Add authorized actions output on resources (#870)

internal/servers/controller/handlers/accounts/account_service.go

@@ -10,6 +10,7 @@ import (
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/accounts"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -18,7 +19,26 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var maskManager handlers.MaskManager
+var (
+	maskManager handlers.MaskManager
+
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Update,
+		action.Delete,
+		action.SetPassword,
+		action.ChangePassword,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
+)
 
 func init() {
 	var err error
@@ -57,10 +77,20 @@ func (s Service) ListAccounts(ctx context.Context, req *pbs.ListAccountsRequest)
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.Account, 0, len(ul))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.Account,
+		Pin:     req.GetAuthMethodId(),
+	}
 	for _, item := range ul {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+		}
 	}
-	return &pbs.ListAccountsResponse{Items: ul}, nil
+	return &pbs.ListAccountsResponse{Items: finalItems}, nil
 }
 
 // GetAccount implements the interface pbs.AccountServiceServer.
@@ -77,6 +107,7 @@ func (s Service) GetAccount(ctx context.Context, req *pbs.GetAccountRequest) (*p
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.GetAccountResponse{Item: u}, nil
 }
 
@@ -94,6 +125,7 @@ func (s Service) CreateAccount(ctx context.Context, req *pbs.CreateAccountReques
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.CreateAccountResponse{Item: u, Uri: fmt.Sprintf("accounts/%s", u.GetId())}, nil
 }
 
@@ -111,6 +143,7 @@ func (s Service) UpdateAccount(ctx context.Context, req *pbs.UpdateAccountReques
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.UpdateAccountResponse{Item: u}, nil
 }
 
@@ -144,6 +177,7 @@ func (s Service) ChangePassword(ctx context.Context, req *pbs.ChangePasswordRequ
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.ChangePasswordResponse{Item: u}, nil
 }
 
@@ -161,6 +195,7 @@ func (s Service) SetPassword(ctx context.Context, req *pbs.SetPasswordRequest) (
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.SetPasswordResponse{Item: u}, nil
 }
 

internal/servers/controller/handlers/accounts/account_service_test.go

@@ -46,14 +46,15 @@ func TestGet(t *testing.T) {
 	aa := password.TestAccounts(t, conn, am.GetPublicId(), 1)[0]
 
 	wireAccount := pb.Account{
-		Id:           aa.GetPublicId(),
-		AuthMethodId: aa.GetAuthMethodId(),
-		CreatedTime:  aa.GetCreateTime().GetTimestamp(),
-		UpdatedTime:  aa.GetUpdateTime().GetTimestamp(),
-		Scope:        &scopepb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
-		Version:      1,
-		Type:         "password",
-		Attributes:   &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(aa.GetLoginName())}},
+		Id:                aa.GetPublicId(),
+		AuthMethodId:      aa.GetAuthMethodId(),
+		CreatedTime:       aa.GetCreateTime().GetTimestamp(),
+		UpdatedTime:       aa.GetUpdateTime().GetTimestamp(),
+		Scope:             &scopepb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+		Version:           1,
+		Type:              "password",
+		Attributes:        &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(aa.GetLoginName())}},
+		AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 	}
 
 	cases := []struct {
@@ -115,28 +116,30 @@ func TestList(t *testing.T) {
 	var wantSomeAccounts []*pb.Account
 	for _, aa := range password.TestAccounts(t, conn, amSomeAccounts.GetPublicId(), 3) {
 		wantSomeAccounts = append(wantSomeAccounts, &pb.Account{
-			Id:           aa.GetPublicId(),
-			AuthMethodId: aa.GetAuthMethodId(),
-			CreatedTime:  aa.GetCreateTime().GetTimestamp(),
-			UpdatedTime:  aa.GetUpdateTime().GetTimestamp(),
-			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
-			Version:      1,
-			Type:         "password",
-			Attributes:   &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(aa.GetLoginName())}},
+			Id:                aa.GetPublicId(),
+			AuthMethodId:      aa.GetAuthMethodId(),
+			CreatedTime:       aa.GetCreateTime().GetTimestamp(),
+			UpdatedTime:       aa.GetUpdateTime().GetTimestamp(),
+			Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+			Version:           1,
+			Type:              "password",
+			Attributes:        &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(aa.GetLoginName())}},
+			AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 		})
 	}
 
 	var wantOtherAccounts []*pb.Account
 	for _, aa := range password.TestAccounts(t, conn, amOtherAccounts.GetPublicId(), 3) {
 		wantOtherAccounts = append(wantOtherAccounts, &pb.Account{
-			Id:           aa.GetPublicId(),
-			AuthMethodId: aa.GetAuthMethodId(),
-			CreatedTime:  aa.GetCreateTime().GetTimestamp(),
-			UpdatedTime:  aa.GetUpdateTime().GetTimestamp(),
-			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
-			Version:      1,
-			Type:         "password",
-			Attributes:   &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(aa.GetLoginName())}},
+			Id:                aa.GetPublicId(),
+			AuthMethodId:      aa.GetAuthMethodId(),
+			CreatedTime:       aa.GetCreateTime().GetTimestamp(),
+			UpdatedTime:       aa.GetUpdateTime().GetTimestamp(),
+			Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+			Version:           1,
+			Type:              "password",
+			Attributes:        &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(aa.GetLoginName())}},
+			AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 		})
 	}
 
@@ -315,13 +318,14 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateAccountResponse{
 				Uri: fmt.Sprintf("accounts/%s_", password.AccountPrefix),
 				Item: &pb.Account{
-					AuthMethodId: defaultAccount.GetAuthMethodId(),
-					Name:         &wrapperspb.StringValue{Value: "name"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
-					Version:      1,
-					Type:         "password",
-					Attributes:   createAttr("validaccount", ""),
+					AuthMethodId:      defaultAccount.GetAuthMethodId(),
+					Name:              &wrapperspb.StringValue{Value: "name"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+					Version:           1,
+					Type:              "password",
+					Attributes:        createAttr("validaccount", ""),
+					AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 				},
 			},
 		},
@@ -336,11 +340,12 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateAccountResponse{
 				Uri: fmt.Sprintf("accounts/%s_", password.AccountPrefix),
 				Item: &pb.Account{
-					AuthMethodId: defaultAccount.GetAuthMethodId(),
-					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
-					Version:      1,
-					Type:         "password",
-					Attributes:   createAttr("notypedefined", ""),
+					AuthMethodId:      defaultAccount.GetAuthMethodId(),
+					Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+					Version:           1,
+					Type:              "password",
+					Attributes:        createAttr("notypedefined", ""),
+					AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 				},
 			},
 		},
@@ -357,13 +362,14 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateAccountResponse{
 				Uri: fmt.Sprintf("accounts/%s_", password.AccountPrefix),
 				Item: &pb.Account{
-					AuthMethodId: defaultAccount.GetAuthMethodId(),
-					Name:         &wrapperspb.StringValue{Value: "name_with_password"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
-					Version:      1,
-					Type:         "password",
-					Attributes:   createAttr("haspassword", ""),
+					AuthMethodId:      defaultAccount.GetAuthMethodId(),
+					Name:              &wrapperspb.StringValue{Value: "name_with_password"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+					Version:           1,
+					Type:              "password",
+					Attributes:        createAttr("haspassword", ""),
+					AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 				},
 			},
 		},
@@ -525,12 +531,13 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateAccountResponse{
 				Item: &pb.Account{
-					AuthMethodId: am.GetPublicId(),
-					Name:         &wrapperspb.StringValue{Value: "new"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Type:         "password",
-					Attributes:   defaultAttributes,
-					Scope:        defaultScopeInfo,
+					AuthMethodId:      am.GetPublicId(),
+					Name:              &wrapperspb.StringValue{Value: "new"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					Type:              "password",
+					Attributes:        defaultAttributes,
+					Scope:             defaultScopeInfo,
+					AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 				},
 			},
 		},
@@ -548,12 +555,13 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateAccountResponse{
 				Item: &pb.Account{
-					AuthMethodId: am.GetPublicId(),
-					Name:         &wrapperspb.StringValue{Value: "new"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Type:         "password",
-					Attributes:   defaultAttributes,
-					Scope:        defaultScopeInfo,
+					AuthMethodId:      am.GetPublicId(),
+					Name:              &wrapperspb.StringValue{Value: "new"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					Type:              "password",
+					Attributes:        defaultAttributes,
+					Scope:             defaultScopeInfo,
+					AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 				},
 			},
 		},
@@ -618,11 +626,12 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateAccountResponse{
 				Item: &pb.Account{
-					AuthMethodId: am.GetPublicId(),
-					Description:  &wrapperspb.StringValue{Value: "default"},
-					Type:         "password",
-					Attributes:   defaultAttributes,
-					Scope:        defaultScopeInfo,
+					AuthMethodId:      am.GetPublicId(),
+					Description:       &wrapperspb.StringValue{Value: "default"},
+					Type:              "password",
+					Attributes:        defaultAttributes,
+					Scope:             defaultScopeInfo,
+					AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 				},
 			},
 		},
@@ -640,12 +649,13 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateAccountResponse{
 				Item: &pb.Account{
-					AuthMethodId: am.GetPublicId(),
-					Name:         &wrapperspb.StringValue{Value: "updated"},
-					Description:  &wrapperspb.StringValue{Value: "default"},
-					Type:         "password",
-					Attributes:   defaultAttributes,
-					Scope:        defaultScopeInfo,
+					AuthMethodId:      am.GetPublicId(),
+					Name:              &wrapperspb.StringValue{Value: "updated"},
+					Description:       &wrapperspb.StringValue{Value: "default"},
+					Type:              "password",
+					Attributes:        defaultAttributes,
+					Scope:             defaultScopeInfo,
+					AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 				},
 			},
 		},
@@ -663,12 +673,13 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateAccountResponse{
 				Item: &pb.Account{
-					AuthMethodId: am.GetPublicId(),
-					Name:         &wrapperspb.StringValue{Value: "default"},
-					Description:  &wrapperspb.StringValue{Value: "notignored"},
-					Type:         "password",
-					Attributes:   defaultAttributes,
-					Scope:        defaultScopeInfo,
+					AuthMethodId:      am.GetPublicId(),
+					Name:              &wrapperspb.StringValue{Value: "default"},
+					Description:       &wrapperspb.StringValue{Value: "notignored"},
+					Type:              "password",
+					Attributes:        defaultAttributes,
+					Scope:             defaultScopeInfo,
+					AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 				},
 			},
 		},
@@ -686,12 +697,13 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateAccountResponse{
 				Item: &pb.Account{
-					AuthMethodId: am.GetPublicId(),
-					Name:         &wrapperspb.StringValue{Value: "default"},
-					Description:  &wrapperspb.StringValue{Value: "default"},
-					Type:         "password",
-					Attributes:   modifiedAttributes,
-					Scope:        defaultScopeInfo,
+					AuthMethodId:      am.GetPublicId(),
+					Name:              &wrapperspb.StringValue{Value: "default"},
+					Description:       &wrapperspb.StringValue{Value: "default"},
+					Type:              "password",
+					Attributes:        modifiedAttributes,
+					Scope:             defaultScopeInfo,
+					AuthorizedActions: []string{"read", "update", "delete", "set-password", "change-password"},
 				},
 			},
 		},

internal/servers/controller/handlers/authmethods/authmethod_service.go

@@ -17,12 +17,17 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/accounts"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/authtokens"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/hashicorp/boundary/sdk/strutil"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
@@ -31,7 +36,29 @@ const (
 	pwKey        = "password"
 )
 
-var maskManager handlers.MaskManager
+var (
+	maskManager handlers.MaskManager
+
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Update,
+		action.Delete,
+		action.Authenticate,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
+
+	collectionTypeMap = map[resource.Type]action.ActionSet{
+		resource.Account: accounts.CollectionActions,
+	}
+)
 
 func init() {
 	var err error
@@ -40,6 +67,33 @@ func init() {
 	}
 }
 
+func populateCollectionAuthorizedActions(ctx context.Context,
+	authResults auth.VerifyResults,
+	item *pb.AuthMethod) error {
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Pin:     item.Id,
+	}
+	// Range over the defined collections and check permissions against those
+	// collections. We use the ID of this scope being returned, not its parent,
+	// hence passing in a resource here.
+	for k, v := range collectionTypeMap {
+		res.Type = k
+		acts := authResults.FetchActionSetForType(ctx, k, v, auth.WithResource(res)).Strings()
+		if len(acts) > 0 {
+			if item.AuthorizedCollectionActions == nil {
+				item.AuthorizedCollectionActions = make(map[string]*structpb.ListValue)
+			}
+			lv, err := structpb.NewList(strutil.StringListToInterfaceList(acts))
+			if err != nil {
+				return err
+			}
+			item.AuthorizedCollectionActions[k.String()+"s"] = lv
+		}
+	}
+	return nil
+}
+
 // Service handles request as described by the pbs.AuthMethodServiceServer interface.
 type Service struct {
 	pbs.UnimplementedAuthMethodServiceServer
@@ -79,10 +133,22 @@ func (s Service) ListAuthMethods(ctx context.Context, req *pbs.ListAuthMethodsRe
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.AuthMethod, 0, len(ul))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.AuthMethod,
+	}
 	for _, item := range ul {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+			if err := populateCollectionAuthorizedActions(ctx, authResults, item); err != nil {
+				return nil, err
+			}
+		}
 	}
-	return &pbs.ListAuthMethodsResponse{Items: ul}, nil
+	return &pbs.ListAuthMethodsResponse{Items: finalItems}, nil
 }
 
 // GetAuthMethod implements the interface pbs.AuthMethodServiceServer.
@@ -99,6 +165,10 @@ func (s Service) GetAuthMethod(ctx context.Context, req *pbs.GetAuthMethodReques
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
+	if err := populateCollectionAuthorizedActions(ctx, authResults, u); err != nil {
+		return nil, err
+	}
 	return &pbs.GetAuthMethodResponse{Item: u}, nil
 }
 
@@ -116,6 +186,10 @@ func (s Service) CreateAuthMethod(ctx context.Context, req *pbs.CreateAuthMethod
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
+	if err := populateCollectionAuthorizedActions(ctx, authResults, u); err != nil {
+		return nil, err
+	}
 	return &pbs.CreateAuthMethodResponse{Item: u, Uri: fmt.Sprintf("auth-methods/%s", u.GetId())}, nil
 }
 
@@ -133,6 +207,10 @@ func (s Service) UpdateAuthMethod(ctx context.Context, req *pbs.UpdateAuthMethod
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
+	if err := populateCollectionAuthorizedActions(ctx, authResults, u); err != nil {
+		return nil, err
+	}
 	return &pbs.UpdateAuthMethodResponse{Item: u}, nil
 }
 
@@ -166,6 +244,11 @@ func (s Service) Authenticate(ctx context.Context, req *pbs.AuthenticateRequest)
 	if err != nil {
 		return nil, err
 	}
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.AuthToken,
+	}
+	tok.AuthorizedActions = authResults.FetchActionSetForId(ctx, tok.Id, authtokens.IdActions, auth.WithResource(res)).Strings()
 	return &pbs.AuthenticateResponse{Item: tok, TokenType: req.GetTokenType()}, nil
 }
 

internal/servers/controller/handlers/authmethods/authmethod_service_test.go

@@ -36,6 +36,15 @@ const (
 	testLoginName = "default"
 )
 
+var authorizedCollectionActions = map[string]*structpb.ListValue{
+	"accounts": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+}
+
 func TestGet(t *testing.T) {
 	conn, _ := db.TestSetup(t, "postgres")
 	rw := db.New(conn)
@@ -70,6 +79,8 @@ func TestGet(t *testing.T) {
 			Id:   o.GetPublicId(),
 			Type: o.GetType(),
 		},
+		AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+		AuthorizedCollectionActions: authorizedCollectionActions,
 	}
 
 	cases := []struct {
@@ -158,6 +169,8 @@ func TestList(t *testing.T) {
 				"min_password_length":   structpb.NewNumberValue(8),
 				"min_login_name_length": structpb.NewNumberValue(3),
 			}},
+			AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+			AuthorizedCollectionActions: authorizedCollectionActions,
 		})
 	}
 
@@ -175,6 +188,8 @@ func TestList(t *testing.T) {
 				"min_password_length":   structpb.NewNumberValue(8),
 				"min_login_name_length": structpb.NewNumberValue(3),
 			}},
+			AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+			AuthorizedCollectionActions: authorizedCollectionActions,
 		})
 	}
 
@@ -368,6 +383,8 @@ func TestCreate(t *testing.T) {
 						"min_password_length":   structpb.NewNumberValue(8),
 						"min_login_name_length": structpb.NewNumberValue(3),
 					}},
+					AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -395,6 +412,8 @@ func TestCreate(t *testing.T) {
 						"min_password_length":   structpb.NewNumberValue(8),
 						"min_login_name_length": structpb.NewNumberValue(3),
 					}},
+					AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -568,7 +587,9 @@ func TestUpdate(t *testing.T) {
 						"min_password_length":   structpb.NewNumberValue(8),
 						"min_login_name_length": structpb.NewNumberValue(3),
 					}},
-					Scope: defaultScopeInfo,
+					Scope:                       defaultScopeInfo,
+					AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -594,7 +615,9 @@ func TestUpdate(t *testing.T) {
 						"min_password_length":   structpb.NewNumberValue(8),
 						"min_login_name_length": structpb.NewNumberValue(3),
 					}},
-					Scope: defaultScopeInfo,
+					Scope:                       defaultScopeInfo,
+					AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -660,7 +683,9 @@ func TestUpdate(t *testing.T) {
 						"min_password_length":   structpb.NewNumberValue(8),
 						"min_login_name_length": structpb.NewNumberValue(3),
 					}},
-					Scope: defaultScopeInfo,
+					Scope:                       defaultScopeInfo,
+					AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -685,7 +710,9 @@ func TestUpdate(t *testing.T) {
 						"min_password_length":   structpb.NewNumberValue(8),
 						"min_login_name_length": structpb.NewNumberValue(3),
 					}},
-					Scope: defaultScopeInfo,
+					Scope:                       defaultScopeInfo,
+					AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -710,7 +737,9 @@ func TestUpdate(t *testing.T) {
 						"min_password_length":   structpb.NewNumberValue(8),
 						"min_login_name_length": structpb.NewNumberValue(3),
 					}},
-					Scope: defaultScopeInfo,
+					Scope:                       defaultScopeInfo,
+					AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -807,7 +836,9 @@ func TestUpdate(t *testing.T) {
 						"min_password_length":   structpb.NewNumberValue(8),
 						"min_login_name_length": structpb.NewNumberValue(42),
 					}},
-					Scope: defaultScopeInfo,
+					Scope:                       defaultScopeInfo,
+					AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -836,7 +867,9 @@ func TestUpdate(t *testing.T) {
 						"min_password_length":   structpb.NewNumberValue(42),
 						"min_login_name_length": structpb.NewNumberValue(3),
 					}},
-					Scope: defaultScopeInfo,
+					Scope:                       defaultScopeInfo,
+					AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},

internal/servers/controller/handlers/authtokens/authtoken_service.go

@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/authtokens"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -16,6 +17,21 @@ import (
 	"github.com/hashicorp/boundary/internal/types/scope"
 )
 
+var (
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Delete,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.List,
+	}
+)
+
 // Service handles request as described by the pbs.AuthTokenServiceServer interface.
 type Service struct {
 	pbs.UnimplementedAuthTokenServiceServer
@@ -50,10 +66,19 @@ func (s Service) ListAuthTokens(ctx context.Context, req *pbs.ListAuthTokensRequ
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.AuthToken, 0, len(ul))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.AuthToken,
+	}
 	for _, item := range ul {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+		}
 	}
-	return &pbs.ListAuthTokensResponse{Items: ul}, nil
+	return &pbs.ListAuthTokensResponse{Items: finalItems}, nil
 }
 
 // GetAuthToken implements the interface pbs.AuthTokenServiceServer.
@@ -70,6 +95,7 @@ func (s Service) GetAuthToken(ctx context.Context, req *pbs.GetAuthTokenRequest)
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.GetAuthTokenResponse{Item: u}, nil
 }
 

internal/servers/controller/handlers/authtokens/authtoken_service_test.go

@@ -52,6 +52,7 @@ func TestGet(t *testing.T) {
 		ApproximateLastUsedTime: at.GetApproximateLastAccessTime().GetTimestamp(),
 		ExpirationTime:          at.GetExpirationTime().GetTimestamp(),
 		Scope:                   &scopes.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+		AuthorizedActions:       []string{"read", "delete"},
 	}
 
 	cases := []struct {
@@ -127,6 +128,7 @@ func TestList(t *testing.T) {
 			ApproximateLastUsedTime: at.GetApproximateLastAccessTime().GetTimestamp(),
 			ExpirationTime:          at.GetExpirationTime().GetTimestamp(),
 			Scope:                   &scopes.ScopeInfo{Id: orgWithSomeTokens.GetPublicId(), Type: scope.Org.String()},
+			AuthorizedActions:       []string{"read", "delete"},
 		})
 	}
 
@@ -145,6 +147,7 @@ func TestList(t *testing.T) {
 			ApproximateLastUsedTime: at.GetApproximateLastAccessTime().GetTimestamp(),
 			ExpirationTime:          at.GetExpirationTime().GetTimestamp(),
 			Scope:                   &scopes.ScopeInfo{Id: orgWithOtherTokens.GetPublicId(), Type: scope.Org.String()},
+			AuthorizedActions:       []string{"read", "delete"},
 		})
 	}
 

internal/servers/controller/handlers/groups/group_service.go

@@ -10,6 +10,7 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/iam/store"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -20,7 +21,27 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var maskManager handlers.MaskManager
+var (
+	maskManager handlers.MaskManager
+
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Update,
+		action.Delete,
+		action.AddMembers,
+		action.SetMembers,
+		action.RemoveMembers,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
+)
 
 func init() {
 	var err error
@@ -59,10 +80,19 @@ func (s Service) ListGroups(ctx context.Context, req *pbs.ListGroupsRequest) (*p
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.Group, 0, len(gl))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.Group,
+	}
 	for _, item := range gl {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+		}
 	}
-	return &pbs.ListGroupsResponse{Items: gl}, nil
+	return &pbs.ListGroupsResponse{Items: finalItems}, nil
 }
 
 // GetGroups implements the interface pbs.GroupServiceServer.
@@ -79,6 +109,7 @@ func (s Service) GetGroup(ctx context.Context, req *pbs.GetGroupRequest) (*pbs.G
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.GetGroupResponse{Item: u}, nil
 }
 
@@ -96,6 +127,7 @@ func (s Service) CreateGroup(ctx context.Context, req *pbs.CreateGroupRequest) (
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.CreateGroupResponse{Item: u, Uri: fmt.Sprintf("groups/%s", u.GetId())}, nil
 }
 
@@ -113,6 +145,7 @@ func (s Service) UpdateGroup(ctx context.Context, req *pbs.UpdateGroupRequest) (
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.UpdateGroupResponse{Item: u}, nil
 }
 
@@ -146,6 +179,7 @@ func (s Service) AddGroupMembers(ctx context.Context, req *pbs.AddGroupMembersRe
 		return nil, err
 	}
 	g.Scope = authResults.Scope
+	g.AuthorizedActions = authResults.FetchActionSetForId(ctx, g.Id, IdActions).Strings()
 	return &pbs.AddGroupMembersResponse{Item: g}, nil
 }
 
@@ -163,6 +197,7 @@ func (s Service) SetGroupMembers(ctx context.Context, req *pbs.SetGroupMembersRe
 		return nil, err
 	}
 	g.Scope = authResults.Scope
+	g.AuthorizedActions = authResults.FetchActionSetForId(ctx, g.Id, IdActions).Strings()
 	return &pbs.SetGroupMembersResponse{Item: g}, nil
 }
 
@@ -180,6 +215,7 @@ func (s Service) RemoveGroupMembers(ctx context.Context, req *pbs.RemoveGroupMem
 		return nil, err
 	}
 	g.Scope = authResults.Scope
+	g.AuthorizedActions = authResults.FetchActionSetForId(ctx, g.Id, IdActions).Strings()
 	return &pbs.RemoveGroupMembersResponse{Item: g}, nil
 }
 

internal/servers/controller/handlers/groups/group_service_test.go

@@ -106,6 +106,7 @@ func TestGet(t *testing.T) {
 				ScopeId: u.GetScopeId(),
 			},
 		},
+		AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 	}
 
 	wantProjGroup := &pb.Group{
@@ -124,6 +125,7 @@ func TestGet(t *testing.T) {
 				ScopeId: u.GetScopeId(),
 			},
 		},
+		AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 	}
 
 	cases := []struct {
@@ -218,21 +220,23 @@ func TestList(t *testing.T) {
 	for i := 0; i < 10; i++ {
 		og := iam.TestGroup(t, conn, oWithGroups.GetPublicId())
 		wantOrgGroups = append(wantOrgGroups, &pb.Group{
-			Id:          og.GetPublicId(),
-			ScopeId:     og.GetScopeId(),
-			Scope:       &scopes.ScopeInfo{Id: oWithGroups.GetPublicId(), Type: scope.Org.String()},
-			CreatedTime: og.GetCreateTime().GetTimestamp(),
-			UpdatedTime: og.GetUpdateTime().GetTimestamp(),
-			Version:     1,
+			Id:                og.GetPublicId(),
+			ScopeId:           og.GetScopeId(),
+			Scope:             &scopes.ScopeInfo{Id: oWithGroups.GetPublicId(), Type: scope.Org.String()},
+			CreatedTime:       og.GetCreateTime().GetTimestamp(),
+			UpdatedTime:       og.GetUpdateTime().GetTimestamp(),
+			Version:           1,
+			AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 		})
 		pg := iam.TestGroup(t, conn, pWithGroups.GetPublicId())
 		wantProjGroups = append(wantProjGroups, &pb.Group{
-			Id:          pg.GetPublicId(),
-			ScopeId:     pg.GetScopeId(),
-			Scope:       &scopes.ScopeInfo{Id: pWithGroups.GetPublicId(), Type: scope.Project.String()},
-			CreatedTime: pg.GetCreateTime().GetTimestamp(),
-			UpdatedTime: pg.GetUpdateTime().GetTimestamp(),
-			Version:     1,
+			Id:                pg.GetPublicId(),
+			ScopeId:           pg.GetScopeId(),
+			Scope:             &scopes.ScopeInfo{Id: pWithGroups.GetPublicId(), Type: scope.Project.String()},
+			CreatedTime:       pg.GetCreateTime().GetTimestamp(),
+			UpdatedTime:       pg.GetUpdateTime().GetTimestamp(),
+			Version:           1,
+			AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 		})
 	}
 
@@ -397,11 +401,12 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateGroupResponse{
 				Uri: fmt.Sprintf("groups/%s_", iam.GroupPrefix),
 				Item: &pb.Group{
-					ScopeId:     defaultOGroup.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: defaultOGroup.GetScopeId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "name"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					Version:     1,
+					ScopeId:           defaultOGroup.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: defaultOGroup.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "name"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					Version:           1,
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},
@@ -415,11 +420,12 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateGroupResponse{
 				Uri: fmt.Sprintf("groups/%s_", iam.GroupPrefix),
 				Item: &pb.Group{
-					ScopeId:     scope.Global.String(),
-					Scope:       &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
-					Name:        &wrapperspb.StringValue{Value: "name"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					Version:     1,
+					ScopeId:           scope.Global.String(),
+					Scope:             &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Name:              &wrapperspb.StringValue{Value: "name"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					Version:           1,
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},
@@ -435,11 +441,12 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateGroupResponse{
 				Uri: fmt.Sprintf("groups/%s_", iam.GroupPrefix),
 				Item: &pb.Group{
-					ScopeId:     defaultPGroup.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: defaultPGroup.GetScopeId(), Type: scope.Project.String()},
-					Name:        &wrapperspb.StringValue{Value: "name"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					Version:     1,
+					ScopeId:           defaultPGroup.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: defaultPGroup.GetScopeId(), Type: scope.Project.String()},
+					Name:              &wrapperspb.StringValue{Value: "name"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					Version:           1,
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},
@@ -581,6 +588,7 @@ func TestUpdate(t *testing.T) {
 							ScopeId: u.GetScopeId(),
 						},
 					},
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},
@@ -611,6 +619,7 @@ func TestUpdate(t *testing.T) {
 							ScopeId: u.GetScopeId(),
 						},
 					},
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},
@@ -642,6 +651,7 @@ func TestUpdate(t *testing.T) {
 							ScopeId: u.GetScopeId(),
 						},
 					},
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},
@@ -673,6 +683,7 @@ func TestUpdate(t *testing.T) {
 							ScopeId: u.GetScopeId(),
 						},
 					},
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},
@@ -735,6 +746,7 @@ func TestUpdate(t *testing.T) {
 							ScopeId: u.GetScopeId(),
 						},
 					},
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},
@@ -765,6 +777,7 @@ func TestUpdate(t *testing.T) {
 							ScopeId: u.GetScopeId(),
 						},
 					},
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},
@@ -795,6 +808,7 @@ func TestUpdate(t *testing.T) {
 							ScopeId: u.GetScopeId(),
 						},
 					},
+					AuthorizedActions: []string{"read", "update", "delete", "add-members", "set-members", "remove-members"},
 				},
 			},
 		},

internal/servers/controller/handlers/host_catalogs/host_catalog_service.go

@@ -11,16 +11,43 @@ import (
 	"github.com/hashicorp/boundary/internal/host"
 	"github.com/hashicorp/boundary/internal/host/static"
 	"github.com/hashicorp/boundary/internal/host/static/store"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/host_sets"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/hosts"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/hashicorp/boundary/sdk/strutil"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var maskManager handlers.MaskManager
+var (
+	maskManager handlers.MaskManager
+
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Update,
+		action.Delete,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
+
+	collectionTypeMap = map[resource.Type]action.ActionSet{
+		resource.HostSet: host_sets.CollectionActions,
+		resource.Host:    hosts.CollectionActions,
+	}
+)
 
 func init() {
 	var err error
@@ -38,6 +65,33 @@ type Service struct {
 
 var _ pbs.HostCatalogServiceServer = Service{}
 
+func populateCollectionAuthorizedActions(ctx context.Context,
+	authResults auth.VerifyResults,
+	item *pb.HostCatalog) error {
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Pin:     item.Id,
+	}
+	// Range over the defined collections and check permissions against those
+	// collections. We use the ID of this scope being returned, not its parent,
+	// hence passing in a resource here.
+	for k, v := range collectionTypeMap {
+		res.Type = k
+		acts := authResults.FetchActionSetForType(ctx, k, v, auth.WithResource(res)).Strings()
+		if len(acts) > 0 {
+			if item.AuthorizedCollectionActions == nil {
+				item.AuthorizedCollectionActions = make(map[string]*structpb.ListValue)
+			}
+			lv, err := structpb.NewList(strutil.StringListToInterfaceList(acts))
+			if err != nil {
+				return err
+			}
+			item.AuthorizedCollectionActions[k.String()+"s"] = lv
+		}
+	}
+	return nil
+}
+
 // NewService returns a host catalog Service which handles host catalog related requests to boundary and uses the provided
 // repositories for storage and retrieval.
 func NewService(repoFn common.StaticRepoFactory, iamRepoFn common.IamRepoFactory) (Service, error) {
@@ -62,10 +116,22 @@ func (s Service) ListHostCatalogs(ctx context.Context, req *pbs.ListHostCatalogs
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.HostCatalog, 0, len(ul))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.HostCatalog,
+	}
 	for _, item := range ul {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+			if err := populateCollectionAuthorizedActions(ctx, authResults, item); err != nil {
+				return nil, err
+			}
+		}
 	}
-	return &pbs.ListHostCatalogsResponse{Items: ul}, nil
+	return &pbs.ListHostCatalogsResponse{Items: finalItems}, nil
 }
 
 // GetHostCatalog implements the interface pbs.HostCatalogServiceServer.
@@ -82,6 +148,10 @@ func (s Service) GetHostCatalog(ctx context.Context, req *pbs.GetHostCatalogRequ
 		return nil, err
 	}
 	hc.Scope = authResults.Scope
+	hc.AuthorizedActions = authResults.FetchActionSetForId(ctx, hc.Id, IdActions).Strings()
+	if err := populateCollectionAuthorizedActions(ctx, authResults, hc); err != nil {
+		return nil, err
+	}
 	return &pbs.GetHostCatalogResponse{Item: hc}, nil
 }
 
@@ -99,6 +169,10 @@ func (s Service) CreateHostCatalog(ctx context.Context, req *pbs.CreateHostCatal
 		return nil, err
 	}
 	hc.Scope = authResults.Scope
+	hc.AuthorizedActions = authResults.FetchActionSetForId(ctx, hc.Id, IdActions).Strings()
+	if err := populateCollectionAuthorizedActions(ctx, authResults, hc); err != nil {
+		return nil, err
+	}
 	return &pbs.CreateHostCatalogResponse{
 		Item: hc,
 		Uri:  fmt.Sprintf("host-catalogs/%s", hc.GetId()),
@@ -119,6 +193,10 @@ func (s Service) UpdateHostCatalog(ctx context.Context, req *pbs.UpdateHostCatal
 		return nil, err
 	}
 	hc.Scope = authResults.Scope
+	hc.AuthorizedActions = authResults.FetchActionSetForId(ctx, hc.Id, IdActions).Strings()
+	if err := populateCollectionAuthorizedActions(ctx, authResults, hc); err != nil {
+		return nil, err
+	}
 	return &pbs.UpdateHostCatalogResponse{Item: hc}, nil
 }
 

internal/servers/controller/handlers/host_catalogs/host_catalog_service_test.go

@@ -26,11 +26,27 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+var authorizedCollectionActions = map[string]*structpb.ListValue{
+	"host-sets": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+	"hosts": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+}
+
 func createDefaultHostCatalogAndRepo(t *testing.T) (*static.HostCatalog, *iam.Scope, common.StaticRepoFactory, common.IamRepoFactory) {
 	t.Helper()
 	require := require.New(t)
@@ -66,14 +82,16 @@ func TestGet(t *testing.T) {
 	}
 
 	pHostCatalog := &pb.HostCatalog{
-		Id:          hc.GetPublicId(),
-		ScopeId:     hc.GetScopeId(),
-		Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-		Name:        &wrappers.StringValue{Value: hc.GetName()},
-		Description: &wrappers.StringValue{Value: hc.GetDescription()},
-		CreatedTime: hc.CreateTime.GetTimestamp(),
-		UpdatedTime: hc.UpdateTime.GetTimestamp(),
-		Type:        "static",
+		Id:                          hc.GetPublicId(),
+		ScopeId:                     hc.GetScopeId(),
+		Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+		Name:                        &wrappers.StringValue{Value: hc.GetName()},
+		Description:                 &wrappers.StringValue{Value: hc.GetDescription()},
+		CreatedTime:                 hc.CreateTime.GetTimestamp(),
+		UpdatedTime:                 hc.UpdateTime.GetTimestamp(),
+		Type:                        "static",
+		AuthorizedActions:           []string{"read", "update", "delete"},
+		AuthorizedCollectionActions: authorizedCollectionActions,
 	}
 
 	cases := []struct {
@@ -149,26 +167,30 @@ func TestList(t *testing.T) {
 	var wantSomeCatalogs []*pb.HostCatalog
 	for _, hc := range static.TestCatalogs(t, conn, pWithCatalogs.GetPublicId(), 3) {
 		wantSomeCatalogs = append(wantSomeCatalogs, &pb.HostCatalog{
-			Id:          hc.GetPublicId(),
-			ScopeId:     hc.GetScopeId(),
-			CreatedTime: hc.GetCreateTime().GetTimestamp(),
-			UpdatedTime: hc.GetUpdateTime().GetTimestamp(),
-			Scope:       &scopepb.ScopeInfo{Id: pWithCatalogs.GetPublicId(), Type: scope.Project.String()},
-			Version:     1,
-			Type:        "static",
+			Id:                          hc.GetPublicId(),
+			ScopeId:                     hc.GetScopeId(),
+			CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
+			UpdatedTime:                 hc.GetUpdateTime().GetTimestamp(),
+			Scope:                       &scopepb.ScopeInfo{Id: pWithCatalogs.GetPublicId(), Type: scope.Project.String()},
+			Version:                     1,
+			Type:                        "static",
+			AuthorizedActions:           []string{"read", "update", "delete"},
+			AuthorizedCollectionActions: authorizedCollectionActions,
 		})
 	}
 
 	var wantOtherCatalogs []*pb.HostCatalog
 	for _, hc := range static.TestCatalogs(t, conn, pWithOtherCatalogs.GetPublicId(), 3) {
 		wantOtherCatalogs = append(wantOtherCatalogs, &pb.HostCatalog{
-			Id:          hc.GetPublicId(),
-			ScopeId:     hc.GetScopeId(),
-			CreatedTime: hc.GetCreateTime().GetTimestamp(),
-			UpdatedTime: hc.GetUpdateTime().GetTimestamp(),
-			Scope:       &scopepb.ScopeInfo{Id: pWithOtherCatalogs.GetPublicId(), Type: scope.Project.String()},
-			Version:     1,
-			Type:        "static",
+			Id:                          hc.GetPublicId(),
+			ScopeId:                     hc.GetScopeId(),
+			CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
+			UpdatedTime:                 hc.GetUpdateTime().GetTimestamp(),
+			Scope:                       &scopepb.ScopeInfo{Id: pWithOtherCatalogs.GetPublicId(), Type: scope.Project.String()},
+			Version:                     1,
+			Type:                        "static",
+			AuthorizedActions:           []string{"read", "update", "delete"},
+			AuthorizedCollectionActions: authorizedCollectionActions,
 		})
 	}
 
@@ -314,11 +336,13 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateHostCatalogResponse{
 				Uri: fmt.Sprintf("host-catalogs/%s_", static.HostCatalogPrefix),
 				Item: &pb.HostCatalog{
-					ScopeId:     proj.GetPublicId(),
-					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:        &wrappers.StringValue{Value: "name"},
-					Description: &wrappers.StringValue{Value: "desc"},
-					Type:        "static",
+					ScopeId:                     proj.GetPublicId(),
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:                        &wrappers.StringValue{Value: "name"},
+					Description:                 &wrappers.StringValue{Value: "desc"},
+					Type:                        "static",
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -465,13 +489,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostCatalogResponse{
 				Item: &pb.HostCatalog{
-					Id:          hc.GetPublicId(),
-					ScopeId:     hc.GetScopeId(),
-					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:        &wrappers.StringValue{Value: "new"},
-					Description: &wrappers.StringValue{Value: "desc"},
-					CreatedTime: hc.GetCreateTime().GetTimestamp(),
-					Type:        "static",
+					Id:                          hc.GetPublicId(),
+					ScopeId:                     hc.GetScopeId(),
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:                        &wrappers.StringValue{Value: "new"},
+					Description:                 &wrappers.StringValue{Value: "desc"},
+					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
+					Type:                        "static",
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -489,13 +515,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostCatalogResponse{
 				Item: &pb.HostCatalog{
-					Id:          hc.GetPublicId(),
-					ScopeId:     hc.GetScopeId(),
-					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:        &wrappers.StringValue{Value: "new"},
-					Description: &wrappers.StringValue{Value: "desc"},
-					CreatedTime: hc.GetCreateTime().GetTimestamp(),
-					Type:        "static",
+					Id:                          hc.GetPublicId(),
+					ScopeId:                     hc.GetScopeId(),
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:                        &wrappers.StringValue{Value: "new"},
+					Description:                 &wrappers.StringValue{Value: "desc"},
+					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
+					Type:                        "static",
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -543,12 +571,14 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostCatalogResponse{
 				Item: &pb.HostCatalog{
-					Id:          hc.GetPublicId(),
-					ScopeId:     hc.GetScopeId(),
-					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Description: &wrappers.StringValue{Value: "default"},
-					CreatedTime: hc.GetCreateTime().GetTimestamp(),
-					Type:        "static",
+					Id:                          hc.GetPublicId(),
+					ScopeId:                     hc.GetScopeId(),
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Description:                 &wrappers.StringValue{Value: "default"},
+					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
+					Type:                        "static",
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -564,12 +594,14 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostCatalogResponse{
 				Item: &pb.HostCatalog{
-					Id:          hc.GetPublicId(),
-					ScopeId:     hc.GetScopeId(),
-					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:        &wrappers.StringValue{Value: "default"},
-					CreatedTime: hc.GetCreateTime().GetTimestamp(),
-					Type:        "static",
+					Id:                          hc.GetPublicId(),
+					ScopeId:                     hc.GetScopeId(),
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:                        &wrappers.StringValue{Value: "default"},
+					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
+					Type:                        "static",
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -586,13 +618,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostCatalogResponse{
 				Item: &pb.HostCatalog{
-					Id:          hc.GetPublicId(),
-					ScopeId:     hc.GetScopeId(),
-					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:        &wrappers.StringValue{Value: "updated"},
-					Description: &wrappers.StringValue{Value: "default"},
-					CreatedTime: hc.GetCreateTime().GetTimestamp(),
-					Type:        "static",
+					Id:                          hc.GetPublicId(),
+					ScopeId:                     hc.GetScopeId(),
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:                        &wrappers.StringValue{Value: "updated"},
+					Description:                 &wrappers.StringValue{Value: "default"},
+					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
+					Type:                        "static",
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},
@@ -609,13 +643,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostCatalogResponse{
 				Item: &pb.HostCatalog{
-					Id:          hc.GetPublicId(),
-					ScopeId:     hc.GetScopeId(),
-					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:        &wrappers.StringValue{Value: "default"},
-					Description: &wrappers.StringValue{Value: "notignored"},
-					CreatedTime: hc.GetCreateTime().GetTimestamp(),
-					Type:        "static",
+					Id:                          hc.GetPublicId(),
+					ScopeId:                     hc.GetScopeId(),
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:                        &wrappers.StringValue{Value: "default"},
+					Description:                 &wrappers.StringValue{Value: "notignored"},
+					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
+					Type:                        "static",
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: authorizedCollectionActions,
 				},
 			},
 		},

internal/servers/controller/handlers/host_sets/host_set_service.go

@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/boundary/internal/host"
 	"github.com/hashicorp/boundary/internal/host/static"
 	"github.com/hashicorp/boundary/internal/host/static/store"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -20,7 +21,27 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var maskManager handlers.MaskManager
+var (
+	maskManager handlers.MaskManager
+
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Update,
+		action.Delete,
+		action.AddHosts,
+		action.SetHosts,
+		action.RemoveHosts,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
+)
 
 func init() {
 	var err error
@@ -58,10 +79,20 @@ func (s Service) ListHostSets(ctx context.Context, req *pbs.ListHostSetsRequest)
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.HostSet, 0, len(hl))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.HostSet,
+		Pin:     req.GetHostCatalogId(),
+	}
 	for _, item := range hl {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+		}
 	}
-	return &pbs.ListHostSetsResponse{Items: hl}, nil
+	return &pbs.ListHostSetsResponse{Items: finalItems}, nil
 }
 
 // GetHostSet implements the interface pbs.HostSetServiceServer.
@@ -78,6 +109,7 @@ func (s Service) GetHostSet(ctx context.Context, req *pbs.GetHostSetRequest) (*p
 		return nil, err
 	}
 	hc.Scope = authResults.Scope
+	hc.AuthorizedActions = authResults.FetchActionSetForId(ctx, hc.Id, IdActions).Strings()
 	return &pbs.GetHostSetResponse{Item: hc}, nil
 }
 
@@ -95,6 +127,7 @@ func (s Service) CreateHostSet(ctx context.Context, req *pbs.CreateHostSetReques
 		return nil, err
 	}
 	h.Scope = authResults.Scope
+	h.AuthorizedActions = authResults.FetchActionSetForId(ctx, h.Id, IdActions).Strings()
 	return &pbs.CreateHostSetResponse{
 		Item: h,
 		Uri:  fmt.Sprintf("host-sets/%s", h.GetId()),
@@ -115,6 +148,7 @@ func (s Service) UpdateHostSet(ctx context.Context, req *pbs.UpdateHostSetReques
 		return nil, err
 	}
 	hc.Scope = authResults.Scope
+	hc.AuthorizedActions = authResults.FetchActionSetForId(ctx, hc.Id, IdActions).Strings()
 	return &pbs.UpdateHostSetResponse{Item: hc}, nil
 }
 
@@ -148,6 +182,7 @@ func (s Service) AddHostSetHosts(ctx context.Context, req *pbs.AddHostSetHostsRe
 		return nil, err
 	}
 	g.Scope = authResults.Scope
+	g.AuthorizedActions = authResults.FetchActionSetForId(ctx, g.Id, IdActions).Strings()
 	return &pbs.AddHostSetHostsResponse{Item: g}, nil
 }
 
@@ -165,6 +200,7 @@ func (s Service) SetHostSetHosts(ctx context.Context, req *pbs.SetHostSetHostsRe
 		return nil, err
 	}
 	g.Scope = authResults.Scope
+	g.AuthorizedActions = authResults.FetchActionSetForId(ctx, g.Id, IdActions).Strings()
 	return &pbs.SetHostSetHostsResponse{Item: g}, nil
 }
 
@@ -182,6 +218,7 @@ func (s Service) RemoveHostSetHosts(ctx context.Context, req *pbs.RemoveHostSetH
 		return nil, err
 	}
 	g.Scope = authResults.Scope
+	g.AuthorizedActions = authResults.FetchActionSetForId(ctx, g.Id, IdActions).Strings()
 	return &pbs.RemoveHostSetHostsResponse{Item: g}, nil
 }
 

internal/servers/controller/handlers/host_sets/host_set_service_test.go

@@ -53,13 +53,14 @@ func TestGet(t *testing.T) {
 	toMerge := &pbs.GetHostSetRequest{}
 
 	pHost := &pb.HostSet{
-		HostCatalogId: hc.GetPublicId(),
-		Id:            hs.GetPublicId(),
-		CreatedTime:   hs.CreateTime.GetTimestamp(),
-		UpdatedTime:   hs.UpdateTime.GetTimestamp(),
-		Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-		Type:          "static",
-		HostIds:       hIds,
+		HostCatalogId:     hc.GetPublicId(),
+		Id:                hs.GetPublicId(),
+		CreatedTime:       hs.CreateTime.GetTimestamp(),
+		UpdatedTime:       hs.UpdateTime.GetTimestamp(),
+		Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+		Type:              "static",
+		HostIds:           hIds,
+		AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 	}
 
 	cases := []struct {
@@ -132,13 +133,14 @@ func TestList(t *testing.T) {
 	var wantHs []*pb.HostSet
 	for _, h := range static.TestSets(t, conn, hc.GetPublicId(), 10) {
 		wantHs = append(wantHs, &pb.HostSet{
-			Id:            h.GetPublicId(),
-			HostCatalogId: h.GetCatalogId(),
-			Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-			CreatedTime:   h.GetCreateTime().GetTimestamp(),
-			UpdatedTime:   h.GetUpdateTime().GetTimestamp(),
-			Version:       h.GetVersion(),
-			Type:          host.StaticSubtype.String(),
+			Id:                h.GetPublicId(),
+			HostCatalogId:     h.GetCatalogId(),
+			Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+			CreatedTime:       h.GetCreateTime().GetTimestamp(),
+			UpdatedTime:       h.GetUpdateTime().GetTimestamp(),
+			Version:           h.GetVersion(),
+			Type:              host.StaticSubtype.String(),
+			AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 		})
 	}
 
@@ -309,11 +311,12 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateHostSetResponse{
 				Uri: fmt.Sprintf("host-sets/%s_", static.HostSetPrefix),
 				Item: &pb.HostSet{
-					HostCatalogId: hc.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:          &wrappers.StringValue{Value: "name"},
-					Description:   &wrappers.StringValue{Value: "desc"},
-					Type:          "static",
+					HostCatalogId:     hc.GetPublicId(),
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:              &wrappers.StringValue{Value: "name"},
+					Description:       &wrappers.StringValue{Value: "desc"},
+					Type:              "static",
+					AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 				},
 			},
 		},
@@ -337,11 +340,12 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateHostSetResponse{
 				Uri: fmt.Sprintf("host-sets/%s_", static.HostSetPrefix),
 				Item: &pb.HostSet{
-					HostCatalogId: hc.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:          &wrappers.StringValue{Value: "no type name"},
-					Description:   &wrappers.StringValue{Value: "no type desc"},
-					Type:          "static",
+					HostCatalogId:     hc.GetPublicId(),
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:              &wrappers.StringValue{Value: "no type name"},
+					Description:       &wrappers.StringValue{Value: "no type desc"},
+					Type:              "static",
+					AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 				},
 			},
 		},
@@ -474,14 +478,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostSetResponse{
 				Item: &pb.HostSet{
-					HostCatalogId: hc.GetPublicId(),
-					Id:            hs.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:          &wrappers.StringValue{Value: "new"},
-					Description:   &wrappers.StringValue{Value: "desc"},
-					CreatedTime:   hs.GetCreateTime().GetTimestamp(),
-					Type:          "static",
-					HostIds:       hIds,
+					HostCatalogId:     hc.GetPublicId(),
+					Id:                hs.GetPublicId(),
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:              &wrappers.StringValue{Value: "new"},
+					Description:       &wrappers.StringValue{Value: "desc"},
+					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
+					Type:              "static",
+					HostIds:           hIds,
+					AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 				},
 			},
 		},
@@ -499,14 +504,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostSetResponse{
 				Item: &pb.HostSet{
-					HostCatalogId: hc.GetPublicId(),
-					Id:            hs.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:          &wrappers.StringValue{Value: "new"},
-					Description:   &wrappers.StringValue{Value: "desc"},
-					CreatedTime:   hs.GetCreateTime().GetTimestamp(),
-					Type:          "static",
-					HostIds:       hIds,
+					HostCatalogId:     hc.GetPublicId(),
+					Id:                hs.GetPublicId(),
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:              &wrappers.StringValue{Value: "new"},
+					Description:       &wrappers.StringValue{Value: "desc"},
+					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
+					Type:              "static",
+					HostIds:           hIds,
+					AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 				},
 			},
 		},
@@ -568,13 +574,14 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostSetResponse{
 				Item: &pb.HostSet{
-					HostCatalogId: hc.GetPublicId(),
-					Id:            hs.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Description:   &wrappers.StringValue{Value: "default"},
-					CreatedTime:   hs.GetCreateTime().GetTimestamp(),
-					Type:          "static",
-					HostIds:       hIds,
+					HostCatalogId:     hc.GetPublicId(),
+					Id:                hs.GetPublicId(),
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Description:       &wrappers.StringValue{Value: "default"},
+					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
+					Type:              "static",
+					HostIds:           hIds,
+					AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 				},
 			},
 		},
@@ -590,13 +597,14 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostSetResponse{
 				Item: &pb.HostSet{
-					HostCatalogId: hc.GetPublicId(),
-					Id:            hs.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:          &wrappers.StringValue{Value: "default"},
-					CreatedTime:   hs.GetCreateTime().GetTimestamp(),
-					Type:          "static",
-					HostIds:       hIds,
+					HostCatalogId:     hc.GetPublicId(),
+					Id:                hs.GetPublicId(),
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:              &wrappers.StringValue{Value: "default"},
+					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
+					Type:              "static",
+					HostIds:           hIds,
+					AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 				},
 			},
 		},
@@ -613,14 +621,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostSetResponse{
 				Item: &pb.HostSet{
-					HostCatalogId: hc.GetPublicId(),
-					Id:            hs.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:          &wrappers.StringValue{Value: "updated"},
-					Description:   &wrappers.StringValue{Value: "default"},
-					CreatedTime:   hs.GetCreateTime().GetTimestamp(),
-					Type:          "static",
-					HostIds:       hIds,
+					HostCatalogId:     hc.GetPublicId(),
+					Id:                hs.GetPublicId(),
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:              &wrappers.StringValue{Value: "updated"},
+					Description:       &wrappers.StringValue{Value: "default"},
+					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
+					Type:              "static",
+					HostIds:           hIds,
+					AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 				},
 			},
 		},
@@ -637,14 +646,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateHostSetResponse{
 				Item: &pb.HostSet{
-					HostCatalogId: hc.GetPublicId(),
-					Id:            hs.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
-					Name:          &wrappers.StringValue{Value: "default"},
-					Description:   &wrappers.StringValue{Value: "notignored"},
-					CreatedTime:   hs.GetCreateTime().GetTimestamp(),
-					Type:          "static",
-					HostIds:       hIds,
+					HostCatalogId:     hc.GetPublicId(),
+					Id:                hs.GetPublicId(),
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Name:              &wrappers.StringValue{Value: "default"},
+					Description:       &wrappers.StringValue{Value: "notignored"},
+					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
+					Type:              "static",
+					HostIds:           hIds,
+					AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
 				},
 			},
 		},

internal/servers/controller/handlers/hosts/host_service.go

@@ -13,6 +13,7 @@ import (
 	"github.com/hashicorp/boundary/internal/host"
 	"github.com/hashicorp/boundary/internal/host/static"
 	"github.com/hashicorp/boundary/internal/host/static/store"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -21,7 +22,24 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var maskManager handlers.MaskManager
+var (
+	maskManager handlers.MaskManager
+
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Update,
+		action.Delete,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
+)
 
 func init() {
 	var err error
@@ -59,10 +77,20 @@ func (s Service) ListHosts(ctx context.Context, req *pbs.ListHostsRequest) (*pbs
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.Host, 0, len(hl))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.Host,
+		Pin:     req.GetHostCatalogId(),
+	}
 	for _, item := range hl {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+		}
 	}
-	return &pbs.ListHostsResponse{Items: hl}, nil
+	return &pbs.ListHostsResponse{Items: finalItems}, nil
 }
 
 // GetHost implements the interface pbs.HostServiceServer.
@@ -79,6 +107,7 @@ func (s Service) GetHost(ctx context.Context, req *pbs.GetHostRequest) (*pbs.Get
 		return nil, err
 	}
 	hc.Scope = authResults.Scope
+	hc.AuthorizedActions = authResults.FetchActionSetForId(ctx, hc.Id, IdActions).Strings()
 	return &pbs.GetHostResponse{Item: hc}, nil
 }
 
@@ -96,6 +125,7 @@ func (s Service) CreateHost(ctx context.Context, req *pbs.CreateHostRequest) (*p
 		return nil, err
 	}
 	h.Scope = authResults.Scope
+	h.AuthorizedActions = authResults.FetchActionSetForId(ctx, h.Id, IdActions).Strings()
 	return &pbs.CreateHostResponse{
 		Item: h,
 		Uri:  fmt.Sprintf("hosts/%s", h.GetId()),
@@ -116,6 +146,7 @@ func (s Service) UpdateHost(ctx context.Context, req *pbs.UpdateHostRequest) (*p
 		return nil, err
 	}
 	hc.Scope = authResults.Scope
+	hc.AuthorizedActions = authResults.FetchActionSetForId(ctx, hc.Id, IdActions).Strings()
 	return &pbs.UpdateHostResponse{Item: hc}, nil
 }
 

internal/servers/controller/handlers/hosts/host_service_test.go

@@ -56,6 +56,7 @@ func TestGet(t *testing.T) {
 		Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 			"address": structpb.NewStringValue(h.GetAddress()),
 		}},
+		AuthorizedActions: []string{"read", "update", "delete"},
 	}
 
 	cases := []struct {
@@ -134,6 +135,7 @@ func TestList(t *testing.T) {
 			Type:          host.StaticSubtype.String(), Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 				"address": structpb.NewStringValue(h.GetAddress()),
 			}},
+			AuthorizedActions: []string{"read", "update", "delete"},
 		})
 	}
 
@@ -307,6 +309,7 @@ func TestCreate(t *testing.T) {
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"address": structpb.NewStringValue("123.456.789"),
 					}},
+					AuthorizedActions: []string{"read", "update", "delete"},
 				},
 			},
 		},
@@ -365,6 +368,7 @@ func TestCreate(t *testing.T) {
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"address": structpb.NewStringValue("123.456.789"),
 					}},
+					AuthorizedActions: []string{"read", "update", "delete"},
 				},
 			},
 		},
@@ -500,6 +504,7 @@ func TestUpdate(t *testing.T) {
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"address": structpb.NewStringValue("defaultaddress"),
 					}},
+					AuthorizedActions: []string{"read", "update", "delete"},
 				},
 			},
 		},
@@ -527,6 +532,7 @@ func TestUpdate(t *testing.T) {
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"address": structpb.NewStringValue("defaultaddress"),
 					}},
+					AuthorizedActions: []string{"read", "update", "delete"},
 				},
 			},
 		},
@@ -596,6 +602,7 @@ func TestUpdate(t *testing.T) {
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"address": structpb.NewStringValue("defaultaddress"),
 					}},
+					AuthorizedActions: []string{"read", "update", "delete"},
 				},
 			},
 		},
@@ -620,6 +627,7 @@ func TestUpdate(t *testing.T) {
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"address": structpb.NewStringValue("defaultaddress"),
 					}},
+					AuthorizedActions: []string{"read", "update", "delete"},
 				},
 			},
 		},
@@ -646,6 +654,7 @@ func TestUpdate(t *testing.T) {
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"address": structpb.NewStringValue("defaultaddress"),
 					}},
+					AuthorizedActions: []string{"read", "update", "delete"},
 				},
 			},
 		},
@@ -672,6 +681,7 @@ func TestUpdate(t *testing.T) {
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"address": structpb.NewStringValue("defaultaddress"),
 					}},
+					AuthorizedActions: []string{"read", "update", "delete"},
 				},
 			},
 		},

internal/servers/controller/handlers/roles/role_service.go

@@ -21,7 +21,30 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var maskManager handlers.MaskManager
+var (
+	maskManager handlers.MaskManager
+
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Update,
+		action.Delete,
+		action.AddPrincipals,
+		action.SetPrincipals,
+		action.RemovePrincipals,
+		action.AddGrants,
+		action.SetGrants,
+		action.RemoveGrants,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
+)
 
 func init() {
 	var err error
@@ -60,10 +83,19 @@ func (s Service) ListRoles(ctx context.Context, req *pbs.ListRolesRequest) (*pbs
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.Role, 0, len(gl))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.Role,
+	}
 	for _, item := range gl {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+		}
 	}
-	return &pbs.ListRolesResponse{Items: gl}, nil
+	return &pbs.ListRolesResponse{Items: finalItems}, nil
 }
 
 // GetRoles implements the interface pbs.RoleServiceServer.
@@ -80,6 +112,7 @@ func (s Service) GetRole(ctx context.Context, req *pbs.GetRoleRequest) (*pbs.Get
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.GetRoleResponse{Item: u}, nil
 }
 
@@ -97,6 +130,7 @@ func (s Service) CreateRole(ctx context.Context, req *pbs.CreateRoleRequest) (*p
 		return nil, err
 	}
 	r.Scope = authResults.Scope
+	r.AuthorizedActions = authResults.FetchActionSetForId(ctx, r.Id, IdActions).Strings()
 	return &pbs.CreateRoleResponse{Item: r, Uri: fmt.Sprintf("roles/%s", r.GetId())}, nil
 }
 
@@ -114,6 +148,7 @@ func (s Service) UpdateRole(ctx context.Context, req *pbs.UpdateRoleRequest) (*p
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.UpdateRoleResponse{Item: u}, nil
 }
 
@@ -147,6 +182,7 @@ func (s Service) AddRolePrincipals(ctx context.Context, req *pbs.AddRolePrincipa
 		return nil, err
 	}
 	r.Scope = authResults.Scope
+	r.AuthorizedActions = authResults.FetchActionSetForId(ctx, r.Id, IdActions).Strings()
 	return &pbs.AddRolePrincipalsResponse{Item: r}, nil
 }
 
@@ -164,6 +200,7 @@ func (s Service) SetRolePrincipals(ctx context.Context, req *pbs.SetRolePrincipa
 		return nil, err
 	}
 	r.Scope = authResults.Scope
+	r.AuthorizedActions = authResults.FetchActionSetForId(ctx, r.Id, IdActions).Strings()
 	return &pbs.SetRolePrincipalsResponse{Item: r}, nil
 }
 
@@ -181,6 +218,7 @@ func (s Service) RemoveRolePrincipals(ctx context.Context, req *pbs.RemoveRolePr
 		return nil, err
 	}
 	r.Scope = authResults.Scope
+	r.AuthorizedActions = authResults.FetchActionSetForId(ctx, r.Id, IdActions).Strings()
 	return &pbs.RemoveRolePrincipalsResponse{Item: r}, nil
 }
 
@@ -198,6 +236,7 @@ func (s Service) AddRoleGrants(ctx context.Context, req *pbs.AddRoleGrantsReques
 		return nil, err
 	}
 	r.Scope = authResults.Scope
+	r.AuthorizedActions = authResults.FetchActionSetForId(ctx, r.Id, IdActions).Strings()
 	return &pbs.AddRoleGrantsResponse{Item: r}, nil
 }
 
@@ -215,6 +254,7 @@ func (s Service) SetRoleGrants(ctx context.Context, req *pbs.SetRoleGrantsReques
 		return nil, err
 	}
 	r.Scope = authResults.Scope
+	r.AuthorizedActions = authResults.FetchActionSetForId(ctx, r.Id, IdActions).Strings()
 	return &pbs.SetRoleGrantsResponse{Item: r}, nil
 }
 
@@ -232,6 +272,7 @@ func (s Service) RemoveRoleGrants(ctx context.Context, req *pbs.RemoveRoleGrants
 		return nil, err
 	}
 	r.Scope = authResults.Scope
+	r.AuthorizedActions = authResults.FetchActionSetForId(ctx, r.Id, IdActions).Strings()
 	return &pbs.RemoveRoleGrantsResponse{Item: r}, nil
 }
 

internal/servers/controller/handlers/roles/role_service_test.go

@@ -77,27 +77,29 @@ func TestGet(t *testing.T) {
 	}
 
 	wantOrgRole := &pb.Role{
-		Id:           or.GetPublicId(),
-		ScopeId:      or.GetScopeId(),
-		Scope:        &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
-		Name:         &wrapperspb.StringValue{Value: or.GetName()},
-		Description:  &wrapperspb.StringValue{Value: or.GetDescription()},
-		GrantScopeId: &wrapperspb.StringValue{Value: pr.GetGrantScopeId()},
-		CreatedTime:  or.CreateTime.GetTimestamp(),
-		UpdatedTime:  or.UpdateTime.GetTimestamp(),
-		Version:      or.GetVersion(),
+		Id:                or.GetPublicId(),
+		ScopeId:           or.GetScopeId(),
+		Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+		Name:              &wrapperspb.StringValue{Value: or.GetName()},
+		Description:       &wrapperspb.StringValue{Value: or.GetDescription()},
+		GrantScopeId:      &wrapperspb.StringValue{Value: pr.GetGrantScopeId()},
+		CreatedTime:       or.CreateTime.GetTimestamp(),
+		UpdatedTime:       or.UpdateTime.GetTimestamp(),
+		Version:           or.GetVersion(),
+		AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 	}
 
 	wantProjRole := &pb.Role{
-		Id:           pr.GetPublicId(),
-		ScopeId:      pr.GetScopeId(),
-		Scope:        &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
-		Name:         &wrapperspb.StringValue{Value: pr.GetName()},
-		Description:  &wrapperspb.StringValue{Value: pr.GetDescription()},
-		GrantScopeId: &wrapperspb.StringValue{Value: pr.GetGrantScopeId()},
-		CreatedTime:  pr.CreateTime.GetTimestamp(),
-		UpdatedTime:  pr.UpdateTime.GetTimestamp(),
-		Version:      pr.GetVersion(),
+		Id:                pr.GetPublicId(),
+		ScopeId:           pr.GetScopeId(),
+		Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
+		Name:              &wrapperspb.StringValue{Value: pr.GetName()},
+		Description:       &wrapperspb.StringValue{Value: pr.GetDescription()},
+		GrantScopeId:      &wrapperspb.StringValue{Value: pr.GetGrantScopeId()},
+		CreatedTime:       pr.CreateTime.GetTimestamp(),
+		UpdatedTime:       pr.UpdateTime.GetTimestamp(),
+		Version:           pr.GetVersion(),
+		AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 	}
 
 	cases := []struct {
@@ -192,23 +194,25 @@ func TestList(t *testing.T) {
 	for i := 0; i < 10; i++ {
 		or := iam.TestRole(t, conn, oWithRoles.GetPublicId())
 		wantOrgRoles = append(wantOrgRoles, &pb.Role{
-			Id:           or.GetPublicId(),
-			ScopeId:      or.GetScopeId(),
-			Scope:        &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
-			CreatedTime:  or.GetCreateTime().GetTimestamp(),
-			UpdatedTime:  or.GetUpdateTime().GetTimestamp(),
-			GrantScopeId: &wrapperspb.StringValue{Value: or.GetGrantScopeId()},
-			Version:      or.GetVersion(),
+			Id:                or.GetPublicId(),
+			ScopeId:           or.GetScopeId(),
+			Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+			CreatedTime:       or.GetCreateTime().GetTimestamp(),
+			UpdatedTime:       or.GetUpdateTime().GetTimestamp(),
+			GrantScopeId:      &wrapperspb.StringValue{Value: or.GetGrantScopeId()},
+			Version:           or.GetVersion(),
+			AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 		})
 		pr := iam.TestRole(t, conn, pWithRoles.GetPublicId())
 		wantProjRoles = append(wantProjRoles, &pb.Role{
-			Id:           pr.GetPublicId(),
-			ScopeId:      pr.GetScopeId(),
-			Scope:        &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
-			CreatedTime:  pr.GetCreateTime().GetTimestamp(),
-			UpdatedTime:  pr.GetUpdateTime().GetTimestamp(),
-			GrantScopeId: &wrapperspb.StringValue{Value: pr.GetGrantScopeId()},
-			Version:      pr.GetVersion(),
+			Id:                pr.GetPublicId(),
+			ScopeId:           pr.GetScopeId(),
+			Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
+			CreatedTime:       pr.GetCreateTime().GetTimestamp(),
+			UpdatedTime:       pr.GetUpdateTime().GetTimestamp(),
+			GrantScopeId:      &wrapperspb.StringValue{Value: pr.GetGrantScopeId()},
+			Version:           pr.GetVersion(),
+			AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 		})
 	}
 
@@ -367,12 +371,13 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateRoleResponse{
 				Uri: fmt.Sprintf("roles/%s_", iam.RolePrefix),
 				Item: &pb.Role{
-					ScopeId:      defaultOrgRole.GetScopeId(),
-					Scope:        &scopes.ScopeInfo{Id: defaultOrgRole.GetScopeId(), Type: scope.Org.String()},
-					Name:         &wrapperspb.StringValue{Value: "name"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					GrantScopeId: &wrapperspb.StringValue{Value: defaultProjRole.ScopeId},
-					Version:      1,
+					ScopeId:           defaultOrgRole.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: defaultOrgRole.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "name"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					GrantScopeId:      &wrapperspb.StringValue{Value: defaultProjRole.ScopeId},
+					Version:           1,
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},
@@ -387,12 +392,13 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateRoleResponse{
 				Uri: fmt.Sprintf("roles/%s_", iam.RolePrefix),
 				Item: &pb.Role{
-					ScopeId:      scope.Global.String(),
-					Scope:        &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
-					Name:         &wrapperspb.StringValue{Value: "name"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					GrantScopeId: &wrapperspb.StringValue{Value: defaultProjRole.ScopeId},
-					Version:      1,
+					ScopeId:           scope.Global.String(),
+					Scope:             &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Name:              &wrapperspb.StringValue{Value: "name"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					GrantScopeId:      &wrapperspb.StringValue{Value: defaultProjRole.ScopeId},
+					Version:           1,
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},
@@ -408,12 +414,13 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateRoleResponse{
 				Uri: fmt.Sprintf("roles/%s_", iam.RolePrefix),
 				Item: &pb.Role{
-					ScopeId:      defaultProjRole.GetScopeId(),
-					Scope:        &scopes.ScopeInfo{Id: defaultProjRole.GetScopeId(), Type: scope.Project.String()},
-					Name:         &wrapperspb.StringValue{Value: "name"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					GrantScopeId: &wrapperspb.StringValue{Value: defaultProjRole.ScopeId},
-					Version:      1,
+					ScopeId:           defaultProjRole.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: defaultProjRole.GetScopeId(), Type: scope.Project.String()},
+					Name:              &wrapperspb.StringValue{Value: "name"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					GrantScopeId:      &wrapperspb.StringValue{Value: defaultProjRole.ScopeId},
+					Version:           1,
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},
@@ -581,17 +588,18 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateRoleResponse{
 				Item: &pb.Role{
-					Id:           or.GetPublicId(),
-					ScopeId:      or.GetScopeId(),
-					Scope:        &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
-					Name:         &wrapperspb.StringValue{Value: "new"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					CreatedTime:  or.GetCreateTime().GetTimestamp(),
-					GrantScopeId: &wrapperspb.StringValue{Value: or.GetScopeId()},
-					GrantStrings: []string{grant.GetRaw()},
-					Grants:       []*pb.Grant{grant},
-					PrincipalIds: []string{u.GetPublicId()},
-					Principals:   []*pb.Principal{principal},
+					Id:                or.GetPublicId(),
+					ScopeId:           or.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "new"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					CreatedTime:       or.GetCreateTime().GetTimestamp(),
+					GrantScopeId:      &wrapperspb.StringValue{Value: or.GetScopeId()},
+					GrantStrings:      []string{grant.GetRaw()},
+					Grants:            []*pb.Grant{grant},
+					PrincipalIds:      []string{u.GetPublicId()},
+					Principals:        []*pb.Principal{principal},
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},
@@ -609,17 +617,18 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateRoleResponse{
 				Item: &pb.Role{
-					Id:           or.GetPublicId(),
-					ScopeId:      or.GetScopeId(),
-					Scope:        &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
-					Name:         &wrapperspb.StringValue{Value: "new"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					CreatedTime:  or.GetCreateTime().GetTimestamp(),
-					GrantScopeId: &wrapperspb.StringValue{Value: or.GetScopeId()},
-					GrantStrings: []string{grant.GetRaw()},
-					Grants:       []*pb.Grant{grant},
-					PrincipalIds: []string{u.GetPublicId()},
-					Principals:   []*pb.Principal{principal},
+					Id:                or.GetPublicId(),
+					ScopeId:           or.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "new"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					CreatedTime:       or.GetCreateTime().GetTimestamp(),
+					GrantScopeId:      &wrapperspb.StringValue{Value: or.GetScopeId()},
+					GrantStrings:      []string{grant.GetRaw()},
+					Grants:            []*pb.Grant{grant},
+					PrincipalIds:      []string{u.GetPublicId()},
+					Principals:        []*pb.Principal{principal},
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},
@@ -638,17 +647,18 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateRoleResponse{
 				Item: &pb.Role{
-					Id:           pr.GetPublicId(),
-					ScopeId:      pr.GetScopeId(),
-					Scope:        &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
-					Name:         &wrapperspb.StringValue{Value: "new"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					CreatedTime:  pr.GetCreateTime().GetTimestamp(),
-					GrantScopeId: &wrapperspb.StringValue{Value: pr.GetScopeId()},
-					GrantStrings: []string{grant.GetRaw()},
-					Grants:       []*pb.Grant{grant},
-					PrincipalIds: []string{u.GetPublicId()},
-					Principals:   []*pb.Principal{principal},
+					Id:                pr.GetPublicId(),
+					ScopeId:           pr.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
+					Name:              &wrapperspb.StringValue{Value: "new"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					CreatedTime:       pr.GetCreateTime().GetTimestamp(),
+					GrantScopeId:      &wrapperspb.StringValue{Value: pr.GetScopeId()},
+					GrantStrings:      []string{grant.GetRaw()},
+					Grants:            []*pb.Grant{grant},
+					PrincipalIds:      []string{u.GetPublicId()},
+					Principals:        []*pb.Principal{principal},
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},
@@ -667,17 +677,18 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateRoleResponse{
 				Item: &pb.Role{
-					Id:           pr.GetPublicId(),
-					ScopeId:      pr.GetScopeId(),
-					Scope:        &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
-					Name:         &wrapperspb.StringValue{Value: "new"},
-					Description:  &wrapperspb.StringValue{Value: "desc"},
-					CreatedTime:  pr.GetCreateTime().GetTimestamp(),
-					GrantScopeId: &wrapperspb.StringValue{Value: pr.GetScopeId()},
-					GrantStrings: []string{grant.GetRaw()},
-					Grants:       []*pb.Grant{grant},
-					PrincipalIds: []string{u.GetPublicId()},
-					Principals:   []*pb.Principal{principal},
+					Id:                pr.GetPublicId(),
+					ScopeId:           pr.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
+					Name:              &wrapperspb.StringValue{Value: "new"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					CreatedTime:       pr.GetCreateTime().GetTimestamp(),
+					GrantScopeId:      &wrapperspb.StringValue{Value: pr.GetScopeId()},
+					GrantStrings:      []string{grant.GetRaw()},
+					Grants:            []*pb.Grant{grant},
+					PrincipalIds:      []string{u.GetPublicId()},
+					Principals:        []*pb.Principal{principal},
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},
@@ -728,16 +739,17 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateRoleResponse{
 				Item: &pb.Role{
-					Id:           or.GetPublicId(),
-					ScopeId:      or.GetScopeId(),
-					Scope:        &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
-					Description:  &wrapperspb.StringValue{Value: "default"},
-					CreatedTime:  or.GetCreateTime().GetTimestamp(),
-					GrantScopeId: &wrapperspb.StringValue{Value: or.GetScopeId()},
-					GrantStrings: []string{grant.GetRaw()},
-					Grants:       []*pb.Grant{grant},
-					PrincipalIds: []string{u.GetPublicId()},
-					Principals:   []*pb.Principal{principal},
+					Id:                or.GetPublicId(),
+					ScopeId:           or.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Description:       &wrapperspb.StringValue{Value: "default"},
+					CreatedTime:       or.GetCreateTime().GetTimestamp(),
+					GrantScopeId:      &wrapperspb.StringValue{Value: or.GetScopeId()},
+					GrantStrings:      []string{grant.GetRaw()},
+					Grants:            []*pb.Grant{grant},
+					PrincipalIds:      []string{u.GetPublicId()},
+					Principals:        []*pb.Principal{principal},
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},
@@ -755,17 +767,18 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateRoleResponse{
 				Item: &pb.Role{
-					Id:           or.GetPublicId(),
-					ScopeId:      or.GetScopeId(),
-					Scope:        &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
-					Name:         &wrapperspb.StringValue{Value: "updated"},
-					Description:  &wrapperspb.StringValue{Value: "default"},
-					CreatedTime:  or.GetCreateTime().GetTimestamp(),
-					GrantScopeId: &wrapperspb.StringValue{Value: or.GetScopeId()},
-					GrantStrings: []string{grant.GetRaw()},
-					Grants:       []*pb.Grant{grant},
-					PrincipalIds: []string{u.GetPublicId()},
-					Principals:   []*pb.Principal{principal},
+					Id:                or.GetPublicId(),
+					ScopeId:           or.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "updated"},
+					Description:       &wrapperspb.StringValue{Value: "default"},
+					CreatedTime:       or.GetCreateTime().GetTimestamp(),
+					GrantScopeId:      &wrapperspb.StringValue{Value: or.GetScopeId()},
+					GrantStrings:      []string{grant.GetRaw()},
+					Grants:            []*pb.Grant{grant},
+					PrincipalIds:      []string{u.GetPublicId()},
+					Principals:        []*pb.Principal{principal},
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},
@@ -783,17 +796,18 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateRoleResponse{
 				Item: &pb.Role{
-					Id:           or.GetPublicId(),
-					ScopeId:      or.GetScopeId(),
-					Scope:        &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
-					Name:         &wrapperspb.StringValue{Value: "default"},
-					Description:  &wrapperspb.StringValue{Value: "notignored"},
-					CreatedTime:  or.GetCreateTime().GetTimestamp(),
-					GrantScopeId: &wrapperspb.StringValue{Value: or.GetScopeId()},
-					GrantStrings: []string{grant.GetRaw()},
-					Grants:       []*pb.Grant{grant},
-					PrincipalIds: []string{u.GetPublicId()},
-					Principals:   []*pb.Principal{principal},
+					Id:                or.GetPublicId(),
+					ScopeId:           or.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "default"},
+					Description:       &wrapperspb.StringValue{Value: "notignored"},
+					CreatedTime:       or.GetCreateTime().GetTimestamp(),
+					GrantScopeId:      &wrapperspb.StringValue{Value: or.GetScopeId()},
+					GrantStrings:      []string{grant.GetRaw()},
+					Grants:            []*pb.Grant{grant},
+					PrincipalIds:      []string{u.GetPublicId()},
+					Principals:        []*pb.Principal{principal},
+					AuthorizedActions: []string{"read", "update", "delete", "add-principals", "set-principals", "remove-principals", "add-grants", "set-grants", "remove-grants"},
 				},
 			},
 		},

internal/servers/controller/handlers/scopes/scope_service.go

@@ -12,16 +12,61 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/iam/store"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/authmethods"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/authtokens"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/groups"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/host_catalogs"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/roles"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/sessions"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/targets"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/users"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/hashicorp/boundary/sdk/strutil"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var maskManager handlers.MaskManager
+var (
+	maskManager handlers.MaskManager
+
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Update,
+		action.Delete,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
+
+	orgCollectionTypeMap = map[resource.Type]action.ActionSet{
+		resource.AuthMethod: authmethods.CollectionActions,
+		resource.AuthToken:  authtokens.CollectionActions,
+		resource.Group:      groups.CollectionActions,
+		resource.Role:       roles.CollectionActions,
+		resource.Scope:      CollectionActions,
+		resource.Session:    sessions.CollectionActions,
+		resource.User:       users.CollectionActions,
+	}
+
+	projectCollectionTypeMap = map[resource.Type]action.ActionSet{
+		resource.Group:       groups.CollectionActions,
+		resource.HostCatalog: host_catalogs.CollectionActions,
+		resource.Role:        roles.CollectionActions,
+		resource.Target:      targets.CollectionActions,
+	}
+)
 
 func init() {
 	var err error
@@ -47,6 +92,36 @@ func NewService(repo common.IamRepoFactory) (Service, error) {
 
 var _ pbs.ScopeServiceServer = Service{}
 
+func populateCollectionAuthorizedActions(ctx context.Context,
+	authResults auth.VerifyResults,
+	item *pb.Scope) error {
+	res := &perms.Resource{
+		ScopeId: item.Id,
+	}
+	mapToRange := orgCollectionTypeMap
+	if item.Type == "project" {
+		mapToRange = projectCollectionTypeMap
+	}
+	// Range over the defined collections and check permissions against those
+	// collections. We use the ID of this scope being returned, not its parent,
+	// hence passing in a resource here.
+	for k, v := range mapToRange {
+		res.Type = k
+		acts := authResults.FetchActionSetForType(ctx, k, v, auth.WithResource(res)).Strings()
+		if len(acts) > 0 {
+			if item.AuthorizedCollectionActions == nil {
+				item.AuthorizedCollectionActions = make(map[string]*structpb.ListValue)
+			}
+			lv, err := structpb.NewList(strutil.StringListToInterfaceList(acts))
+			if err != nil {
+				return err
+			}
+			item.AuthorizedCollectionActions[k.String()+"s"] = lv
+		}
+	}
+	return nil
+}
+
 // ListScopes implements the interface pbs.ScopeServiceServer.
 func (s Service) ListScopes(ctx context.Context, req *pbs.ListScopesRequest) (*pbs.ListScopesResponse, error) {
 	if req.GetScopeId() == "" {
@@ -63,12 +138,23 @@ func (s Service) ListScopes(ctx context.Context, req *pbs.ListScopesRequest) (*p
 	if err != nil {
 		return nil, err
 	}
-
+	finalItems := make([]*pb.Scope, 0, len(pl))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.Scope,
+	}
 	for _, item := range pl {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+			if err := populateCollectionAuthorizedActions(ctx, authResults, item); err != nil {
+				return nil, err
+			}
+		}
 	}
 
-	return &pbs.ListScopesResponse{Items: pl}, nil
+	return &pbs.ListScopesResponse{Items: finalItems}, nil
 }
 
 // GetScopes implements the interface pbs.ScopeServiceServer.
@@ -85,6 +171,15 @@ func (s Service) GetScope(ctx context.Context, req *pbs.GetScopeRequest) (*pbs.G
 		return nil, err
 	}
 	p.Scope = authResults.Scope
+	act := IdActions
+	// Can't delete global so elide it
+	if p.Id == "global" {
+		act = act[0:2]
+	}
+	p.AuthorizedActions = authResults.FetchActionSetForId(ctx, p.Id, act).Strings()
+	if err := populateCollectionAuthorizedActions(ctx, authResults, p); err != nil {
+		return nil, err
+	}
 	return &pbs.GetScopeResponse{Item: p}, nil
 }
 
@@ -102,6 +197,10 @@ func (s Service) CreateScope(ctx context.Context, req *pbs.CreateScopeRequest) (
 		return nil, err
 	}
 	p.Scope = authResults.Scope
+	p.AuthorizedActions = authResults.FetchActionSetForId(ctx, p.Id, IdActions).Strings()
+	if err := populateCollectionAuthorizedActions(ctx, authResults, p); err != nil {
+		return nil, err
+	}
 	return &pbs.CreateScopeResponse{Item: p, Uri: fmt.Sprintf("scopes/%s", p.GetId())}, nil
 }
 
@@ -119,6 +218,10 @@ func (s Service) UpdateScope(ctx context.Context, req *pbs.UpdateScopeRequest) (
 		return nil, err
 	}
 	p.Scope = authResults.Scope
+	p.AuthorizedActions = authResults.FetchActionSetForId(ctx, p.Id, IdActions).Strings()
+	if err := populateCollectionAuthorizedActions(ctx, authResults, p); err != nil {
+		return nil, err
+	}
 	return &pbs.UpdateScopeResponse{Item: p}, nil
 }
 

internal/servers/controller/handlers/scopes/scope_service_test.go

@@ -22,6 +22,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	"github.com/stretchr/testify/assert"
@@ -55,6 +56,76 @@ func createDefaultScopesAndRepo(t *testing.T) (*iam.Scope, *iam.Scope, func() (*
 	return oRes, pRes, repoFn
 }
 
+var orgAuthorizedCollectionActions = map[string]*structpb.ListValue{
+	"auth-methods": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+	"auth-tokens": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("list"),
+		},
+	},
+	"groups": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+	"roles": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+	"scopes": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+	"sessions": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("list"),
+		},
+	},
+	"users": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+}
+
+var projectAuthorizedCollectionActions = map[string]*structpb.ListValue{
+	"groups": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+	"host-catalogs": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+	"roles": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+	"targets": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
+}
+
 func TestGet(t *testing.T) {
 	org, proj, repo := createDefaultScopesAndRepo(t)
 	toMerge := &pbs.GetScopeRequest{
@@ -62,27 +133,31 @@ func TestGet(t *testing.T) {
 	}
 
 	oScope := &pb.Scope{
-		Id:          org.GetPublicId(),
-		ScopeId:     org.GetParentId(),
-		Scope:       &pb.ScopeInfo{Id: "global", Type: scope.Global.String()},
-		Name:        &wrapperspb.StringValue{Value: org.GetName()},
-		Description: &wrapperspb.StringValue{Value: org.GetDescription()},
-		CreatedTime: org.CreateTime.GetTimestamp(),
-		UpdatedTime: org.UpdateTime.GetTimestamp(),
-		Version:     2,
-		Type:        scope.Org.String(),
+		Id:                          org.GetPublicId(),
+		ScopeId:                     org.GetParentId(),
+		Scope:                       &pb.ScopeInfo{Id: "global", Type: scope.Global.String()},
+		Name:                        &wrapperspb.StringValue{Value: org.GetName()},
+		Description:                 &wrapperspb.StringValue{Value: org.GetDescription()},
+		CreatedTime:                 org.CreateTime.GetTimestamp(),
+		UpdatedTime:                 org.UpdateTime.GetTimestamp(),
+		Version:                     2,
+		Type:                        scope.Org.String(),
+		AuthorizedActions:           []string{"read", "update", "delete"},
+		AuthorizedCollectionActions: orgAuthorizedCollectionActions,
 	}
 
 	pScope := &pb.Scope{
-		Id:          proj.GetPublicId(),
-		ScopeId:     proj.GetParentId(),
-		Scope:       &pb.ScopeInfo{Id: oScope.Id, Type: scope.Org.String()},
-		Name:        &wrapperspb.StringValue{Value: proj.GetName()},
-		Description: &wrapperspb.StringValue{Value: proj.GetDescription()},
-		CreatedTime: proj.CreateTime.GetTimestamp(),
-		UpdatedTime: proj.UpdateTime.GetTimestamp(),
-		Version:     2,
-		Type:        scope.Project.String(),
+		Id:                          proj.GetPublicId(),
+		ScopeId:                     proj.GetParentId(),
+		Scope:                       &pb.ScopeInfo{Id: oScope.Id, Type: scope.Org.String()},
+		Name:                        &wrapperspb.StringValue{Value: proj.GetName()},
+		Description:                 &wrapperspb.StringValue{Value: proj.GetDescription()},
+		CreatedTime:                 proj.CreateTime.GetTimestamp(),
+		UpdatedTime:                 proj.UpdateTime.GetTimestamp(),
+		Version:                     2,
+		Type:                        scope.Project.String(),
+		AuthorizedActions:           []string{"read", "update", "delete"},
+		AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 	}
 
 	cases := []struct {
@@ -174,8 +249,12 @@ func TestList(t *testing.T) {
 	globalScope := &pb.ScopeInfo{Id: "global", Type: scope.Global.String()}
 	oNoProjectsProto := scopes.ToProto(oNoProjects)
 	oNoProjectsProto.Scope = globalScope
+	oNoProjectsProto.AuthorizedActions = []string{"read", "update", "delete"}
+	oNoProjectsProto.AuthorizedCollectionActions = orgAuthorizedCollectionActions
 	oWithProjectsProto := scopes.ToProto(oWithProjects)
 	oWithProjectsProto.Scope = globalScope
+	oWithProjectsProto.AuthorizedActions = []string{"read", "update", "delete"}
+	oWithProjectsProto.AuthorizedCollectionActions = orgAuthorizedCollectionActions
 	initialOrgs = append(initialOrgs, oNoProjectsProto, oWithProjectsProto)
 	scopes.SortScopes(initialOrgs)
 
@@ -227,13 +306,15 @@ func TestList(t *testing.T) {
 		o, err := repo.CreateScope(context.Background(), newO, "")
 		require.NoError(t, err)
 		wantOrgs = append(wantOrgs, &pb.Scope{
-			Id:          o.GetPublicId(),
-			ScopeId:     globalScope.GetId(),
-			Scope:       globalScope,
-			CreatedTime: o.GetCreateTime().GetTimestamp(),
-			UpdatedTime: o.GetUpdateTime().GetTimestamp(),
-			Version:     1,
-			Type:        scope.Org.String(),
+			Id:                          o.GetPublicId(),
+			ScopeId:                     globalScope.GetId(),
+			Scope:                       globalScope,
+			CreatedTime:                 o.GetCreateTime().GetTimestamp(),
+			UpdatedTime:                 o.GetUpdateTime().GetTimestamp(),
+			Version:                     1,
+			Type:                        scope.Org.String(),
+			AuthorizedActions:           []string{"read", "update", "delete"},
+			AuthorizedCollectionActions: orgAuthorizedCollectionActions,
 		})
 	}
 	wantOrgs = append(wantOrgs, initialOrgs...)
@@ -246,13 +327,15 @@ func TestList(t *testing.T) {
 		p, err := repo.CreateScope(context.Background(), newP, "")
 		require.NoError(t, err)
 		wantProjects = append(wantProjects, &pb.Scope{
-			Id:          p.GetPublicId(),
-			ScopeId:     oWithProjects.GetPublicId(),
-			Scope:       &pb.ScopeInfo{Id: oWithProjects.GetPublicId(), Type: scope.Org.String()},
-			CreatedTime: p.GetCreateTime().GetTimestamp(),
-			UpdatedTime: p.GetUpdateTime().GetTimestamp(),
-			Version:     1,
-			Type:        scope.Project.String(),
+			Id:                          p.GetPublicId(),
+			ScopeId:                     oWithProjects.GetPublicId(),
+			Scope:                       &pb.ScopeInfo{Id: oWithProjects.GetPublicId(), Type: scope.Org.String()},
+			CreatedTime:                 p.GetCreateTime().GetTimestamp(),
+			UpdatedTime:                 p.GetUpdateTime().GetTimestamp(),
+			Version:                     1,
+			Type:                        scope.Project.String(),
+			AuthorizedActions:           []string{"read", "update", "delete"},
+			AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 		})
 	}
 	scopes.SortScopes(wantProjects)
@@ -433,12 +516,14 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateScopeResponse{
 				Uri: "scopes/p_",
 				Item: &pb.Scope{
-					ScopeId:     defaultOrg.GetPublicId(),
-					Scope:       &pb.ScopeInfo{Id: defaultOrg.GetPublicId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "name"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					Version:     1,
-					Type:        scope.Project.String(),
+					ScopeId:                     defaultOrg.GetPublicId(),
+					Scope:                       &pb.ScopeInfo{Id: defaultOrg.GetPublicId(), Type: scope.Org.String()},
+					Name:                        &wrapperspb.StringValue{Value: "name"},
+					Description:                 &wrapperspb.StringValue{Value: "desc"},
+					Version:                     1,
+					Type:                        scope.Project.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -455,12 +540,14 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateScopeResponse{
 				Uri: "scopes/o_",
 				Item: &pb.Scope{
-					ScopeId:     scope.Global.String(),
-					Scope:       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
-					Name:        &wrapperspb.StringValue{Value: "name"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					Version:     1,
-					Type:        scope.Org.String(),
+					ScopeId:                     scope.Global.String(),
+					Scope:                       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Name:                        &wrapperspb.StringValue{Value: "name"},
+					Description:                 &wrapperspb.StringValue{Value: "desc"},
+					Version:                     1,
+					Type:                        scope.Org.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: orgAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -477,11 +564,13 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateScopeResponse{
 				Uri: "scopes/p_",
 				Item: &pb.Scope{
-					ScopeId:     defaultOrg.GetPublicId(),
-					Scope:       &pb.ScopeInfo{Id: defaultOrg.GetPublicId(), Type: scope.Org.String()},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					Version:     1,
-					Type:        scope.Project.String(),
+					ScopeId:                     defaultOrg.GetPublicId(),
+					Scope:                       &pb.ScopeInfo{Id: defaultOrg.GetPublicId(), Type: scope.Org.String()},
+					Description:                 &wrapperspb.StringValue{Value: "desc"},
+					Version:                     1,
+					Type:                        scope.Project.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -498,11 +587,13 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateScopeResponse{
 				Uri: "scopes/o_",
 				Item: &pb.Scope{
-					ScopeId:     scope.Global.String(),
-					Scope:       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					Version:     1,
-					Type:        scope.Org.String(),
+					ScopeId:                     scope.Global.String(),
+					Scope:                       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Description:                 &wrapperspb.StringValue{Value: "desc"},
+					Version:                     1,
+					Type:                        scope.Org.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: orgAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -704,13 +795,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateScopeResponse{
 				Item: &pb.Scope{
-					Id:          proj.GetPublicId(),
-					ScopeId:     org.GetPublicId(),
-					Scope:       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "new"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					CreatedTime: proj.GetCreateTime().GetTimestamp(),
-					Type:        scope.Project.String(),
+					Id:                          proj.GetPublicId(),
+					ScopeId:                     org.GetPublicId(),
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Name:                        &wrapperspb.StringValue{Value: "new"},
+					Description:                 &wrapperspb.StringValue{Value: "desc"},
+					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
+					Type:                        scope.Project.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -729,13 +822,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateScopeResponse{
 				Item: &pb.Scope{
-					Id:          org.GetPublicId(),
-					ScopeId:     scope.Global.String(),
-					Scope:       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
-					Name:        &wrapperspb.StringValue{Value: "new"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					CreatedTime: org.GetCreateTime().GetTimestamp(),
-					Type:        scope.Org.String(),
+					Id:                          org.GetPublicId(),
+					ScopeId:                     scope.Global.String(),
+					Scope:                       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Name:                        &wrapperspb.StringValue{Value: "new"},
+					Description:                 &wrapperspb.StringValue{Value: "desc"},
+					CreatedTime:                 org.GetCreateTime().GetTimestamp(),
+					Type:                        scope.Org.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: orgAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -753,13 +848,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateScopeResponse{
 				Item: &pb.Scope{
-					Id:          proj.GetPublicId(),
-					ScopeId:     org.GetPublicId(),
-					Scope:       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "new"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					CreatedTime: proj.GetCreateTime().GetTimestamp(),
-					Type:        scope.Project.String(),
+					Id:                          proj.GetPublicId(),
+					ScopeId:                     org.GetPublicId(),
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Name:                        &wrapperspb.StringValue{Value: "new"},
+					Description:                 &wrapperspb.StringValue{Value: "desc"},
+					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
+					Type:                        scope.Project.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -825,12 +922,14 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateScopeResponse{
 				Item: &pb.Scope{
-					Id:          proj.GetPublicId(),
-					ScopeId:     org.GetPublicId(),
-					Scope:       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
-					Description: &wrapperspb.StringValue{Value: "defaultProj"},
-					CreatedTime: proj.GetCreateTime().GetTimestamp(),
-					Type:        scope.Project.String(),
+					Id:                          proj.GetPublicId(),
+					ScopeId:                     org.GetPublicId(),
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Description:                 &wrapperspb.StringValue{Value: "defaultProj"},
+					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
+					Type:                        scope.Project.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -847,12 +946,14 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateScopeResponse{
 				Item: &pb.Scope{
-					Id:          proj.GetPublicId(),
-					ScopeId:     org.GetPublicId(),
-					Scope:       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
-					Name:        &wrappers.StringValue{Value: "defaultProj"},
-					CreatedTime: proj.GetCreateTime().GetTimestamp(),
-					Type:        scope.Project.String(),
+					Id:                          proj.GetPublicId(),
+					ScopeId:                     org.GetPublicId(),
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Name:                        &wrappers.StringValue{Value: "defaultProj"},
+					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
+					Type:                        scope.Project.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -870,13 +971,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateScopeResponse{
 				Item: &pb.Scope{
-					Id:          proj.GetPublicId(),
-					ScopeId:     org.GetPublicId(),
-					Scope:       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "updated"},
-					Description: &wrapperspb.StringValue{Value: "defaultProj"},
-					CreatedTime: proj.GetCreateTime().GetTimestamp(),
-					Type:        scope.Project.String(),
+					Id:                          proj.GetPublicId(),
+					ScopeId:                     org.GetPublicId(),
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Name:                        &wrapperspb.StringValue{Value: "updated"},
+					Description:                 &wrapperspb.StringValue{Value: "defaultProj"},
+					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
+					Type:                        scope.Project.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 				},
 			},
 		},
@@ -894,13 +997,15 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateScopeResponse{
 				Item: &pb.Scope{
-					Id:          proj.GetPublicId(),
-					ScopeId:     org.GetPublicId(),
-					Scope:       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "defaultProj"},
-					Description: &wrapperspb.StringValue{Value: "notignored"},
-					CreatedTime: proj.GetCreateTime().GetTimestamp(),
-					Type:        scope.Project.String(),
+					Id:                          proj.GetPublicId(),
+					ScopeId:                     org.GetPublicId(),
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Name:                        &wrapperspb.StringValue{Value: "defaultProj"},
+					Description:                 &wrapperspb.StringValue{Value: "notignored"},
+					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
+					Type:                        scope.Project.String(),
+					AuthorizedActions:           []string{"read", "update", "delete"},
+					AuthorizedCollectionActions: projectAuthorizedCollectionActions,
 				},
 			},
 		},

internal/servers/controller/handlers/sessions/session_service.go

@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/sessions"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/session"
@@ -18,6 +19,21 @@ import (
 	"github.com/hashicorp/boundary/internal/types/scope"
 )
 
+var (
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Cancel,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.List,
+	}
+)
+
 // Service handles request as described by the pbs.SessionServiceServer interface.
 type Service struct {
 	pbs.UnimplementedSessionServiceServer
@@ -53,6 +69,7 @@ func (s Service) GetSession(ctx context.Context, req *pbs.GetSessionRequest) (*p
 		return nil, err
 	}
 	ses.Scope = authResults.Scope
+	ses.AuthorizedActions = authResults.FetchActionSetForId(ctx, ses.Id, IdActions).Strings()
 	return &pbs.GetSessionResponse{Item: ses}, nil
 }
 
@@ -69,10 +86,19 @@ func (s Service) ListSessions(ctx context.Context, req *pbs.ListSessionsRequest)
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.Session, 0, len(seslist))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.Session,
+	}
 	for _, item := range seslist {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+		}
 	}
-	return &pbs.ListSessionsResponse{Items: seslist}, nil
+	return &pbs.ListSessionsResponse{Items: finalItems}, nil
 }
 
 // CancelSession implements the interface pbs.SessionServiceServer.
@@ -89,6 +115,7 @@ func (s Service) CancelSession(ctx context.Context, req *pbs.CancelSessionReques
 		return nil, err
 	}
 	ses.Scope = authResults.Scope
+	ses.AuthorizedActions = authResults.FetchActionSetForId(ctx, ses.Id, IdActions).Strings()
 	return &pbs.CancelSessionResponse{Item: ses}, nil
 }
 

internal/servers/controller/handlers/sessions/session_service_test.go

@@ -64,23 +64,24 @@ func TestGetSession(t *testing.T) {
 	})
 
 	wireSess := &pb.Session{
-		Id:             sess.GetPublicId(),
-		ScopeId:        p.GetPublicId(),
-		AuthTokenId:    at.GetPublicId(),
-		Endpoint:       sess.Endpoint,
-		UserId:         at.GetIamUserId(),
-		TargetId:       sess.TargetId,
-		HostSetId:      sess.HostSetId,
-		HostId:         sess.HostId,
-		Version:        sess.Version,
-		Status:         session.StatusPending.String(),
-		UpdatedTime:    sess.UpdateTime.GetTimestamp(),
-		CreatedTime:    sess.CreateTime.GetTimestamp(),
-		ExpirationTime: sess.ExpirationTime.GetTimestamp(),
-		Scope:          &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String()},
-		States:         []*pb.SessionState{{Status: session.StatusPending.String(), StartTime: sess.CreateTime.GetTimestamp()}},
-		Certificate:    sess.Certificate,
-		Type:           target.TcpSubType.String(),
+		Id:                sess.GetPublicId(),
+		ScopeId:           p.GetPublicId(),
+		AuthTokenId:       at.GetPublicId(),
+		Endpoint:          sess.Endpoint,
+		UserId:            at.GetIamUserId(),
+		TargetId:          sess.TargetId,
+		HostSetId:         sess.HostSetId,
+		HostId:            sess.HostId,
+		Version:           sess.Version,
+		Status:            session.StatusPending.String(),
+		UpdatedTime:       sess.UpdateTime.GetTimestamp(),
+		CreatedTime:       sess.CreateTime.GetTimestamp(),
+		ExpirationTime:    sess.ExpirationTime.GetTimestamp(),
+		Scope:             &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String()},
+		States:            []*pb.SessionState{{Status: session.StatusPending.String(), StartTime: sess.CreateTime.GetTimestamp()}},
+		Certificate:       sess.Certificate,
+		Type:              target.TcpSubType.String(),
+		AuthorizedActions: []string{"read", "cancel"},
 	}
 
 	cases := []struct {
@@ -180,23 +181,24 @@ func TestList(t *testing.T) {
 		status, states := convertStates(sess.States)
 
 		wantSession = append(wantSession, &pb.Session{
-			Id:             sess.GetPublicId(),
-			ScopeId:        pWithSessions.GetPublicId(),
-			AuthTokenId:    at.GetPublicId(),
-			UserId:         at.GetIamUserId(),
-			TargetId:       sess.TargetId,
-			Endpoint:       sess.Endpoint,
-			HostSetId:      sess.HostSetId,
-			HostId:         sess.HostId,
-			Version:        sess.Version,
-			UpdatedTime:    sess.UpdateTime.GetTimestamp(),
-			CreatedTime:    sess.CreateTime.GetTimestamp(),
-			ExpirationTime: sess.ExpirationTime.GetTimestamp(),
-			Scope:          &scopes.ScopeInfo{Id: pWithSessions.GetPublicId(), Type: scope.Project.String()},
-			Status:         status,
-			States:         states,
-			Certificate:    sess.Certificate,
-			Type:           target.TcpSubType.String(),
+			Id:                sess.GetPublicId(),
+			ScopeId:           pWithSessions.GetPublicId(),
+			AuthTokenId:       at.GetPublicId(),
+			UserId:            at.GetIamUserId(),
+			TargetId:          sess.TargetId,
+			Endpoint:          sess.Endpoint,
+			HostSetId:         sess.HostSetId,
+			HostId:            sess.HostId,
+			Version:           sess.Version,
+			UpdatedTime:       sess.UpdateTime.GetTimestamp(),
+			CreatedTime:       sess.CreateTime.GetTimestamp(),
+			ExpirationTime:    sess.ExpirationTime.GetTimestamp(),
+			Scope:             &scopes.ScopeInfo{Id: pWithSessions.GetPublicId(), Type: scope.Project.String()},
+			Status:            status,
+			States:            states,
+			Certificate:       sess.Certificate,
+			Type:              target.TcpSubType.String(),
+			AuthorizedActions: []string{"read", "cancel"},
 		})
 	}
 
@@ -293,21 +295,22 @@ func TestCancel(t *testing.T) {
 	})
 
 	wireSess := &pb.Session{
-		Id:             sess.GetPublicId(),
-		ScopeId:        p.GetPublicId(),
-		AuthTokenId:    at.GetPublicId(),
-		UserId:         at.GetIamUserId(),
-		TargetId:       sess.TargetId,
-		HostSetId:      sess.HostSetId,
-		HostId:         sess.HostId,
-		Version:        sess.Version,
-		Endpoint:       sess.Endpoint,
-		CreatedTime:    sess.CreateTime.GetTimestamp(),
-		ExpirationTime: sess.ExpirationTime.GetTimestamp(),
-		Scope:          &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String()},
-		Status:         session.StatusCanceling.String(),
-		Certificate:    sess.Certificate,
-		Type:           target.TcpSubType.String(),
+		Id:                sess.GetPublicId(),
+		ScopeId:           p.GetPublicId(),
+		AuthTokenId:       at.GetPublicId(),
+		UserId:            at.GetIamUserId(),
+		TargetId:          sess.TargetId,
+		HostSetId:         sess.HostSetId,
+		HostId:            sess.HostId,
+		Version:           sess.Version,
+		Endpoint:          sess.Endpoint,
+		CreatedTime:       sess.CreateTime.GetTimestamp(),
+		ExpirationTime:    sess.ExpirationTime.GetTimestamp(),
+		Scope:             &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String()},
+		Status:            session.StatusCanceling.String(),
+		Certificate:       sess.Certificate,
+		Type:              target.TcpSubType.String(),
+		AuthorizedActions: []string{"read", "cancel"},
 	}
 
 	version := wireSess.GetVersion()

internal/servers/controller/handlers/targets/target_service.go

@@ -38,9 +38,9 @@ import (
 var (
 	maskManager handlers.MaskManager
 
-	// TargetIdActions contains the set of actions that can be performed on
-	// individual target resources
-	TargetIdActions = action.Actions{
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
 		action.Read,
 		action.Update,
 		action.Delete,
@@ -49,6 +49,13 @@ var (
 		action.RemoveHostSets,
 		action.AuthorizeSession,
 	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
 )
 
 func init() {
@@ -119,13 +126,13 @@ func (s Service) ListTargets(ctx context.Context, req *pbs.ListTargetsRequest) (
 		return nil, err
 	}
 	finalItems := make([]*pb.Target, 0, len(ul))
-	resource := &perms.Resource{
+	res := &perms.Resource{
 		ScopeId: authResults.Scope.Id,
 		Type:    resource.Target,
 	}
 	for _, item := range ul {
 		item.Scope = authResults.Scope
-		item.AuthorizedActions = authResults.FetchActionsForId(ctx, item.Id, TargetIdActions, auth.WithResource(resource)).Strings()
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
 		if len(item.AuthorizedActions) > 0 {
 			finalItems = append(finalItems, item)
 		}
@@ -147,7 +154,7 @@ func (s Service) GetTarget(ctx context.Context, req *pbs.GetTargetRequest) (*pbs
 		return nil, err
 	}
 	u.Scope = authResults.Scope
-	u.AuthorizedActions = authResults.FetchActionsForId(ctx, u.Id, TargetIdActions).Strings()
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.GetTargetResponse{Item: u}, nil
 }
 
@@ -165,7 +172,7 @@ func (s Service) CreateTarget(ctx context.Context, req *pbs.CreateTargetRequest)
 		return nil, err
 	}
 	u.Scope = authResults.Scope
-	u.AuthorizedActions = authResults.FetchActionsForId(ctx, u.Id, TargetIdActions).Strings()
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.CreateTargetResponse{Item: u, Uri: fmt.Sprintf("targets/%s", u.GetId())}, nil
 }
 
@@ -183,7 +190,7 @@ func (s Service) UpdateTarget(ctx context.Context, req *pbs.UpdateTargetRequest)
 		return nil, err
 	}
 	u.Scope = authResults.Scope
-	u.AuthorizedActions = authResults.FetchActionsForId(ctx, u.Id, TargetIdActions).Strings()
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.UpdateTargetResponse{Item: u}, nil
 }
 
@@ -217,7 +224,7 @@ func (s Service) AddTargetHostSets(ctx context.Context, req *pbs.AddTargetHostSe
 		return nil, err
 	}
 	u.Scope = authResults.Scope
-	u.AuthorizedActions = authResults.FetchActionsForId(ctx, u.Id, TargetIdActions).Strings()
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.AddTargetHostSetsResponse{Item: u}, nil
 }
 
@@ -235,7 +242,7 @@ func (s Service) SetTargetHostSets(ctx context.Context, req *pbs.SetTargetHostSe
 		return nil, err
 	}
 	u.Scope = authResults.Scope
-	u.AuthorizedActions = authResults.FetchActionsForId(ctx, u.Id, TargetIdActions).Strings()
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.SetTargetHostSetsResponse{Item: u}, nil
 }
 
@@ -253,7 +260,7 @@ func (s Service) RemoveTargetHostSets(ctx context.Context, req *pbs.RemoveTarget
 		return nil, err
 	}
 	u.Scope = authResults.Scope
-	u.AuthorizedActions = authResults.FetchActionsForId(ctx, u.Id, TargetIdActions).Strings()
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.RemoveTargetHostSetsResponse{Item: u}, nil
 }
 

internal/servers/controller/handlers/targets/target_service_test.go

@@ -81,7 +81,7 @@ func TestGet(t *testing.T) {
 		Attributes:             new(structpb.Struct),
 		SessionMaxSeconds:      wrapperspb.UInt32(28800),
 		SessionConnectionLimit: wrapperspb.Int32(1),
-		AuthorizedActions:      targets.TargetIdActions.Strings(),
+		AuthorizedActions:      targets.IdActions.Strings(),
 	}
 	for _, ihs := range hs {
 		pTar.HostSets = append(pTar.HostSets, &pb.HostSet{Id: ihs.GetPublicId(), HostCatalogId: ihs.GetCatalogId()})
@@ -164,7 +164,7 @@ func TestList(t *testing.T) {
 			Attributes:             new(structpb.Struct),
 			SessionMaxSeconds:      wrapperspb.UInt32(28800),
 			SessionConnectionLimit: wrapperspb.Int32(1),
-			AuthorizedActions:      targets.TargetIdActions.Strings(),
+			AuthorizedActions:      targets.IdActions.Strings(),
 		})
 	}
 
@@ -320,7 +320,7 @@ func TestCreate(t *testing.T) {
 					}},
 					SessionMaxSeconds:      wrapperspb.UInt32(28800),
 					SessionConnectionLimit: wrapperspb.Int32(1),
-					AuthorizedActions:      targets.TargetIdActions.Strings(),
+					AuthorizedActions:      targets.IdActions.Strings(),
 				},
 			},
 		},
@@ -491,7 +491,7 @@ func TestUpdate(t *testing.T) {
 					HostSets:               hostSets,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
-					AuthorizedActions:      targets.TargetIdActions.Strings(),
+					AuthorizedActions:      targets.IdActions.Strings(),
 				},
 			},
 		},
@@ -523,7 +523,7 @@ func TestUpdate(t *testing.T) {
 					HostSets:               hostSets,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
-					AuthorizedActions:      targets.TargetIdActions.Strings(),
+					AuthorizedActions:      targets.IdActions.Strings(),
 				},
 			},
 		},
@@ -608,7 +608,7 @@ func TestUpdate(t *testing.T) {
 					HostSets:               hostSets,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
-					AuthorizedActions:      targets.TargetIdActions.Strings(),
+					AuthorizedActions:      targets.IdActions.Strings(),
 				},
 			},
 		},
@@ -639,7 +639,7 @@ func TestUpdate(t *testing.T) {
 					HostSets:               hostSets,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
-					AuthorizedActions:      targets.TargetIdActions.Strings(),
+					AuthorizedActions:      targets.IdActions.Strings(),
 				},
 			},
 		},
@@ -670,7 +670,7 @@ func TestUpdate(t *testing.T) {
 					HostSets:               hostSets,
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
-					AuthorizedActions:      targets.TargetIdActions.Strings(),
+					AuthorizedActions:      targets.IdActions.Strings(),
 				},
 			},
 		},

internal/servers/controller/handlers/users/user_service.go

@@ -11,6 +11,7 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/iam/store"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -21,7 +22,27 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var maskManager handlers.MaskManager
+var (
+	maskManager handlers.MaskManager
+
+	// IdActions contains the set of actions that can be performed on
+	// individual resources
+	IdActions = action.ActionSet{
+		action.Read,
+		action.Update,
+		action.Delete,
+		action.AddAccounts,
+		action.SetAccounts,
+		action.RemoveAccounts,
+	}
+
+	// CollectionActions contains the set of actions that can be performed on
+	// this collection
+	CollectionActions = action.ActionSet{
+		action.Create,
+		action.List,
+	}
+)
 
 func init() {
 	var err error
@@ -60,10 +81,19 @@ func (s Service) ListUsers(ctx context.Context, req *pbs.ListUsersRequest) (*pbs
 	if err != nil {
 		return nil, err
 	}
+	finalItems := make([]*pb.User, 0, len(ul))
+	res := &perms.Resource{
+		ScopeId: authResults.Scope.Id,
+		Type:    resource.User,
+	}
 	for _, item := range ul {
 		item.Scope = authResults.Scope
+		item.AuthorizedActions = authResults.FetchActionSetForId(ctx, item.Id, IdActions, auth.WithResource(res)).Strings()
+		if len(item.AuthorizedActions) > 0 {
+			finalItems = append(finalItems, item)
+		}
 	}
-	return &pbs.ListUsersResponse{Items: ul}, nil
+	return &pbs.ListUsersResponse{Items: finalItems}, nil
 }
 
 // GetUsers implements the interface pbs.UserServiceServer.
@@ -80,6 +110,7 @@ func (s Service) GetUser(ctx context.Context, req *pbs.GetUserRequest) (*pbs.Get
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.GetUserResponse{Item: u}, nil
 }
 
@@ -97,6 +128,7 @@ func (s Service) CreateUser(ctx context.Context, req *pbs.CreateUserRequest) (*p
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.CreateUserResponse{Item: u, Uri: fmt.Sprintf("users/%s", u.GetId())}, nil
 }
 
@@ -114,6 +146,7 @@ func (s Service) UpdateUser(ctx context.Context, req *pbs.UpdateUserRequest) (*p
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.UpdateUserResponse{Item: u}, nil
 }
 
@@ -147,6 +180,7 @@ func (s Service) AddUserAccounts(ctx context.Context, req *pbs.AddUserAccountsRe
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.AddUserAccountsResponse{Item: u}, nil
 }
 
@@ -164,6 +198,7 @@ func (s Service) SetUserAccounts(ctx context.Context, req *pbs.SetUserAccountsRe
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.SetUserAccountsResponse{Item: u}, nil
 }
 
@@ -181,6 +216,7 @@ func (s Service) RemoveUserAccounts(ctx context.Context, req *pbs.RemoveUserAcco
 		return nil, err
 	}
 	u.Scope = authResults.Scope
+	u.AuthorizedActions = authResults.FetchActionSetForId(ctx, u.Id, IdActions).Strings()
 	return &pbs.RemoveUserAccountsResponse{Item: u}, nil
 }
 

internal/servers/controller/handlers/users/user_service_test.go

@@ -49,14 +49,15 @@ func TestGet(t *testing.T) {
 	}
 
 	wantU := &pb.User{
-		Id:          u.GetPublicId(),
-		ScopeId:     u.GetScopeId(),
-		Scope:       &scopes.ScopeInfo{Id: u.ScopeId, Type: scope.Org.String()},
-		Name:        &wrapperspb.StringValue{Value: u.GetName()},
-		Description: &wrapperspb.StringValue{Value: u.GetDescription()},
-		CreatedTime: u.CreateTime.GetTimestamp(),
-		UpdatedTime: u.UpdateTime.GetTimestamp(),
-		Version:     1,
+		Id:                u.GetPublicId(),
+		ScopeId:           u.GetScopeId(),
+		Scope:             &scopes.ScopeInfo{Id: u.ScopeId, Type: scope.Org.String()},
+		Name:              &wrapperspb.StringValue{Value: u.GetName()},
+		Description:       &wrapperspb.StringValue{Value: u.GetDescription()},
+		CreatedTime:       u.CreateTime.GetTimestamp(),
+		UpdatedTime:       u.UpdateTime.GetTimestamp(),
+		Version:           1,
+		AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
 	}
 
 	cases := []struct {
@@ -128,12 +129,13 @@ func TestList(t *testing.T) {
 		u, err := repo.CreateUser(context.Background(), newU)
 		require.NoError(t, err)
 		wantUsers = append(wantUsers, &pb.User{
-			Id:          u.GetPublicId(),
-			ScopeId:     u.GetScopeId(),
-			Scope:       &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
-			CreatedTime: u.GetCreateTime().GetTimestamp(),
-			UpdatedTime: u.GetUpdateTime().GetTimestamp(),
-			Version:     1,
+			Id:                u.GetPublicId(),
+			ScopeId:           u.GetScopeId(),
+			Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+			CreatedTime:       u.GetCreateTime().GetTimestamp(),
+			UpdatedTime:       u.GetUpdateTime().GetTimestamp(),
+			Version:           1,
+			AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
 		})
 	}
 
@@ -254,11 +256,12 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateUserResponse{
 				Uri: fmt.Sprintf("users/%s_", iam.UserPrefix),
 				Item: &pb.User{
-					ScopeId:     defaultUser.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: defaultUser.GetScopeId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "name"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					Version:     1,
+					ScopeId:           defaultUser.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: defaultUser.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "name"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					Version:           1,
+					AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
 				},
 			},
 		},
@@ -272,11 +275,12 @@ func TestCreate(t *testing.T) {
 			res: &pbs.CreateUserResponse{
 				Uri: fmt.Sprintf("users/%s_", iam.UserPrefix),
 				Item: &pb.User{
-					ScopeId:     scope.Global.String(),
-					Scope:       &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
-					Name:        &wrapperspb.StringValue{Value: "name"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					Version:     1,
+					ScopeId:           scope.Global.String(),
+					Scope:             &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Name:              &wrapperspb.StringValue{Value: "name"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					Version:           1,
+					AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
 				},
 			},
 		},
@@ -381,12 +385,13 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateUserResponse{
 				Item: &pb.User{
-					Id:          u.GetPublicId(),
-					ScopeId:     u.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "new"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					CreatedTime: u.GetCreateTime().GetTimestamp(),
+					Id:                u.GetPublicId(),
+					ScopeId:           u.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "new"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					CreatedTime:       u.GetCreateTime().GetTimestamp(),
+					AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
 				},
 			},
 		},
@@ -403,12 +408,13 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateUserResponse{
 				Item: &pb.User{
-					Id:          u.GetPublicId(),
-					ScopeId:     u.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "new"},
-					Description: &wrapperspb.StringValue{Value: "desc"},
-					CreatedTime: u.GetCreateTime().GetTimestamp(),
+					Id:                u.GetPublicId(),
+					ScopeId:           u.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "new"},
+					Description:       &wrapperspb.StringValue{Value: "desc"},
+					CreatedTime:       u.GetCreateTime().GetTimestamp(),
+					AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
 				},
 			},
 		},
@@ -456,11 +462,12 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateUserResponse{
 				Item: &pb.User{
-					Id:          u.GetPublicId(),
-					ScopeId:     u.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
-					Description: &wrapperspb.StringValue{Value: "default"},
-					CreatedTime: u.GetCreateTime().GetTimestamp(),
+					Id:                u.GetPublicId(),
+					ScopeId:           u.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Description:       &wrapperspb.StringValue{Value: "default"},
+					CreatedTime:       u.GetCreateTime().GetTimestamp(),
+					AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
 				},
 			},
 		},
@@ -477,12 +484,13 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateUserResponse{
 				Item: &pb.User{
-					Id:          u.GetPublicId(),
-					ScopeId:     u.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "updated"},
-					Description: &wrapperspb.StringValue{Value: "default"},
-					CreatedTime: u.GetCreateTime().GetTimestamp(),
+					Id:                u.GetPublicId(),
+					ScopeId:           u.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "updated"},
+					Description:       &wrapperspb.StringValue{Value: "default"},
+					CreatedTime:       u.GetCreateTime().GetTimestamp(),
+					AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
 				},
 			},
 		},
@@ -499,12 +507,13 @@ func TestUpdate(t *testing.T) {
 			},
 			res: &pbs.UpdateUserResponse{
 				Item: &pb.User{
-					Id:          u.GetPublicId(),
-					ScopeId:     u.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
-					Name:        &wrapperspb.StringValue{Value: "default"},
-					Description: &wrapperspb.StringValue{Value: "notignored"},
-					CreatedTime: u.GetCreateTime().GetTimestamp(),
+					Id:                u.GetPublicId(),
+					ScopeId:           u.GetScopeId(),
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Name:              &wrapperspb.StringValue{Value: "default"},
+					Description:       &wrapperspb.StringValue{Value: "notignored"},
+					CreatedTime:       u.GetCreateTime().GetTimestamp(),
+					AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
 				},
 			},
 		},