diff --git a/awx/ui/client/src/controllers/Credentials.js b/awx/ui/client/src/controllers/Credentials.js
index bc84930255..66b016dc50 100644
--- a/awx/ui/client/src/controllers/Credentials.js
+++ b/awx/ui/client/src/controllers/Credentials.js
@@ -148,7 +148,7 @@ export function CredentialsAdd($scope, $rootScope, $compile, $location, $log,
         url;
 
     $scope.keyEntered = false;
-
+    $scope.permissionsTooltip = 'Please save before assigning permissions';
     generator.inject(form, { mode: 'add', related: false, scope: $scope });
     generator.reset();
 
@@ -391,6 +391,12 @@ export function CredentialsEdit($scope, $rootScope, $compile, $location, $log,
         $scope.removeCredentialLoaded();
     }
     $scope.removeCredentialLoaded = $scope.$on('credentialLoaded', function () {
+        // if the credential is assigned to an organization, allow permission delegation
+        // do NOT use $scope.organization in a view directive to determine if a credential is associated with an org
+        $scope.disablePermissionAssignment = typeof($scope.organization) === 'number' ? false : true;
+        if ($scope.disablePermissionAssignment){
+            $scope.permissionsTooltip = 'Credentials are only shared within an organization. Assign credentials to an organization to delegate credential permissions. The organization cannot be edited after credentials are assigned.';
+        }
         var set;
         for (set in relatedSets) {
             $scope.search(relatedSets[set].iterator);
diff --git a/awx/ui/client/src/forms/Credentials.js b/awx/ui/client/src/forms/Credentials.js
index fe61186cce..d503f53905 100644
--- a/awx/ui/client/src/forms/Credentials.js
+++ b/awx/ui/client/src/forms/Credentials.js
@@ -404,7 +404,9 @@ export default
 
             related: {
                 permissions: {
-                    awToolTip: 'Please save before assigning permissions',
+                    disabled: 'disablePermissionAssignment',
+                    awToolTip: '{{permissionsTooltip}}',
+                    dataTipWatch: 'permissionsTooltip',
                     dataPlacement: 'top',
                     basePath: 'credentials/:id/access_list/',
                     type: 'collection',
@@ -452,7 +454,7 @@ export default
                 return {
                     permissions: {
                         iterator: 'permission',
-                        url: urls.access_list
+                        url: urls.access_list,
                     }
                 };
             }
diff --git a/awx/ui/client/src/shared/form-generator.js b/awx/ui/client/src/shared/form-generator.js
index ac90c89b7b..66c4f750b8 100644
--- a/awx/ui/client/src/shared/form-generator.js
+++ b/awx/ui/client/src/shared/form-generator.js
@@ -1526,8 +1526,13 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             collection = this.form.related[itm];
                             html += `<div id="${itm}_tab"`+
                                 `class="Form-tab"`+
-                                `ng-click="${this.form.related[itm].disabled} || toggleFormTabs($event)"` +
-                                `ng-class="{'is-selected': ${itm}Selected ` ;
+                                `ng-click="${this.form.related[itm].disabled} || toggleFormTabs($event)"`;
+                            if (collection.awToolTip){
+                                html += `aw-tool-tip="${collection.awToolTip}"` +
+                                `aw-tip-placement="${collection.dataPlacement}"` +
+                                `data-tip-watch="${collection.dataTipWatch}"`;
+                            }
+                            html += `ng-class="{'is-selected': ${itm}Selected ` ;
                             if(this.form.related[itm].disabled){
                                 html += `, 'Form-tab--disabled' : ${this.form.related[itm].disabled }`;
                             }