diff --git a/addons/api/mirage/factories/user.js b/addons/api/mirage/factories/user.js
index 39c5abf96..b8463506d 100644
--- a/addons/api/mirage/factories/user.js
+++ b/addons/api/mirage/factories/user.js
@@ -1,5 +1,13 @@
 import factory from '../generated/factories/user';
+import permissions from '../helpers/permissions';
 
 export default factory.extend({
+  authorized_actions: () =>
+    permissions.authorizedActionsFor('user') || [
+      'no-op',
+      'read',
+      'update',
+      'delete',
+    ],
   id: (i) => `user-${i}`,
 });
diff --git a/ui/admin/app/components/form/user/index.hbs b/ui/admin/app/components/form/user/index.hbs
index a0c3230ef..7ed797846 100644
--- a/ui/admin/app/components/form/user/index.hbs
+++ b/ui/admin/app/components/form/user/index.hbs
@@ -46,11 +46,12 @@
     {{/if}}
   </form.textarea>
 
-  <form.actions
-    @disabled={{if @model.cannotSave @model.cannotSave}}
-    @enableEditText={{t 'actions.edit-form'}}
-    @submitText={{t 'actions.save'}}
-    @cancelText={{t 'actions.cancel'}}
-  />
-
+  {{#if (can 'save model' @model)}}
+    <form.actions
+      @disabled={{if @model.cannotSave @model.cannotSave}}
+      @enableEditText={{t 'actions.edit-form'}}
+      @submitText={{t 'actions.save'}}
+      @cancelText={{t 'actions.cancel'}}
+    />
+  {{/if}}
 </Rose::Form>
\ No newline at end of file
diff --git a/ui/admin/app/templates/scopes/scope/users/index.hbs b/ui/admin/app/templates/scopes/scope/users/index.hbs
index 5d44a46b0..ab31bc1cf 100644
--- a/ui/admin/app/templates/scopes/scope/users/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/users/index.hbs
@@ -37,9 +37,13 @@
           {{#each @model as |user|}}
             <body.row as |row|>
               <row.headerCell>
-                <LinkTo @route='scopes.scope.users.user' @model={{user.id}}>
+                {{#if (can 'read model' user)}}
+                  <LinkTo @route='scopes.scope.users.user' @model={{user.id}}>
+                    {{user.displayName}}
+                  </LinkTo>
+                {{else}}
                   {{user.displayName}}
-                </LinkTo>
+                {{/if}}
                 <p>{{user.description}}</p>
               </row.headerCell>
               <row.cell>
diff --git a/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs b/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs
index 0947bef21..4f993d425 100644
--- a/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs
+++ b/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs
@@ -1,17 +1,19 @@
-<Rose::Dropdown
-  @text='{{t 'actions.manage'}}'
-  @dropdownRight={{true}}
-  as |dropdown|
->
-  <dropdown.link @route='scopes.scope.users.user.add-accounts'>
-    {{t 'resources.user.actions.add-accounts'}}
-  </dropdown.link>
-  <dropdown.separator />
-  <dropdown.button
-    @style='danger'
-    @disabled={{@model.canSave}}
-    {{on 'click' (route-action 'delete' @model)}}
+{{#if (can 'delete model' @model)}}
+  <Rose::Dropdown
+    @text='{{t 'actions.manage'}}'
+    @dropdownRight={{true}}
+    as |dropdown|
   >
-    {{t 'resources.user.actions.delete'}}
-  </dropdown.button>
-</Rose::Dropdown>
\ No newline at end of file
+    <dropdown.link @route='scopes.scope.users.user.add-accounts'>
+      {{t 'resources.user.actions.add-accounts'}}
+    </dropdown.link>
+    <dropdown.separator />
+    <dropdown.button
+      @style='danger'
+      @disabled={{@model.canSave}}
+      {{on 'click' (route-action 'delete' @model)}}
+    >
+      {{t 'resources.user.actions.delete'}}
+    </dropdown.button>
+  </Rose::Dropdown>
+{{/if}}
\ No newline at end of file
diff --git a/ui/admin/jsconfig.json b/ui/admin/jsconfig.json
new file mode 100644
index 000000000..f408cac8c
--- /dev/null
+++ b/ui/admin/jsconfig.json
@@ -0,0 +1 @@
+{"compilerOptions":{"target":"es6","experimentalDecorators":true},"exclude":["node_modules","bower_components","tmp","vendor",".git","dist"]}
\ No newline at end of file
diff --git a/ui/admin/tests/acceptance/users-test.js b/ui/admin/tests/acceptance/users-test.js
index 065f8974b..b047a0d2a 100644
--- a/ui/admin/tests/acceptance/users-test.js
+++ b/ui/admin/tests/acceptance/users-test.js
@@ -2,7 +2,6 @@ import { module, test } from 'qunit';
 import { visit, currentURL, click, fillIn, find } from '@ember/test-helpers';
 import { setupApplicationTest } from 'ember-qunit';
 import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
-import a11yAudit from 'ember-a11y-testing/test-support/audit';
 import { Response } from 'miragejs';
 import {
   authenticateSession,
@@ -17,7 +16,6 @@ module('Acceptance | users', function (hooks) {
 
   let orgScope;
   let usersURL;
-  let userURL;
   let newUserURL;
 
   hooks.beforeEach(function () {
@@ -29,31 +27,12 @@ module('Acceptance | users', function (hooks) {
       'withChildren'
     );
 
-    const user = this.server.create('user', {
-      scope: orgScope,
-    });
-
     usersURL = `/scopes/${orgScope.id}/users`;
-    userURL = `${usersURL}/${user.id}`;
     newUserURL = `${usersURL}/new`;
 
     authenticateSession({});
   });
 
-  test('visiting users', async function (assert) {
-    assert.expect(1);
-    await visit(usersURL);
-    await a11yAudit();
-    assert.equal(currentURL(), usersURL);
-  });
-
-  test('visiting a user', async function (assert) {
-    assert.expect(1);
-    await visit(newUserURL);
-    await a11yAudit();
-    assert.equal(currentURL(), newUserURL);
-  });
-
   test('can create new users', async function (assert) {
     assert.expect(1);
     const usersCount = this.server.db.users.length;
@@ -108,90 +87,4 @@ module('Acceptance | users', function (hooks) {
       'Displays field-level errors.'
     );
   });
-
-  test('can save changes to an existing user', async function (assert) {
-    assert.expect(2);
-    await visit(userURL);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'Updated user name');
-    await click('.rose-form-actions [type="submit"]');
-    assert.equal(currentURL(), userURL);
-    assert.equal(this.server.db.users[0].name, 'Updated user name');
-  });
-
-  test('can cancel changes to an existing user', async function (assert) {
-    assert.expect(1);
-    await visit(userURL);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'Unsaved user name');
-    await click('.rose-form-actions [type="button"]');
-    assert.notEqual(find('[name="name"]').value, 'Unsaved user name');
-  });
-
-  test('can delete an user', async function (assert) {
-    assert.expect(1);
-    const usersCount = this.server.db.users.length;
-    await visit(userURL);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    assert.equal(this.server.db.users.length, usersCount - 1);
-  });
-
-  test('saving an existing user with invalid fields displays error messages', async function (assert) {
-    assert.expect(2);
-    this.server.patch('/users/:id', () => {
-      return new Response(
-        400,
-        {},
-        {
-          status: 400,
-          code: 'invalid_argument',
-          message: 'The request was invalid.',
-          details: {
-            request_fields: [
-              {
-                name: 'name',
-                description: 'Name is required.',
-              },
-            ],
-          },
-        }
-      );
-    });
-    await visit(userURL);
-    await click('form [type="button"]', 'Activate edit mode');
-    await fillIn('[name="name"]', 'User name');
-    await click('[type="submit"]');
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'The request was invalid.',
-      'Displays primary error message.'
-    );
-    assert.ok(
-      find('.rose-form-error-message').textContent.trim(),
-      'Name is required.',
-      'Displays field-level errors.'
-    );
-  });
-
-  test('errors are displayed when user deletion fails', async function (assert) {
-    assert.expect(1);
-    this.server.del('/users/:id', () => {
-      return new Response(
-        490,
-        {},
-        {
-          status: 490,
-          code: 'error',
-          message: 'Oops.',
-        }
-      );
-    });
-    await visit(userURL);
-    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
-    assert.ok(
-      find('[role="alert"]').textContent.trim(),
-      'Oops.',
-      'Displays primary error message.'
-    );
-  });
 });
diff --git a/ui/admin/tests/acceptance/users/delete-test.js b/ui/admin/tests/acceptance/users/delete-test.js
new file mode 100644
index 000000000..14b5371fc
--- /dev/null
+++ b/ui/admin/tests/acceptance/users/delete-test.js
@@ -0,0 +1,86 @@
+import { module, test } from 'qunit';
+import { visit, click, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import { Response } from 'miragejs';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | users | delete', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  let orgScope;
+  let usersURL;
+  let userURL;
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    user: null,
+  };
+  hooks.beforeEach(function () {
+    orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+      },
+      'withChildren'
+    );
+
+    instances.user = this.server.create('user', {
+      scope: orgScope,
+    });
+    //instances.user = this.server.schema.users.all().models[0];
+    usersURL = `/scopes/${orgScope.id}/users`;
+    userURL = `${usersURL}/${instances.user.id}`;
+
+    authenticateSession({});
+  });
+
+  test('can delete an user', async function (assert) {
+    assert.expect(1);
+    const usersCount = this.server.db.users.length;
+    await visit(userURL);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    assert.equal(this.server.db.users.length, usersCount - 1);
+  });
+
+  test('cannot delete a user without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.user.authorized_actions =
+      instances.user.authorized_actions.filter((item) => item !== 'delete');
+    await visit(userURL);
+    assert.notOk(
+      find('.rose-layout-page-actions .rose-dropdown-button-danger')
+    );
+  });
+
+  test('errors are displayed when user deletion fails', async function (assert) {
+    assert.expect(1);
+    this.server.del('/users/:id', () => {
+      return new Response(
+        490,
+        {},
+        {
+          status: 490,
+          code: 'error',
+          message: 'Oops.',
+        }
+      );
+    });
+    await visit(userURL);
+    await click('.rose-layout-page-actions .rose-dropdown-button-danger');
+    assert.ok(
+      find('[role="alert"]').textContent.trim(),
+      'Oops.',
+      'Displays primary error message.'
+    );
+  });
+});
diff --git a/ui/admin/tests/acceptance/users/read-test.js b/ui/admin/tests/acceptance/users/read-test.js
new file mode 100644
index 000000000..06b9f4880
--- /dev/null
+++ b/ui/admin/tests/acceptance/users/read-test.js
@@ -0,0 +1,57 @@
+import { module, test } from 'qunit';
+import { visit, currentURL, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import a11yAudit from 'ember-a11y-testing/test-support/audit';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | users | read', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  let orgScope;
+  let usersURL;
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    user: null,
+  };
+
+  hooks.beforeEach(function () {
+    orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+      },
+      'withChildren'
+    );
+    instances.user = this.server.create('user', {
+      scope: orgScope,
+    });
+    usersURL = `/scopes/${orgScope.id}/users`;
+    authenticateSession({});
+  });
+
+  test('visiting users', async function (assert) {
+    assert.expect(1);
+    await visit(usersURL);
+    await a11yAudit();
+    assert.equal(currentURL(), usersURL);
+  });
+
+  test('cannot navigate to an account form without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.user.authorized_actions =
+      instances.user.authorized_actions.filter((item) => item !== 'read');
+    await visit(usersURL);
+    assert.notOk(find('main tbody .rose-table-header-cell:nth-child(1) a'));
+  });
+});
diff --git a/ui/admin/tests/acceptance/users/update-test.js b/ui/admin/tests/acceptance/users/update-test.js
new file mode 100644
index 000000000..931a58641
--- /dev/null
+++ b/ui/admin/tests/acceptance/users/update-test.js
@@ -0,0 +1,110 @@
+import { module, test } from 'qunit';
+import { visit, currentURL, click, fillIn, find } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import { Response } from 'miragejs';
+import {
+  authenticateSession,
+  // These are left here intentionally for future reference.
+  //currentSession,
+  //invalidateSession,
+} from 'ember-simple-auth/test-support';
+
+module('Acceptance | users | update', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  let orgScope;
+  let usersURL;
+  let userURL;
+
+  const instances = {
+    scopes: {
+      global: null,
+      org: null,
+    },
+    user: null,
+  };
+
+  hooks.beforeEach(function () {
+    orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+      },
+      'withChildren'
+    );
+
+    instances.user = this.server.create('user', {
+      scope: orgScope,
+    });
+
+    usersURL = `/scopes/${orgScope.id}/users`;
+    userURL = `${usersURL}/${instances.user.id}`;
+
+    authenticateSession({});
+  });
+  test('can save changes to an existing user', async function (assert) {
+    assert.expect(2);
+    await visit(userURL);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'Updated user name');
+    await click('.rose-form-actions [type="submit"]');
+    assert.equal(currentURL(), userURL);
+    assert.equal(this.server.db.users[0].name, 'Updated user name');
+  });
+
+  test('cannot make changes to an existing user without proper authorization', async function (assert) {
+    assert.expect(1);
+    instances.user.authorized_actions =
+      instances.user.authorized_actions.filter((item) => item !== 'update');
+    await visit(userURL);
+    assert.notOk(find('.rose-layout-page-actions .rose-button-secondary'));
+  });
+
+  test('can cancel changes to an existing user', async function (assert) {
+    assert.expect(1);
+    await visit(userURL);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'Unsaved user name');
+    await click('.rose-form-actions [type="button"]');
+    assert.notEqual(find('[name="name"]').value, 'Unsaved user name');
+  });
+
+  test('saving an existing user with invalid fields displays error messages', async function (assert) {
+    assert.expect(2);
+    this.server.patch('/users/:id', () => {
+      return new Response(
+        400,
+        {},
+        {
+          status: 400,
+          code: 'invalid_argument',
+          message: 'The request was invalid.',
+          details: {
+            request_fields: [
+              {
+                name: 'name',
+                description: 'Name is required.',
+              },
+            ],
+          },
+        }
+      );
+    });
+    await visit(userURL);
+    await click('form [type="button"]', 'Activate edit mode');
+    await fillIn('[name="name"]', 'User name');
+    await click('[type="submit"]');
+    assert.ok(
+      find('[role="alert"]').textContent.trim(),
+      'The request was invalid.',
+      'Displays primary error message.'
+    );
+    assert.ok(
+      find('.rose-form-error-message').textContent.trim(),
+      'Name is required.',
+      'Displays field-level errors.'
+    );
+  });
+});
diff --git a/ui/desktop/jsconfig.json b/ui/desktop/jsconfig.json
new file mode 100644
index 000000000..f408cac8c
--- /dev/null
+++ b/ui/desktop/jsconfig.json
@@ -0,0 +1 @@
+{"compilerOptions":{"target":"es6","experimentalDecorators":true},"exclude":["node_modules","bower_components","tmp","vendor",".git","dist"]}
\ No newline at end of file