope = `/scopes/${instances.scopes.org.id}/new`;
+    urls.projectScope = `/scopes/${instances.scopes.project.id}`;
+    urls.project2Scope = `/scopes/${instances.scopes.project2.id}`;
+    urls.projectScopeEdit = `/scopes/${instances.scopes.project.id}/edit`;
+    urls.project2ScopeEdit = `/scopes/${instances.scopes.project2.id}/edit`;
+    authenticateSession({});
+  });
+
+  test('can save changes to existing scope', async function (assert) {
+    assert.expect(3);
+    assert.notEqual(instances.scopes.org.name, 'random string');
+    await visit(urls.orgScopeEdit);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'random string');
+    await click('.rose-form-actions [type="submit"]');
+    assert.equal(currentURL(), urls.orgScopeEdit);
+    assert.equal(
+      this.server.schema.scopes.where({ type: 'org' }).models[0].name,
+      'random string'
+    );
+  });
+
+  test('cannot save changes to without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.scopes.org.update({ authorized_actions: [] });
+    await visit(urls.orgScopeEdit);
+    assert.notOk(find('form [type="button"]'));
+  });
+
+  test('can cancel changes to existing scope', async function (assert) {
+    assert.expect(2);
+    await visit(urls.orgScopeEdit);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'random string');
+    await click('.rose-form-actions [type="button"]');
+    assert.notEqual(instances.scopes.org.name, 'random string');
+    assert.equal(find('[name="name"]').value, instances.scopes.org.name);
+  });
+
+  test('saving an existing scope with invalid fields displays error messages', async function (assert) {
+    assert.expect(2);
+    this.server.patch('/scopes/:id', () => {
+      return new Response(
+        400,
+        {},
+        {
+          status: 400,
+          code: 'invalid_argument',
+          message: 'The request was invalid.',
+          details: {
+            request_fields: [
+              {
+                name: 'name',
+                description: 'Name is required.',
+              },
+            ],
+          },
+        }
+      );
+    });
+    await visit(urls.orgScopeEdit);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'random string');
+    await click('[type="submit"]');
+    assert.ok(
+      find('[role="alert"]').textContent.trim(),
+      'The request was invalid.'
+    );
+    assert.ok(
+      find('.rose-form-error-message').textContent.trim(),
+      'Name is required.'
+    );
+  });
+
+  test('can discard unsaved scope changes via dialog', async function (assert) {
+    assert.expect(5);
+    const confirmService = this.owner.lookup('service:confirm');
+    confirmService.enabled = true;
+    assert.notEqual(instances.scopes.org.name, 'random string');
+    await visit(urls.orgScopeEdit);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'random string');
+    assert.equal(currentURL(), urls.orgScopeEdit);
+    try {
+      await visit(urls.globalScope);
+    } catch (e) {
+      assert.ok(find('.rose-dialog'));
+      await click('.rose-dialog-footer button:first-child');
+      assert.equal(currentURL(), urls.globalScope);
+      assert.notEqual(
+        this.server.schema.scopes.where({ type: 'org' }).models[0].name,
+        'random string'
+      );
+    }
+  });
+
+  test('can cancel discard unsaved scope changes via dialog', async function (assert) {
+    assert.expect(5);
+    const confirmService = this.owner.lookup('service:confirm');
+    confirmService.enabled = true;
+    assert.notEqual(instances.scopes.org.name, 'random string');
+    await visit(urls.orgScopeEdit);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'random string');
+    assert.equal(currentURL(), urls.orgScopeEdit);
+    try {
+      await visit(urls.globalScope);
+    } catch (e) {
+      assert.ok(find('.rose-dialog'));
+      await click('.rose-dialog-footer button:last-child');
+      assert.equal(currentURL(), urls.orgScopeEdit);
+      assert.notEqual(
+        this.server.schema.scopes.where({ type: 'org' }).models[0].name,
+        'random string'
+      );
+    }
+  });
+});
diff --git a/ui/admin/tests/acceptance/users/create-test.js b/ui/admin/tests/acceptance/users/create-test.js
index 99b715b9b..b69a1f3df 100644
--- a/ui/admin/tests/acceptance/users/create-test.js
+++ b/ui/admin/tests/acceptance/users/create-test.js
@@ -20,6 +20,7 @@ module('Acceptance | users | create', function (hooks) {
   let newUserURL;
 
   hooks.beforeEach(function () {
+    this.server.create('scope', { id: 'global' });
     orgScope = this.server.create(
       'scope',
       {
diff --git a/ui/admin/tests/acceptance/users/list-test.js b/ui/admin/tests/acceptance/users/list-test.js
index d453e5b04..ccf1bcf2e 100644
--- a/ui/admin/tests/acceptance/users/list-test.js
+++ b/ui/admin/tests/acceptance/users/list-test.js
@@ -19,7 +19,6 @@ module('Acceptance | users | list', function (hooks) {
       global: null,
       org: null,
     },
-    orgScope: null,
   };
 
   const urls = {