diff --git a/addons/api/mirage/factories/account.js b/addons/api/mirage/factories/account.js
index 5c49f96b5..569d4d8fc 100644
--- a/addons/api/mirage/factories/account.js
+++ b/addons/api/mirage/factories/account.js
@@ -2,6 +2,7 @@ import factory from '../generated/factories/account';
 import { random, internet } from 'faker';
 
 export default factory.extend({
+  authorized_actions: () => ['no-op', 'read', 'update', 'delete'],
   attributes() {
     switch (this.type) {
       case 'password':
diff --git a/addons/api/mirage/serializers/application.js b/addons/api/mirage/serializers/application.js
index f63e2bfbd..453e11e21 100644
--- a/addons/api/mirage/serializers/application.js
+++ b/addons/api/mirage/serializers/application.js
@@ -61,8 +61,6 @@ export default RestSerializer.extend({
         type: model.scope.type,
       };
     }
-    // TODO:  make these toggleable
-    json.authorized_actions = ['read', 'update', 'delete'];
     return json;
   },
 
diff --git a/addons/api/tests/unit/abilities/model-test.js b/addons/api/tests/unit/abilities/model-test.js
index dd989f94f..8bff24680 100644
--- a/addons/api/tests/unit/abilities/model-test.js
+++ b/addons/api/tests/unit/abilities/model-test.js
@@ -7,10 +7,9 @@ module('Unit | Abilities | Model', function (hooks) {
   test('it reflects when a given model may be read based on authorized_actions', function (assert) {
     assert.expect(2);
     const service = this.owner.lookup('service:can');
-    const store = this.owner.lookup('service:store');
-    const model = store.createRecord('account', {
+    const model = {
       authorized_actions: ['read'],
-    });
+    };
     assert.ok(service.can('read model', model));
     model.authorized_actions = [];
     assert.notOk(service.can('read model', model));
@@ -19,22 +18,49 @@ module('Unit | Abilities | Model', function (hooks) {
   test('it reflects when a given model may be updated based on authorized_actions', function (assert) {
     assert.expect(2);
     const service = this.owner.lookup('service:can');
-    const store = this.owner.lookup('service:store');
-    const model = store.createRecord('account', {
+    const model = {
       authorized_actions: ['update'],
-    });
+    };
     assert.ok(service.can('update model', model));
     model.authorized_actions = [];
     assert.notOk(service.can('update model', model));
   });
 
+  test('it reflects when a given model may be saved based on isNew and authorized_actions', function (assert) {
+    assert.expect(4);
+    const service = this.owner.lookup('service:can');
+    let model = {
+      isNew: false,
+      authorized_actions: ['update'],
+    };
+    assert.ok(service.can('save model', model));
+    model = {
+      isNew: false,
+      authorized_actions: [],
+    };
+    assert.notOk(service.can('save model', model));
+    // Model instances are always saveable at this level when isNew is true.
+    // In practice, the ability to _create_ a resource depends not on instance
+    // authorization, but on collection authorization, which is
+    // tested separately.
+    model = {
+      isNew: true,
+      authorized_actions: ['update'],
+    };
+    assert.ok(service.can('save model', model));
+    model = {
+      isNew: true,
+      authorized_actions: [],
+    };
+    assert.ok(service.can('save model', model));
+  });
+
   test('it reflects when a given model may be deleted based on authorized_actions', function (assert) {
     assert.expect(2);
     const service = this.owner.lookup('service:can');
-    const store = this.owner.lookup('service:store');
-    const model = store.createRecord('account', {
+    const model = {
       authorized_actions: ['delete'],
-    });
+    };
     assert.ok(service.can('delete model', model));
     model.authorized_actions = [];
     assert.notOk(service.can('delete model', model));
diff --git a/ui/admin/app/components/form/user/index.hbs b/ui/admin/app/components/form/user/index.hbs
index d86d409b3..a0c3230ef 100644
--- a/ui/admin/app/components/form/user/index.hbs
+++ b/ui/admin/app/components/form/user/index.hbs
@@ -46,13 +46,11 @@
     {{/if}}
   </form.textarea>
 
-  {{#if (can 'save model' @model)}}
-    <form.actions
-      @disabled={{if @model.cannotSave @model.cannotSave}}
-      @enableEditText={{t 'actions.edit-form'}}
-      @submitText={{t 'actions.save'}}
-      @cancelText={{t 'actions.cancel'}}
-    />
-  {{/if}}
+  <form.actions
+    @disabled={{if @model.cannotSave @model.cannotSave}}
+    @enableEditText={{t 'actions.edit-form'}}
+    @submitText={{t 'actions.save'}}
+    @cancelText={{t 'actions.cancel'}}
+  />
 
 </Rose::Form>
\ No newline at end of file
diff --git a/ui/admin/app/templates/scopes/scope/users/index.hbs b/ui/admin/app/templates/scopes/scope/users/index.hbs
index ab31bc1cf..5d44a46b0 100644
--- a/ui/admin/app/templates/scopes/scope/users/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/users/index.hbs
@@ -37,13 +37,9 @@
           {{#each @model as |user|}}
             <body.row as |row|>
               <row.headerCell>
-                {{#if (can 'read model' user)}}
-                  <LinkTo @route='scopes.scope.users.user' @model={{user.id}}>
-                    {{user.displayName}}
-                  </LinkTo>
-                {{else}}
+                <LinkTo @route='scopes.scope.users.user' @model={{user.id}}>
                   {{user.displayName}}
-                {{/if}}
+                </LinkTo>
                 <p>{{user.description}}</p>
               </row.headerCell>
               <row.cell>
diff --git a/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs b/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs
index 280fd98bb..0947bef21 100644
--- a/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs
+++ b/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs
@@ -6,14 +6,12 @@
   <dropdown.link @route='scopes.scope.users.user.add-accounts'>
     {{t 'resources.user.actions.add-accounts'}}
   </dropdown.link>
-  {{#if (can 'delete model' @model)}}
-    <dropdown.separator />
-    <dropdown.button
-      @style='danger'
-      @disabled={{@model.canSave}}
-      {{on 'click' (route-action 'delete' @model)}}
-    >
-      {{t 'resources.user.actions.delete'}}
-    </dropdown.button>
-  {{/if}}
+  <dropdown.separator />
+  <dropdown.button
+    @style='danger'
+    @disabled={{@model.canSave}}
+    {{on 'click' (route-action 'delete' @model)}}
+  >
+    {{t 'resources.user.actions.delete'}}
+  </dropdown.button>
 </Rose::Dropdown>
\ No newline at end of file