diff --git a/addons/api/addon/abilities/target.js b/addons/api/addon/abilities/target.js
index 12b35044e..977266d63 100644
--- a/addons/api/addon/abilities/target.js
+++ b/addons/api/addon/abilities/target.js
@@ -12,4 +12,18 @@ export default class TargetAbility extends ModelAbility {
   get canConnect() {
     return this.hasAuthorizedAction('authorize-session');
   }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveHostSources() {
+    return this.hasAuthorizedAction('remove-host-sources');
+  }
+
+  /**
+   * @type {boolean}
+   */
+  get canRemoveCredentialSources() {
+    return this.hasAuthorizedAction('remove-credential-sources');
+  }
 }
diff --git a/addons/api/tests/unit/abilities/target-test.js b/addons/api/tests/unit/abilities/target-test.js
index 09b64c9c8..4fe4dc23d 100644
--- a/addons/api/tests/unit/abilities/target-test.js
+++ b/addons/api/tests/unit/abilities/target-test.js
@@ -14,4 +14,26 @@ module('Unit | Abilities | Target', function (hooks) {
     model.authorized_actions = [];
     assert.notOk(service.can('connect target', model));
   });
+
+  test('it reflects when a given target may remove host sources', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['remove-host-sources'],
+    };
+    assert.ok(service.can('removeHostSources target', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('removeHostSources target', model));
+  });
+
+  test('it reflects when a given target may remove crednetial sources', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['remove-credential-sources'],
+    };
+    assert.ok(service.can('removeCredentialSources target', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('removeCredentialSources target', model));
+  });
 });
diff --git a/ui/admin/app/templates/scopes/scope/targets/target/credential-sources.hbs b/ui/admin/app/templates/scopes/scope/targets/target/credential-sources.hbs
index 1c297bd1e..c1c06cfef 100644
--- a/ui/admin/app/templates/scopes/scope/targets/target/credential-sources.hbs
+++ b/ui/admin/app/templates/scopes/scope/targets/target/credential-sources.hbs
@@ -43,26 +43,28 @@
             </Copyable>
           </row.cell>
           <row.cell>
-            <Rose::Dropdown
-              @icon='flight-icons/svg/more-horizontal-16'
-              @iconOnly={{true}}
-              @showCaret={{false}}
-              @dropdownRight={{true}}
-              @text={{t 'actions.manage'}}
-              as |dropdown|
-            >
-              <dropdown.button
-                @style='danger'
-                {{on
-                  'click'
-                  (route-action
-                    'removeCredentialSource' @model credentialLibrary
-                  )
-                }}
+            {{#if (can 'removeCredentialSources target' @model)}}
+              <Rose::Dropdown
+                @icon='flight-icons/svg/more-horizontal-16'
+                @iconOnly={{true}}
+                @showCaret={{false}}
+                @dropdownRight={{true}}
+                @text={{t 'actions.manage'}}
+                as |dropdown|
               >
-                {{t 'actions.remove'}}
-              </dropdown.button>
-            </Rose::Dropdown>
+                <dropdown.button
+                  @style='danger'
+                  {{on
+                    'click'
+                    (route-action
+                      'removeCredentialSource' @model credentialLibrary
+                    )
+                  }}
+                >
+                  {{t 'actions.remove'}}
+                </dropdown.button>
+              </Rose::Dropdown>
+            {{/if}}
           </row.cell>
         </body.row>
       {{/each}}
diff --git a/ui/admin/app/templates/scopes/scope/targets/target/host-sources.hbs b/ui/admin/app/templates/scopes/scope/targets/target/host-sources.hbs
index e9081c106..00e74bd55 100644
--- a/ui/admin/app/templates/scopes/scope/targets/target/host-sources.hbs
+++ b/ui/admin/app/templates/scopes/scope/targets/target/host-sources.hbs
@@ -33,24 +33,26 @@
             </Copyable>
           </row.cell>
           <row.cell>
-            <Rose::Dropdown
-              @icon='flight-icons/svg/more-horizontal-16'
-              @iconOnly={{true}}
-              @showCaret={{false}}
-              @dropdownRight={{true}}
-              @text='{{t 'actions.manage'}}'
-              as |dropdown|
-            >
-              <dropdown.button
-                @style='danger'
-                {{on
-                  'click'
-                  (route-action 'removeHostSource' @model hostSet.model)
-                }}
+            {{#if (can 'removeHostSources target' @model)}}
+              <Rose::Dropdown
+                @icon='flight-icons/svg/more-horizontal-16'
+                @iconOnly={{true}}
+                @showCaret={{false}}
+                @dropdownRight={{true}}
+                @text='{{t 'actions.manage'}}'
+                as |dropdown|
               >
-                {{t 'actions.remove'}}
-              </dropdown.button>
-            </Rose::Dropdown>
+                <dropdown.button
+                  @style='danger'
+                  {{on
+                    'click'
+                    (route-action 'removeHostSource' @model hostSet.model)
+                  }}
+                >
+                  {{t 'actions.remove'}}
+                </dropdown.button>
+              </Rose::Dropdown>
+            {{/if}}
           </row.cell>
         </body.row>
       {{/each}}
diff --git a/ui/admin/tests/acceptance/targets/credential-sources-test.js b/ui/admin/tests/acceptance/targets/credential-sources-test.js
index b5c4d6508..9402006d1 100644
--- a/ui/admin/tests/acceptance/targets/credential-sources-test.js
+++ b/ui/admin/tests/acceptance/targets/credential-sources-test.js
@@ -160,6 +160,16 @@ module('Acceptance | targets | credential-libraries', function (hooks) {
     assert.equal(findAll('tbody tr').length, count - 1);
   });
 
+  test('cannot remove credential libraries without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.target.authorized_actions =
+      instances.target.authorized_actions.filter(
+        (item) => item !== 'remove-credential-sources'
+      );
+    await visit(urls.credentialSources);
+    assert.notOk(find('tbody tr .rose-dropdown-button-danger'));
+  });
+
   test('removing a target credential library which errors displays error messages', async function (assert) {
     assert.expect(2);
     this.server.post('/targets/:idMethod', () => {
diff --git a/ui/admin/tests/acceptance/targets/host-sources-test.js b/ui/admin/tests/acceptance/targets/host-sources-test.js
index e80ee4816..93a6b166e 100644
--- a/ui/admin/tests/acceptance/targets/host-sources-test.js
+++ b/ui/admin/tests/acceptance/targets/host-sources-test.js
@@ -75,7 +75,7 @@ module('Acceptance | targets | host-sources', function (hooks) {
     assert.equal(findAll('tbody tr').length, targetHostSetCount);
   });
 
-  test('can remove a host sets', async function (assert) {
+  test('can remove a host set', async function (assert) {
     assert.expect(2);
     const targetHostSetCount = instances.target.hostSets.length;
     await visit(urls.targetHostSources);
@@ -84,6 +84,16 @@ module('Acceptance | targets | host-sources', function (hooks) {
     assert.equal(findAll('tbody tr').length, targetHostSetCount - 1);
   });
 
+  test('cannot remove a host set without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.target.authorized_actions =
+      instances.target.authorized_actions.filter(
+        (item) => item !== 'remove-host-sources'
+      );
+    await visit(urls.targetHostSources);
+    assert.notOk(find('tbody tr .rose-dropdown-button-danger'));
+  });
+
   test('removing a target host set which errors displays error messages', async function (assert) {
     assert.expect(2);
     this.server.post('/targets/:idMethod', () => {