diff --git a/addons/api/addon/abilities/collection.js b/addons/api/addon/abilities/collection.js
index ad52afd18..92f0e4342 100644
--- a/addons/api/addon/abilities/collection.js
+++ b/addons/api/addon/abilities/collection.js
@@ -29,7 +29,8 @@ export default class CollectionAbility extends Ability {
    * @return {boolean}
    */
   hasAuthorizedCollectionAction(action) {
-    const { authorized_collection_actions } = this.model;
+    const authorized_collection_actions =
+      (this.model || {}).authorized_collection_actions || {};
     const collection = this.collection || {};
     return authorized_collection_actions[collection]?.includes(action);
   }
diff --git a/addons/api/addon/models/base.js b/addons/api/addon/models/base.js
index f99e0351a..7fd41ec64 100644
--- a/addons/api/addon/models/base.js
+++ b/addons/api/addon/models/base.js
@@ -42,6 +42,11 @@ export default class BaseModel extends Model {
   })
   authorized_actions;
 
+  @attr({
+    readOnly: true,
+  })
+  authorized_collection_actions;
+
   set scopeModel(model) {
     if (model) {
       const json = model.serialize();
diff --git a/addons/api/mirage/factories/scope.js b/addons/api/mirage/factories/scope.js
index fe41f3866..e9c5ac09f 100644
--- a/addons/api/mirage/factories/scope.js
+++ b/addons/api/mirage/factories/scope.js
@@ -4,6 +4,19 @@ import { trait } from 'ember-cli-mirage';
 export default factory.extend({
   type: 'global',
 
+  authorized_collection_actions: () => {
+    return {
+      users: ['create', 'list'],
+      // groups: ['create', 'list'],
+      // roles: ['create', 'list'],
+      // 'auth-methods': ['create', 'list'],
+      // sessopms: ['list'],
+      // targets: ['create', 'list'],
+      // 'host-catalogs': ['create', 'list'],
+      // 'credential-stores': ['create', 'list'],
+    };
+  },
+
   /**
    * Generates realistic-ish IDs while still being deterministic.
    */
diff --git a/addons/core/translations/en-us.yaml b/addons/core/translations/en-us.yaml
index 5370c7e75..8f98f633c 100644
--- a/addons/core/translations/en-us.yaml
+++ b/addons/core/translations/en-us.yaml
@@ -32,6 +32,8 @@ titles:
 descriptions:
   empty-set: There are no items to display yet.  You may be able to add items or try back later.
   origin-initialization: To get started, please enter your origin URL
+  create-but-not-list: You do not have permission to list {resource}, but you can create new instances.
+  neither-list-nor-create: You do not have permission to list or create {resource}.
 questions:
   delete-confirm: Are you sure you want to delete this resource?
   remove-confirm: Are you sure you want to remove this association?
diff --git a/ui/admin/app/routes/scopes/scope/users.js b/ui/admin/app/routes/scopes/scope/users.js
index 42f9c8832..aa3dde96a 100644
--- a/ui/admin/app/routes/scopes/scope/users.js
+++ b/ui/admin/app/routes/scopes/scope/users.js
@@ -11,6 +11,7 @@ export default class ScopesScopeUsersRoute extends Route {
   @service intl;
   @service notify;
   @service session;
+  @service can;
 
   // =methods
 
@@ -26,8 +27,11 @@ export default class ScopesScopeUsersRoute extends Route {
    * @return {Promise{[UserModel]}}
    */
   async model() {
-    const { id: scope_id } = this.modelFor('scopes.scope');
-    return this.store.query('user', { scope_id });
+    const scope = this.modelFor('scopes.scope');
+    const { id: scope_id } = scope;
+    if (this.can.can('list collection', scope, { collection: 'users' })) {
+      return this.store.query('user', { scope_id });
+    }
   }
 
   // =actions
diff --git a/ui/admin/app/routes/scopes/scope/users/index.js b/ui/admin/app/routes/scopes/scope/users/index.js
index f59170106..2e92b693d 100644
--- a/ui/admin/app/routes/scopes/scope/users/index.js
+++ b/ui/admin/app/routes/scopes/scope/users/index.js
@@ -1,3 +1,11 @@
 import Route from '@ember/routing/route';
 
-export default class ScopesScopeUsersIndexRoute extends Route {}
+export default class ScopesScopeUsersIndexRoute extends Route {
+  // =methods
+
+  setupController(controller) {
+    const scope = this.modelFor('scopes.scope');
+    super.setupController(...arguments);
+    controller.setProperties({ scope });
+  }
+}
diff --git a/ui/admin/app/templates/scopes/scope.hbs b/ui/admin/app/templates/scopes/scope.hbs
index 9396f280d..decc3194d 100644
--- a/ui/admin/app/templates/scopes/scope.hbs
+++ b/ui/admin/app/templates/scopes/scope.hbs
@@ -94,10 +94,12 @@
 
       {{#unless @model.isProject}}
         <Rose::Nav::Sidebar @title={{t 'titles.iam'}} as |nav|>
-          <nav.link @route='scopes.scope.users'>
-            <Rose::Icon @name='flight-icons/users-16' @size='medium' />
-            {{t 'resources.user.title_plural'}}
-          </nav.link>
+          {{#if (can 'navigate collection' @model collection='users')}}
+            <nav.link @route='scopes.scope.users'>
+              <Rose::Icon @name='flight-icons/users-16' @size='medium' />
+              {{t 'resources.user.title_plural'}}
+            </nav.link>
+          {{/if}}
           <nav.link @route='scopes.scope.groups'>
             <Rose::Icon @name='flight-icons/folder-users-16' @size='medium' />
             {{t 'resources.group.title_plural'}}
diff --git a/ui/admin/app/templates/scopes/scope/users/index.hbs b/ui/admin/app/templates/scopes/scope/users/index.hbs
index b0cf3e83b..fdc93dbb3 100644
--- a/ui/admin/app/templates/scopes/scope/users/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/users/index.hbs
@@ -15,10 +15,12 @@
   </page.header>
 
   <page.actions>
-    {{#if @model}}
-      <Rose::LinkButton @route='scopes.scope.users.new' @style='primary'>{{t
-          'titles.new'
-        }}</Rose::LinkButton>
+    {{#if (can 'create collection' this.scope collection='users')}}
+      {{#if @model}}
+        <Rose::LinkButton @route='scopes.scope.users.new' @style='primary'>{{t
+            'titles.new'
+          }}</Rose::LinkButton>
+      {{/if}}
     {{/if}}
   </page.actions>
 
@@ -68,12 +70,29 @@
           as |message|
         >
           <message.description>
-            {{t 'resources.user.description'}}
+            {{#if (can 'list collection' this.scope collection='users')}}
+              {{! can list (at least):  show default welcome message}}
+              {{t 'resources.user.description'}}
+            {{else if (can 'create collection' this.scope collection='users')}}
+              {{! can create (only):  show create-but-not-list welcome message}}
+              {{t
+                'descriptions.create-but-not-list'
+                resource=(t 'resources.user.title_plural')
+              }}
+            {{else}}
+              {{! can neither list nor create }}
+              {{t
+                'descriptions.neither-list-nor-create'
+                resource=(t 'resources.user.title_plural')
+              }}
+            {{/if}}
           </message.description>
-          <message.link @route='scopes.scope.users.new'>
-            <Rose::Icon @name='flight-icons/plus-circle-16' />
-            {{t 'titles.new'}}
-          </message.link>
+          {{#if (can 'create collection' this.scope collection='users')}}
+            <message.link @route='scopes.scope.users.new'>
+              <Rose::Icon @name='flight-icons/plus-circle-16' />
+              {{t 'titles.new'}}
+            </message.link>
+          {{/if}}
         </Rose::Message>
       </Rose::Layout::Centered>
 
diff --git a/ui/admin/tests/acceptance/users-test.js b/ui/admin/tests/acceptance/users/create-test.js
similarity index 75%
rename from ui/admin/tests/acceptance/users-test.js
rename to ui/admin/tests/acceptance/users/create-test.js
index b047a0d2a..fbff7fbee 100644
--- a/ui/admin/tests/acceptance/users-test.js
+++ b/ui/admin/tests/acceptance/users/create-test.js
@@ -10,11 +10,12 @@ import {
   //invalidateSession,
 } from 'ember-simple-auth/test-support';
 
-module('Acceptance | users', function (hooks) {
+module('Acceptance | users | create', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
   let orgScope;
+  let orgURL;
   let usersURL;
   let newUserURL;
 
@@ -23,10 +24,12 @@ module('Acceptance | users', function (hooks) {
       'scope',
       {
         type: 'org',
+        scope: { id: 'global', type: 'global' },
       },
       'withChildren'
     );
 
+    orgURL = `/scopes/${orgScope.id}`;
     usersURL = `/scopes/${orgScope.id}/users`;
     newUserURL = `${usersURL}/new`;
 
@@ -42,6 +45,23 @@ module('Acceptance | users', function (hooks) {
     assert.equal(this.server.db.users.length, usersCount + 1);
   });
 
+  test('can navigate to new users route with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(orgURL);
+    assert.ok(orgScope.authorized_collection_actions.users.includes('create'));
+    assert.ok(find(`[href="${orgURL}/users"]`));
+  });
+
+  test('cannot navigate to new users route without proper authorization', async function (assert) {
+    assert.expect(2);
+    orgScope.authorized_collection_actions.users = [];
+    await visit(orgURL);
+    assert.notOk(
+      orgScope.authorized_collection_actions.users.includes('create')
+    );
+    assert.notOk(find(`[href="${orgURL}/users"]`));
+  });
+
   test('can cancel creation of a new user', async function (assert) {
     assert.expect(2);
     const usersCount = this.server.db.users.length;
diff --git a/ui/admin/tests/acceptance/users/list-test.js b/ui/admin/tests/acceptance/users/list-test.js
new file mode 100644
index 000000000..72a6e35eb
--- /dev/null
+++ b/ui/admin/tests/acceptance/users/list-test.js
@@ -0,0 +1,75 @@
+import { module, test } from 'qunit';
+import { visit, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | users | list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+  let orgURL;
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    orgScope: null,
+  };
+
+  const urls = {
+    scopes: {
+      org: null,
+    },
+    users: null,
+  };
+
+  hooks.beforeEach(function () {
+    instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
+    instances.user = this.server.create('user', {
+      scope: instances.orgScope,
+    });
+    orgURL = `/scopes/${instances.orgScope.id}`;
+    urls.users = `/scopes/${instances.orgScope.id}/users`;
+    authenticateSession({});
+  });
+
+  test('can navigate to users with proper authorization', async function (assert) {
+    assert.expect(2);
+    await visit(orgURL);
+    assert.ok(
+      instances.orgScope.authorized_collection_actions.users.includes('list')
+    );
+    assert.ok(find(`[href="${urls.users}"]`));
+  });
+
+  test('User cannot navigate to index without either list or create actions', async function (assert) {
+    assert.expect(2);
+    instances.orgScope.authorized_collection_actions.users = [];
+    await visit(orgURL);
+    assert.notOk(
+      instances.orgScope.authorized_collection_actions.users.includes('list')
+    );
+    assert.notOk(find(`[href="${urls.users}"]`));
+  });
+
+  test('User can navigate to index with only create action', async function (assert) {
+    assert.expect(1);
+    instances.orgScope.authorized_collection_actions.users = ['create'];
+    await visit(orgURL);
+    assert.ok(find(`[href="${urls.users}"]`));
+  });
+});