diff --git a/addons/api/addon/models/base.js b/addons/api/addon/models/base.js
index 70da1b8a6..16b50048c 100644
--- a/addons/api/addon/models/base.js
+++ b/addons/api/addon/models/base.js
@@ -1,4 +1,5 @@
 import Model from '@ember-data/model';
+import { attr } from '@ember-data/model';
 import { fragment } from 'ember-data-model-fragments/attributes';
 import { computed } from '@ember/object';
 
@@ -35,6 +36,11 @@ export default class BaseModel extends Model {
 
   // =attributes
 
+  @attr({
+    readOnly: true,
+    emptyArrayIfMissing: true,
+  }) authorized_actions;
+
   set scopeModel(model) {
     if (model) {
       const json = model.serialize();
diff --git a/addons/api/mirage/serializers/application.js b/addons/api/mirage/serializers/application.js
index 453e11e21..f63e2bfbd 100644
--- a/addons/api/mirage/serializers/application.js
+++ b/addons/api/mirage/serializers/application.js
@@ -61,6 +61,8 @@ export default RestSerializer.extend({
         type: model.scope.type,
       };
     }
+    // TODO:  make these toggleable
+    json.authorized_actions = ['read', 'update', 'delete'];
     return json;
   },
 
diff --git a/ui/admin/app/components/form/user/index.hbs b/ui/admin/app/components/form/user/index.hbs
index a0c3230ef..d86d409b3 100644
--- a/ui/admin/app/components/form/user/index.hbs
+++ b/ui/admin/app/components/form/user/index.hbs
@@ -46,11 +46,13 @@
     {{/if}}
   </form.textarea>
 
-  <form.actions
-    @disabled={{if @model.cannotSave @model.cannotSave}}
-    @enableEditText={{t 'actions.edit-form'}}
-    @submitText={{t 'actions.save'}}
-    @cancelText={{t 'actions.cancel'}}
-  />
+  {{#if (can 'save model' @model)}}
+    <form.actions
+      @disabled={{if @model.cannotSave @model.cannotSave}}
+      @enableEditText={{t 'actions.edit-form'}}
+      @submitText={{t 'actions.save'}}
+      @cancelText={{t 'actions.cancel'}}
+    />
+  {{/if}}
 
 </Rose::Form>
\ No newline at end of file
diff --git a/ui/admin/app/templates/scopes/scope/users/index.hbs b/ui/admin/app/templates/scopes/scope/users/index.hbs
index 5d44a46b0..ab31bc1cf 100644
--- a/ui/admin/app/templates/scopes/scope/users/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/users/index.hbs
@@ -37,9 +37,13 @@
           {{#each @model as |user|}}
             <body.row as |row|>
               <row.headerCell>
-                <LinkTo @route='scopes.scope.users.user' @model={{user.id}}>
+                {{#if (can 'read model' user)}}
+                  <LinkTo @route='scopes.scope.users.user' @model={{user.id}}>
+                    {{user.displayName}}
+                  </LinkTo>
+                {{else}}
                   {{user.displayName}}
-                </LinkTo>
+                {{/if}}
                 <p>{{user.description}}</p>
               </row.headerCell>
               <row.cell>
diff --git a/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs b/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs
index 0947bef21..280fd98bb 100644
--- a/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs
+++ b/ui/admin/app/templates/scopes/scope/users/user/-actions.hbs
@@ -6,12 +6,14 @@
   <dropdown.link @route='scopes.scope.users.user.add-accounts'>
     {{t 'resources.user.actions.add-accounts'}}
   </dropdown.link>
-  <dropdown.separator />
-  <dropdown.button
-    @style='danger'
-    @disabled={{@model.canSave}}
-    {{on 'click' (route-action 'delete' @model)}}
-  >
-    {{t 'resources.user.actions.delete'}}
-  </dropdown.button>
+  {{#if (can 'delete model' @model)}}
+    <dropdown.separator />
+    <dropdown.button
+      @style='danger'
+      @disabled={{@model.canSave}}
+      {{on 'click' (route-action 'delete' @model)}}
+    >
+      {{t 'resources.user.actions.delete'}}
+    </dropdown.button>
+  {{/if}}
 </Rose::Dropdown>
\ No newline at end of file