diff --git a/addons/api/mirage/factories/scope.js b/addons/api/mirage/factories/scope.js
index 09a87d09e..bb43723c0 100644
--- a/addons/api/mirage/factories/scope.js
+++ b/addons/api/mirage/factories/scope.js
@@ -7,10 +7,10 @@ export default factory.extend({
   authorized_collection_actions: () => {
     return {
       users: ['create', 'list'],
+      sessions: ['list'],
       groups: ['create', 'list'],
       roles: ['create', 'list'],
       'auth-methods': ['create', 'list'],
-      // sessopms: ['list'],
       // targets: ['create', 'list'],
       'host-catalogs': ['create', 'list'],
       // 'credential-stores': ['create', 'list'],
diff --git a/ui/admin/app/templates/scopes/scope.hbs b/ui/admin/app/templates/scopes/scope.hbs
index 5169fb657..2a1a045d7 100644
--- a/ui/admin/app/templates/scopes/scope.hbs
+++ b/ui/admin/app/templates/scopes/scope.hbs
@@ -71,10 +71,12 @@
         </Rose::Nav::Sidebar>
         --}}
         <Rose::Nav::Sidebar @title={{t 'titles.resources'}} as |nav|>
-          <nav.link @route='scopes.scope.sessions'>
-            <Rose::Icon @name='flight-icons/entry-point-16' @size='medium' />
-            {{t 'resources.session.title_plural'}}
-          </nav.link>
+          {{#if (can 'navigate collection' @model collection='sessions')}}
+            <nav.link @route='scopes.scope.sessions'>
+              <Rose::Icon @name='app-icons/action-session' @size='medium' />
+              {{t 'resources.session.title_plural'}}
+            </nav.link>
+          {{/if}}
           <nav.link @route='scopes.scope.targets'>
             <Rose::Icon @name='flight-icons/crosshair-16' @size='medium' />
             {{t 'resources.target.title_plural'}}
diff --git a/ui/admin/tests/acceptance/sessions-test.js b/ui/admin/tests/acceptance/sessions-test.js
index d5f68ffeb..a5dfa25ff 100644
--- a/ui/admin/tests/acceptance/sessions-test.js
+++ b/ui/admin/tests/acceptance/sessions-test.js
@@ -15,13 +15,13 @@ import {
 module('Acceptance | sessions', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
-
   const instances = {
     scopes: {
       global: null,
       org: null,
     },
     sessions: null,
+    orgScope: null,
   };
   const urls = {
     orgScope: null,
@@ -31,6 +31,14 @@ module('Acceptance | sessions', function (hooks) {
   hooks.beforeEach(function () {
     authenticateSession({});
     instances.scopes.global = this.server.create('scope', { id: 'global' });
+    instances.orgScope = this.server.create(
+      'scope',
+      {
+        type: 'org',
+        scope: { id: 'global', type: 'global' },
+      },
+      'withChildren'
+    );
     instances.scopes.org = this.server.create('scope', {
       type: 'org',
       scope: { id: 'global', type: 'global' },
@@ -66,6 +74,7 @@ module('Acceptance | sessions', function (hooks) {
       },
       'withAssociations'
     );
+    urls.orgScope = `/scopes/${instances.scopes.project.id}`;
     urls.sessions = `/scopes/${instances.scopes.project.id}/sessions`;
   });
 
@@ -81,6 +90,38 @@ module('Acceptance | sessions', function (hooks) {
     await visit(urls.sessions);
   });
 
+  test('Users cannot navigate to sessions without proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions.sessions = [];
+    authenticateSession({});
+    later(async () => {
+      run.cancelTimers();
+      assert.notOk(
+        instances.scopes.project.authorized_collection_actions.sessions.includes(
+          'list'
+        )
+      );
+      assert.notOk(find(`[href="${urls.sessions}"]`));
+    }, 750);
+    await visit(urls.orgScope);
+  });
+
+  test('Users can navigate to sessions with proper authorization', async function (assert) {
+    assert.expect(2);
+    instances.scopes.project.authorized_collection_actions.sessions = ['list'];
+    authenticateSession({});
+    later(async () => {
+      run.cancelTimers();
+      assert.ok(
+        instances.scopes.project.authorized_collection_actions.sessions.includes(
+          'list'
+        )
+      );
+      assert.ok(find(`[href="${urls.sessions}"]`));
+    }, 750);
+    await visit(urls.orgScope);
+  });
+
   test('visiting sessions without users or targets is OK', async function (assert) {
     assert.expect(2);
     instances.sessions[0].update({
diff --git a/ui/admin/tests/acceptance/users/create-test.js b/ui/admin/tests/acceptance/users/create-test.js
index fbff7fbee..99b715b9b 100644
--- a/ui/admin/tests/acceptance/users/create-test.js
+++ b/ui/admin/tests/acceptance/users/create-test.js
@@ -45,14 +45,14 @@ module('Acceptance | users | create', function (hooks) {
     assert.equal(this.server.db.users.length, usersCount + 1);
   });
 
-  test('can navigate to new users route with proper authorization', async function (assert) {
+  test('Users can navigate to new users route with proper authorization', async function (assert) {
     assert.expect(2);
     await visit(orgURL);
     assert.ok(orgScope.authorized_collection_actions.users.includes('create'));
     assert.ok(find(`[href="${orgURL}/users"]`));
   });
 
-  test('cannot navigate to new users route without proper authorization', async function (assert) {
+  test('Users cannot navigate to new users route without proper authorization', async function (assert) {
     assert.expect(2);
     orgScope.authorized_collection_actions.users = [];
     await visit(orgURL);
diff --git a/ui/admin/tests/acceptance/users/list-test.js b/ui/admin/tests/acceptance/users/list-test.js
index 72a6e35eb..d453e5b04 100644
--- a/ui/admin/tests/acceptance/users/list-test.js
+++ b/ui/admin/tests/acceptance/users/list-test.js
@@ -47,7 +47,7 @@ module('Acceptance | users | list', function (hooks) {
     authenticateSession({});
   });
 
-  test('can navigate to users with proper authorization', async function (assert) {
+  test('Users can navigate to users with proper authorization', async function (assert) {
     assert.expect(2);
     await visit(orgURL);
     assert.ok(