diff --git a/awx/ui/client/src/access/roleList.partial.html b/awx/ui/client/src/access/roleList.partial.html
index 1478c9dc37..365a20f061 100644
--- a/awx/ui/client/src/access/roleList.partial.html
+++ b/awx/ui/client/src/access/roleList.partial.html
@@ -1,13 +1,13 @@
 <div class="RoleList-tagContainer"
     ng-repeat="entry in access_list">
     <div class="RoleList-deleteContainer"
-        ng-if="entry.explicit"
+        ng-if="entry.explicit && entry.user_capabilities.unattach"
         ng-click="deletePermission(permission, entry)">
-        <i ng-if="entry.explicit"
+        <i ng-if="entry.explicit && entry.user_capabilities.unattach"
             class="fa fa-times RoleList-tagDelete"></i>
     </div>
     <div class="RoleList-tag"
-        ng-class="{'RoleList-tag--deletable': entry.explicit,
+        ng-class="{'RoleList-tag--deletable': entry.explicit && entry.user_capabilities.unattach,
             'RoleList-tag--team': entry.team_id}"
         aw-tool-tip='{{entry.team_name | sanitize}}' aw-tip-placement='bottom'>
         <span class="RoleList-name">{{ entry.name }}</span>
diff --git a/awx/ui/client/src/app.js b/awx/ui/client/src/app.js
index b3425609fe..0f925812f6 100644
--- a/awx/ui/client/src/app.js
+++ b/awx/ui/client/src/app.js
@@ -839,6 +839,7 @@ var tower = angular.module('Tower', [
                 // If browser refresh, set the user_is_superuser value
                 $rootScope.user_is_superuser = Authorization.getUserInfo('is_superuser');
                 $rootScope.user_is_system_auditor = Authorization.getUserInfo('is_system_auditor');
+
                 // state the user refreshes we want to open the socket, except if the user is on the login page, which should happen after the user logs in (see the AuthService module for that call to OpenSocket)
                 if (!_.contains($location.$$url, '/login')) {
                     ConfigService.getConfig().then(function() {
diff --git a/awx/ui/client/src/controllers/Credentials.js b/awx/ui/client/src/controllers/Credentials.js
index 66b016dc50..aed17aee32 100644
--- a/awx/ui/client/src/controllers/Credentials.js
+++ b/awx/ui/client/src/controllers/Credentials.js
@@ -138,7 +138,6 @@ export function CredentialsAdd($scope, $rootScope, $compile, $location, $log,
     ReturnToCaller, ClearScope, GenerateList, SearchInit, PaginateInit,
     LookUpInit, OrganizationList, GetBasePath, GetChoices, Empty, KindChange,
     OwnerChange, FormSave, $state, CreateSelect2) {
-
     ClearScope();
 
     // Inject dynamic view
@@ -337,6 +336,7 @@ export function CredentialsEdit($scope, $rootScope, $compile, $location, $log,
     }
 
     ClearScope();
+
     var defaultUrl = GetBasePath('credentials'),
         generator = GenerateForm,
         form = CredentialForm,
@@ -344,6 +344,7 @@ export function CredentialsEdit($scope, $rootScope, $compile, $location, $log,
         master = {},
         id = $stateParams.credential_id,
         relatedSets = {};
+
     generator.inject(form, { mode: 'edit', related: true, scope: $scope });
     generator.reset();
     $scope.id = id;
diff --git a/awx/ui/client/src/controllers/Jobs.js b/awx/ui/client/src/controllers/Jobs.js
index 3f0e3bdcfd..0e2f46f736 100644
--- a/awx/ui/client/src/controllers/Jobs.js
+++ b/awx/ui/client/src/controllers/Jobs.js
@@ -13,7 +13,7 @@
 
 export function JobsListController ($rootScope, $log, $scope, $compile, $stateParams,
     ClearScope, LoadSchedulesScope,
-    LoadJobsScope, AllJobsList, ScheduledJobsList, GetChoices, GetBasePath, Wait) {
+    LoadJobsScope, AllJobsList, ScheduledJobsList, GetChoices, GetBasePath, Wait, $state) {
 
     ClearScope();
 
@@ -61,6 +61,11 @@ export function JobsListController ($rootScope, $log, $scope, $compile, $statePa
             }
         }
         jobs_scope = $scope.$new(true);
+
+        jobs_scope.viewJob = function (id) {
+            $state.transitionTo('jobDetail', {id: id});
+        };
+        
         jobs_scope.showJobType = true;
         LoadJobsScope({
             parent_scope: $scope,
@@ -153,4 +158,4 @@ export function JobsListController ($rootScope, $log, $scope, $compile, $statePa
 
 JobsListController.$inject = ['$rootScope', '$log', '$scope', '$compile', '$stateParams',
 'ClearScope', 'LoadSchedulesScope', 'LoadJobsScope',
-'AllJobsList', 'ScheduledJobsList', 'GetChoices', 'GetBasePath', 'Wait'];
+'AllJobsList', 'ScheduledJobsList', 'GetChoices', 'GetBasePath', 'Wait', '$state'];
diff --git a/awx/ui/client/src/controllers/Projects.js b/awx/ui/client/src/controllers/Projects.js
index 60692d581e..6c882cdd13 100644
--- a/awx/ui/client/src/controllers/Projects.js
+++ b/awx/ui/client/src/controllers/Projects.js
@@ -15,10 +15,16 @@ export function ProjectsList ($scope, $rootScope, $location, $log, $stateParams,
     Rest, Alert, ProjectList, GenerateList, Prompt, SearchInit,
     PaginateInit, ReturnToCaller, ClearScope, ProcessErrors, GetBasePath,
     SelectionInit, ProjectUpdate, Refresh, Wait, GetChoices, Empty,
-    Find, GetProjectIcon, GetProjectToolTip, $filter, $state) {
-
+    Find, GetProjectIcon, GetProjectToolTip, $filter, $state, rbacUiControlService) {
     ClearScope();
 
+    $scope.canAdd = false;
+
+    rbacUiControlService.canAdd('projects')
+        .then(function(canAdd) {
+            $scope.canAdd = canAdd;
+        });
+
     Wait('start');
 
     var list = ProjectList,
@@ -369,7 +375,7 @@ ProjectsList.$inject = ['$scope', '$rootScope', '$location', '$log',
     'SearchInit', 'PaginateInit', 'ReturnToCaller', 'ClearScope',
     'ProcessErrors', 'GetBasePath', 'SelectionInit', 'ProjectUpdate',
     'Refresh', 'Wait', 'GetChoices', 'Empty', 'Find',
-    'GetProjectIcon', 'GetProjectToolTip', '$filter', '$state'
+    'GetProjectIcon', 'GetProjectToolTip', '$filter', '$state', 'rbacUiControlService'
 ];
 
 
@@ -379,6 +385,15 @@ export function ProjectsAdd(Refresh, $scope, $rootScope, $compile, $location, $l
     OrganizationList, CredentialList, GetChoices, DebugForm, Wait, $state,
     CreateSelect2) {
 
+    Rest.setUrl(GetBasePath('projects'));
+    Rest.options()
+        .success(function(data) {
+            if (!data.actions.POST) {
+                $state.go("^");
+                Alert('Permission Error', 'You do not have permission to add a project.', 'alert-info');
+            }
+        });
+
     ClearScope();
 
     // Inject dynamic view
diff --git a/awx/ui/client/src/controllers/Teams.js b/awx/ui/client/src/controllers/Teams.js
index a8eed62bc5..ca30f84699 100644
--- a/awx/ui/client/src/controllers/Teams.js
+++ b/awx/ui/client/src/controllers/Teams.js
@@ -14,10 +14,16 @@
 export function TeamsList($scope, $rootScope, $location, $log, $stateParams,
     Rest, Alert, TeamList, GenerateList, Prompt, SearchInit, PaginateInit,
     ReturnToCaller, ClearScope, ProcessErrors, SetTeamListeners, GetBasePath,
-    SelectionInit, Wait, $state, Refresh, $filter) {
-
+    SelectionInit, Wait, $state, Refresh, $filter, rbacUiControlService) {
     ClearScope();
 
+    $scope.canAdd = false;
+
+    rbacUiControlService.canAdd('teams')
+        .then(function(canAdd) {
+            $scope.canAdd = canAdd;
+        });
+
     var list = TeamList,
         defaultUrl = GetBasePath('teams'),
         generator = GenerateList,
@@ -126,7 +132,7 @@ TeamsList.$inject = ['$scope', '$rootScope', '$location', '$log',
     '$stateParams', 'Rest', 'Alert', 'TeamList', 'generateList', 'Prompt',
     'SearchInit', 'PaginateInit', 'ReturnToCaller', 'ClearScope',
     'ProcessErrors', 'SetTeamListeners', 'GetBasePath', 'SelectionInit', 'Wait',
-    '$state', 'Refresh', '$filter'
+    '$state', 'Refresh', '$filter', 'rbacUiControlService'
 ];
 
 
@@ -137,6 +143,15 @@ export function TeamsAdd($scope, $rootScope, $compile, $location, $log,
     ClearScope('htmlTemplate'); //Garbage collection. Don't leave behind any listeners/watchers from the prior
     //$scope.
 
+    Rest.setUrl(GetBasePath('teams'));
+    Rest.options()
+        .success(function(data) {
+            if (!data.actions.POST) {
+                $state.go("^");
+                Alert('Permission Error', 'You do not have permission to add a team.', 'alert-info');
+            }
+        });
+
     // Inject dynamic view
     var defaultUrl = GetBasePath('teams'),
         form = TeamForm,
diff --git a/awx/ui/client/src/controllers/Users.js b/awx/ui/client/src/controllers/Users.js
index 103e1d1c84..0a00ed97c3 100644
--- a/awx/ui/client/src/controllers/Users.js
+++ b/awx/ui/client/src/controllers/Users.js
@@ -34,10 +34,16 @@ function user_type_sync($scope) {
 export function UsersList($scope, $rootScope, $location, $log, $stateParams,
     Rest, Alert, UserList, GenerateList, Prompt, SearchInit, PaginateInit,
     ReturnToCaller, ClearScope, ProcessErrors, GetBasePath, SelectionInit,
-    Wait, $state, Refresh, $filter) {
-
+    Wait, $state, Refresh, $filter, rbacUiControlService) {
     ClearScope();
 
+    $scope.canAdd = false;
+
+    rbacUiControlService.canAdd('users')
+        .then(function(canAdd) {
+            $scope.canAdd = canAdd;
+        });
+
     var list = UserList,
         defaultUrl = GetBasePath('users'),
         generator = GenerateList,
@@ -136,7 +142,7 @@ UsersList.$inject = ['$scope', '$rootScope', '$location', '$log',
     '$stateParams', 'Rest', 'Alert', 'UserList', 'generateList', 'Prompt',
     'SearchInit', 'PaginateInit', 'ReturnToCaller', 'ClearScope',
     'ProcessErrors', 'GetBasePath', 'SelectionInit', 'Wait', '$state',
-    'Refresh', '$filter'
+    'Refresh', '$filter', 'rbacUiControlService'
 ];
 
 
@@ -148,6 +154,15 @@ export function UsersAdd($scope, $rootScope, $compile, $location, $log,
     ReturnToCaller, ClearScope, GetBasePath, LookUpInit, OrganizationList,
     ResetForm, Wait, CreateSelect2, $state) {
 
+    Rest.setUrl(GetBasePath('users'));
+    Rest.options()
+        .success(function(data) {
+            if (!data.actions.POST) {
+                $state.go("^");
+                Alert('Permission Error', 'You do not have permission to add a user.', 'alert-info');
+            }
+        });
+
     ClearScope();
 
     // Inject dynamic view
diff --git a/awx/ui/client/src/forms/Credentials.js b/awx/ui/client/src/forms/Credentials.js
index d503f53905..c75f30c8be 100644
--- a/awx/ui/client/src/forms/Credentials.js
+++ b/awx/ui/client/src/forms/Credentials.js
@@ -32,13 +32,15 @@ export default
                     type: 'text',
                     addRequired: true,
                     editRequired: true,
-                    autocomplete: false
+                    autocomplete: false,
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 description: {
                     label: 'Description',
                     type: 'text',
                     addRequired: false,
-                    editRequired: false
+                    editRequired: false,
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 organization: {
                     addRequired: false,
@@ -52,7 +54,8 @@ export default
                     awPopOver: "<p>If no organization is given, the credential can only be used by the user that creates the credential.  Organization admins and system administrators can assign an organization so that roles for the credential can be assigned to users and teams in that organization.</p>",
                     dataTitle: 'Organization ',
                     dataPlacement: 'bottom',
-                    dataContainer: "body"
+                    dataContainer: "body",
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 kind: {
                     label: 'Type',
@@ -83,7 +86,8 @@ export default
                     dataTitle: 'Type',
                     dataPlacement: 'right',
                     dataContainer: "body",
-                    hasSubForm: true
+                    hasSubForm: true,
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 access_key: {
                     label: 'Access Key',
@@ -96,12 +100,13 @@ export default
                     autocomplete: false,
                     apiField: 'username',
                     subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 secret_key: {
                     label: 'Secret Key',
                     type: 'sensitive',
                     ngShow: "kind.value == 'aws'",
-                    ngDisabled: "secret_key_ask",
+                    ngDisabled: "secret_key_ask || !credential_obj.summary_fields.user_capabilities.edit",
                     awRequiredWhen: {
                         reqExpression: "aws_required",
                         init: false
@@ -123,7 +128,8 @@ export default
                     dataTitle: 'STS Token',
                     dataPlacement: 'right',
                     dataContainer: "body",
-                    subForm: 'credentialSubForm'
+                    subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "host": {
                     labelBind: 'hostLabel',
@@ -139,7 +145,8 @@ export default
                         reqExpression: 'host_required',
                         init: false
                     },
-                    subForm: 'credentialSubForm'
+                    subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "subscription": {
                     label: "Subscription ID",
@@ -156,7 +163,8 @@ export default
                     dataTitle: 'Subscription ID',
                     dataPlacement: 'right',
                     dataContainer: "body",
-                    subForm: 'credentialSubForm'
+                    subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "username": {
                     labelBind: 'usernameLabel',
@@ -168,7 +176,8 @@ export default
                         init: false
                     },
                     autocomplete: false,
-                    subForm: "credentialSubForm"
+                    subForm: "credentialSubForm",
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "email_address": {
                     labelBind: 'usernameLabel',
@@ -183,7 +192,8 @@ export default
                     dataTitle: 'Email',
                     dataPlacement: 'right',
                     dataContainer: "body",
-                    subForm: 'credentialSubForm'
+                    subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "api_key": {
                     label: 'API Key',
@@ -196,7 +206,8 @@ export default
                     autocomplete: false,
                     hasShowInputButton: true,
                     clear: false,
-                    subForm: 'credentialSubForm'
+                    subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "password": {
                     labelBind: 'passwordLabel',
@@ -209,13 +220,14 @@ export default
                         reqExpression: "password_required",
                         init: false
                     },
-                    subForm: "credentialSubForm"
+                    subForm: "credentialSubForm",
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "ssh_password": {
                     label: 'Password',
                     type: 'sensitive',
                     ngShow: "kind.value == 'ssh'",
-                    ngDisabled: "ssh_password_ask",
+                    ngDisabled: "ssh_password_ask || !credential_obj.summary_fields.user_capabilities.edit",
                     addRequired: false,
                     editRequired: false,
                     subCheckbox: {
@@ -247,7 +259,8 @@ export default
                     dataTitle: 'Private Key',
                     dataPlacement: 'right',
                     dataContainer: "body",
-                    subForm: "credentialSubForm"
+                    subForm: "credentialSubForm",
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "ssh_key_unlock": {
                     label: 'Private Key Passphrase',
@@ -255,7 +268,7 @@ export default
                     ngShow: "kind.value == 'ssh' || kind.value == 'scm'",
                     addRequired: false,
                     editRequired: false,
-                    ngDisabled: "keyEntered === false || ssh_key_unlock_ask",
+                    ngDisabled: "keyEntered === false || ssh_key_unlock_ask || !credential_obj.summary_fields.user_capabilities.edit",
                     subCheckbox: {
                         variable: 'ssh_key_unlock_ask',
                         ngShow: "kind.value == 'ssh'",
@@ -278,7 +291,8 @@ export default
                     "<code>sudo | su | pbrun | pfexec | runas</code> <br>(defaults to <code>sudo</code>)</p>",
                     dataPlacement: 'right',
                     dataContainer: "body",
-                    subForm: 'credentialSubForm'
+                    subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "become_username": {
                     labelBind: 'becomeUsernameLabel',
@@ -287,13 +301,14 @@ export default
                     addRequired: false,
                     editRequired: false,
                     autocomplete: false,
-                    subForm: 'credentialSubForm'
+                    subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "become_password": {
                     labelBind: 'becomePasswordLabel',
                     type: 'sensitive',
                     ngShow: "(kind.value == 'ssh' && (become_method && become_method.value)) ",
-                    ngDisabled: "become_password_ask",
+                    ngDisabled: "become_password_ask || !credential_obj.summary_fields.user_capabilities.edit",
                     addRequired: false,
                     editRequired: false,
                     subCheckbox: {
@@ -309,7 +324,8 @@ export default
                     type: 'text',
                     label: 'Client ID',
                     subForm: 'credentialSubForm',
-                    ngShow: "kind.value === 'azure_rm'"
+                    ngShow: "kind.value === 'azure_rm'",
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 secret:{
                     type: 'sensitive',
@@ -317,20 +333,23 @@ export default
                     autocomplete: false,
                     label: 'Client Secret',
                     subForm: 'credentialSubForm',
-                    ngShow: "kind.value === 'azure_rm'"
+                    ngShow: "kind.value === 'azure_rm'",
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 tenant: {
                     type: 'text',
                     label: 'Tenant ID',
                     subForm: 'credentialSubForm',
-                    ngShow: "kind.value === 'azure_rm'"
+                    ngShow: "kind.value === 'azure_rm'",
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 authorize: {
                     label: 'Authorize',
                     type: 'checkbox',
                     ngChange: "toggleCallback('host_config_key')",
                     subForm: 'credentialSubForm',
-                    ngShow: "kind.value === 'net'"
+                    ngShow: "kind.value === 'net'",
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 authorize_password: {
                     label: 'Authorize Password',
@@ -339,6 +358,7 @@ export default
                     autocomplete: false,
                     subForm: 'credentialSubForm',
                     ngShow: "authorize && authorize !== 'false'",
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "project": {
                     labelBind: 'projectLabel',
@@ -355,7 +375,8 @@ export default
                         reqExpression: 'project_required',
                         init: false
                     },
-                    subForm: 'credentialSubForm'
+                    subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "domain": {
                     labelBind: 'domainLabel',
@@ -371,13 +392,14 @@ export default
                     dataContainer: "body",
                     addRequired: false,
                     editRequired: false,
-                    subForm: 'credentialSubForm'
+                    subForm: 'credentialSubForm',
+                    ngDisabled: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 "vault_password": {
                     label: "Vault Password",
                     type: 'sensitive',
                     ngShow: "kind.value == 'ssh'",
-                    ngDisabled: "vault_password_ask",
+                    ngDisabled: "vault_password_ask || !credential_obj.summary_fields.user_capabilities.edit",
                     addRequired: false,
                     editRequired: false,
                     subCheckbox: {
@@ -394,11 +416,17 @@ export default
             buttons: {
                 cancel: {
                     ngClick: 'formCancel()',
+                    ngShow: 'credential_obj.summary_fields.user_capabilities.edit'
+                },
+                close: {
+                    ngClick: 'formCancel()',
+                    ngShow: '!credential_obj.summary_fields.user_capabilities.edit'
                 },
                 save: {
                     label: 'Save',
                     ngClick: 'formSave()', //$scope.function to call on click, optional
-                    ngDisabled: true //Disable when $pristine or $invalid, optional
+                    ngDisabled: true,
+                    ngShow: 'credential_obj.summary_fields.user_capabilities.edit' //Disable when $pristine or $invalid, optional
                 }
             },
 
@@ -421,7 +449,8 @@ export default
                             label: 'Add',
                             awToolTip: 'Add a permission',
                             actionClass: 'btn List-buttonSubmit',
-                            buttonContent: '&#43; ADD'
+                            buttonContent: '&#43; ADD',
+                            ngShow: 'credential_obj.summary_fields.user_capabilities.edit'
                         }
                     },
 
diff --git a/awx/ui/client/src/forms/Groups.js b/awx/ui/client/src/forms/Groups.js
index e3327d442e..40a5cd3301 100644
--- a/awx/ui/client/src/forms/Groups.js
+++ b/awx/ui/client/src/forms/Groups.js
@@ -26,14 +26,16 @@ export default
                     type: 'text',
                     addRequired: true,
                     editRequired: true,
-                    tab: 'properties'
+                    tab: 'properties',
+                    ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                 },
                 description: {
                     label: 'Description',
                     type: 'text',
                     addRequired: false,
                     editRequired: false,
-                    tab: 'properties'
+                    tab: 'properties',
+                    ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                 },
                 variables: {
                     label: 'Variables',
@@ -65,7 +67,8 @@ export default
                     ngChange: 'sourceChange(source)',
                     addRequired: false,
                     editRequired: false,
-                    ngModel: 'source'
+                    ngModel: 'source',
+                    ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                 },
                 credential: {
                     label: 'Cloud Credential',
@@ -77,7 +80,8 @@ export default
                     awRequiredWhen: {
                         reqExpression: "cloudCredentialRequired",
                         init: "false"
-                    }
+                    },
+                    ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                 },
                 source_regions: {
                     label: 'Regions',
@@ -92,7 +96,8 @@ export default
                     awPopOver: "<p>Click on the regions field to see a list of regions for your cloud provider. You can select multiple regions, " +
                         "or choose <em>All</em> to include all regions. Tower will only be updated with Hosts associated with the selected regions." +
                         "</p>",
-                    dataContainer: 'body'
+                    dataContainer: 'body',
+                    ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                 },
                 instance_filters: {
                     label: 'Instance Filters',
@@ -112,7 +117,8 @@ export default
                         "<blockquote>tag:Name=test*</blockquote>\n" +
                         "<p>View the <a href=\"http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ApiReference-query-DescribeInstances.html\" target=\"_blank\">Describe Instances documentation</a> " +
                         "for a complete list of supported filters.</p>",
-                    dataContainer: 'body'
+                    dataContainer: 'body',
+                    ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                 },
                 group_by: {
                     label: 'Only Group By',
@@ -137,7 +143,8 @@ export default
                         "<li>VPC ID: <strong>vpcs &raquo; vpc-5ca1ab1e</strong></li>" +
                         "<li>Tag None: <strong>tags &raquo; tag_none</strong></li>" +
                         "</ul><p>If blank, all groups above are created except <em>Instance ID</em>.</p>",
-                    dataContainer: 'body'
+                    dataContainer: 'body',
+                    ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                 },
                 inventory_script: {
                     label :  "Custom Inventory Script",
@@ -149,6 +156,7 @@ export default
                     addRequired: true,
                     editRequired: true,
                     ngRequired: "source && source.value === 'custom'",
+                    ngDisabled: '!group_obj.summary_fields.user_capabilities.edit',
                 },
                 custom_variables: {
                     id: 'custom_variables',
@@ -269,7 +277,8 @@ export default
                         dataTitle: 'Overwrite',
                         dataContainer: 'body',
                         dataPlacement: 'right',
-                        labelClass: 'checkbox-options'
+                        labelClass: 'checkbox-options',
+                        ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                     }, {
                         name: 'overwrite_vars',
                         label: 'Overwrite Variables',
@@ -283,7 +292,8 @@ export default
                         dataTitle: 'Overwrite Variables',
                         dataContainer: 'body',
                         dataPlacement: 'right',
-                        labelClass: 'checkbox-options'
+                        labelClass: 'checkbox-options',
+                        ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                     }, {
                         name: 'update_on_launch',
                         label: 'Update on Launch',
@@ -296,7 +306,8 @@ export default
                         dataTitle: 'Update on Launch',
                         dataContainer: 'body',
                         dataPlacement: 'right',
-                        labelClass: 'checkbox-options'
+                        labelClass: 'checkbox-options',
+                        ngDisabled: '!group_obj.summary_fields.user_capabilities.edit'
                     }]
                 },
                 update_cache_timeout: {
@@ -321,11 +332,17 @@ export default
 
             buttons: {
                 cancel: {
-                    ngClick: 'formCancel()'
+                    ngClick: 'formCancel()',
+                    ngShow: 'group_obj.summary_fields.user_capabilities.edit'
+                },
+                close: {
+                    ngClick: 'formCancel()',
+                    ngShow: '!group_obj.summary_fields.user_capabilities.edit'
                 },
                 save: {
                     ngClick: 'formSave()',
-                    ngDisabled: true
+                    ngDisabled: true,
+                    ngShow: 'group_obj.summary_fields.user_capabilities.edit'
                 }
             },
 
diff --git a/awx/ui/client/src/forms/Hosts.js b/awx/ui/client/src/forms/Hosts.js
index 0da34d3e2e..3f01a6cf5c 100644
--- a/awx/ui/client/src/forms/Hosts.js
+++ b/awx/ui/client/src/forms/Hosts.js
@@ -46,13 +46,15 @@ export default
                         "</blockquote>",
                     dataTitle: 'Host Name',
                     dataPlacement: 'right',
-                    dataContainer: 'body'
+                    dataContainer: 'body',
+                    ngDisabled: '!host.summary_fields.user_capabilities.edit'
                 },
                 description: {
                     label: 'Description',
                     type: 'text',
                     addRequired: false,
-                    editRequired: false
+                    editRequired: false,
+                    ngDisabled: '!host.summary_fields.user_capabilities.edit'
                 },
                 variables: {
                     label: 'Variables',
@@ -83,10 +85,16 @@ export default
             buttons: {
                 cancel: {
                     ngClick: 'formCancel()',
+                    ngShow: 'host.summary_fields.user_capabilities.edit'
+                },
+                close: {
+                    ngClick: 'formCancel()',
+                    ngShow: '!host.summary_fields.user_capabilities.edit'
                 },
                 save: {
                     ngClick: 'formSave()',
-                    ngDisabled: true
+                    ngDisabled: true,
+                    ngShow: 'host.summary_fields.user_capabilities.edit'
                 }
             },
 
diff --git a/awx/ui/client/src/forms/Inventories.js b/awx/ui/client/src/forms/Inventories.js
index 6467bf28d3..425c4d342d 100644
--- a/awx/ui/client/src/forms/Inventories.js
+++ b/awx/ui/client/src/forms/Inventories.js
@@ -26,14 +26,16 @@ export default
                     type: 'text',
                     addRequired: true,
                     editRequired: true,
-                    capitalize: false
+                    capitalize: false,
+                    ngDisabled: '!inventory_obj.summary_fields.user_capabilities.edit'
                 },
                 inventory_description: {
                     realName: 'description',
                     label: 'Description',
                     type: 'text',
                     addRequired: false,
-                    editRequired: false
+                    editRequired: false,
+                    ngDisabled: '!inventory_obj.summary_fields.user_capabilities.edit'
                 },
                 organization: {
                     label: 'Organization',
@@ -44,7 +46,8 @@ export default
                     awRequiredWhen: {
                         reqExpression: "organizationrequired",
                         init: "true"
-                    }
+                    },
+                    ngDisabled: '!inventory_obj.summary_fields.user_capabilities.edit'
                 },
                 variables: {
                     label: 'Variables',
@@ -63,17 +66,24 @@ export default
                         '<p>View YAML examples at <a href="http://docs.ansible.com/YAMLSyntax.html" target="_blank">docs.ansible.com</a></p>',
                     dataTitle: 'Inventory Variables',
                     dataPlacement: 'right',
-                    dataContainer: 'body'
+                    dataContainer: 'body',
+                    ngDisabled: '!inventory_obj.summary_fields.user_capabilities.edit' // TODO: get working
                 }
             },
 
             buttons: {
                 cancel: {
-                    ngClick: 'formCancel()'
+                    ngClick: 'formCancel()',
+                    ngShow: 'inventory_obj.summary_fields.user_capabilities.edit'
+                },
+                close: {
+                    ngClick: 'formCancel()',
+                    ngHide: 'inventory_obj.summary_fields.user_capabilities.edit'
                 },
                 save: {
                     ngClick: 'formSave()',
-                    ngDisabled: true
+                    ngDisabled: true,
+                    ngShow: 'inventory_obj.summary_fields.user_capabilities.edit'
                 }
             },
 
@@ -94,7 +104,8 @@ export default
                             label: 'Add',
                             awToolTip: 'Add a permission',
                             actionClass: 'btn List-buttonSubmit',
-                            buttonContent: '&#43; ADD'
+                            buttonContent: '&#43; ADD',
+                            ngShow: 'inventory_obj.summary_fields.user_capabilities.edit'
                         }
                     },
 
diff --git a/awx/ui/client/src/forms/JobTemplates.js b/awx/ui/client/src/forms/JobTemplates.js
index 5d56907c88..13e826492d 100644
--- a/awx/ui/client/src/forms/JobTemplates.js
+++ b/awx/ui/client/src/forms/JobTemplates.js
@@ -27,14 +27,16 @@ export default
                     type: 'text',
                     addRequired: true,
                     editRequired: true,
-                    column: 1
+                    column: 1,
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 description: {
                     label: 'Description',
                     type: 'text',
                     addRequired: false,
                     editRequired: false,
-                    column: 1
+                    column: 1,
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 job_type: {
                     label: 'Job Type',
@@ -56,7 +58,8 @@ export default
                         variable: 'ask_job_type_on_launch',
                         ngShow: "!job_type.value || job_type.value !== 'scan'",
                         text: 'Prompt on launch'
-                    }
+                    },
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 inventory: {
                     label: 'Inventory',
@@ -78,7 +81,8 @@ export default
                         variable: 'ask_inventory_on_launch',
                         ngShow: "!job_type.value || job_type.value !== 'scan'",
                         text: 'Prompt on launch'
-                    }
+                    },
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 project: {
                     label: 'Project',
@@ -100,12 +104,13 @@ export default
                     dataTitle: 'Project',
                     dataPlacement: 'right',
                     dataContainer: "body",
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 playbook: {
                     label: 'Playbook',
                     type:'select',
                     ngOptions: 'book for book in playbook_options track by book',
-                    ngDisabled: "job_type.value === 'scan' && project_name === 'Default'",
+                    ngDisabled: "(job_type.value === 'scan' && project_name === 'Default') || !job_template_obj.summary_fields.user_capabilities.edit",
                     id: 'playbook-select',
                     awRequiredWhen: {
                         reqExpression: "playbookrequired",
@@ -138,7 +143,8 @@ export default
                     subCheckbox: {
                         variable: 'ask_credential_on_launch',
                         text: 'Prompt on launch'
-                    }
+                    },
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 cloud_credential: {
                     label: 'Cloud Credential',
@@ -153,7 +159,8 @@ export default
                         "running playbook, allowing provisioning into the cloud without manually passing parameters to the included modules.</p>",
                     dataTitle: 'Cloud Credential',
                     dataPlacement: 'right',
-                    dataContainer: "body"
+                    dataContainer: "body",
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 network_credential: {
                     label: 'Network Credential',
@@ -167,7 +174,8 @@ export default
                     awPopOver: "<p>Network credentials are used by Ansible networking modules to connect to and manage networking devices.</p>",
                     dataTitle: 'Network Credential',
                     dataPlacement: 'right',
-                    dataContainer: "body"
+                    dataContainer: "body",
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 forks: {
                     label: 'Forks',
@@ -186,7 +194,8 @@ export default
                         ' target=\"_blank\">ansible configuration file</a>.</p>',
                     dataTitle: 'Forks',
                     dataPlacement: 'right',
-                    dataContainer: "body"
+                    dataContainer: "body",
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit' // TODO: get working
                 },
                 limit: {
                     label: 'Limit',
@@ -203,7 +212,8 @@ export default
                     subCheckbox: {
                         variable: 'ask_limit_on_launch',
                         text: 'Prompt on launch'
-                    }
+                    },
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 verbosity: {
                     label: 'Verbosity',
@@ -216,7 +226,8 @@ export default
                     awPopOver: "<p>Control the level of output ansible will produce as the playbook executes.</p>",
                     dataTitle: 'Verbosity',
                     dataPlacement: 'right',
-                    dataContainer: "body"
+                    dataContainer: "body",
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 job_tags: {
                     label: 'Job Tags',
@@ -235,7 +246,8 @@ export default
                     subCheckbox: {
                         variable: 'ask_tags_on_launch',
                         text: 'Prompt on launch'
-                    }
+                    },
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 skip_tags: {
                     label: 'Skip Tags',
@@ -254,7 +266,8 @@ export default
                     subCheckbox: {
                         variable: 'ask_skip_tags_on_launch',
                         text: 'Prompt on launch'
-                    }
+                    },
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 checkbox_group: {
                     label: 'Options',
@@ -270,7 +283,8 @@ export default
                         dataPlacement: 'right',
                         dataTitle: 'Become Privilege Escalation',
                         dataContainer: "body",
-                        labelClass: 'stack-inline'
+                        labelClass: 'stack-inline',
+                        ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                     }, {
                         name: 'allow_callbacks',
                         label: 'Allow Provisioning Callbacks',
@@ -284,7 +298,8 @@ export default
                         dataPlacement: 'right',
                         dataTitle: 'Allow Provisioning Callbacks',
                         dataContainer: "body",
-                        labelClass: 'stack-inline'
+                        labelClass: 'stack-inline',
+                        ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                     }]
                 },
                 callback_url: {
@@ -299,7 +314,8 @@ export default
                     awPopOverWatch: "callback_help",
                     dataPlacement: 'top',
                     dataTitle: 'Provisioning Callback URL',
-                    dataContainer: "body"
+                    dataContainer: "body",
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 host_config_key: {
                     label: 'Host Config Key',
@@ -312,7 +328,8 @@ export default
                     awPopOverWatch: "callback_help",
                     dataPlacement: 'right',
                     dataTitle: "Host Config Key",
-                    dataContainer: "body"
+                    dataContainer: "body",
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 labels: {
                     label: 'Labels',
@@ -325,7 +342,8 @@ export default
                     dataTitle: 'Labels',
                     dataPlacement: 'right',
                     awPopOver: "<p>Optional labels that describe this job template, such as 'dev' or 'test'. Labels can be used to group and filter job templates and completed jobs in the Tower display.</p>",
-                    dataContainer: 'body'
+                    dataContainer: 'body',
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 variables: {
                     label: 'Extra Variables',
@@ -348,14 +366,15 @@ export default
                     subCheckbox: {
                         variable: 'ask_variables_on_launch',
                         text: 'Prompt on launch'
-                    }
+                    },
+                    ngDisabled: '!job_template_obj.summary_fields.user_capabilities.edit' // TODO: get working
                 }
             },
 
             buttons: { //for now always generates <button> tags
                 add_survey: {
                     ngClick: 'addSurvey()',
-                    ngShow: 'job_type.value !== "scan" && !survey_exists',
+                    ngShow: 'job_type.value !== "scan" && !survey_exists && job_template_obj.summary_fields.user_capabilities.edit',
                     awFeature: 'surveys',
                     awToolTip: 'Surveys allow users to be prompted at job launch with a series of questions related to the job. This allows for variables to be defined that affect the playbook run at time of launch.',
                     dataPlacement: 'top'
@@ -363,14 +382,25 @@ export default
                 edit_survey: {
                     ngClick: 'editSurvey()',
                     awFeature: 'surveys',
-                    ngShow: 'job_type.value !== "scan" && survey_exists'
+                    ngShow: 'job_type.value !== "scan" && survey_exists && job_template_obj.summary_fields.user_capabilities.edit'
+                },
+                view_survey: {
+                    ngClick: 'editSurvey()',
+                    awFeature: 'surveys',
+                    ngShow: 'job_type.value !== "scan" && survey_exists && !job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 cancel: {
-                    ngClick: 'formCancel()'
+                    ngClick: 'formCancel()',
+                    ngShow: 'job_template_obj.summary_fields.user_capabilities.edit'
+                },
+                close: {
+                    ngClick: 'formCancel()',
+                    ngShow: '!job_template_obj.summary_fields.user_capabilities.edit'
                 },
                 save: {
                     ngClick: 'formSave()',    //$scope.function to call on click, optional
-                    ngDisabled: "job_templates_form.$invalid || can_edit!==true"//true          //Disable when $pristine or $invalid, optional and when can_edit = false, for permission reasons
+                    ngDisabled: "job_templates_form.$invalid || can_edit!==true",//true          //Disable when $pristine or $invalid, optional and when can_edit = false, for permission reasons
+                    ngShow: 'job_template_obj.summary_fields.user_capabilities.edit'
                 }
             },
 
@@ -394,7 +424,8 @@ export default
                             label: 'Add',
                             awToolTip: 'Add a permission',
                             actionClass: 'btn List-buttonSubmit',
-                            buttonContent: '&#43; ADD'
+                            buttonContent: '&#43; ADD',
+                            ngShow: 'job_template_obj.summary_fields.user_capabilities.edit'
                         }
                     },
 
diff --git a/awx/ui/client/src/forms/Organizations.js b/awx/ui/client/src/forms/Organizations.js
index 7c678e09c7..daf3e7d5f0 100644
--- a/awx/ui/client/src/forms/Organizations.js
+++ b/awx/ui/client/src/forms/Organizations.js
@@ -25,23 +25,31 @@ export default
                     type: 'text',
                     addRequired: true,
                     editRequired: true,
-                    capitalize: false
+                    capitalize: false,
+                    ngDisabled: '!organization_obj.summary_fields.user_capabilities.edit'
                 },
                 description: {
                     label: 'Description',
                     type: 'text',
                     addRequired: false,
-                    editRequired: false
+                    editRequired: false,
+                    ngDisabled: '!organization_obj.summary_fields.user_capabilities.edit'
                 }
             },
 
             buttons: { //for now always generates <button> tags
                 cancel: {
-                    ngClick: 'formCancel()'
+                    ngClick: 'formCancel()',
+                    ngShow: 'organization_obj.summary_fields.user_capabilities.edit'
+                },
+                close: {
+                    ngClick: 'formCancel()',
+                    ngShow: '!organization_obj.summary_fields.user_capabilities.edit'
                 },
                 save: {
                     ngClick: 'formSave()', //$scope.function to call on click, optional
-                    ngDisabled: true //Disable when $pristine or $invalid, optional
+                    ngDisabled: true,
+                    ngShow: 'organization_obj.summary_fields.user_capabilities.edit'
                 }
             },
 
@@ -62,7 +70,8 @@ export default
                             label: 'Add',
                             awToolTip: 'Add a permission',
                             actionClass: 'btn List-buttonSubmit',
-                            buttonContent: '&#43; ADD'
+                            buttonContent: '&#43; ADD',
+                            ngShow: 'organization_obj.summary_fields.user_capabilities.edit'
                         }
                     },
 
diff --git a/awx/ui/client/src/forms/Projects.js b/awx/ui/client/src/forms/Projects.js
index 7064c01ff3..b77f234f06 100644
--- a/awx/ui/client/src/forms/Projects.js
+++ b/awx/ui/client/src/forms/Projects.js
@@ -30,13 +30,15 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                 type: 'text',
                 addRequired: true,
                 editRequired: true,
-                capitalize: false
+                capitalize: false,
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
             },
             description: {
                 label: 'Description',
                 type: 'text',
                 addRequired: false,
-                editRequired: false
+                editRequired: false,
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
             },
             organization: {
                 label: 'Organization',
@@ -50,7 +52,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                 },
                 dataTitle: 'Organization',
                 dataContainer: 'body',
-                dataPlacement: 'right'
+                dataPlacement: 'right',
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
             },
             scm_type: {
                 label: 'SCM Type',
@@ -61,6 +64,7 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                 addRequired: true,
                 editRequired: true,
                 hasSubForm: true,
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
             },
             missing_path_alert: {
                 type: 'alertblock',
@@ -82,7 +86,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                     '<p>Use PROJECTS_ROOT in your environment settings file to determine the base path value.</p>',
                 dataTitle: 'Project Base Path',
                 dataContainer: 'body',
-                dataPlacement: 'right'
+                dataPlacement: 'right',
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
             },
             local_path: {
                 label: 'Playbook Directory',
@@ -99,7 +104,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                     '<p>Use PROJECTS_ROOT in your environment settings file to determine the base path value.</p>',
                 dataTitle: 'Project Path',
                 dataContainer: 'body',
-                dataPlacement: 'right'
+                dataPlacement: 'right',
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
             },
             scm_url: {
                 label: 'SCM URL',
@@ -115,7 +121,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                 awPopOver: "set in controllers/projects",
                 dataTitle: 'SCM URL',
                 dataContainer: 'body',
-                dataPlacement: 'right'
+                dataPlacement: 'right',
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
             },
             scm_branch: {
                 labelBind: "scmBranchLabel",
@@ -123,7 +130,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                 ngShow: "scm_type && scm_type.value !== 'manual'",
                 addRequired: false,
                 editRequired: false,
-                subForm: 'sourceSubForm'
+                subForm: 'sourceSubForm',
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
             },
             credential: {
                 label: 'SCM Credential',
@@ -134,7 +142,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                 ngClick: 'lookUpCredential()',
                 addRequired: false,
                 editRequired: false,
-                subForm: 'sourceSubForm'
+                subForm: 'sourceSubForm',
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
             },
             checkbox_group: {
                 label: 'SCM Update Options',
@@ -151,7 +160,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                     dataTitle: 'SCM Clean',
                     dataContainer: 'body',
                     dataPlacement: 'right',
-                    labelClass: 'checkbox-options stack-inline'
+                    labelClass: 'checkbox-options stack-inline',
+                    ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
                 }, {
                     name: 'scm_delete_on_update',
                     label: 'Delete on Update',
@@ -163,7 +173,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                     dataTitle: 'SCM Delete',
                     dataContainer: 'body',
                     dataPlacement: 'right',
-                    labelClass: 'checkbox-options stack-inline'
+                    labelClass: 'checkbox-options stack-inline',
+                    ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
                 }, {
                     name: 'scm_update_on_launch',
                     label: 'Update on Launch',
@@ -174,7 +185,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                     dataTitle: 'SCM Update',
                     dataContainer: 'body',
                     dataPlacement: 'right',
-                    labelClass: 'checkbox-options stack-inline'
+                    labelClass: 'checkbox-options stack-inline',
+                    ngDisabled: '!project_obj.summary_fields.user_capabilities.edit'
                 }]
             },
             scm_update_cache_timeout: {
@@ -193,17 +205,24 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                     'and a new project update will be performed.</p>',
                 dataTitle: 'Cache Timeout',
                 dataPlacement: 'right',
-                dataContainer: "body"
+                dataContainer: "body",
+                ngDisabled: '!project_obj.summary_fields.user_capabilities.edit' // TODO: get working
             }
         },
 
         buttons: {
             cancel: {
-                ngClick: 'formCancel()'
+                ngClick: 'formCancel()',
+                ngShow: 'project_obj.summary_fields.user_capabilities.edit'
+            },
+            close: {
+                ngClick: 'formCancel()',
+                ngShow: '!project_obj.summary_fields.user_capabilities.edit'
             },
             save: {
                 ngClick: 'formSave()',
-                ngDisabled: true
+                ngDisabled: true,
+                ngShow: 'project_obj.summary_fields.user_capabilities.edit'
             }
         },
 
@@ -224,7 +243,8 @@ angular.module('ProjectFormDefinition', ['SchedulesListDefinition'])
                         label: 'Add',
                         awToolTip: 'Add a permission',
                         actionClass: 'btn List-buttonSubmit',
-                        buttonContent: '&#43; ADD'
+                        buttonContent: '&#43; ADD',
+                        ngShow: 'project_obj.summary_fields.user_capabilities.edit'
                     }
                 },
 
diff --git a/awx/ui/client/src/forms/Teams.js b/awx/ui/client/src/forms/Teams.js
index 45f0b3b04b..07eb88a630 100644
--- a/awx/ui/client/src/forms/Teams.js
+++ b/awx/ui/client/src/forms/Teams.js
@@ -25,13 +25,15 @@ export default
                     type: 'text',
                     addRequired: true,
                     editRequired: true,
-                    capitalize: false
+                    capitalize: false,
+                    ngDisabled: '!team_obj.summary_fields.user_capabilities.edit'
                 },
                 description: {
                     label: 'Description',
                     type: 'text',
                     addRequired: false,
-                    editRequired: false
+                    editRequired: false,
+                    ngDisabled: '!team_obj.summary_fields.user_capabilities.edit'
                 },
                 organization: {
                     label: 'Organization',
@@ -44,17 +46,24 @@ export default
                     awRequiredWhen: {
                         reqExpression: "orgrequired",
                         init: true
-                    }
+                    },
+                    ngDisabled: '!team_obj.summary_fields.user_capabilities.edit'
                 }
             },
 
             buttons: {
                 cancel: {
-                    ngClick: 'formCancel()'
+                    ngClick: 'formCancel()',
+                    ngShow: 'team_obj.summary_fields.user_capabilities.edit'
+                },
+                close: {
+                    ngClick: 'formCancel()',
+                    ngShow: '!team_obj.summary_fields.user_capabilities.edit'
                 },
                 save: {
                     ngClick: 'formSave()',
-                    ngDisabled: true
+                    ngDisabled: true,
+                    ngShow: 'team_obj.summary_fields.user_capabilities.edit'
                 }
             },
 
@@ -75,7 +84,8 @@ export default
                             label: 'Add',
                             awToolTip: 'Add user to team',
                             actionClass: 'btn List-buttonSubmit',
-                            buttonContent: '&#43; ADD'
+                            buttonContent: '&#43; ADD',
+                            ngShow: 'team_obj.summary_fields.user_capabilities.edit'
                         }
                     },
 
@@ -132,7 +142,8 @@ export default
                             'class': "List-actionButton--delete",
                             iconClass: 'fa fa-times',
                             awToolTip: 'Dissasociate permission from team',
-                            dataPlacement: 'top'
+                            dataPlacement: 'top',
+                            ngShow: 'permission.summary_fields.user_capabilities.unattach'
                         }
                     },
                     hideOnSuperuser: true
diff --git a/awx/ui/client/src/forms/Users.js b/awx/ui/client/src/forms/Users.js
index ddcda6e296..769eebe76e 100644
--- a/awx/ui/client/src/forms/Users.js
+++ b/awx/ui/client/src/forms/Users.js
@@ -26,21 +26,24 @@ export default
                     type: 'text',
                     addRequired: true,
                     editRequired: true,
-                    capitalize: true
+                    capitalize: true,
+                    ngDisabled: '!user_obj.summary_fields.user_capabilities.edit'
                 },
                 last_name: {
                     label: 'Last Name',
                     type: 'text',
                     addRequired: true,
                     editRequired: true,
-                    capitalize: true
+                    capitalize: true,
+                    ngDisabled: '!user_obj.summary_fields.user_capabilities.edit'
                 },
                 email: {
                     label: 'Email',
                     type: 'email',
                     addRequired: true,
                     editRequired: true,
-                    autocomplete: false
+                    autocomplete: false,
+                    ngDisabled: '!user_obj.summary_fields.user_capabilities.edit'
                 },
                 username: {
                     label: 'Username',
@@ -49,7 +52,8 @@ export default
                         reqExpression: "not_ldap_user && external_account === null",
                         init: true
                     },
-                    autocomplete: false
+                    autocomplete: false,
+                    ngDisabled: '!user_obj.summary_fields.user_capabilities.edit'
                 },
                 organization: {
                     label: 'Organization',
@@ -63,7 +67,8 @@ export default
                     awRequiredWhen: {
                         reqExpression: "orgrequired",
                         init: true
-                    }
+                    },
+                    ngDisabled: '!user_obj.summary_fields.user_capabilities.edit'
                 },
                 password: {
                     label: 'Password',
@@ -74,7 +79,8 @@ export default
                     editRequired: false,
                     ngChange: "clearPWConfirm('password_confirm')",
                     autocomplete: false,
-                    chkPass: true
+                    chkPass: true,
+                    ngDisabled: '!user_obj.summary_fields.user_capabilities.edit'
                 },
                 password_confirm: {
                     label: 'Confirm Password',
@@ -85,7 +91,8 @@ export default
                     editRequired: false,
                     awPassMatch: true,
                     associated: 'password',
-                    autocomplete: false
+                    autocomplete: false,
+                    ngDisabled: '!user_obj.summary_fields.user_capabilities.edit'
                 },
                 user_type: {
                     label: 'User Type',
@@ -94,16 +101,23 @@ export default
                     disableChooseOption: true,
                     ngModel: 'user_type',
                     ngShow: 'current_user["is_superuser"]',
+                    ngDisabled: '!user_obj.summary_fields.user_capabilities.edit'
                 },
             },
 
             buttons: {
                 cancel: {
-                    ngClick: 'formCancel()'
+                    ngClick: 'formCancel()',
+                    ngShow: 'user_obj.summary_fields.user_capabilities.edit'
+                },
+                close: {
+                    ngClick: 'formCancel()',
+                    ngShow: '!user_obj.summary_fields.user_capabilities.edit'
                 },
                 save: {
                     ngClick: 'formSave()',
-                    ngDisabled: true
+                    ngDisabled: true,
+                    ngShow: 'user_obj.summary_fields.user_capabilities.edit'
                 }
             },
 
@@ -186,7 +200,8 @@ export default
                             label: 'Remove',
                             ngClick: 'deletePermissionFromUser(user_id, username, permission.name, permission.summary_fields.resource_name, permission.related.users)',
                             iconClass: 'fa fa-times',
-                            awToolTip: 'Dissasociate permission from user'
+                            awToolTip: 'Dissasociate permission from user',
+                            ngShow: 'permission.summary_fields.user_capabilities.unattach'
                         }
                     },
                     hideOnSuperuser: true
diff --git a/awx/ui/client/src/helpers/Parse.js b/awx/ui/client/src/helpers/Parse.js
index 5e76bc670d..a2715f6efd 100644
--- a/awx/ui/client/src/helpers/Parse.js
+++ b/awx/ui/client/src/helpers/Parse.js
@@ -46,7 +46,7 @@ export default
                 function createField(onChange, onReady, fld) {
                     //hide the textarea and show a fresh CodeMirror with the current mode (json or yaml)
 
-                    scope[fld + 'codeMirror'] = AngularCodeMirror();
+                    scope[fld + 'codeMirror'] = AngularCodeMirror(readOnly);
                     scope[fld + 'codeMirror'].addModes(global.$AnsibleConfig.variable_edit_modes);
                     scope[fld + 'codeMirror'].showTextArea({
                         scope: scope,
diff --git a/awx/ui/client/src/helpers/ProjectPath.js b/awx/ui/client/src/helpers/ProjectPath.js
index 91761fce0e..e0868b7bc4 100644
--- a/awx/ui/client/src/helpers/ProjectPath.js
+++ b/awx/ui/client/src/helpers/ProjectPath.js
@@ -3,7 +3,7 @@
  *
  * All Rights Reserved
  *************************************************/
- 
+
     /**
  * @ngdoc function
  * @name helpers.function:ProjectPath
@@ -47,11 +47,13 @@ export default
                     Rest.get()
                         .success(function (data) {
                             var opts = [], i;
-                            for (i = 0; i < data.project_local_paths.length; i++) {
-                                opts.push({
-                                    label: data.project_local_paths[i],
-                                    value: data.project_local_paths[i]
-                                });
+                            if (data.project_local_paths) {
+                                for (i = 0; i < data.project_local_paths.length; i++) {
+                                    opts.push({
+                                        label: data.project_local_paths[i],
+                                        value: data.project_local_paths[i]
+                                    });
+                                }
                             }
                             if (scope.local_path) {
                                 // List only includes paths not assigned to projects, so add the
diff --git a/awx/ui/client/src/inventories/add/inventory-add.controller.js b/awx/ui/client/src/inventories/add/inventory-add.controller.js
index ceb874f8ec..0e46f4f7be 100644
--- a/awx/ui/client/src/inventories/add/inventory-add.controller.js
+++ b/awx/ui/client/src/inventories/add/inventory-add.controller.js
@@ -16,6 +16,15 @@ function InventoriesAdd($scope, $rootScope, $compile, $location, $log,
     PaginateInit, LookUpInit, GetBasePath, ParseTypeChange, Wait, ToJSON,
     $state) {
 
+    Rest.setUrl(GetBasePath('inventory'));
+    Rest.options()
+        .success(function(data) {
+            if (!data.actions.POST) {
+                $state.go("^");
+                Alert('Permission Error', 'You do not have permission to add an inventory.', 'alert-info');
+            }
+        });
+
     ClearScope();
 
     // Inject dynamic view
diff --git a/awx/ui/client/src/inventories/edit/inventory-edit.controller.js b/awx/ui/client/src/inventories/edit/inventory-edit.controller.js
index d198683677..8b01b8be3e 100644
--- a/awx/ui/client/src/inventories/edit/inventory-edit.controller.js
+++ b/awx/ui/client/src/inventories/edit/inventory-edit.controller.js
@@ -17,7 +17,6 @@ function InventoriesEdit($scope, $rootScope, $compile, $location,
     ParseVariableString, RelatedSearchInit, RelatedPaginateInit,
     Prompt, InitiatePlaybookRun, CreateDialog, deleteJobTemplate, $state,
     $filter) {
-
     ClearScope();
 
     // Inject dynamic view
diff --git a/awx/ui/client/src/inventories/list/inventory-list.controller.js b/awx/ui/client/src/inventories/list/inventory-list.controller.js
index 54ed987ec6..a8d5fc73e7 100644
--- a/awx/ui/client/src/inventories/list/inventory-list.controller.js
+++ b/awx/ui/client/src/inventories/list/inventory-list.controller.js
@@ -14,7 +14,14 @@ function InventoriesList($scope, $rootScope, $location, $log,
     $stateParams, $compile, $filter, sanitizeFilter, Rest, Alert, InventoryList,
     generateList, Prompt, SearchInit, PaginateInit, ReturnToCaller,
     ClearScope, ProcessErrors, GetBasePath, Wait,
-    Find, Empty, $state) {
+    Find, Empty, $state, rbacUiControlService) {
+
+        $scope.canAdd = false;
+
+        rbacUiControlService.canAdd('inventory')
+            .then(function(canAdd) {
+                $scope.canAdd = canAdd;
+            });
 
     var list = InventoryList,
         defaultUrl = GetBasePath('inventory') + ($stateParams.status === 'sync-failed' ? '?not__inventory_sources_with_failures=0' : ''),
@@ -376,4 +383,4 @@ function InventoriesList($scope, $rootScope, $location, $log,
 export default ['$scope', '$rootScope', '$location', '$log',
     '$stateParams', '$compile', '$filter', 'sanitizeFilter', 'Rest', 'Alert', 'InventoryList',
     'generateList', 'Prompt', 'SearchInit', 'PaginateInit', 'ReturnToCaller',
-    'ClearScope', 'ProcessErrors', 'GetBasePath', 'Wait', 'Find', 'Empty', '$state', InventoriesList];
+    'ClearScope', 'ProcessErrors', 'GetBasePath', 'Wait', 'Find', 'Empty', '$state', 'rbacUiControlService', InventoriesList];
diff --git a/awx/ui/client/src/inventories/manage/groups/groups-edit.controller.js b/awx/ui/client/src/inventories/manage/groups/groups-edit.controller.js
index 941789f39d..c6ec30bd06 100644
--- a/awx/ui/client/src/inventories/manage/groups/groups-edit.controller.js
+++ b/awx/ui/client/src/inventories/manage/groups/groups-edit.controller.js
@@ -256,6 +256,7 @@
                 $scope.credential_name = inventorySourceData.summary_fields.credential.name;
             }
             $scope = angular.extend($scope, groupData);
+            $scope.group_obj = groupData;
 
             // instantiate lookup fields
             if (inventorySourceData.source !== 'custom'){
diff --git a/awx/ui/client/src/inventories/manage/groups/groups-list.controller.js b/awx/ui/client/src/inventories/manage/groups/groups-list.controller.js
index ca56eeddd4..a2f843793b 100644
--- a/awx/ui/client/src/inventories/manage/groups/groups-list.controller.js
+++ b/awx/ui/client/src/inventories/manage/groups/groups-list.controller.js
@@ -5,13 +5,22 @@
  *************************************************/
  export default
     ['$scope', '$rootScope', '$state', '$stateParams', 'InventoryGroups', 'generateList', 'InventoryUpdate', 'GroupManageService', 'GroupsCancelUpdate', 'ViewUpdateStatus',
-    'InventoryManageService', 'groupsUrl', 'SearchInit', 'PaginateInit', 'GetSyncStatusMsg', 'GetHostsStatusMsg',
+    'InventoryManageService', 'groupsUrl', 'SearchInit', 'PaginateInit', 'GetSyncStatusMsg', 'GetHostsStatusMsg', 'Rest', 'GetBasePath', 'rbacUiControlService',
     function($scope, $rootScope, $state, $stateParams, InventoryGroups, generateList, InventoryUpdate, GroupManageService, GroupsCancelUpdate, ViewUpdateStatus,
-        InventoryManageService, groupsUrl, SearchInit, PaginateInit, GetSyncStatusMsg, GetHostsStatusMsg){
+        InventoryManageService, groupsUrl, SearchInit, PaginateInit, GetSyncStatusMsg, GetHostsStatusMsg, Rest, GetBasePath, rbacUiControlService){
         var list = InventoryGroups,
             view = generateList,
             pageSize = 20;
         $scope.inventory_id = $stateParams.inventory_id;
+
+        $scope.canAdd = false;
+
+        rbacUiControlService.canAdd(GetBasePath('inventory') + $scope.inventory_id + "/groups")
+            .then(function(canAdd) {
+                $scope.canAdd = canAdd;
+            });
+
+
         // The ncy breadcrumb directive will look at this attribute when attempting to bind to the correct scope.
         // In this case, we don't want to incidentally bind to this scope when editing a host or a group.  See:
         // https://github.com/ncuillery/angular-breadcrumb/issues/42 for a little more information on the
diff --git a/awx/ui/client/src/inventories/manage/hosts/hosts-edit.controller.js b/awx/ui/client/src/inventories/manage/hosts/hosts-edit.controller.js
index 9098e53333..86ad43d791 100644
--- a/awx/ui/client/src/inventories/manage/hosts/hosts-edit.controller.js
+++ b/awx/ui/client/src/inventories/manage/hosts/hosts-edit.controller.js
@@ -5,8 +5,8 @@
  *************************************************/
 
  export default
-    ['$state', '$stateParams', '$scope', 'HostForm', 'ParseTypeChange', 'GenerateForm', 'HostManageService', 'host',
-    function($state, $stateParams, $scope, HostForm, ParseTypeChange, GenerateForm, HostManageService, host){
+    ['$state', '$stateParams', '$scope', 'HostForm', 'ParseTypeChange', 'GenerateForm', 'HostManageService', 'host', 'GetBasePath', 'Rest',
+    function($state, $stateParams, $scope, HostForm, ParseTypeChange, GenerateForm, HostManageService, host, GetBasePath, Rest){
         var generator = GenerateForm,
             form = HostForm;
         $scope.parseType = 'yaml';
diff --git a/awx/ui/client/src/inventories/manage/hosts/hosts-list.controller.js b/awx/ui/client/src/inventories/manage/hosts/hosts-list.controller.js
index 3c48cf8603..f42b9c39b3 100644
--- a/awx/ui/client/src/inventories/manage/hosts/hosts-list.controller.js
+++ b/awx/ui/client/src/inventories/manage/hosts/hosts-list.controller.js
@@ -5,12 +5,23 @@
  *************************************************/
  export default
     ['$scope', '$rootScope', '$state', '$stateParams', 'InventoryHosts', 'generateList', 'InventoryManageService', 'HostManageService',
-     'hostsUrl', 'SearchInit', 'PaginateInit', 'SetStatus', 'Prompt', 'Wait', 'inventoryData', '$filter',
+     'hostsUrl', 'SearchInit', 'PaginateInit', 'SetStatus', 'Prompt', 'Wait', 'inventoryData', '$filter', 'Rest', 'GetBasePath', 'rbacUiControlService',
     function($scope, $rootScope, $state, $stateParams, InventoryHosts, generateList, InventoryManageService, HostManageService,
-     hostsUrl, SearchInit, PaginateInit, SetStatus, Prompt, Wait, inventoryData, $filter){
+     hostsUrl, SearchInit, PaginateInit, SetStatus, Prompt, Wait, inventoryData, $filter, Rest, GetBasePath, rbacUiControlService){
+
         var list = InventoryHosts,
             view = generateList,
             pageSize = 20;
+
+        $scope.inventory_id = $stateParams.inventory_id;
+
+        $scope.canAdd = false;
+
+        rbacUiControlService.canAdd(GetBasePath('inventory') + $scope.inventory_id + "/hosts")
+            .then(function(canAdd) {
+                $scope.canAdd = canAdd;
+            });
+
         // The ncy breadcrumb directive will look at this attribute when attempting to bind to the correct scope.
         // In this case, we don't want to incidentally bind to this scope when editing a host or a group.  See:
         // https://github.com/ncuillery/angular-breadcrumb/issues/42 for a little more information on the
diff --git a/awx/ui/client/src/inventories/manage/inventory-manage.controller.js b/awx/ui/client/src/inventories/manage/inventory-manage.controller.js
index aceb174363..f3201d475a 100644
--- a/awx/ui/client/src/inventories/manage/inventory-manage.controller.js
+++ b/awx/ui/client/src/inventories/manage/inventory-manage.controller.js
@@ -3,21 +3,26 @@
  *
  * All Rights Reserved
  *************************************************/
- export default
- 	['$scope', '$state', function($scope, $state){
- 		$scope.groupsSelected = false;
- 		$scope.hostsSelected = false;
- 		$scope.hostsSelectedItems = [];
- 		$scope.groupsSelectedItems = [];
- 		$scope.setAdhocPattern = function(){
- 			var pattern = _($scope.groupsSelectedItems)
- 				.concat($scope.hostsSelectedItems)
- 				.map(function(item){
- 					return item.name;
- 				}).value().join(':');
- 			$state.go('inventoryManage.adhoc', {pattern: pattern});
- 		};
+export default
+    ['$scope', '$state', 'inventoryData', function($scope, $state, inventoryData){
+        $scope.groupsSelected = false;
+        $scope.hostsSelected = false;
+        $scope.hostsSelectedItems = [];
+        $scope.groupsSelectedItems = [];
+
+        $scope.canAdhoc = inventoryData.summary_fields.user_capabilities.adhoc;
+
+        $scope.setAdhocPattern = function(){
+            var pattern = _($scope.groupsSelectedItems)
+                .concat($scope.hostsSelectedItems)
+                .map(function(item){
+                    return item.name;
+                }).value().join(':');
+
+            $state.go('inventoryManage.adhoc', {pattern: pattern});
+        };
+
         $scope.$watchGroup(['groupsSelected', 'hostsSelected'], function(newVals) {
             $scope.adhocCommandTooltip = (newVals[0] || newVals[1]) ? "Run a command on the selected inventory" : "Select an inventory source by clicking the check box beside it. The inventory source can be a single group or host, a selection of multiple hosts, or a selection of multiple groups.";
         });
- 	}];
+    }];
diff --git a/awx/ui/client/src/inventory-scripts/add/add.controller.js b/awx/ui/client/src/inventory-scripts/add/add.controller.js
index de3be842b3..317d6d5c0a 100644
--- a/awx/ui/client/src/inventory-scripts/add/add.controller.js
+++ b/awx/ui/client/src/inventory-scripts/add/add.controller.js
@@ -8,20 +8,27 @@ export default
     [   '$rootScope', 'pagination', '$compile','SchedulerInit', 'Rest', 'Wait',
         'inventoryScriptsFormObject', 'ProcessErrors', 'GetBasePath', 'Empty',
         'GenerateForm', 'SearchInit' , 'PaginateInit',
-        'LookUpInit', 'OrganizationList', '$scope', '$state',
+        'LookUpInit', 'OrganizationList', '$scope', '$state', 'Alert',
         function(
             $rootScope, pagination, $compile, SchedulerInit, Rest, Wait,
             inventoryScriptsFormObject, ProcessErrors, GetBasePath, Empty,
             GenerateForm, SearchInit, PaginateInit,
-            LookUpInit, OrganizationList, $scope, $state
+            LookUpInit, OrganizationList, $scope, $state, Alert
         ) {
+            Rest.setUrl(GetBasePath('inventory_scripts'));
+            Rest.options()
+                .success(function(data) {
+                    if (!data.actions.POST) {
+                        $state.go("^");
+                        Alert('Permission Error', 'You do not have permission to add an inventory script.', 'alert-info');
+                    }
+                });
+
             var scope = $scope,
                 generator = GenerateForm,
                 form = inventoryScriptsFormObject,
                 url = GetBasePath('inventory_scripts');
 
-            $scope.canEdit = true;
-
             generator.inject(form, {
                 mode: 'add' ,
                 scope:scope,
diff --git a/awx/ui/client/src/inventory-scripts/edit/edit.controller.js b/awx/ui/client/src/inventory-scripts/edit/edit.controller.js
index 3a899cd5a4..33cc50ca2e 100644
--- a/awx/ui/client/src/inventory-scripts/edit/edit.controller.js
+++ b/awx/ui/client/src/inventory-scripts/edit/edit.controller.js
@@ -17,6 +17,7 @@ export default
             LookUpInit, OrganizationList, inventory_script,
             $scope, $state
         ) {
+
             var generator = GenerateForm,
                 id = inventory_script.id,
                 form = inventoryScriptsFormObject,
diff --git a/awx/ui/client/src/inventory-scripts/inventory-scripts.form.js b/awx/ui/client/src/inventory-scripts/inventory-scripts.form.js
index 96099587ef..fd8ecd9023 100644
--- a/awx/ui/client/src/inventory-scripts/inventory-scripts.form.js
+++ b/awx/ui/client/src/inventory-scripts/inventory-scripts.form.js
@@ -24,13 +24,15 @@ export default function() {
                 type: 'text',
                 addRequired: true,
                 editRequired: true,
-                capitalize: false
+                capitalize: false,
+                ngDisabled: '!inventory_script_obj.summary_fields.user_capabilities.edit'
             },
             description: {
                 label: 'Description',
                 type: 'text',
                 addRequired: false,
-                editRequired: false
+                editRequired: false,
+                ngDisabled: '!inventory_script_obj.summary_fields.user_capabilities.edit'
             },
             organization: {
                 label: 'Organization',
@@ -41,7 +43,8 @@ export default function() {
                 },
                 sourceModel: 'organization',
                 sourceField: 'name',
-                ngClick: 'lookUpOrganization()'
+                ngClick: 'lookUpOrganization()',
+                ngDisabled: '!inventory_script_obj.summary_fields.user_capabilities.edit'
             },
             script: {
                 label: 'Custom Script',
@@ -51,7 +54,7 @@ export default function() {
                 addRequired: true,
                 editRequired: true,
                 awDropFile: true,
-                ngDisabled: '!canEdit',
+                ngDisabled: '!inventory_script_obj.summary_fields.user_capabilities.edit',
                 rows: 10,
                 awPopOver: "<p>Drag and drop your custom inventory script file here or create one in the field to import your custom inventory. " +
                                     "<br><br> Script must begin with a hashbang sequence: i.e.... #!/usr/bin/env python</p>",
@@ -64,10 +67,16 @@ export default function() {
         buttons: { //for now always generates <button> tags
             cancel: {
                 ngClick: 'formCancel()',
+                ngShow: 'inventory_script_obj.summary_fields.user_capabilities.edit'
+            },
+            close: {
+                ngClick: 'formCancel()',
+                ngShow: '!inventory_script_obj.summary_fields.user_capabilities.edit'
             },
             save: {
                 ngClick: 'formSave()', //$scope.function to call on click, optional
-                ngDisabled: 'custom_inventory_form.$pristine || custom_inventory_form.$invalid || !canEdit' //Disable when $pristine or $invalid, optional
+                ngDisabled: 'custom_inventory_form.$pristine || custom_inventory_form.$invalid || !canEdit', //Disable when $pristine or $invalid, optional
+                ngShow: 'inventory_script_obj.summary_fields.user_capabilities.edit'
             }
         }
     };
diff --git a/awx/ui/client/src/inventory-scripts/inventory-scripts.list.js b/awx/ui/client/src/inventory-scripts/inventory-scripts.list.js
index 213ff84dbf..ca48ecdecc 100644
--- a/awx/ui/client/src/inventory-scripts/inventory-scripts.list.js
+++ b/awx/ui/client/src/inventory-scripts/inventory-scripts.list.js
@@ -42,7 +42,8 @@ export default function(){
                 ngClick: 'addCustomInv()',
                 awToolTip: 'Create a new custom inventory',
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD'
+                buttonContent: '&#43; ADD',
+                ngShow: 'canAdd'
             }
         },
 
@@ -56,7 +57,16 @@ export default function(){
                 label: 'Edit',
                 "class": 'btn-sm',
                 awToolTip: 'Edit inventory script',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'inventory_script.summary_fields.user_capabilities.edit'
+            },
+            view: {
+                ngClick: "editCustomInv(inventory_script.id)",
+                label: 'View',
+                "class": 'btn-sm',
+                awToolTip: 'View inventory script',
+                dataPlacement: 'top',
+                ngShow: '!inventory_script.summary_fields.user_capabilities.edit'
             },
             "delete": {
                 ngClick: "deleteCustomInv(inventory_script.id, inventory_script.name)",
@@ -64,7 +74,8 @@ export default function(){
                 label: 'Delete',
                 "class": 'btn-sm',
                 awToolTip: 'Delete inventory script',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'inventory_script.summary_fields.user_capabilities.delete'
             }
         }
     };
diff --git a/awx/ui/client/src/inventory-scripts/list/list.controller.js b/awx/ui/client/src/inventory-scripts/list/list.controller.js
index c9f3e4d360..08e0db5f67 100644
--- a/awx/ui/client/src/inventory-scripts/list/list.controller.js
+++ b/awx/ui/client/src/inventory-scripts/list/list.controller.js
@@ -7,17 +7,24 @@
 export default
     [   '$rootScope','Wait', 'generateList', 'inventoryScriptsListObject',
         'GetBasePath' , 'SearchInit' , 'PaginateInit', 'Rest' , 'ProcessErrors',
-        'Prompt', '$state', '$filter',
+        'Prompt', '$state', '$filter', 'rbacUiControlService',
         function(
             $rootScope,Wait, GenerateList, inventoryScriptsListObject,
             GetBasePath, SearchInit, PaginateInit,
-            Rest, ProcessErrors, Prompt, $state, $filter
+            Rest, ProcessErrors, Prompt, $state, $filter, rbacUiControlService
         ) {
             var scope = $rootScope.$new(),
                 defaultUrl = GetBasePath('inventory_scripts'),
                 list = inventoryScriptsListObject,
                 view = GenerateList;
 
+            scope.canAdd = false;
+
+            rbacUiControlService.canAdd("inventory_scripts")
+                .then(function(canAdd) {
+                    scope.canAdd = canAdd;
+                });
+
             view.inject( list, {
                 mode: 'edit',
                 scope: scope
diff --git a/awx/ui/client/src/job-templates/add/job-templates-add.controller.js b/awx/ui/client/src/job-templates/add/job-templates-add.controller.js
index 39a9377c0a..0af5406c9d 100644
--- a/awx/ui/client/src/job-templates/add/job-templates-add.controller.js
+++ b/awx/ui/client/src/job-templates/add/job-templates-add.controller.js
@@ -21,6 +21,15 @@
              $state, CreateSelect2, $q
          ) {
 
+             Rest.setUrl(GetBasePath('job_templates'));
+             Rest.options()
+                 .success(function(data) {
+                     if (!data.actions.POST) {
+                         $state.go("^");
+                         Alert('Permission Error', 'You do not have permission to add a job template.', 'alert-info');
+                     }
+                 });
+
             ClearScope();
             // Inject dynamic view
             var defaultUrl = GetBasePath('job_templates'),
diff --git a/awx/ui/client/src/job-templates/list/job-templates-list.controller.js b/awx/ui/client/src/job-templates/list/job-templates-list.controller.js
index 48cec89271..4e50f43fec 100644
--- a/awx/ui/client/src/job-templates/list/job-templates-list.controller.js
+++ b/awx/ui/client/src/job-templates/list/job-templates-list.controller.js
@@ -10,18 +10,24 @@ export default
         'Prompt', 'SearchInit', 'PaginateInit', 'ReturnToCaller', 'ClearScope',
         'ProcessErrors', 'GetBasePath', 'JobTemplateForm', 'CredentialList',
         'LookUpInit', 'InitiatePlaybookRun', 'Wait', '$compile',
-        '$state', '$filter',
+        '$state', '$filter', 'rbacUiControlService',
 
         function(
             $scope, $rootScope, $location, $log,
             $stateParams, Rest, Alert, JobTemplateList, GenerateList, Prompt,
             SearchInit, PaginateInit, ReturnToCaller, ClearScope, ProcessErrors,
             GetBasePath, JobTemplateForm, CredentialList, LookUpInit, InitiatePlaybookRun,
-            Wait, $compile, $state, $filter
+            Wait, $compile, $state, $filter, rbacUiControlService
         ) {
-
             ClearScope();
 
+            $scope.canAdd = false;
+
+            rbacUiControlService.canAdd("job_templates")
+                .then(function(canAdd) {
+                    $scope.canAdd = canAdd;
+                });
+
             var list = JobTemplateList,
                 defaultUrl = GetBasePath('job_templates'),
                 view = GenerateList,
diff --git a/awx/ui/client/src/job-templates/survey-maker/survey-maker.block.less b/awx/ui/client/src/job-templates/survey-maker/survey-maker.block.less
index f0976c5927..4e3597e7d0 100644
--- a/awx/ui/client/src/job-templates/survey-maker/survey-maker.block.less
+++ b/awx/ui/client/src/job-templates/survey-maker/survey-maker.block.less
@@ -70,6 +70,12 @@
     flex: 0 0 637px;
     max-width: 637px;
 }
+
+.SurveyMaker-previewPanel--viewOnly {
+    flex: 0 0 1155px;
+    max-width: 1155px;
+}
+
 .SurveyMaker-separatorPanel {
     display: flex;
     flex: 0 0 51px;
diff --git a/awx/ui/client/src/lists/AllJobs.js b/awx/ui/client/src/lists/AllJobs.js
index 1e3bb3629b..7aecc6bf57 100644
--- a/awx/ui/client/src/lists/AllJobs.js
+++ b/awx/ui/client/src/lists/AllJobs.js
@@ -94,28 +94,33 @@ export default
         fieldActions: {
 
             columnClass: 'col-lg-2 col-md-2 col-sm-3 col-xs-4',
-
+            "view": {
+                mode: "all",
+                ngClick: "viewJob(all_job.id)",
+                awToolTip: "View the job",
+                dataPlacement: "top"
+            },
             submit: {
                 icon: 'icon-rocket',
                 mode: 'all',
                 ngClick: 'relaunchJob($event, all_job.id)',
                 awToolTip: 'Relaunch using the same parameters',
                 dataPlacement: 'top',
-                ngHide: "all_job.type == 'system_job' "
+                ngShow: "!(all_job.type == 'system_job') && all_job.summary_fields.user_capabilities.start"
             },
             cancel: {
                 mode: 'all',
                 ngClick: 'deleteJob(all_job.id)',
                 awToolTip: 'Cancel the job',
                 dataPlacement: 'top',
-                ngShow: "all_job.status === 'running'|| all_job.status === 'waiting' || all_job.status === 'pending'"
+                ngShow: "(all_job.status === 'running'|| all_job.status === 'waiting' || all_job.status === 'pending') && all_job.summary_fields.user_capabilities.start"
             },
             "delete": {
                 mode: 'all',
                 ngClick: 'deleteJob(all_job.id)',
                 awToolTip: 'Delete the job',
                 dataPlacement: 'top',
-                ngShow: "all_job.status !== 'running' && all_job.status !== 'waiting' && all_job.status !== 'pending'"
+                ngShow: "(all_job.status !== 'running' && all_job.status !== 'waiting' && all_job.status !== 'pending') && all_job.summary_fields.user_capabilities.delete"
             }
         }
     });
diff --git a/awx/ui/client/src/lists/CompletedJobs.js b/awx/ui/client/src/lists/CompletedJobs.js
index 23e4f325a8..319ee98074 100644
--- a/awx/ui/client/src/lists/CompletedJobs.js
+++ b/awx/ui/client/src/lists/CompletedJobs.js
@@ -100,13 +100,14 @@ export default
                 ngClick: 'relaunchJob($event, completed_job.id)',
                 awToolTip: 'Relaunch using the same parameters',
                 dataPlacement: 'top',
-                ngHide: "completed_job.type == 'system_job' "
+                ngShow: "!completed_job.type == 'system_job' || completed_job.summary_fields.user_capabilities.start"
             },
             "delete": {
                 mode: 'all',
                 ngClick: 'deleteJob(completed_job.id)',
                 awToolTip: 'Delete the job',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'completed_job.summary_fields.user_capabilities.delete'
             }
         }
     });
diff --git a/awx/ui/client/src/lists/Credentials.js b/awx/ui/client/src/lists/Credentials.js
index 580b4b9f5b..d9496b1807 100644
--- a/awx/ui/client/src/lists/Credentials.js
+++ b/awx/ui/client/src/lists/Credentials.js
@@ -72,7 +72,17 @@ export default
                 label: 'Edit',
                 "class": 'btn-sm',
                 awToolTip: 'Edit credential',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'credential.summary_fields.user_capabilities.edit'
+            },
+
+            view: {
+                ngClick: "editCredential(credential.id)",
+                label: 'View',
+                "class": 'btn-sm',
+                awToolTip: 'View credential',
+                dataPlacement: 'top',
+                ngShow: '!credential.summary_fields.user_capabilities.edit'
             },
 
             "delete": {
@@ -81,7 +91,8 @@ export default
                 label: 'Delete',
                 "class": 'btn-sm',
                 awToolTip: 'Delete credential',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'credential.summary_fields.user_capabilities.delete'
             }
         }
     });
diff --git a/awx/ui/client/src/lists/Inventories.js b/awx/ui/client/src/lists/Inventories.js
index c371b83d21..fec3b27c2d 100644
--- a/awx/ui/client/src/lists/Inventories.js
+++ b/awx/ui/client/src/lists/Inventories.js
@@ -91,7 +91,8 @@ export default
                 ngClick: 'addInventory()',
                 awToolTip: 'Create a new inventory',
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD'
+                buttonContent: '&#43; ADD',
+                ngShow: 'canAdd'
             }
         },
 
@@ -103,13 +104,22 @@ export default
                 label: 'Edit',
                 ngClick: 'editInventory(inventory.id)',
                 awToolTip: 'Edit inventory',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'inventory.summary_fields.user_capabilities.edit'
+            },
+            view: {
+                label: 'View',
+                ngClick: 'editInventory(inventory.id)',
+                awToolTip: 'View inventory',
+                dataPlacement: 'top',
+                ngShow: '!inventory.summary_fields.user_capabilities.edit'
             },
             "delete": {
                 label: 'Delete',
                 ngClick: "deleteInventory(inventory.id, inventory.name)",
                 awToolTip: 'Delete inventory',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'inventory.summary_fields.user_capabilities.delete'
             }
         }
     });
diff --git a/awx/ui/client/src/lists/InventoryGroups.js b/awx/ui/client/src/lists/InventoryGroups.js
index c7f1a661e5..d228982dd3 100644
--- a/awx/ui/client/src/lists/InventoryGroups.js
+++ b/awx/ui/client/src/lists/InventoryGroups.js
@@ -143,7 +143,8 @@ export default
                 actionClass: 'btn List-buttonDefault',
                 buttonContent: 'RUN COMMANDS',
                 showTipWhenDisabled: true,
-                tooltipInnerClass: "Tooltip-wide"
+                tooltipInnerClass: "Tooltip-wide",
+                ngShow: 'canAdhoc'
                 // TODO: set up a tip watcher and change text based on when
                 // things are selected/not selected.  This is started and
                 // commented out in the inventory controller within the watchers.
@@ -155,7 +156,8 @@ export default
                 ngClick: "createGroup()",
                 awToolTip: "Create a new group",
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD GROUP'
+                buttonContent: '&#43; ADD GROUP',
+                ngShow: 'canAdd'
             }
         },
 
@@ -169,8 +171,8 @@ export default
                 ngClick: 'updateGroup(group)',
                 awToolTip: "{{ group.launch_tooltip }}",
                 dataTipWatch: "group.launch_tooltip",
-                ngShow: "group.status !== 'running' && group.status " +
-                    "!== 'pending' && group.status !== 'updating'",
+                ngShow: "(group.status !== 'running' && group.status " +
+                    "!== 'pending' && group.status !== 'updating') && group.summary_fields.user_capabilities.start",
                 ngClass: "group.launch_class",
                 dataPlacement: "top",
             },
@@ -180,8 +182,8 @@ export default
                 ngClick: "cancelUpdate(group.id)",
                 awToolTip: "Cancel sync process",
                 'class': 'red-txt',
-                ngShow: "group.status == 'running' || group.status == 'pending' " +
-                    "|| group.status == 'updating'",
+                ngShow: "(group.status == 'running' || group.status == 'pending' " +
+                    "|| group.status == 'updating') && group.summary_fields.user_capabilities.start",
                 dataPlacement: "top",
                 iconClass: "fa fa-minus-circle"
             },
@@ -189,7 +191,7 @@ export default
                 mode: 'all',
                 ngClick: "copyMoveGroup(group.id)",
                 awToolTip: 'Copy or move group',
-                ngShow: "group.id > 0",
+                ngShow: "group.id > 0 && group.summary_fields.user_capabilities.copy",
                 dataPlacement: "top"
             },
             schedule: {
@@ -198,21 +200,31 @@ export default
                 awToolTip: "{{ group.group_schedule_tooltip }}",
                 ngClass: "group.scm_type_class",
                 dataPlacement: 'top',
-                ngHide: "group.summary_fields.inventory_source.source === ''"
+                ngShow: "!(group.summary_fields.inventory_source.source === '') && group.summary_fields.user_capabilities.schedule"
             },
             edit: {
                 //label: 'Edit',
                 mode: 'all',
                 ngClick: "editGroup(group.id)",
                 awToolTip: 'Edit group',
-                dataPlacement: "top"
+                dataPlacement: "top",
+                ngShow: "group.summary_fields.user_capabilities.edit"
+            },
+            view: {
+                //label: 'Edit',
+                mode: 'all',
+                ngClick: "editGroup(group.id)",
+                awToolTip: 'View group',
+                dataPlacement: "top",
+                ngShow: "!group.summary_fields.user_capabilities.edit"
             },
             "delete": {
                 //label: 'Delete',
                 mode: 'all',
                 ngClick: "deleteGroup(group)",
                 awToolTip: 'Delete group',
-                dataPlacement: "top"
+                dataPlacement: "top",
+                ngShow: "group.summary_fields.user_capabilities.delete"
             }
         }
     });
diff --git a/awx/ui/client/src/lists/InventoryHosts.js b/awx/ui/client/src/lists/InventoryHosts.js
index 1c01a77021..1a01ae1ca2 100644
--- a/awx/ui/client/src/lists/InventoryHosts.js
+++ b/awx/ui/client/src/lists/InventoryHosts.js
@@ -78,21 +78,31 @@ export default
                 mode: 'all',
                 ngClick: "copyMoveHost(host.id)",
                 awToolTip: 'Copy or move host to another group',
-                dataPlacement: "top"
+                dataPlacement: "top",
+                ngShow: 'host.summary_fields.user_capabilities.edit'
             },
             edit: {
                 //label: 'Edit',
                 ngClick: "editHost(host.id)",
                 icon: 'icon-edit',
                 awToolTip: 'Edit host',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'host.summary_fields.user_capabilities.edit'
+            },
+            view: {
+                //label: 'Edit',
+                ngClick: "editHost(host.id)",
+                awToolTip: 'View host',
+                dataPlacement: 'top',
+                ngShow: '!host.summary_fields.user_capabilities.edit'
             },
             "delete": {
                 //label: 'Delete',
                 ngClick: "deleteHost(host.id, host.name)",
                 icon: 'icon-trash',
                 awToolTip: 'Delete host',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'host.summary_fields.user_capabilities.delete'
             }
         },
 
@@ -122,7 +132,8 @@ export default
                 ngClick: "createHost()",
                 awToolTip: "Create a new host",
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD HOST'
+                buttonContent: '&#43; ADD HOST',
+                ngShow: 'canAdd'
             }
         }
 
diff --git a/awx/ui/client/src/lists/JobTemplates.js b/awx/ui/client/src/lists/JobTemplates.js
index cd61344686..ce75bf3dd6 100644
--- a/awx/ui/client/src/lists/JobTemplates.js
+++ b/awx/ui/client/src/lists/JobTemplates.js
@@ -55,7 +55,8 @@ export default
                 basePaths: ['job_templates'],
                 awToolTip: 'Create a new template',
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD'
+                buttonContent: '&#43; ADD',
+                ngShow: 'canAdd'
             }
         },
 
@@ -68,7 +69,8 @@ export default
                 mode: 'all',
                 ngClick: 'submitJob(job_template.id)',
                 awToolTip: 'Start a job using this template',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'job_template.summary_fields.user_capabilities.start'
             },
             schedule: {
                 label: 'Schedule',
@@ -76,6 +78,7 @@ export default
                 ngClick: 'scheduleJob(job_template.id)',
                 awToolTip: 'Schedule future job template runs',
                 dataPlacement: 'top',
+                ngShow: 'job_template.summary_fields.user_capabilities.schedule'
             },
             copy: {
                 label: 'Copy',
@@ -83,7 +86,7 @@ export default
                 "class": 'btn-danger btn-xs',
                 awToolTip: 'Copy template',
                 dataPlacement: 'top',
-                ngHide: 'job_template.summary_fields.can_copy===false'
+                ngShow: 'job_template.summary_fields.user_capabilities.copy'
             },
             edit: {
                 label: 'Edit',
@@ -91,6 +94,15 @@ export default
                 awToolTip: 'Edit template',
                 "class": 'btn-default btn-xs',
                 dataPlacement: 'top',
+                ngShow: 'job_template.summary_fields.user_capabilities.edit'
+            },
+            view: {
+                label: 'View',
+                ngClick: "editJobTemplate(job_template.id)",
+                awToolTip: 'View template',
+                "class": 'btn-default btn-xs',
+                dataPlacement: 'top',
+                ngShow: '!job_template.summary_fields.user_capabilities.edit'
             },
             "delete": {
                 label: 'Delete',
@@ -98,6 +110,7 @@ export default
                 "class": 'btn-danger btn-xs',
                 awToolTip: 'Delete template',
                 dataPlacement: 'top',
+                ngShow: 'job_template.summary_fields.user_capabilities.delete'
             }
         }
     });
diff --git a/awx/ui/client/src/lists/Projects.js b/awx/ui/client/src/lists/Projects.js
index a209a9ae1d..93d940730a 100644
--- a/awx/ui/client/src/lists/Projects.js
+++ b/awx/ui/client/src/lists/Projects.js
@@ -65,7 +65,8 @@ export default
                 ngClick: 'addProject()',
                 awToolTip: 'Create a new project',
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD'
+                buttonContent: '&#43; ADD',
+                ngShow: "canAdd"
             },
             refresh: {
                 mode: 'all',
@@ -86,30 +87,40 @@ export default
                 awToolTip: "{{ project.scm_update_tooltip }}",
                 dataTipWatch: "project.scm_update_tooltip",
                 ngClass: "project.scm_type_class",
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: "project.summary_fields.user_capabilities.start"
             },
             schedule: {
                 mode: 'all',
                 ngClick: "editSchedules(project.id)",
                 awToolTip: "{{ project.scm_schedule_tooltip }}",
                 ngClass: "project.scm_type_class",
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: "project.summary_fields.user_capabilities.schedule"
             },
             edit: {
                 ngClick: "editProject(project.id)",
                 awToolTip: 'Edit the project',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: "project.summary_fields.user_capabilities.edit"
+            },
+            view: {
+                ngClick: "editProject(project.id)",
+                awToolTip: 'View the project',
+                dataPlacement: 'top',
+                ngShow: "!project.summary_fields.user_capabilities.edit",
+                icon: 'fa-eye',
             },
             "delete": {
                 ngClick: "deleteProject(project.id, project.name)",
                 awToolTip: 'Delete the project',
-                ngShow: "project.status !== 'updating' && project.status !== 'running' && project.status !== 'pending'",
+                ngShow: "(project.status !== 'updating' && project.status !== 'running' && project.status !== 'pending')  && project.summary_fields.user_capabilities.delete",
                 dataPlacement: 'top'
             },
             cancel: {
                 ngClick: "cancelUpdate(project.id, project.name)",
                 awToolTip: 'Cancel the SCM update',
-                ngShow: "project.status == 'updating' || project.status == 'running' || project.status == 'pending'",
+                ngShow: "(project.status == 'updating' || project.status == 'running' || project.status == 'pending') && project.summary_fields.user_capabilities.start",
                 dataPlacement: 'top'
             }
         }
diff --git a/awx/ui/client/src/lists/ScheduledJobs.js b/awx/ui/client/src/lists/ScheduledJobs.js
index be4e7bd22d..9f535c189e 100644
--- a/awx/ui/client/src/lists/ScheduledJobs.js
+++ b/awx/ui/client/src/lists/ScheduledJobs.js
@@ -78,13 +78,22 @@ export default
                 mode: "all",
                 ngClick: "editSchedule(schedule)",
                 awToolTip: "Edit the schedule",
-                dataPlacement: "top"
+                dataPlacement: "top",
+                ngShow: 'schedule.summary_fields.user_capabilities.edit'
+            },
+            "view": {
+                mode: "all",
+                ngClick: "editSchedule(schedule)",
+                awToolTip: "View the schedule",
+                dataPlacement: "top",
+                ngShow: '!schedule.summary_fields.user_capabilities.edit'
             },
             "delete": {
                 mode: 'all',
                 ngClick: 'deleteSchedule(schedule.id)',
                 awToolTip: 'Delete the schedule',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'schedule.summary_fields.user_capabilities.delete'
             }
         }
     });
diff --git a/awx/ui/client/src/lists/Schedules.js b/awx/ui/client/src/lists/Schedules.js
index 9159862976..1249932eb4 100644
--- a/awx/ui/client/src/lists/Schedules.js
+++ b/awx/ui/client/src/lists/Schedules.js
@@ -69,7 +69,8 @@ export default
                 ngClick: 'addSchedule()',
                 awToolTip: 'Add a new schedule',
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD'
+                buttonContent: '&#43; ADD',
+                ngShow: 'canAdd'
             }
         },
 
@@ -79,14 +80,23 @@ export default
                 ngClick: "editSchedule(schedule.id)",
                 icon: 'icon-edit',
                 awToolTip: 'Edit schedule',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'schedule.summary_fields.user_capabilities.edit'
+            },
+            view: {
+                label: 'View',
+                ngClick: "editSchedule(schedule.id)",
+                awToolTip: 'View schedule',
+                dataPlacement: 'top',
+                ngShow: '!schedule.summary_fields.user_capabilities.edit'
             },
             "delete": {
                 label: 'Delete',
                 ngClick: "deleteSchedule(schedule.id)",
                 icon: 'icon-trash',
                 awToolTip: 'Delete schedule',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'schedule.summary_fields.user_capabilities.delete'
             }
         }
     });
diff --git a/awx/ui/client/src/lists/Teams.js b/awx/ui/client/src/lists/Teams.js
index 5f12b07b53..73fbfe38e2 100644
--- a/awx/ui/client/src/lists/Teams.js
+++ b/awx/ui/client/src/lists/Teams.js
@@ -47,7 +47,8 @@ export default
                 ngClick: 'addTeam()',
                 awToolTip: 'Create a new team',
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD'
+                buttonContent: '&#43; ADD',
+                ngShow: 'canAdd'
             }
         },
 
@@ -61,16 +62,25 @@ export default
                 icon: 'icon-edit',
                 "class": 'btn-xs btn-default',
                 awToolTip: 'Edit team',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'team.summary_fields.user_capabilities.edit'
+            },
+            view: {
+                label: 'View',
+                ngClick: "editTeam(team.id)",
+                "class": 'btn-xs btn-default',
+                awToolTip: 'View team',
+                dataPlacement: 'top',
+                ngShow: '!team.summary_fields.user_capabilities.edit'
             },
-
             "delete": {
                 label: 'Delete',
                 ngClick: "deleteTeam(team.id, team.name)",
                 icon: 'icon-trash',
                 "class": 'btn-xs btn-danger',
                 awToolTip: 'Delete team',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'team.summary_fields.user_capabilities.delete'
             }
         }
     });
diff --git a/awx/ui/client/src/lists/Users.js b/awx/ui/client/src/lists/Users.js
index 5d86704db4..ad70d1c30f 100644
--- a/awx/ui/client/src/lists/Users.js
+++ b/awx/ui/client/src/lists/Users.js
@@ -44,7 +44,8 @@ export default
                 basePaths: ['organizations', 'users'], // base path must be in list, or action not available
                 awToolTip: 'Create a new user',
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD'
+                buttonContent: '&#43; ADD',
+                ngShow: 'canAdd'
             }
         },
 
@@ -58,7 +59,17 @@ export default
                 icon: 'icon-edit',
                 "class": 'btn-xs btn-default',
                 awToolTip: 'Edit user',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'user.summary_fields.user_capabilities.edit'
+            },
+
+            view: {
+                label: 'View',
+                ngClick: "editUser(user.id)",
+                "class": 'btn-xs btn-default',
+                awToolTip: 'View user',
+                dataPlacement: 'top',
+                ngShow: '!user.summary_fields.user_capabilities.edit'
             },
 
             "delete": {
@@ -67,7 +78,8 @@ export default
                 icon: 'icon-trash',
                 "class": 'btn-xs btn-danger',
                 awToolTip: 'Delete user',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'user.summary_fields.user_capabilities.delete'
             }
         }
     });
diff --git a/awx/ui/client/src/management-jobs/card/card.partial.html b/awx/ui/client/src/management-jobs/card/card.partial.html
index ae0d660b50..0b90bf8bdc 100644
--- a/awx/ui/client/src/management-jobs/card/card.partial.html
+++ b/awx/ui/client/src/management-jobs/card/card.partial.html
@@ -17,6 +17,7 @@
 				<div class="MgmtCards-actionItems">
 					<button class="MgmtCards-actionItem List-actionButton"
 						ng-click='chooseRunJob(card.id, card.name)'
+						ng-show='current_user.is_superuser'
 						data-placement="top" aw-tool-tip="Launch Management Job" data-original-title="" title="">
 						<i class="MgmtCards-actionItemIcon icon-launch"></i>
 					</button>
@@ -27,6 +28,7 @@
 					</button>
 					<button class="MgmtCards-actionItem List-actionButton"
 						ng-click='goToNotifications(card, card.id)'
+						ng-show='current_user.is_superuser'
 						data-placement="top" aw-tool-tip="Configure Notifications" data-original-title="" title="" ng-class="{'List-editButton--selected': activeCard === card.id && cardAction === 'notifications'}">
 						<i class="MgmtCards-actionItemIcon fa fa-bell-o"></i>
 					</button>
diff --git a/awx/ui/client/src/notifications/add/add.controller.js b/awx/ui/client/src/notifications/add/add.controller.js
index 0b58f2e257..122d822cf4 100644
--- a/awx/ui/client/src/notifications/add/add.controller.js
+++ b/awx/ui/client/src/notifications/add/add.controller.js
@@ -9,14 +9,23 @@ export default
         'NotificationsFormObject', 'ProcessErrors', 'GetBasePath', 'Empty',
         'GenerateForm', 'SearchInit' , 'PaginateInit', 'LookUpInit',
         'OrganizationList', '$scope', '$state', 'CreateSelect2', 'GetChoices',
-        'NotificationsTypeChange', 'ParseTypeChange',
+        'NotificationsTypeChange', 'ParseTypeChange', 'Alert',
         function(
             $rootScope, pagination, $compile, SchedulerInit, Rest, Wait,
             NotificationsFormObject, ProcessErrors, GetBasePath, Empty,
             GenerateForm, SearchInit, PaginateInit, LookUpInit,
             OrganizationList, $scope, $state, CreateSelect2, GetChoices,
-            NotificationsTypeChange, ParseTypeChange
+            NotificationsTypeChange, ParseTypeChange, Alert
         ) {
+            Rest.setUrl(GetBasePath('projects'));
+            Rest.options()
+                .success(function(data) {
+                    if (!data.actions.POST) {
+                        $state.go("^");
+                        Alert('Permission Error', 'You do not have permission to add a notification template.', 'alert-info');
+                    }
+                });
+
             var generator = GenerateForm,
                 form = NotificationsFormObject,
                 url = GetBasePath('notification_templates');
diff --git a/awx/ui/client/src/notifications/notification-templates-list/list.controller.js b/awx/ui/client/src/notifications/notification-templates-list/list.controller.js
index 04265f1181..7fc279534b 100644
--- a/awx/ui/client/src/notifications/notification-templates-list/list.controller.js
+++ b/awx/ui/client/src/notifications/notification-templates-list/list.controller.js
@@ -8,12 +8,12 @@ export default
     [   '$rootScope','Wait', 'generateList', 'NotificationTemplatesList',
         'GetBasePath' , 'SearchInit' , 'PaginateInit', 'Rest' ,
         'ProcessErrors', 'Prompt', '$state', 'GetChoices', 'Empty', 'Find',
-        'ngToast', '$compile', '$filter',
+        'ngToast', '$compile', '$filter', 'rbacUiControlService',
         function(
             $rootScope,Wait, GenerateList, NotificationTemplatesList,
             GetBasePath, SearchInit, PaginateInit, Rest,
             ProcessErrors, Prompt, $state, GetChoices, Empty, Find, ngToast,
-            $compile, $filter) {
+            $compile, $filter, rbacUiControlService) {
             var scope = $rootScope.$new(),
                 defaultUrl = GetBasePath('notification_templates'),
                 list = NotificationTemplatesList,
@@ -24,6 +24,13 @@ export default
                 scope: scope
             });
 
+            scope.canAdd = false;
+
+            rbacUiControlService.canAdd("notification_templates")
+                .then(function(canAdd) {
+                    scope.canAdd = canAdd;
+                });
+
             scope.removePostRefresh = scope.$on('PostRefresh', function () {
                 Wait('stop');
                 if (scope.notification_templates) {
diff --git a/awx/ui/client/src/notifications/notificationTemplates.form.js b/awx/ui/client/src/notifications/notificationTemplates.form.js
index cd0ff9d945..69128bbb18 100644
--- a/awx/ui/client/src/notifications/notificationTemplates.form.js
+++ b/awx/ui/client/src/notifications/notificationTemplates.form.js
@@ -27,13 +27,15 @@ export default function() {
                 type: 'text',
                 addRequired: true,
                 editRequired: true,
-                capitalize: false
+                capitalize: false,
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             description: {
                 label: 'Description',
                 type: 'text',
                 addRequired: false,
-                editRequired: false
+                editRequired: false,
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             organization: {
                 label: 'Organization',
@@ -44,7 +46,8 @@ export default function() {
                 awRequiredWhen: {
                     reqExpression: "organizationrequired",
                     init: "true"
-                }
+                },
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             notification_type: {
                 label:  'Type',
@@ -54,13 +57,15 @@ export default function() {
                 class: 'NotificationsForm-typeSelect',
                 ngOptions: 'type.label for type in notification_type_options track by type.value',
                 ngChange: 'typeChange()',
-                hasSubForm: true
+                hasSubForm: true,
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             username: {
                 label: 'Username',
                 type: 'text',
                 ngShow: "notification_type.value == 'email' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
 
             host: {
@@ -71,7 +76,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'email' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             sender: {
                 label: 'Sender Email',
@@ -81,7 +87,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'email' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             recipients: {
                 label: 'Recipient List',
@@ -97,7 +104,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'email' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             password: {
                 labelBind: 'passwordLabel',
@@ -108,7 +116,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'email' || notification_type.value == 'irc' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             port: {
                 labelBind: 'portLabel',
@@ -122,7 +131,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'email' || notification_type.value == 'irc'",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             channels: {
                 label: 'Destination Channels',
@@ -138,7 +148,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'slack'",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             rooms: {
                 label: 'Destination Channels',
@@ -154,7 +165,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'hipchat'",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             token: {
                 labelBind: 'tokenLabel',
@@ -165,7 +177,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'slack' || notification_type.value == 'pagerduty' || notification_type.value == 'hipchat'",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             account_token: {
                 label: 'Account Token',
@@ -176,7 +189,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'twilio' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             from_number: {
                 label: 'Source Phone Number',
@@ -188,7 +202,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'twilio' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             to_numbers: {
                 label: 'Destination SMS Number',
@@ -204,7 +219,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'twilio' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             account_sid: {
                 label: 'Account SID',
@@ -214,7 +230,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'twilio' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             subdomain: {
                 label: 'Pagerduty subdomain',
@@ -224,7 +241,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'pagerduty' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             service_key: {
                 label: 'API Service/Integration Key',
@@ -234,7 +252,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'pagerduty' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             client_name: {
                 label: 'Client Identifier',
@@ -244,7 +263,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'pagerduty' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             message_from: {
                 label: 'Label to be shown with notification',
@@ -254,7 +274,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'hipchat' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             api_url: {
                 label: 'API URL',
@@ -265,7 +286,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'hipchat' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             color: {
                 label: 'Notification Color',
@@ -277,13 +299,15 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'hipchat' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             notify: {
                 label: 'Notify Channel',
                 type: 'checkbox',
                 ngShow: "notification_type.value == 'hipchat' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             url: {
                 label: 'Target URL',
@@ -293,7 +317,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'webhook' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             headers: {
                 label: 'HTTP Headers',
@@ -313,7 +338,8 @@ export default function() {
                            '</pre></p>',
                 dataPlacement: 'right',
                 ngShow: "notification_type.value == 'webhook' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             server: {
                 label: 'IRC Server Address',
@@ -323,7 +349,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'irc' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             nickname: {
                 label: 'IRC Nick',
@@ -333,7 +360,8 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'irc' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             targets: {
                 label: 'Destination Channels or Users',
@@ -349,13 +377,15 @@ export default function() {
                     init: "false"
                 },
                 ngShow: "notification_type.value == 'irc' ",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             use_ssl: {
                 label: 'SSL Connection',
                 type: 'checkbox',
                 ngShow: "notification_type.value == 'irc'",
-                subForm: 'typeSubForm'
+                subForm: 'typeSubForm',
+                ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
             },
             checkbox_group: {
                 label: 'Options',
@@ -367,13 +397,15 @@ export default function() {
                     label: 'Use TLS',
                     type: 'checkbox',
                     ngShow: "notification_type.value == 'email' ",
-                    labelClass: 'checkbox-options stack-inline'
+                    labelClass: 'checkbox-options stack-inline',
+                    ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
                 }, {
                     name: 'use_ssl',
                     label: 'Use SSL',
                     type: 'checkbox',
                     ngShow: "notification_type.value == 'email'",
-                    labelClass: 'checkbox-options stack-inline'
+                    labelClass: 'checkbox-options stack-inline',
+                    ngDisabled: '!notification_template.summary_fields.user_capabilities.edit'
                 }]
             }
         },
@@ -381,9 +413,15 @@ export default function() {
         buttons: { //for now always generates <button> tags
             cancel: {
                 ngClick: 'formCancel()',
+                ngShow: 'notification_template.summary_fields.user_capabilities.edit'
+            },
+            close: {
+                ngClick: 'formCancel()',
+                ngShow: '!notification_template.summary_fields.user_capabilities.edit'
             },
             save: {
-                ngClick: 'formSave()', //$scope.function to call on click, optional
+                ngClick: 'formSave()',
+                ngShow: 'notification_template.summary_fields.user_capabilities.edit', //$scope.function to call on click, optional
                 ngDisabled: true //Disable when $pristine or $invalid, optional
             }
         }
diff --git a/awx/ui/client/src/notifications/notificationTemplates.list.js b/awx/ui/client/src/notifications/notificationTemplates.list.js
index 06eb25615f..58d0794d4a 100644
--- a/awx/ui/client/src/notifications/notificationTemplates.list.js
+++ b/awx/ui/client/src/notifications/notificationTemplates.list.js
@@ -49,7 +49,8 @@ export default function(){
                 ngClick: 'addNotification()',
                 awToolTip: 'Create a new custom inventory',
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD'
+                buttonContent: '&#43; ADD',
+                ngShow: 'canAdd'
             }
         },
 
@@ -62,7 +63,8 @@ export default function(){
                 label: 'Edit',
                 "class": 'btn-sm',
                 awToolTip: 'Test notification',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'notification_template.summary_fields.user_capabilities.edit'
             },
             edit: {
                 ngClick: "editNotification(notification_template.id)",
@@ -70,7 +72,16 @@ export default function(){
                 label: 'Edit',
                 "class": 'btn-sm',
                 awToolTip: 'Edit notification',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'notification_template.summary_fields.user_capabilities.edit'
+            },
+            view: {
+                ngClick: "editNotification(notification_template.id)",
+                label: 'View',
+                "class": 'btn-sm',
+                awToolTip: 'View notification',
+                dataPlacement: 'top',
+                ngShow: '!notification_template.summary_fields.user_capabilities.edit'
             },
             "delete": {
                 ngClick: "deleteNotification(notification_template.id, notification_template.name)",
@@ -78,7 +89,8 @@ export default function(){
                 label: 'Delete',
                 "class": 'btn-sm',
                 awToolTip: 'Delete notification',
-                dataPlacement: 'top'
+                dataPlacement: 'top',
+                ngShow: 'notification_template.summary_fields.user_capabilities.delete'
             }
         }
     };
diff --git a/awx/ui/client/src/notifications/notifications.list.js b/awx/ui/client/src/notifications/notifications.list.js
index 553d125656..ed74e0b12b 100644
--- a/awx/ui/client/src/notifications/notifications.list.js
+++ b/awx/ui/client/src/notifications/notifications.list.js
@@ -65,7 +65,8 @@ export default function(){
                 ngClick: 'addNotificationTemplate()',
                 awToolTip: 'Create a new notification template',
                 actionClass: 'btn List-buttonSubmit',
-                buttonContent: '&#43; ADD NOTIFICATION TEMPLATE'
+                buttonContent: '&#43; ADD NOTIFICATION TEMPLATE',
+                ngShow: 'current_user.is_superuser || (current_user_admin_orgs && current_user_admin_orgs.length > 0)'
             }
         }
 
diff --git a/awx/ui/client/src/notifications/shared/notification-list-init.factory.js b/awx/ui/client/src/notifications/shared/notification-list-init.factory.js
index ba13bea4c9..e8a711e783 100644
--- a/awx/ui/client/src/notifications/shared/notification-list-init.factory.js
+++ b/awx/ui/client/src/notifications/shared/notification-list-init.factory.js
@@ -15,13 +15,21 @@
  */
 
 export default ['Wait', 'GetBasePath', 'ProcessErrors', 'Rest', 'GetChoices',
-    '$state',
-    function(Wait, GetBasePath, ProcessErrors, Rest, GetChoices, $state) {
+    '$state', '$rootScope',
+    function(Wait, GetBasePath, ProcessErrors, Rest, GetChoices, $state, $rootScope) {
     return function(params) {
         var scope = params.scope,
             url = params.url,
             id = params.id;
 
+        scope.current_user_admin_orgs = [];
+
+        Rest.setUrl($rootScope.current_user.related.admin_of_organizations);
+        Rest.get()
+            .success(function(data) {
+                scope.current_user_admin_orgs = data.results.map(i => i.name);
+            });
+
         scope.addNotificationTemplate = function(){
             $state.go('notifications.add');
         };
diff --git a/awx/ui/client/src/organizations/add/organizations-add.controller.js b/awx/ui/client/src/organizations/add/organizations-add.controller.js
index 87c450e903..d209926475 100644
--- a/awx/ui/client/src/organizations/add/organizations-add.controller.js
+++ b/awx/ui/client/src/organizations/add/organizations-add.controller.js
@@ -12,6 +12,15 @@ export default ['$scope', '$rootScope', '$compile', '$location',
         $stateParams, OrganizationForm, GenerateForm, Rest, Alert, ProcessErrors,
         ClearScope, GetBasePath, ReturnToCaller, Wait, $state) {
 
+        Rest.setUrl(GetBasePath('organizations'));
+        Rest.options()
+            .success(function(data) {
+                if (!data.actions.POST) {
+                    $state.go("^");
+                    Alert('Permission Error', 'You do not have permission to add an organization.', 'alert-info');
+                }
+            });
+
         ClearScope();
 
         // Inject dynamic view
diff --git a/awx/ui/client/src/organizations/list/organizations-list.controller.js b/awx/ui/client/src/organizations/list/organizations-list.controller.js
index 84510a60dc..13ea87ce82 100644
--- a/awx/ui/client/src/organizations/list/organizations-list.controller.js
+++ b/awx/ui/client/src/organizations/list/organizations-list.controller.js
@@ -8,15 +8,22 @@ export default ['$stateParams', '$scope', '$rootScope', '$location',
     '$log', '$compile', 'Rest', 'PaginateInit',
     'SearchInit', 'OrganizationList', 'Alert', 'Prompt', 'ClearScope',
     'ProcessErrors', 'GetBasePath', 'Wait',
-    '$state', 'generateList', 'Refresh', '$filter',
+    '$state', 'generateList', 'Refresh', '$filter', 'rbacUiControlService',
     function($stateParams, $scope, $rootScope, $location,
         $log, $compile, Rest, PaginateInit,
         SearchInit, OrganizationList, Alert, Prompt, ClearScope,
         ProcessErrors, GetBasePath, Wait,
-        $state, generateList, Refresh, $filter) {
+        $state, generateList, Refresh, $filter, rbacUiControlService) {
 
         ClearScope();
 
+        $scope.canAdd = false;
+
+        rbacUiControlService.canAdd("organizations")
+            .then(function(canAdd) {
+                $scope.canAdd = canAdd;
+            });
+
         var defaultUrl = GetBasePath('organizations'),
             list = OrganizationList,
             pageSize = 24,
@@ -25,6 +32,7 @@ export default ['$stateParams', '$scope', '$rootScope', '$location',
         var parseCardData = function(cards) {
             return cards.map(function(card) {
                 var val = {}, url = '/#/organizations/' + card.id + '/';
+                val.user_capabilities = card.summary_fields.user_capabilities;
                 val.name = card.name;
                 val.id = card.id;
                 val.description = card.description || undefined;
diff --git a/awx/ui/client/src/organizations/list/organizations-list.partial.html b/awx/ui/client/src/organizations/list/organizations-list.partial.html
index 6018e602ce..9746cc5756 100644
--- a/awx/ui/client/src/organizations/list/organizations-list.partial.html
+++ b/awx/ui/client/src/organizations/list/organizations-list.partial.html
@@ -13,6 +13,7 @@
             <div class="List-actions">
                 <button class="btn List-buttonSubmit"
                     aw-tool-tip="Create a new organization"
+                    ng-show="canAdd"
                     ng-click="addOrganization()">
                     + ADD
                 </button>
@@ -31,13 +32,23 @@
                         <div class="OrgCards-actionItems">
                             <button class="OrgCards-actionItem
                                 List-actionButton"
+                                ng-show="card.user_capabilities.edit"
                                 ng-class="{'List-editButton--selected': (activeCard === card.id || card.isActiveCard) && activeMode === 'edit' }"
                                 ng-click="editOrganization(card.id)">
                                 <i class="OrgCards-actionItemIcon fa fa-pencil">
                                 </i>
                             </button>
+                            <button class="OrgCards-actionItem
+                                List-actionButton"
+                                ng-show="!card.user_capabilities.edit"
+                                ng-class="{'List-editButton--selected': (activeCard === card.id || card.isActiveCard) && activeMode === 'edit' }"
+                                ng-click="editOrganization(card.id)">
+                                <i class="OrgCards-actionItemIcon fa fa-search-plus">
+                                </i>
+                            </button>
                             <button class="OrgCards-actionItem List-actionButton
                                 List-actionButton--delete"
+                                ng-show="card.user_capabilities.delete"
                                 ng-click="deleteOrganization(card.id, card.name)">
                                 <i class="OrgCards-actionItemIcon
                                     fa fa-trash-o">
diff --git a/awx/ui/client/src/partials/survey-maker-modal.html b/awx/ui/client/src/partials/survey-maker-modal.html
index b87b6f961b..1ebb795bb8 100644
--- a/awx/ui/client/src/partials/survey-maker-modal.html
+++ b/awx/ui/client/src/partials/survey-maker-modal.html
@@ -32,13 +32,13 @@
         </div>
     </div>
     <div class="SurveyMaker-content">
-        <div class="SurveyMaker-questionPanel">
+        <div class="SurveyMaker-questionPanel" ng-show="job_template_obj.summary_fields.user_capabilities.edit">
             <div id="survey_maker_question_form"></div>
         </div>
-        <div class="SurveyMaker-separatorPanel">
+        <div class="SurveyMaker-separatorPanel" ng-show="job_template_obj.summary_fields.user_capabilities.edit">
             <div class="SurveyMaker-contentSeparator"></div>
         </div>
-        <div class="SurveyMaker-previewPanel">
+        <div class="SurveyMaker-previewPanel" ng-class="{'SurveyMaker-previewPanel--viewOnly': !job_template_obj.summary_fields.user_capabilities.edit}">
             <div style="display: flex; flex-direction: column; width: 100%;">
                 <div class="SurveyMaker-panelHeader">PREVIEW</div>
                 <div class="SurveyMaker-panelBody">
@@ -56,13 +56,13 @@
                                     <i>{{question.question_description}}</i>
                                 </div>
                                 <div class="SurveyMaker-previewInputRow">
-                                    <span dnd-handle class="SurveyMaker-reorderButton" data-placement="top" aw-tool-tip="Drag to reorder question" data-original-title="" title="">
+                                    <span dnd-handle class="SurveyMaker-reorderButton" data-placement="top" aw-tool-tip="Drag to reorder question" data-original-title="" title="" ng-show="job_template_obj.summary_fields.user_capabilities.edit">
                                         <i class="fa fa-ellipsis-v"></i>
                                         <span>&nbsp;</span>
                                         <i class="fa fa-ellipsis-v"></i>
                                     </span>
                                     <survey-question class="SurveyMaker-previewInput" preview="true" question="question" ng-required="question.required" ng-disabled=true></survey-question>
-                                    <div class="SurveyMaker-previewActions">
+                                    <div class="SurveyMaker-previewActions" ng-show="job_template_obj.summary_fields.user_capabilities.edit">
                                         <button class="List-actionButton" data-placement="top" ng-class="{'SurveyMaker-previewActions--selected' : editQuestionIndex == $index}" ng-click="editQuestion($index)" aw-tool-tip="Edit question" data-original-title="" title="">
                                             <i class="fa fa-pencil"></i>
                                         </button>
@@ -80,9 +80,10 @@
                 </div>
                 <div class="SurveyMaker-panelFooter">
                     <div class="Form-buttons">
-                        <button id="survey-delete-button" class="btn btn-sm SurveyMaker-deleteButton" ng-show="survey_exists" ng-click="showDeleteOverlay('survey')">DELETE SURVEY</button>
-                        <button id="survey-close-button" class="btn btn-sm Form-buttonDefault" ng-click="closeSurvey('survey-modal-dialog')">CANCEL</button>
-                        <button id="survey-save-button" class="btn btn-sm Form-saveButton" ng-click="saveSurvey()" ng-disabled="survey_questions.length < 1 || !can_edit || editQuestionIndex !== null">SAVE</button>
+                        <button id="survey-delete-button" class="btn btn-sm SurveyMaker-deleteButton" ng-show="survey_exists && job_template_obj.summary_fields.user_capabilities.edit" ng-click="showDeleteOverlay('survey')">DELETE SURVEY</button>
+                        <button id="survey-close-button" class="btn btn-sm Form-buttonDefault" ng-click="closeSurvey('survey-modal-dialog')" ng-show="job_template_obj.summary_fields.user_capabilities.edit">CANCEL</button>
+                        <button id="survey-close-button" class="btn btn-sm Form-buttonDefault" ng-click="closeSurvey('survey-modal-dialog')" ng-show="!job_template_obj.summary_fields.user_capabilities.edit">CLOSE</button>
+                        <button id="survey-save-button" class="btn btn-sm Form-saveButton" ng-click="saveSurvey()" ng-disabled="survey_questions.length < 1 || !can_edit || editQuestionIndex !== null" ng-show="job_template_obj.summary_fields.user_capabilities.edit">SAVE</button>
                     </div>
                 </div>
             </div>
diff --git a/awx/ui/client/src/scheduler/scheduler.controller.js b/awx/ui/client/src/scheduler/scheduler.controller.js
index dffa82098e..db8eaa7b29 100644
--- a/awx/ui/client/src/scheduler/scheduler.controller.js
+++ b/awx/ui/client/src/scheduler/scheduler.controller.js
@@ -14,11 +14,11 @@
 export default [
     '$scope', '$compile', '$location', '$stateParams', 'SchedulesList', 'Rest',
     'ProcessErrors', 'ReturnToCaller', 'ClearScope', 'GetBasePath', 'Wait',
-    'Find', 'LoadSchedulesScope', 'GetChoices', '$q', '$state',
+    'Find', 'LoadSchedulesScope', 'GetChoices', '$q', '$state', 'rbacUiControlService',
     function ($scope, $compile, $location, $stateParams,
     SchedulesList, Rest, ProcessErrors, ReturnToCaller, ClearScope,
     GetBasePath, Wait, Find, LoadSchedulesScope, GetChoices,
-    $q, $state) {
+    $q, $state, rbacUiControlService) {
         var schedList = _.cloneDeep(SchedulesList);
 
         ClearScope();
@@ -48,6 +48,14 @@ export default [
         }
         $scope.removeParentLoaded = $scope.$on('ParentLoaded', function() {
             url += "schedules/";
+
+            $scope.canAdd = false;
+
+            rbacUiControlService.canAdd(url)
+                .then(function(canAdd) {
+                    $scope.canAdd = canAdd;
+                });
+
             schedList.well = true;
 
             // include name of item in listTitle
diff --git a/awx/ui/client/src/scheduler/schedulerAdd.controller.js b/awx/ui/client/src/scheduler/schedulerAdd.controller.js
index 48dcbb764b..e1ffc75589 100644
--- a/awx/ui/client/src/scheduler/schedulerAdd.controller.js
+++ b/awx/ui/client/src/scheduler/schedulerAdd.controller.js
@@ -9,7 +9,6 @@ export default ['$compile', '$filter', '$state', '$stateParams', 'AddSchedule',
     'Rest', 'ParamPass',
     function($compile, $filter, $state, $stateParams, AddSchedule, Wait, $scope,
         $rootScope, CreateSelect2, ParseTypeChange, GetBasePath, Rest, ParamPass) {
-
     $scope.processSchedulerEndDt = function(){
         // set the schedulerEndDt to be equal to schedulerStartDt + 1 day @ midnight
         var dt = new Date($scope.schedulerUTCTime);
diff --git a/awx/ui/client/src/shared/form-generator.js b/awx/ui/client/src/shared/form-generator.js
index 66c4f750b8..821857e3f6 100644
--- a/awx/ui/client/src/shared/form-generator.js
+++ b/awx/ui/client/src/shared/form-generator.js
@@ -865,6 +865,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             html += ">";
                             html += "<input type=\"checkbox\" ng-model=\"" + field.subCheckbox.variable + "\" ";
                             html += (field.subCheckbox.ngChange) ? "ng-change=\"" + field.subCheckbox.ngChange + "\" " : "";
+                            html += (field.ngDisabled) ? "ng-disabled=\"" + field.ngDisabled + "\" " : "";
                             html += "id=\"" + this.form.name + "_" + fld + "_ask_chbox\" ";
                             html += ">";
                             html += field.subCheckbox.text ? field.subCheckbox.text : "";
@@ -987,6 +988,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             if (field.subCheckbox.ngDisabled) {
                                 html += "ng-disabled='" + field.subCheckbox.ngDisabled + "'";
                             }
+                            html += (field.ngDisabled) ? "ng-disabled=\"" + field.ngDisabled + "\" " : "";
                             html += ">";
                             html += field.subCheckbox.text ? field.subCheckbox.text : "";
                             html += "</label>";
@@ -1084,6 +1086,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             if (field.subCheckbox.ngDisabled) {
                                 html += "ng-disabled='" + field.subCheckbox.ngDisabled + "'";
                             }
+                            html += (field.ngDisabled) ? "ng-disabled=\"" + field.ngDisabled + "\" " : "";
                             html += ">";
                             html += field.subCheckbox.text ? field.subCheckbox.text : "";
                             html += "</label>";
@@ -1151,6 +1154,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             if (field.subCheckbox.ngDisabled) {
                                 html += "ng-disabled='" + field.subCheckbox.ngDisabled + "'";
                             }
+                            html += (field.ngDisabled) ? "ng-disabled=\"" + field.ngDisabled + "\" " : "";
                             html += ">";
                             html += field.subCheckbox.text ? field.subCheckbox.text : "";
                             html += "</label>";
@@ -1199,6 +1203,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                         html += (field.min || field.min === 0) ? this.attr(field, 'min') : "";
                         html += (field.max) ? this.attr(field, 'max') : "";
                         html += (field.ngChange) ? this.attr(field, 'ngChange') : "";
+                        html += (field.ngDisabled) ? "ng-disabled=\"" + field.ngDisabled + "\" " : "";
                         html += (field.slider) ? "id=\"" + fld + "-number\"" : (field.id) ? this.attr(field, 'id') : "";
                         html += (options.mode === 'edit' && field.editRequired) ? "required " : "";
                         html += (options.mode === 'add' && field.addRequired) ? "required " : "";
@@ -1219,6 +1224,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             html += "<input type=\"checkbox\" ng-model=\"" +
                                 field.subCheckbox.variable + "\" ";
                             html += (field.subCheckbox.ngChange) ? "ng-change=\"" + field.subCheckbox.ngChange + "\" " : "";
+                            html += (field.ngDisabled) ? "ng-disabled=\"" + field.ngDisabled + "\" " : "";
                             html += "id=\"" + this.form.name + "_" + fld + "_ask_chbox\" ";
                             html += ">";
                             html += field.subCheckbox.text ? field.subCheckbox.text : "";
@@ -1422,6 +1428,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             html += "<input type=\"checkbox\" ng-model=\"" +
                                 field.subCheckbox.variable + "\" ";
                             html += (field.subCheckbox.ngChange) ? "ng-change=\"" + field.subCheckbox.ngChange + "\" " : "";
+                            html += (field.ngDisabled) ? "ng-disabled=\"" + field.ngDisabled + "\" " : "";
                             html += "id=\"" + this.form.name + "_" + fld + "_ask_chbox\" ";
                             html += ">";
                             html += field.subCheckbox.text ? field.subCheckbox.text : "";
@@ -1693,6 +1700,10 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                                     button.label = 'Cancel';
                                     button['class'] = 'Form-cancelButton';
                                 }
+                                if (btn === 'close') {
+                                    button.label = 'Close';
+                                    button['class'] = 'Form-cancelButton';
+                                }
                                 if (btn === 'launch') {
                                     button.label = 'Launch';
                                     button['class'] = 'Form-launchButton';
@@ -1705,6 +1716,10 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                                     button.label = 'Edit Survey';
                                     button['class'] = 'Form-surveyButton';
                                 }
+                                if (btn === 'view_survey') {
+                                    button.label = 'View Survey';
+                                    button['class'] = 'Form-surveyButton';
+                                }
 
                                 // Build button HTML
                                 html += "<button type=\"button\" ";
diff --git a/awx/ui/client/src/shared/main.js b/awx/ui/client/src/shared/main.js
index 6279fbf1e7..60c812e12c 100644
--- a/awx/ui/client/src/shared/main.js
+++ b/awx/ui/client/src/shared/main.js
@@ -11,12 +11,14 @@ import lodashAsPromised from './lodash-as-promised';
 import stringFilters from './string-filters/main';
 import truncatedText from './truncated-text.directive';
 import stateExtender from './stateExtender.provider';
+import rbacUiControl from './rbacUiControl';
 
 export default
 angular.module('shared', [listGenerator.name,
         pagination.name,
         stringFilters.name,
-        'ui.router'
+        'ui.router',
+        rbacUiControl.name
     ])
     .factory('lodashAsPromised', lodashAsPromised)
     .directive('truncatedText', truncatedText)
diff --git a/awx/ui/client/src/shared/rbacUiControl.js b/awx/ui/client/src/shared/rbacUiControl.js
new file mode 100644
index 0000000000..4c8a00d827
--- /dev/null
+++ b/awx/ui/client/src/shared/rbacUiControl.js
@@ -0,0 +1,32 @@
+/*************************************************
+ * Copyright (c) 2015 Ansible, Inc.
+ *
+ * All Rights Reserved
+ *************************************************/
+
+export default
+    angular.module('rbacUiControl', [])
+        .service('rbacUiControlService', ['$q', 'GetBasePath', 'Rest', 'Wait', function($q, GetBasePath, Rest, Wait){
+            this.canAdd = function(apiPath) {
+                var canAddVal = $q.defer();
+
+                if (apiPath.indexOf("api/v1") > -1) {
+                    Rest.setUrl(apiPath);
+                } else {
+                    Rest.setUrl(GetBasePath(apiPath));
+                }
+
+                Wait("start");
+                Rest.options()
+                    .success(function(data) {
+                        if (data.actions.POST) {
+                            canAddVal.resolve(true);
+                        } else {
+                            canAddVal.reject(false);
+                        }
+                        Wait("stop");
+                    });
+
+                return canAddVal.promise;
+            };
+        }]);