diff --git a/addons/api/addon/abilities/account.js b/addons/api/addon/abilities/account.js
new file mode 100644
index 000000000..147f73b9f
--- /dev/null
+++ b/addons/api/addon/abilities/account.js
@@ -0,0 +1,15 @@
+import ModelAbility from './model';
+
+/**
+ * Provides abilities for accounts.
+ */
+export default class AccountAbility extends ModelAbility {
+  // =permissions
+
+  /**
+   * @type {boolean}
+   */
+  get canSetPassword() {
+    return this.hasAuthorizedAction('set-password');
+  }
+}
diff --git a/addons/api/addon/abilities/target.js b/addons/api/addon/abilities/target.js
index fb6b30d33..11516c3b5 100644
--- a/addons/api/addon/abilities/target.js
+++ b/addons/api/addon/abilities/target.js
@@ -1,7 +1,7 @@
 import ModelAbility from './model';
 
 /**
- * Provides a `connect` ability for targets.
+ * Provides abilities for targets.
  */
 export default class TargetAbility extends ModelAbility {
   // =permissions
diff --git a/addons/api/app/abilities/account.js b/addons/api/app/abilities/account.js
new file mode 100644
index 000000000..e64435a5e
--- /dev/null
+++ b/addons/api/app/abilities/account.js
@@ -0,0 +1 @@
+export { default } from 'api/abilities/account';
diff --git a/addons/api/mirage/factories/account.js b/addons/api/mirage/factories/account.js
index 5b7a14c09..f5da7b5af 100644
--- a/addons/api/mirage/factories/account.js
+++ b/addons/api/mirage/factories/account.js
@@ -9,6 +9,7 @@ export default factory.extend({
       'read',
       'update',
       'delete',
+      'set-password',
     ],
   attributes() {
     switch (this.type) {
diff --git a/addons/api/tests/unit/abilities/account-test-.js b/addons/api/tests/unit/abilities/account-test-.js
new file mode 100644
index 000000000..afd89329d
--- /dev/null
+++ b/addons/api/tests/unit/abilities/account-test-.js
@@ -0,0 +1,17 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Abilities | Account', function (hooks) {
+  setupTest(hooks);
+
+  test('it reflects when a given account may set password based on authorized_actions', function (assert) {
+    assert.expect(2);
+    const service = this.owner.lookup('service:can');
+    const model = {
+      authorized_actions: ['set-password'],
+    };
+    assert.ok(service.can('setPassword target', model));
+    model.authorized_actions = [];
+    assert.notOk(service.can('setPassword target', model));
+  });
+});
diff --git a/ui/admin/app/index.html b/ui/admin/app/index.html
index befb5d7b5..04a597a2f 100644
--- a/ui/admin/app/index.html
+++ b/ui/admin/app/index.html
@@ -6,6 +6,7 @@
     <title>Admin</title>
     <meta name="description" content="Simple and secure remote access with HashiCorp Boundary.">
     <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="theme-color" content="#f24c53">
 
     {{content-for "head"}}
 
diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/account/-navigation.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/account/-navigation.hbs
index da08d1834..12ca372ce 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/account/-navigation.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/accounts/account/-navigation.hbs
@@ -5,10 +5,12 @@
     {{t 'titles.details'}}
   </nav.link>
   {{#if @model.isPassword}}
-    <nav.link
-      @route='scopes.scope.auth-methods.auth-method.accounts.account.set-password'
-    >
-      {{t 'actions.set-password'}}
-    </nav.link>
+    {{#if (can 'setPassword account' @model)}}
+      <nav.link
+        @route='scopes.scope.auth-methods.auth-method.accounts.account.set-password'
+      >
+        {{t 'actions.set-password'}}
+      </nav.link>
+    {{/if}}
   {{/if}}
 </Rose::Nav::Tabs>
\ No newline at end of file
diff --git a/ui/admin/tests/acceptance/accounts/set-password-test.js b/ui/admin/tests/acceptance/accounts/set-password-test.js
index 677e9bd7c..89f9ce3e7 100644
--- a/ui/admin/tests/acceptance/accounts/set-password-test.js
+++ b/ui/admin/tests/acceptance/accounts/set-password-test.js
@@ -49,7 +49,8 @@ module('Acceptance | accounts | set password', function (hooks) {
     urls.authMethods = `${urls.orgScope}/auth-methods`;
     urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
     urls.accounts = `${urls.authMethod}/accounts`;
-    urls.setPassword = `${urls.accounts}/${instances.account.id}/set-password`;
+    urls.account = `${urls.accounts}/${instances.account.id}`;
+    urls.setPassword = `${urls.account}/set-password`;
   });
 
   test('visiting account set password', async function (assert) {
@@ -59,6 +60,26 @@ module('Acceptance | accounts | set password', function (hooks) {
     assert.equal(currentURL(), urls.setPassword);
   });
 
+  test('can navigate to route with proper authorization', async function (assert) {
+    assert.expect(1);
+    await visit(urls.account);
+    assert.ok(
+      find(`.rose-layout-page-navigation [href="${urls.setPassword}"]`)
+    );
+  });
+
+  test('cannot navigate to route without proper authorization', async function (assert) {
+    assert.expect(1);
+    const authorized_actions = instances.account.authorized_actions.filter(
+      (item) => item !== 'set-password'
+    );
+    instances.account.update({ authorized_actions });
+    await visit(urls.account);
+    assert.notOk(
+      find(`.rose-layout-page-navigation [href="${urls.setPassword}"]`)
+    );
+  });
+
   test('can set a new password for account', async function (assert) {
     assert.expect(1);
     this.server.post(