diff --git a/src/Frontend/src/App.vue b/src/Frontend/src/App.vue
index 567f2973e6..ccaa60e86a 100644
--- a/src/Frontend/src/App.vue
+++ b/src/Frontend/src/App.vue
@@ -8,20 +8,21 @@ import LicenseNotifications from "@/components/LicenseNotifications.vue";
 import BackendChecksNotifications from "@/components/BackendChecksNotifications.vue";
 import { storeToRefs } from "pinia";
 import { useAuthStore } from "@/stores/AuthStore";
-import { useUserPermissionsStore } from "@/stores/UserPermissionsStore";
-import { useEnvironmentAndVersionsStore } from "@/stores/EnvironmentAndVersionsStore";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
 
 const authStore = useAuthStore();
 const route = useRoute();
 const { isAuthenticated, authEnabled } = storeToRefs(authStore);
 
-const permissionsStore = useUserPermissionsStore();
-const environmentStore = useEnvironmentAndVersionsStore();
+// Load the allowed-route manifest (my/routes) once authenticated, so the nav and other
+// UI can gate on it. Fail-safe: a missing/old endpoint just leaves the manifest unloaded
+// and the UI fails open.
+const { fetchManifest } = useAllowedRoutes();
 watch(
-  [authEnabled, isAuthenticated, () => environmentStore.environment.supportsUserPermissions],
-  ([enabled, authenticated, supported]) => {
-    if (enabled && authenticated && supported) {
-      permissionsStore.refresh();
+  [authEnabled, isAuthenticated],
+  ([enabled, authenticated]) => {
+    if (enabled && authenticated) {
+      fetchManifest();
     }
   },
   { immediate: true }
diff --git a/src/Frontend/src/assets/main.css b/src/Frontend/src/assets/main.css
index a3bd8e2a06..47c52a772b 100644
--- a/src/Frontend/src/assets/main.css
+++ b/src/Frontend/src/assets/main.css
@@ -353,6 +353,7 @@ input.check-label {
 .btn-toolbar > .btn,
 .btn-toolbar > .btn-group,
 .btn-toolbar > .input-group,
+.btn-toolbar > .permission-gate,
 .action-btns .btn {
   margin-left: 0;
   margin-right: 5px;
diff --git a/src/Frontend/src/components/OnOffSwitch.vue b/src/Frontend/src/components/OnOffSwitch.vue
index 1042c63cd3..18aa2250d2 100644
--- a/src/Frontend/src/components/OnOffSwitch.vue
+++ b/src/Frontend/src/components/OnOffSwitch.vue
@@ -1,15 +1,19 @@
 <script setup lang="ts">
-defineProps<{
-  id: string;
-  value: boolean | null;
-}>();
+withDefaults(
+  defineProps<{
+    id: string;
+    value: boolean | null;
+    disabled?: boolean;
+  }>(),
+  { disabled: false }
+);
 
 const emit = defineEmits<{ toggle: [] }>();
 </script>
 
 <template>
-  <div class="onoffswitch">
-    <input type="checkbox" :id="`onoffswitch${id}`" :name="`onoffswitch${id}`" :aria-label="`onoffswitch${id}`" class="onoffswitch-checkbox" @click="emit('toggle')" :checked="value ?? false" />
+  <div class="onoffswitch" :class="{ disabled }">
+    <input type="checkbox" :id="`onoffswitch${id}`" :name="`onoffswitch${id}`" :aria-label="`onoffswitch${id}`" class="onoffswitch-checkbox" :disabled="disabled" @click="emit('toggle')" :checked="value ?? false" />
     <label class="onoffswitch-label" :for="`onoffswitch${id}`" role="switch" :aria-checked="value ?? false" :aria-label="id">
       <span class="onoffswitch-inner"></span>
       <span class="onoffswitch-switch"></span>
@@ -27,6 +31,13 @@ const emit = defineEmits<{ toggle: [] }>();
   width: 76px;
 }
 
+/* Disabled: dim it and let pointer events pass through to a wrapping PermissionGate so its
+   tooltip shows. The native :disabled on the checkbox already prevents toggling. */
+.onoffswitch.disabled {
+  opacity: 0.65;
+  pointer-events: none;
+}
+
 .onoffswitch-checkbox {
   display: none;
 }
diff --git a/src/Frontend/src/components/PageHeader.vue b/src/Frontend/src/components/PageHeader.vue
index b5c8102113..f465a267ca 100644
--- a/src/Frontend/src/components/PageHeader.vue
+++ b/src/Frontend/src/components/PageHeader.vue
@@ -15,7 +15,8 @@ import AuditMenuItem from "./audit/AuditMenuItem.vue";
 import monitoringClient from "@/components/monitoring/monitoringClient";
 import UserProfileMenuItem from "@/components/UserProfileMenuItem.vue";
 import { useAuthStore } from "@/stores/AuthStore";
-import usePermissionGate from "@/composables/usePermissionGate";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 import { storeToRefs } from "pinia";
 
 const isMonitoringEnabled = monitoringClient.isMonitoringEnabled;
@@ -23,22 +24,27 @@ const isMonitoringEnabled = monitoringClient.isMonitoringEnabled;
 const authStore = useAuthStore();
 const { authEnabled, isAuthenticated } = storeToRefs(authStore);
 
-const { has } = usePermissionGate();
+const { canCall, ready } = useAllowedRoutes();
 
+// Each item gates on the specific route ServiceControl enforces for that area.
+// Gate-on-ready: render nothing until permissions are known, so items never appear and
+// then disappear. canCall() fails open, so auth-disabled / failed-load shows everything.
 // prettier-ignore
-const menuItems = computed(
-  () => [
-  DashboardMenuItem,
-  ...(has("failed_messages_read") ? [HeartbeatsMenuItem] : []),
-  ...(isMonitoringEnabled && has("monitoring_read") ? [MonitoringMenuItem] : []),
-  ...(has("auditing_read") ? [AuditMenuItem] : []),
-  ...(has("failed_messages_read") ? [FailedMessagesMenuItem] : []),
-  ...(has("failed_messages_read") ? [CustomChecksMenuItem] : []),
-  ...(has("failed_messages_read") ? [EventsMenuItem] : []),
-  ...(has("admin_read") ? [ThroughputMenuItem] : []),
-  ConfigurationMenuItem,
-  FeedbackButton,
-]);
+const menuItems = computed(() => {
+  if (!ready.value) return [];
+  return [
+    DashboardMenuItem,
+    ...(canCall(ApiRoutes.viewHeartbeats) ? [HeartbeatsMenuItem] : []),
+    ...(isMonitoringEnabled && canCall(ApiRoutes.viewMonitoredEndpoints) ? [MonitoringMenuItem] : []),
+    ...(canCall(ApiRoutes.viewAuditMessages) ? [AuditMenuItem] : []),
+    ...(canCall(ApiRoutes.viewFailedMessages) ? [FailedMessagesMenuItem] : []),
+    ...(canCall(ApiRoutes.viewCustomChecks) ? [CustomChecksMenuItem] : []),
+    ...(canCall(ApiRoutes.viewEventLog) ? [EventsMenuItem] : []),
+    ...(canCall(ApiRoutes.viewThroughput) ? [ThroughputMenuItem] : []),
+    ConfigurationMenuItem,
+    FeedbackButton,
+  ];
+});
 </script>
 
 <template>
diff --git a/src/Frontend/src/components/PermissionGate.spec.ts b/src/Frontend/src/components/PermissionGate.spec.ts
new file mode 100644
index 0000000000..eb60fc7528
--- /dev/null
+++ b/src/Frontend/src/components/PermissionGate.spec.ts
@@ -0,0 +1,25 @@
+import { render } from "@testing-library/vue";
+import { describe, test, expect } from "vitest";
+import PermissionGate from "@/components/PermissionGate.vue";
+
+function mountGate(allowed: boolean) {
+  return render(PermissionGate, {
+    props: { allowed, reason: "You don't have permission" },
+    slots: { default: '<button class="btn">Do it</button>' },
+    global: { directives: { tippy: () => {} } },
+  });
+}
+
+describe("PermissionGate", () => {
+  test("renders the slot and marks the wrapper denied when not allowed", () => {
+    const { container, getByText } = mountGate(false);
+    expect(getByText("Do it")).toBeTruthy();
+    expect(container.querySelector(".permission-gate.denied")).not.toBeNull();
+  });
+
+  test("does not mark the wrapper denied when allowed", () => {
+    const { container } = mountGate(true);
+    expect(container.querySelector(".permission-gate")).not.toBeNull();
+    expect(container.querySelector(".permission-gate.denied")).toBeNull();
+  });
+});
diff --git a/src/Frontend/src/components/PermissionGate.vue b/src/Frontend/src/components/PermissionGate.vue
new file mode 100644
index 0000000000..a04ee05b9e
--- /dev/null
+++ b/src/Frontend/src/components/PermissionGate.vue
@@ -0,0 +1,45 @@
+<script setup lang="ts">
+// Wraps an action (button or link) so that, when the current user is not allowed to use it,
+// it stays visible but reads as disabled and shows a tooltip explaining why, instead of
+// silently failing server-side.
+//
+// The consumer still disables the inner control (so it gets the native disabled state and
+// any other disable conditions still apply); this wrapper adds the tooltip, lets pointer
+// events reach the wrapper so the tooltip shows even over a disabled button, and tidies the
+// disabled look of link-style buttons.
+interface Props {
+  allowed: boolean;
+  reason?: string;
+}
+withDefaults(defineProps<Props>(), { reason: "" });
+</script>
+
+<template>
+  <span class="permission-gate" :class="{ denied: !allowed }" v-tippy="!allowed ? reason : ''">
+    <slot />
+  </span>
+</template>
+
+<style scoped>
+.permission-gate {
+  display: inline-flex;
+}
+
+.permission-gate.denied {
+  cursor: not-allowed;
+}
+
+/* Let pointer events reach the wrapper so its tooltip shows even though the button is disabled. */
+.permission-gate.denied :deep(.btn) {
+  pointer-events: none;
+}
+
+/* A permission-disabled link should read as disabled: gray, without the default button box. */
+.permission-gate.denied :deep(.btn-link),
+.permission-gate.denied :deep(.btn-link .button-text) {
+  color: #6c757d;
+  opacity: 1;
+  background-color: transparent;
+  border-color: transparent;
+}
+</style>
diff --git a/src/Frontend/src/components/configuration/HealthCheckNotifications.vue b/src/Frontend/src/components/configuration/HealthCheckNotifications.vue
index cc23cd2195..a79564e7f4 100644
--- a/src/Frontend/src/components/configuration/HealthCheckNotifications.vue
+++ b/src/Frontend/src/components/configuration/HealthCheckNotifications.vue
@@ -9,12 +9,16 @@ import type UpdateEmailNotificationsSettingsRequest from "@/resources/UpdateEmai
 import OnOffSwitch from "../OnOffSwitch.vue";
 import FAIcon from "@/components/FAIcon.vue";
 import ActionButton from "@/components/ActionButton.vue";
+import PermissionGate from "@/components/PermissionGate.vue";
 import { faCheck, faEdit, faEnvelope, faExclamationTriangle } from "@fortawesome/free-solid-svg-icons";
 import { useHealthChecksStore } from "@/stores/HealthChecksStore";
 import { storeToRefs } from "pinia";
 
 const healthChecksStore = useHealthChecksStore();
-const { emailNotifications } = storeToRefs(healthChecksStore);
+const { emailNotifications, canManageNotifications, canTestNotifications } = storeToRefs(healthChecksStore);
+
+const manageDeniedTooltip = "You don't have permission to manage notifications.";
+const testDeniedTooltip = "You don't have permission to send test notifications.";
 
 const emailTestSuccessful = ref<boolean | null>(null);
 const emailTestInProgress = ref<boolean | null>(null);
@@ -77,7 +81,9 @@ onMounted(async () => {
                 <div class="col-12 no-side-padding">
                   <div class="row">
                     <div class="col-auto">
-                      <OnOffSwitch id="emailNotifications" @toggle="toggleEmailNotifications" :value="emailNotifications.enabled" />
+                      <PermissionGate :allowed="canManageNotifications" :reason="manageDeniedTooltip">
+                        <OnOffSwitch id="emailNotifications" @toggle="toggleEmailNotifications" :value="emailNotifications.enabled" :disabled="!canManageNotifications" />
+                      </PermissionGate>
                       <div>
                         <span class="connection-test connection-failed">
                           <template v-if="emailToggleSuccessful === false"> <FAIcon :icon="faExclamationTriangle" /> Update failed </template>
@@ -89,10 +95,14 @@ onMounted(async () => {
                         <div class="col-12">
                           <p class="lead">Email notifications</p>
                           <p class="endpoint-metadata">
-                            <ActionButton variant="link" size="sm" :icon="faEdit" @click="editEmailNotifications">Configure</ActionButton>
+                            <PermissionGate :allowed="canManageNotifications" :reason="manageDeniedTooltip">
+                              <ActionButton variant="link" size="sm" :icon="faEdit" :disabled="!canManageNotifications" @click="editEmailNotifications">Configure</ActionButton>
+                            </PermissionGate>
                           </p>
                           <p class="endpoint-metadata">
-                            <ActionButton variant="link" size="sm" :icon="faEnvelope" @click="testEmailNotifications" :disabled="!!emailTestInProgress">Send test notification</ActionButton>
+                            <PermissionGate :allowed="canTestNotifications" :reason="testDeniedTooltip">
+                              <ActionButton variant="link" size="sm" :icon="faEnvelope" :disabled="!!emailTestInProgress || !canTestNotifications" @click="testEmailNotifications">Send test notification</ActionButton>
+                            </PermissionGate>
                             <span class="connection-test connection-testing">
                               <template v-if="emailTestInProgress">
                                 <i class="glyphicon glyphicon-refresh rotate"></i>
diff --git a/src/Frontend/src/components/configuration/RetryRedirects.vue b/src/Frontend/src/components/configuration/RetryRedirects.vue
index 4904439aad..b657f12fe8 100644
--- a/src/Frontend/src/components/configuration/RetryRedirects.vue
+++ b/src/Frontend/src/components/configuration/RetryRedirects.vue
@@ -11,11 +11,16 @@ import type Redirect from "@/resources/Redirect";
 import RetryRedirectEdit, { type RetryRedirect } from "@/components/configuration/RetryRedirectEdit.vue";
 import FAIcon from "@/components/FAIcon.vue";
 import ActionButton from "@/components/ActionButton.vue";
+import PermissionGate from "@/components/PermissionGate.vue";
 import { faClock } from "@fortawesome/free-regular-svg-icons";
 import { useRedirectsStore } from "@/stores/RedirectsStore";
 import LoadingSpinner from "../LoadingSpinner.vue";
+import { storeToRefs } from "pinia";
 
 const redirectsStore = useRedirectsStore();
+const { canManageRedirects } = storeToRefs(redirectsStore);
+// Creating, modifying and ending redirects all manage redirects.
+const redirectsDeniedTooltip = "You don't have permission to manage redirects.";
 
 const loadingData = ref(true);
 const redirects = redirectsStore.redirects;
@@ -131,7 +136,9 @@ onMounted(async () => {
           <div class="row">
             <div class="col-sm-12">
               <div class="btn-toolbar">
-                <ActionButton @click="createRedirect"><i class="fa pa-redirect-source pa-redirect-small"></i> Create Redirect</ActionButton>
+                <PermissionGate :allowed="canManageRedirects" :reason="redirectsDeniedTooltip">
+                  <ActionButton @click="createRedirect" :disabled="!canManageRedirects"><i class="fa pa-redirect-source pa-redirect-small"></i> Create Redirect</ActionButton>
+                </PermissionGate>
                 <span></span>
               </div>
             </div>
@@ -163,8 +170,12 @@ onMounted(async () => {
                     <div class="row">
                       <div class="col-sm-12">
                         <p class="small">
-                          <ActionButton variant="link" size="sm" @click="deleteRedirect(redirect)">End Redirect</ActionButton>
-                          <ActionButton variant="link" size="sm" @click="editRedirect(redirect)">Modify Redirect</ActionButton>
+                          <PermissionGate :allowed="canManageRedirects" :reason="redirectsDeniedTooltip">
+                            <ActionButton variant="link" size="sm" :disabled="!canManageRedirects" @click="deleteRedirect(redirect)">End Redirect</ActionButton>
+                          </PermissionGate>
+                          <PermissionGate :allowed="canManageRedirects" :reason="redirectsDeniedTooltip">
+                            <ActionButton variant="link" size="sm" :disabled="!canManageRedirects" @click="editRedirect(redirect)">Modify Redirect</ActionButton>
+                          </PermissionGate>
                         </p>
                       </div>
                     </div>
diff --git a/src/Frontend/src/components/configuration/UserPermissions.vue b/src/Frontend/src/components/configuration/UserPermissions.vue
index 973b7b1cc2..ae81d37396 100644
--- a/src/Frontend/src/components/configuration/UserPermissions.vue
+++ b/src/Frontend/src/components/configuration/UserPermissions.vue
@@ -1,116 +1,188 @@
+<script lang="ts">
+import { ApiRoutes } from "@/composables/apiRoutes";
+
+// Static capability groupings: each area lists the API routes the user may or may not be able to call.
+// Permissions are derived at render time from canCall — no permission strings are involved.
+// Defined at module scope (outside setup) so it is shared across component instances.
+export const groups = [
+  {
+    area: "Failed messages",
+    caps: [
+      { label: "View", ref: ApiRoutes.viewFailedMessages },
+      { label: "Retry", ref: ApiRoutes.retryMessage },
+      { label: "Edit", ref: ApiRoutes.editMessage },
+      { label: "Delete", ref: ApiRoutes.deleteMessage },
+      { label: "Restore", ref: ApiRoutes.restoreMessage },
+    ],
+  },
+  {
+    area: "Recoverability groups",
+    caps: [
+      { label: "Retry group", ref: ApiRoutes.retryGroup },
+      { label: "Delete group", ref: ApiRoutes.deleteGroup },
+      { label: "Restore group", ref: ApiRoutes.restoreGroup },
+    ],
+  },
+  {
+    area: "Audit",
+    caps: [{ label: "View", ref: ApiRoutes.viewAuditMessages }],
+  },
+  {
+    area: "Monitoring",
+    caps: [
+      { label: "View", ref: ApiRoutes.viewMonitoredEndpoints },
+      { label: "Remove endpoint", ref: ApiRoutes.deleteMonitoredEndpoint },
+    ],
+  },
+  {
+    area: "Custom checks",
+    caps: [
+      { label: "View", ref: ApiRoutes.viewCustomChecks },
+      { label: "Dismiss", ref: ApiRoutes.dismissCustomCheck },
+    ],
+  },
+  {
+    area: "Event log",
+    caps: [{ label: "View", ref: ApiRoutes.viewEventLog }],
+  },
+  {
+    area: "Configuration — License",
+    caps: [{ label: "View", ref: ApiRoutes.viewLicense }],
+  },
+  {
+    area: "Configuration — Connections",
+    caps: [{ label: "View", ref: ApiRoutes.viewConnections }],
+  },
+  {
+    area: "Configuration — Notifications",
+    caps: [
+      { label: "View", ref: ApiRoutes.viewNotifications },
+      { label: "Manage", ref: ApiRoutes.manageNotifications },
+      { label: "Test", ref: ApiRoutes.testNotifications },
+    ],
+  },
+  {
+    area: "Configuration — Redirects",
+    caps: [
+      { label: "View", ref: ApiRoutes.viewRedirects },
+      { label: "Manage", ref: ApiRoutes.manageRedirects },
+    ],
+  },
+  {
+    area: "Configuration — Endpoints",
+    caps: [
+      { label: "View", ref: ApiRoutes.viewEndpoints },
+      { label: "View heartbeats", ref: ApiRoutes.viewHeartbeats },
+      { label: "Remove instance", ref: ApiRoutes.deleteEndpointInstance },
+    ],
+  },
+  {
+    area: "Configuration — Throughput",
+    caps: [
+      { label: "View", ref: ApiRoutes.viewThroughput },
+      { label: "Manage", ref: ApiRoutes.manageThroughput },
+    ],
+  },
+];
+</script>
+
 <script setup lang="ts">
-import { onMounted } from "vue";
-import { faCheck, faTimes } from "@fortawesome/free-solid-svg-icons";
+import { computed } from "vue";
+import { faCheck, faXmark } from "@fortawesome/free-solid-svg-icons";
 import FAIcon from "@/components/FAIcon.vue";
-import LoadingSpinner from "@/components/LoadingSpinner.vue";
-import { useUserPermissionsStore } from "@/stores/UserPermissionsStore";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
 
-const store = useUserPermissionsStore();
+const { canCall } = useAllowedRoutes();
 
-onMounted(async () => {
-  await store.refresh();
-});
+const rows = computed(() =>
+  groups.map((g) => ({
+    area: g.area,
+    caps: g.caps.map((c) => ({ label: c.label, granted: canCall(c.ref) })),
+  }))
+);
 </script>
 
 <template>
   <section name="user-permissions">
     <div class="box">
-      <LoadingSpinner v-if="store.loading" />
-      <div v-else-if="store.error" class="alert alert-danger">{{ store.error }}</div>
-      <template v-else-if="store.summary && store.descriptor">
-        <div class="row">
-          <div class="col-12">
-            <h3>Permissions Summary</h3>
-            <table class="table permissions-table">
-              <thead>
-                <tr>
-                  <th>Area</th>
-                  <th class="text-center">Read</th>
-                  <th class="text-center">Write</th>
-                </tr>
-              </thead>
-              <tbody>
-                <tr>
-                  <td>Failed Messages</td>
-                  <td class="text-center">
-                    <FAIcon :icon="store.summary.failed_messages_read ? faCheck : faTimes" :class="store.summary.failed_messages_read ? 'text-success' : 'text-danger'" />
-                  </td>
-                  <td class="text-center">
-                    <FAIcon :icon="store.summary.failed_messages_write ? faCheck : faTimes" :class="store.summary.failed_messages_write ? 'text-success' : 'text-danger'" />
-                  </td>
-                </tr>
-                <tr>
-                  <td>Auditing</td>
-                  <td class="text-center">
-                    <FAIcon :icon="store.summary.auditing_read ? faCheck : faTimes" :class="store.summary.auditing_read ? 'text-success' : 'text-danger'" />
-                  </td>
-                  <td class="text-center">—</td>
-                </tr>
-                <tr>
-                  <td>Monitoring</td>
-                  <td class="text-center">
-                    <FAIcon :icon="store.summary.monitoring_read ? faCheck : faTimes" :class="store.summary.monitoring_read ? 'text-success' : 'text-danger'" />
-                  </td>
-                  <td class="text-center">
-                    <FAIcon :icon="store.summary.monitoring_write ? faCheck : faTimes" :class="store.summary.monitoring_write ? 'text-success' : 'text-danger'" />
-                  </td>
-                </tr>
-                <tr>
-                  <td>Admin</td>
-                  <td class="text-center">
-                    <FAIcon :icon="store.summary.admin_read ? faCheck : faTimes" :class="store.summary.admin_read ? 'text-success' : 'text-danger'" />
-                  </td>
-                  <td class="text-center">
-                    <FAIcon :icon="store.summary.admin_write ? faCheck : faTimes" :class="store.summary.admin_write ? 'text-success' : 'text-danger'" />
-                  </td>
-                </tr>
-              </tbody>
-            </table>
-          </div>
-        </div>
-        <div class="row">
-          <div class="col-12">
-            <h3>All Permissions</h3>
-            <p class="user-label">User: {{ store.descriptor.user }}</p>
-            <ul class="permissions-list">
-              <li v-for="permission in store.descriptor.permissions" :key="permission">{{ permission }}</li>
-            </ul>
-          </div>
-        </div>
-      </template>
+      <h3>Your permissions</h3>
+
+      <table class="permissions-table">
+        <thead>
+          <tr>
+            <th scope="col" class="area-col">Area</th>
+            <th scope="col" class="cap-col">Capability</th>
+            <th scope="col" class="status-col">Allowed</th>
+          </tr>
+        </thead>
+        <tbody>
+          <template v-for="row in rows" :key="row.area">
+            <tr v-for="(cap, idx) in row.caps" :key="cap.label" class="cap-row">
+              <td v-if="idx === 0" :rowspan="row.caps.length" class="area-col area-cell">{{ row.area }}</td>
+              <td class="cap-col">{{ cap.label }}</td>
+              <td class="status-col">
+                <FAIcon v-if="cap.granted" :icon="faCheck" class="check" aria-label="Allowed" />
+                <FAIcon v-else :icon="faXmark" class="deny" aria-label="Not allowed" />
+              </td>
+            </tr>
+          </template>
+        </tbody>
+      </table>
     </div>
   </section>
 </template>
 
 <style scoped>
 .permissions-table {
-  max-width: 480px;
+  border-collapse: collapse;
+  table-layout: fixed;
+  width: auto;
+}
+
+.area-col {
+  width: 260px;
+}
+
+.cap-col {
+  width: 200px;
+}
+
+.status-col {
+  width: 90px;
+  text-align: center;
 }
 
 .permissions-table th,
 .permissions-table td {
-  padding: 10px 16px;
+  padding: 8px 12px;
+  font-size: 14px;
+  border-bottom: 1px solid #f0f0f0;
 }
 
-.user-label {
-  color: #666;
-  margin-bottom: 12px;
+.permissions-table thead th {
+  font-weight: 600;
+  color: #6c757d;
+  border-bottom: 2px solid #e9ecef;
+  white-space: nowrap;
+  text-align: left;
 }
 
-.permissions-list {
-  list-style: none;
-  padding: 0;
-  margin: 0;
-  font-family: monospace;
-  font-size: 13px;
+.permissions-table thead th.status-col {
+  text-align: center;
 }
 
-.permissions-list li {
-  padding: 4px 0;
-  border-bottom: 1px solid #f0f0f0;
+.area-cell {
+  font-weight: 600;
+  color: #2a2a2a;
+  vertical-align: top;
+  padding-top: 10px;
+}
+
+.check {
+  color: #28a745;
 }
 
-.permissions-list li:last-child {
-  border-bottom: none;
+.deny {
+  color: #dc3545;
 }
 </style>
diff --git a/src/Frontend/src/components/customchecks/CustomCheckView.vue b/src/Frontend/src/components/customchecks/CustomCheckView.vue
index e59f0acfda..0385768233 100644
--- a/src/Frontend/src/components/customchecks/CustomCheckView.vue
+++ b/src/Frontend/src/components/customchecks/CustomCheckView.vue
@@ -1,16 +1,24 @@
 <script setup lang="ts">
+import { computed } from "vue";
 import type CustomCheck from "@/resources/CustomCheck";
 import TimeSince from "@/components/TimeSince.vue";
 import FAIcon from "@/components/FAIcon.vue";
+import PermissionGate from "@/components/PermissionGate.vue";
 import { faCheck, faList, faServer } from "@fortawesome/free-solid-svg-icons";
 import { faClock } from "@fortawesome/free-regular-svg-icons";
 import { hexToCSSFilter } from "hex-to-css-filter";
 import useCustomChecksStoreAutoRefresh from "@/composables/useCustomChecksStoreAutoRefresh";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
-defineProps<{ customCheck: CustomCheck }>();
+const props = defineProps<{ customCheck: CustomCheck }>();
 
 const { store } = useCustomChecksStoreAutoRefresh();
 const endpointColor = hexToCSSFilter("#929E9E").filter;
+
+const { canCall } = useAllowedRoutes();
+const canDismiss = computed(() => canCall(ApiRoutes.dismissCustomCheck, props.customCheck));
+const dismissDeniedTooltip = "You don't have permission to dismiss custom checks.";
 </script>
 
 <template>
@@ -36,7 +44,11 @@ const endpointColor = hexToCSSFilter("#929E9E").filter;
           </div>
         </div>
         <div>
-          <button type="button" class="btn btn-default" title="Dismiss this custom check so it doesn't show up as an alert" role="button" aria-label="custom-check-dismiss" @click="store.dismissCustomCheck(customCheck.id)">Dismiss</button>
+          <PermissionGate :allowed="canDismiss" :reason="dismissDeniedTooltip">
+            <button type="button" class="btn btn-default" title="Dismiss this custom check so it doesn't show up as an alert" role="button" aria-label="custom-check-dismiss" :disabled="!canDismiss" @click="store.dismissCustomCheck(customCheck.id)">
+              Dismiss
+            </button>
+          </PermissionGate>
         </div>
       </div>
     </div>
diff --git a/src/Frontend/src/components/failedmessages/DeletedMessageGroups.vue b/src/Frontend/src/components/failedmessages/DeletedMessageGroups.vue
index 39bc372591..4d0a313558 100644
--- a/src/Frontend/src/components/failedmessages/DeletedMessageGroups.vue
+++ b/src/Frontend/src/components/failedmessages/DeletedMessageGroups.vue
@@ -11,6 +11,9 @@ import routeLinks from "@/router/routeLinks";
 import { TYPE } from "vue-toastification";
 import MetadataItem from "@/components/MetadataItem.vue";
 import ActionButton from "@/components/ActionButton.vue";
+import PermissionGate from "@/components/PermissionGate.vue";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 import { faArrowRotateRight, faEnvelope } from "@fortawesome/free-solid-svg-icons";
 import { faClock } from "@fortawesome/free-regular-svg-icons";
 import { useDeletedMessageGroupsStore, statusesForRestoreOperation, type ExtendedFailureGroupView, type Status } from "@/stores/DeletedMessageGroupsStore";
@@ -25,6 +28,13 @@ const { autoRefresh, isRefreshing, updateInterval } = useStoreAutoRefresh("delet
 const { store } = autoRefresh();
 const { archiveGroups, classifiers, selectedClassifier } = storeToRefs(store);
 const router = useRouter();
+
+const { canCall } = useAllowedRoutes();
+// Restoring a deleted group is an unarchive; keep the button visible but disabled with a
+// tooltip when the user lacks the permission, instead of silently failing server-side.
+const canRestoreGroups = computed(() => canCall(ApiRoutes.restoreGroup));
+const restoreDeniedTooltip = "You don't have permission to restore message groups.";
+
 const showRestoreGroupModal = ref(false);
 const selectedGroup = ref<ExtendedFailureGroupView>();
 
@@ -163,16 +173,11 @@ watch(isRestoreInProgress, (restoreInProgress) => {
 
                             <div class="row" v-if="!isBeingRestored(group.workflow_state.status)">
                               <div class="col-sm-12 no-side-padding">
-                                <ActionButton
-                                  variant="link"
-                                  size="sm"
-                                  :icon="faArrowRotateRight"
-                                  :disabled="group.count === 0 || isBeingRestored(group.workflow_state.status)"
-                                  v-if="archiveGroups.length > 0"
-                                  @click.stop="showRestoreGroupDialog(group)"
-                                >
-                                  Restore group
-                                </ActionButton>
+                                <PermissionGate :allowed="canRestoreGroups" :reason="restoreDeniedTooltip" v-if="archiveGroups.length > 0">
+                                  <ActionButton variant="link" size="sm" :icon="faArrowRotateRight" :disabled="group.count === 0 || isBeingRestored(group.workflow_state.status) || !canRestoreGroups" @click.stop="showRestoreGroupDialog(group)">
+                                    Restore group
+                                  </ActionButton>
+                                </PermissionGate>
                               </div>
                             </div>
 
diff --git a/src/Frontend/src/components/failedmessages/DeletedMessages.vue b/src/Frontend/src/components/failedmessages/DeletedMessages.vue
index b63533a181..11bc5ae1b5 100644
--- a/src/Frontend/src/components/failedmessages/DeletedMessages.vue
+++ b/src/Frontend/src/components/failedmessages/DeletedMessages.vue
@@ -10,6 +10,9 @@ import PaginationStrip from "../../components/PaginationStrip.vue";
 import { FailedMessageStatus } from "@/resources/FailedMessage";
 import { TYPE } from "vue-toastification";
 import FAIcon from "@/components/FAIcon.vue";
+import PermissionGate from "@/components/PermissionGate.vue";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 import { faArrowRotateRight } from "@fortawesome/free-solid-svg-icons";
 import { storeToRefs } from "pinia";
 import { useStoreAutoRefresh } from "@/composables/useAutoRefresh";
@@ -27,6 +30,12 @@ const { messages, groupId, groupName, totalCount, pageNumber, selectedPeriod } =
 const showConfirmRestore = ref(false);
 const messageList = ref<IMessageList | undefined>();
 
+const { canCall } = useAllowedRoutes();
+// Restoring messages is an unarchive; keep the button visible but disabled with a tooltip
+// when the user lacks the permission, instead of silently failing server-side.
+const canRestoreMessages = computed(() => canCall(ApiRoutes.restoreMessage));
+const restoreDeniedTooltip = "You don't have permission to restore messages.";
+
 function numberSelected() {
   return messageList.value?.getSelectedMessages()?.length ?? 0;
 }
@@ -103,7 +112,11 @@ watch(isRefreshing, () => {
             <div class="btn-toolbar">
               <button type="button" class="btn btn-default select-all" @click="selectAll" v-if="!isAnythingSelected()">Select all</button>
               <button type="button" class="btn btn-default select-all" @click="deselectAll" v-if="isAnythingSelected()">Clear selection</button>
-              <button type="button" class="btn btn-default" @click="showConfirmRestore = true" :disabled="!isAnythingSelected()"><FAIcon :icon="faArrowRotateRight" class="icon" /> Restore {{ numberSelected() }} selected</button>
+              <PermissionGate :allowed="canRestoreMessages" :reason="restoreDeniedTooltip">
+                <button type="button" class="btn btn-default" @click="showConfirmRestore = true" :disabled="!isAnythingSelected() || !canRestoreMessages">
+                  <FAIcon :icon="faArrowRotateRight" class="icon" /> Restore {{ numberSelected() }} selected
+                </button>
+              </PermissionGate>
             </div>
           </div>
           <div class="col-3">
diff --git a/src/Frontend/src/components/failedmessages/FailedMessages.vue b/src/Frontend/src/components/failedmessages/FailedMessages.vue
index 54cc9e1650..1277f865b2 100644
--- a/src/Frontend/src/components/failedmessages/FailedMessages.vue
+++ b/src/Frontend/src/components/failedmessages/FailedMessages.vue
@@ -16,6 +16,9 @@ import { TYPE } from "vue-toastification";
 import type GroupOperation from "@/resources/GroupOperation";
 import { faArrowDownAZ, faArrowDownZA, faArrowDownShortWide, faArrowDownWideShort, faArrowRotateRight, faTrash, faDownload } from "@fortawesome/free-solid-svg-icons";
 import ActionButton from "@/components/ActionButton.vue";
+import PermissionGate from "@/components/PermissionGate.vue";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 import { useMessageStore } from "@/stores/MessageStore";
 import { useRecoverabilityStore } from "@/stores/RecoverabilityStore";
 import { useStoreAutoRefresh } from "@/composables/useAutoRefresh";
@@ -32,6 +35,18 @@ const { autoRefresh, isRefreshing, updateInterval } = useStoreAutoRefresh("recov
 const { store } = autoRefresh();
 const { messages, groupId, groupName, totalCount, pageNumber } = storeToRefs(store);
 
+const { canCall } = useAllowedRoutes();
+// Keep the toolbar actions visible but disabled (with a tooltip) when the user lacks the
+// permission, so the capability stays discoverable and clicks don't silently fail server-side.
+const canRetryMessages = computed(() => canCall(ApiRoutes.retryMessage));
+const canDeleteMessages = computed(() => canCall(ApiRoutes.deleteMessage));
+const canRetryGroup = computed(() => canCall(ApiRoutes.retryGroup));
+const canDeleteGroup = computed(() => canCall(ApiRoutes.deleteGroup));
+const retryDeniedTooltip = "You don't have permission to retry messages.";
+const deleteDeniedTooltip = "You don't have permission to delete messages.";
+const retryAllDeniedTooltip = "You don't have permission to retry message groups.";
+const deleteAllDeniedTooltip = "You don't have permission to delete message groups.";
+
 const showDelete = ref(false);
 const showConfirmRetryAll = ref(false);
 const showConfirmDeleteAll = ref(false);
@@ -217,11 +232,19 @@ watch(isRefreshing, () => {
             <div class="btn-toolbar">
               <ActionButton v-if="!isAnythingSelected()" @click="selectAll">Select all</ActionButton>
               <ActionButton v-if="isAnythingSelected()" @click="deselectAll">Clear selection</ActionButton>
-              <ActionButton :icon="faArrowRotateRight" @click="retrySelected()" :disabled="!isAnythingSelected()">Retry {{ numberSelected() }} selected</ActionButton>
-              <ActionButton :icon="faTrash" @click="showDelete = true" :disabled="!isAnythingSelected()">Delete {{ numberSelected() }} selected</ActionButton>
+              <PermissionGate :allowed="canRetryMessages" :reason="retryDeniedTooltip">
+                <ActionButton :icon="faArrowRotateRight" @click="retrySelected()" :disabled="!isAnythingSelected() || !canRetryMessages">Retry {{ numberSelected() }} selected</ActionButton>
+              </PermissionGate>
+              <PermissionGate :allowed="canDeleteMessages" :reason="deleteDeniedTooltip">
+                <ActionButton :icon="faTrash" @click="showDelete = true" :disabled="!isAnythingSelected() || !canDeleteMessages">Delete {{ numberSelected() }} selected</ActionButton>
+              </PermissionGate>
               <ActionButton :icon="faDownload" @click="exportSelected()" :disabled="!isAnythingSelected()">Export {{ numberSelected() }} selected</ActionButton>
-              <ActionButton v-if="groupId" :icon="faArrowRotateRight" @click="showConfirmRetryAll = true">Retry all</ActionButton>
-              <ActionButton v-if="groupId" :icon="faTrash" @click="showConfirmDeleteAll = true">Delete all</ActionButton>
+              <PermissionGate :allowed="canRetryGroup" :reason="retryAllDeniedTooltip" v-if="groupId">
+                <ActionButton :icon="faArrowRotateRight" @click="showConfirmRetryAll = true" :disabled="!canRetryGroup">Retry all</ActionButton>
+              </PermissionGate>
+              <PermissionGate :allowed="canDeleteGroup" :reason="deleteAllDeniedTooltip" v-if="groupId">
+                <ActionButton :icon="faTrash" @click="showConfirmDeleteAll = true" :disabled="!canDeleteGroup">Delete all</ActionButton>
+              </PermissionGate>
             </div>
           </div>
           <div class="col-3">
diff --git a/src/Frontend/src/components/failedmessages/MessageGroupList.vue b/src/Frontend/src/components/failedmessages/MessageGroupList.vue
index 55ee9307d6..977bbaf75b 100644
--- a/src/Frontend/src/components/failedmessages/MessageGroupList.vue
+++ b/src/Frontend/src/components/failedmessages/MessageGroupList.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { onMounted, onUnmounted, ref } from "vue";
+import { computed, onMounted, onUnmounted, ref } from "vue";
 import { useRouter } from "vue-router";
 import { useShowToast } from "../../composables/toast";
 import createMessageGroupClient from "./messageGroupClient";
@@ -15,6 +15,17 @@ import { faArrowRotateRight, faEnvelope, faEraser, faExclamationTriangle, faPenc
 import { faClock } from "@fortawesome/free-regular-svg-icons";
 import ProgressMessage from "./ProgressMessage.vue";
 import ActionButton from "@/components/ActionButton.vue";
+import PermissionGate from "@/components/PermissionGate.vue";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
+
+const { canCall } = useAllowedRoutes();
+// Group-level actions are gated on the recoverabilitygroups permissions. When the user
+// lacks them the buttons stay visible but disabled, with a tooltip explaining why.
+const canRetryGroups = computed(() => canCall(ApiRoutes.retryGroup));
+const canDeleteGroups = computed(() => canCall(ApiRoutes.deleteGroup));
+const retryDeniedTooltip = "You don't have permission to request a retry for message groups.";
+const deleteDeniedTooltip = "You don't have permission to delete message groups.";
 
 interface WorkflowState {
   status: string;
@@ -400,31 +411,33 @@ defineExpose<IMessageGroupList>({
                   </div>
                   <div class="row" v-if="!isBeingRetried(group) && !isBeingArchived(group.workflow_state.status)">
                     <div class="col-sm-12 no-side-padding">
-                      <ActionButton
-                        variant="link"
-                        size="sm"
-                        :icon="faArrowRotateRight"
-                        :disabled="group.count == 0 || isBeingRetried(group)"
-                        @mouseenter="group.hover3 = true"
-                        @mouseleave="group.hover3 = false"
-                        v-if="exceptionGroups.length > 0"
-                        @click.stop="retryGroup(group)"
-                      >
-                        <span>Request retry</span>
-                      </ActionButton>
-
-                      <ActionButton
-                        variant="link"
-                        size="sm"
-                        :icon="faTrash"
-                        :disabled="group.count == 0 || isBeingRetried(group)"
-                        @mouseenter="group.hover3 = true"
-                        @mouseleave="group.hover3 = false"
-                        v-if="exceptionGroups.length > 0"
-                        @click.stop="deleteGroup(group)"
-                      >
-                        <span>Delete group</span>
-                      </ActionButton>
+                      <PermissionGate :allowed="canRetryGroups" :reason="retryDeniedTooltip" v-if="exceptionGroups.length > 0">
+                        <ActionButton
+                          variant="link"
+                          size="sm"
+                          :icon="faArrowRotateRight"
+                          :disabled="group.count == 0 || isBeingRetried(group) || !canRetryGroups"
+                          @mouseenter="group.hover3 = true"
+                          @mouseleave="group.hover3 = false"
+                          @click.stop="retryGroup(group)"
+                        >
+                          <span>Request retry</span>
+                        </ActionButton>
+                      </PermissionGate>
+
+                      <PermissionGate :allowed="canDeleteGroups" :reason="deleteDeniedTooltip" v-if="exceptionGroups.length > 0">
+                        <ActionButton
+                          variant="link"
+                          size="sm"
+                          :icon="faTrash"
+                          :disabled="group.count == 0 || isBeingRetried(group) || !canDeleteGroups"
+                          @mouseenter="group.hover3 = true"
+                          @mouseleave="group.hover3 = false"
+                          @click.stop="deleteGroup(group)"
+                        >
+                          <span>Delete group</span>
+                        </ActionButton>
+                      </PermissionGate>
                       <ActionButton variant="link" size="sm" :icon="faStickyNote" v-if="!group.comment" @click.stop="editNote(group)">Add note</ActionButton>
                       <ActionButton variant="link" size="sm" :icon="faPencil" v-if="group.comment" @click.stop="editNote(group)">Edit note</ActionButton>
                       <ActionButton variant="link" size="sm" :icon="faEraser" v-if="group.comment" @click.stop="deleteNote(group)">Remove note</ActionButton>
diff --git a/src/Frontend/src/components/failedmessages/messageGroupButtonPermissions.spec.ts b/src/Frontend/src/components/failedmessages/messageGroupButtonPermissions.spec.ts
new file mode 100644
index 0000000000..55f02bcfaa
--- /dev/null
+++ b/src/Frontend/src/components/failedmessages/messageGroupButtonPermissions.spec.ts
@@ -0,0 +1,105 @@
+import { describe, test, expect, beforeEach, vi } from "vitest";
+import { render, screen } from "@testing-library/vue";
+import { createTestingPinia } from "@pinia/testing";
+import { defineComponent, h, nextTick, ref } from "vue";
+import { createRouter, createMemoryHistory } from "vue-router";
+import type GroupOperation from "@/resources/GroupOperation";
+import MessageGroupList, { type IMessageGroupList } from "@/components/failedmessages/MessageGroupList.vue";
+import type { ManifestEntry } from "@/stores/AllowedRoutesStore";
+import { ApiRoutes } from "@/composables/apiRoutes";
+import { normalizeRouteKey } from "@/composables/routeMatching";
+
+// The group-level Retry/Delete actions are gated on the recoverabilitygroups allowed routes.
+// Unlike the per-message buttons (which hide), these stay VISIBLE but DISABLED when the
+// route is missing, with a tooltip explaining why, so it's clear the action exists.
+const RETRY_ROUTE_KEY = normalizeRouteKey(ApiRoutes.retryGroup.method, ApiRoutes.retryGroup.path);
+const DELETE_ROUTE_KEY = normalizeRouteKey(ApiRoutes.deleteGroup.method, ApiRoutes.deleteGroup.path);
+
+const group: GroupOperation = {
+  id: "group-1",
+  title: "SomeException",
+  type: "exception-type",
+  count: 2,
+  comment: "",
+  operation_status: "None",
+  operation_progress: 0,
+  need_user_acknowledgement: false,
+};
+
+vi.mock("@/components/failedmessages/messageGroupClient", () => ({
+  default: () => ({
+    getExceptionGroups: vi.fn().mockResolvedValue([group]),
+    isError: () => false,
+  }),
+}));
+
+function makeRoutes(keys: string[]): Map<string, ManifestEntry> {
+  return new Map(keys.map((k) => [k, { method: "", url_template: "" }]));
+}
+
+async function renderGroupList(allowedRouteKeys: string[]) {
+  const listRef = ref<IMessageGroupList>();
+
+  const Harness = defineComponent({
+    setup() {
+      return () => h(MessageGroupList, { ref: listRef, sortFunction: () => 0 });
+    },
+  });
+
+  const router = createRouter({ history: createMemoryHistory(), routes: [{ path: "/:catchAll(.*)", component: { template: "<div />" } }] });
+
+  render(Harness, {
+    global: {
+      plugins: [
+        router,
+        createTestingPinia({
+          stubActions: true,
+          initialState: {
+            auth: { authEnabled: true, isAuthenticated: true },
+            AllowedRoutesStore: { routes: makeRoutes(allowedRouteKeys), loaded: true, loadAttempted: true },
+          },
+        }),
+      ],
+      directives: { tippy: () => {} },
+    },
+  });
+
+  await nextTick();
+  await listRef.value?.loadFailedMessageGroups();
+  await nextTick();
+}
+
+function button(text: RegExp): HTMLButtonElement | null {
+  return screen.queryByText(text)?.closest("button") ?? null;
+}
+
+describe("failed-message group action button permissions", () => {
+  beforeEach(() => {
+    // Teleport target used by the confirm dialogs the list renders.
+    document.body.innerHTML = '<div id="modalDisplay"></div>';
+  });
+
+  test("Request retry is enabled when its route is allowed", async () => {
+    await renderGroupList([RETRY_ROUTE_KEY, DELETE_ROUTE_KEY]);
+    expect(button(/Request retry/i)?.disabled).toBe(false);
+  });
+
+  test("Request retry stays visible but disabled when its route is not allowed", async () => {
+    await renderGroupList([DELETE_ROUTE_KEY]);
+    const retry = button(/Request retry/i);
+    expect(retry).not.toBeNull();
+    expect(retry?.disabled).toBe(true);
+  });
+
+  test("Delete group is enabled when its route is allowed", async () => {
+    await renderGroupList([RETRY_ROUTE_KEY, DELETE_ROUTE_KEY]);
+    expect(button(/Delete group/i)?.disabled).toBe(false);
+  });
+
+  test("Delete group stays visible but disabled when its route is not allowed", async () => {
+    await renderGroupList([RETRY_ROUTE_KEY]);
+    const del = button(/Delete group/i);
+    expect(del).not.toBeNull();
+    expect(del?.disabled).toBe(true);
+  });
+});
diff --git a/src/Frontend/src/components/heartbeats/EndpointInstances.vue b/src/Frontend/src/components/heartbeats/EndpointInstances.vue
index 8fea77c1ab..421b64af1a 100644
--- a/src/Frontend/src/components/heartbeats/EndpointInstances.vue
+++ b/src/Frontend/src/components/heartbeats/EndpointInstances.vue
@@ -19,6 +19,7 @@ import FilterInput from "../FilterInput.vue";
 import ResultsCount from "../ResultsCount.vue";
 import { faBell, faBellSlash, faChevronLeft, faHeartbeat, faTrash } from "@fortawesome/free-solid-svg-icons";
 import FAIcon from "@/components/FAIcon.vue";
+import PermissionGate from "@/components/PermissionGate.vue";
 import useHeartbeatInstancesStoreAutoRefresh from "@/composables/useHeartbeatInstancesStoreAutoRefresh";
 import { useEndpointSettingsStore } from "@/stores/EndpointSettingsStore";
 
@@ -29,9 +30,11 @@ enum Operation {
 
 const route = useRoute();
 const router = useRouter();
+
+const deleteDeniedTooltip = "You don't have permission to delete endpoints.";
 const endpointName = route.params.endpointName.toString();
 const { store } = useHeartbeatInstancesStoreAutoRefresh();
-const { filteredInstances, sortedInstances, instanceFilterString, sortByInstances } = storeToRefs(store);
+const { filteredInstances, sortedInstances, instanceFilterString, sortByInstances, canDeleteEndpointInstance } = storeToRefs(store);
 const endpointSettingsStore = useEndpointSettingsStore();
 const endpointSettings = ref<EndpointSettings[]>([endpointSettingsStore.defaultEndpointSettingsValue]);
 
@@ -170,7 +173,9 @@ async function toggleAlerts(instance: EndpointsView) {
       <no-data v-if="filteredValidInstances.length === 0" message="No endpoint instances found. For untracked endpoints, disconnected instances are automatically pruned.">
         <div class="delete-all">
           <span>You may</span>
-          <button type="button" @click="deleteAllInstances()" class="btn btn-danger btn-sm"><FAIcon :icon="faTrash" class="icon text-white" /> Delete</button>
+          <PermissionGate :allowed="canDeleteEndpointInstance" :reason="deleteDeniedTooltip">
+            <button type="button" @click="deleteAllInstances()" class="btn btn-danger btn-sm" :disabled="!canDeleteEndpointInstance"><FAIcon :icon="faTrash" class="icon text-white" /> Delete</button>
+          </PermissionGate>
           <span>this endpoint</span>
         </div>
       </no-data>
@@ -195,7 +200,9 @@ async function toggleAlerts(instance: EndpointsView) {
                 </div>
               </div>
               <div role="cell" aria-label="actions" class="col-1 actions">
-                <button v-if="instance.heartbeat_information?.reported_status !== EndpointStatus.Alive" type="button" @click="deleteInstance(instance)" class="btn btn-danger btn-sm"><FAIcon :icon="faTrash" class="icon text-white" /> Delete</button>
+                <PermissionGate v-if="instance.heartbeat_information?.reported_status !== EndpointStatus.Alive" :allowed="canDeleteEndpointInstance" :reason="deleteDeniedTooltip">
+                  <button type="button" @click="deleteInstance(instance)" class="btn btn-danger btn-sm" :disabled="!canDeleteEndpointInstance"><FAIcon :icon="faTrash" class="icon text-white" /> Delete</button>
+                </PermissionGate>
               </div>
             </div>
           </div>
diff --git a/src/Frontend/src/components/messages/DeleteMessageButton.vue b/src/Frontend/src/components/messages/DeleteMessageButton.vue
index 033d39ba1d..1dc9830c1e 100644
--- a/src/Frontend/src/components/messages/DeleteMessageButton.vue
+++ b/src/Frontend/src/components/messages/DeleteMessageButton.vue
@@ -11,12 +11,12 @@ import { FailedMessageStatus } from "@/resources/FailedMessage";
 import { faTrash } from "@fortawesome/free-solid-svg-icons";
 
 const store = useMessageStore();
-const { state } = storeToRefs(store);
+const { state, canDelete } = storeToRefs(store);
 const isConfirmDialogVisible = ref(false);
 
 const failureStatus = computed(() => state.value.data.failure_status);
 const isDisabled = computed(() => failureStatus.value.retried || failureStatus.value.resolved);
-const isVisible = computed(() => !failureStatus.value.archived && state.value.data.status !== MessageStatus.Successful && state.value.data.status !== MessageStatus.ResolvedSuccessfully);
+const isVisible = computed(() => canDelete.value && !failureStatus.value.archived && state.value.data.status !== MessageStatus.Successful && state.value.data.status !== MessageStatus.ResolvedSuccessfully);
 
 const handleConfirm = async () => {
   isConfirmDialogVisible.value = false;
diff --git a/src/Frontend/src/components/messages/EditAndRetryButton.vue b/src/Frontend/src/components/messages/EditAndRetryButton.vue
index 4976aedf4f..54ac1c653a 100644
--- a/src/Frontend/src/components/messages/EditAndRetryButton.vue
+++ b/src/Frontend/src/components/messages/EditAndRetryButton.vue
@@ -10,12 +10,18 @@ import { MessageStatus } from "@/resources/Message";
 import { storeToRefs } from "pinia";
 import { FailedMessageStatus } from "@/resources/FailedMessage";
 import { faPencil } from "@fortawesome/free-solid-svg-icons";
+import PermissionGate from "@/components/PermissionGate.vue";
 
 const store = useMessageStore();
-const { state, edit_and_retry_config, editRetryResponse } = storeToRefs(store);
+const { state, edit_and_retry_config, editRetryResponse, canEdit } = storeToRefs(store);
 const isConfirmDialogVisible = ref(false);
 const isEditIgnoredDialogVisible = ref(false);
 
+// Edit & retry is enabled by a ServiceControl setting (edit_and_retry_config). When it is on,
+// the button is shown to everyone but disabled (with a tooltip) for users without the edit
+// permission, rather than hidden.
+const editDeniedTooltip = "You don't have permission to edit and retry messages.";
+
 const failureStatus = computed(() => state.value.data.failure_status);
 const isDisabled = computed(() => failureStatus.value.retried || failureStatus.value.archived || failureStatus.value.resolved);
 const isVisible = computed(() => edit_and_retry_config.value.enabled && state.value.data.status !== MessageStatus.Successful && state.value.data.status !== MessageStatus.ResolvedSuccessfully);
@@ -45,7 +51,9 @@ async function openDialog() {
 
 <template>
   <template v-if="isVisible">
-    <ActionButton :icon="faPencil" aria-label="Edit & retry" :disabled="isDisabled" @click="openDialog">Edit & retry</ActionButton>
+    <PermissionGate :allowed="canEdit" :reason="editDeniedTooltip">
+      <ActionButton :icon="faPencil" aria-label="Edit & retry" :disabled="isDisabled || !canEdit" @click="openDialog">Edit & retry</ActionButton>
+    </PermissionGate>
     <Teleport to="#modalDisplay">
       <EditRetryDialog v-if="isConfirmDialogVisible" @cancel="isConfirmDialogVisible = false" @confirm="handleConfirm"></EditRetryDialog>
       <EditIgnoredDialog v-if="isEditIgnoredDialogVisible" @close="handleIgnoreClose"></EditIgnoredDialog>
diff --git a/src/Frontend/src/components/messages/RestoreMessageButton.vue b/src/Frontend/src/components/messages/RestoreMessageButton.vue
index 5390b3f822..407098b863 100644
--- a/src/Frontend/src/components/messages/RestoreMessageButton.vue
+++ b/src/Frontend/src/components/messages/RestoreMessageButton.vue
@@ -10,10 +10,10 @@ import { FailedMessageStatus } from "@/resources/FailedMessage";
 import { faUndo } from "@fortawesome/free-solid-svg-icons";
 
 const store = useMessageStore();
-const { state } = storeToRefs(store);
+const { state, canRestore } = storeToRefs(store);
 const isConfirmDialogVisible = ref(false);
 
-const isVisible = computed(() => state.value.data.failure_status.archived);
+const isVisible = computed(() => canRestore.value && state.value.data.failure_status.archived);
 
 const handleConfirm = async () => {
   isConfirmDialogVisible.value = false;
diff --git a/src/Frontend/src/components/messages/RetryMessageButton.vue b/src/Frontend/src/components/messages/RetryMessageButton.vue
index b670a89084..534bf45154 100644
--- a/src/Frontend/src/components/messages/RetryMessageButton.vue
+++ b/src/Frontend/src/components/messages/RetryMessageButton.vue
@@ -11,12 +11,12 @@ import { FailedMessageStatus } from "@/resources/FailedMessage";
 import { faRefresh } from "@fortawesome/free-solid-svg-icons";
 
 const store = useMessageStore();
-const { state } = storeToRefs(store);
+const { state, canRetry } = storeToRefs(store);
 const isConfirmDialogVisible = ref(false);
 
 const failureStatus = computed(() => state.value.data.failure_status);
 const isDisabled = computed(() => failureStatus.value.retried || failureStatus.value.archived || failureStatus.value.resolved);
-const isVisible = computed(() => state.value.data.status !== MessageStatus.Successful && state.value.data.status !== MessageStatus.ResolvedSuccessfully);
+const isVisible = computed(() => canRetry.value && state.value.data.status !== MessageStatus.Successful && state.value.data.status !== MessageStatus.ResolvedSuccessfully);
 
 const handleConfirm = async () => {
   isConfirmDialogVisible.value = false;
diff --git a/src/Frontend/src/components/messages/messageButtonPermissions.spec.ts b/src/Frontend/src/components/messages/messageButtonPermissions.spec.ts
new file mode 100644
index 0000000000..26c3fa0171
--- /dev/null
+++ b/src/Frontend/src/components/messages/messageButtonPermissions.spec.ts
@@ -0,0 +1,84 @@
+import { render, screen } from "@testing-library/vue";
+import { describe, test, expect, beforeEach } from "vitest";
+import { createTestingPinia } from "@pinia/testing";
+import type { Component } from "vue";
+import { MessageStatus } from "@/resources/Message";
+import RetryMessageButton from "@/components/messages/RetryMessageButton.vue";
+import EditAndRetryButton from "@/components/messages/EditAndRetryButton.vue";
+import DeleteMessageButton from "@/components/messages/DeleteMessageButton.vue";
+import RestoreMessageButton from "@/components/messages/RestoreMessageButton.vue";
+import type { ManifestEntry } from "@/stores/AllowedRoutesStore";
+
+// Each failed-message action button is gated on its own ServiceControl route. These
+// tests pin the per-action gating: with auth enabled + the manifest loaded, the button
+// shows only when the matching route is in the allowed set.
+interface ButtonCase {
+  name: string;
+  component: Component;
+  routeKey: string; // normalized route key in AllowedRoutesStore
+  text: RegExp;
+  archived: boolean; // Restore is only relevant on an archived message; the others on a live one
+}
+
+// Retry / Delete / Restore are hidden when the route is not allowed. Edit & retry is handled
+// separately below: it is enabled by a setting and, when on, disabled (not hidden) without
+// the permission.
+const cases: ButtonCase[] = [
+  { name: "Retry", component: RetryMessageButton, routeKey: "POST /api/errors/retry", text: /Retry message/i, archived: false },
+  { name: "Delete", component: DeleteMessageButton, routeKey: "PATCH /api/errors/archive", text: /Delete message/i, archived: false },
+  { name: "Restore", component: RestoreMessageButton, routeKey: "PATCH /api/errors/unarchive", text: /Restore/i, archived: true },
+];
+
+function makeRoutes(keys: string[]): Map<string, ManifestEntry> {
+  return new Map(keys.map((k) => [k, { method: "", url_template: "" }]));
+}
+
+function renderButton(component: Component, allowedRouteKeys: string[], archived: boolean) {
+  render(component, {
+    global: {
+      plugins: [
+        createTestingPinia({
+          stubActions: true,
+          initialState: {
+            auth: { authEnabled: true, isAuthenticated: true },
+            AllowedRoutesStore: { routes: makeRoutes(allowedRouteKeys), loaded: true, loadAttempted: true },
+            MessageStore: {
+              state: { data: { id: "msg-1", status: MessageStatus.Failed, failure_status: { archived } } },
+              edit_and_retry_config: { enabled: true, locked_headers: [], sensitive_headers: [] },
+            },
+          },
+        }),
+      ],
+      directives: { tippy: () => {} },
+    },
+  });
+}
+
+describe("failed-message action button permissions", () => {
+  beforeEach(() => {
+    // Teleport target used by the confirm dialogs the buttons render.
+    document.body.innerHTML = '<div id="modalDisplay"></div>';
+  });
+
+  test.each(cases)("$name is shown when its route is allowed", ({ component, routeKey, text, archived }) => {
+    renderButton(component, [routeKey], archived);
+    expect(screen.queryByText(text)).not.toBeNull();
+  });
+
+  test.each(cases)("$name is hidden when its route is not allowed", ({ component, text, archived }) => {
+    renderButton(component, [], archived);
+    expect(screen.queryByText(text)).toBeNull();
+  });
+
+  test("Edit & retry is shown and enabled when edit route is allowed", () => {
+    renderButton(EditAndRetryButton, ["POST /api/edit/{}"], false);
+    const button = screen.getByRole("button", { name: /Edit & retry/i }) as HTMLButtonElement;
+    expect(button.disabled).toBe(false);
+  });
+
+  test("Edit & retry is shown but disabled when edit route is not allowed", () => {
+    renderButton(EditAndRetryButton, [], false);
+    const button = screen.getByRole("button", { name: /Edit & retry/i }) as HTMLButtonElement;
+    expect(button.disabled).toBe(true);
+  });
+});
diff --git a/src/Frontend/src/components/monitoring/EndpointInstances.vue b/src/Frontend/src/components/monitoring/EndpointInstances.vue
index f78d09f91c..611750e55b 100644
--- a/src/Frontend/src/components/monitoring/EndpointInstances.vue
+++ b/src/Frontend/src/components/monitoring/EndpointInstances.vue
@@ -18,7 +18,7 @@ import logger from "@/logger";
 const isRemovingEndpointEnabled = ref<boolean>(false);
 const router = useRouter();
 const monitoringEndpointDetailsStore = useMonitoringEndpointDetailsStore();
-const { endpointDetails: endpoint, endpointName } = storeToRefs(monitoringEndpointDetailsStore);
+const { endpointDetails: endpoint, endpointName, canDeleteMonitoredEndpoint } = storeToRefs(monitoringEndpointDetailsStore);
 
 async function removeEndpoint(endpointName: string, instance: ExtendedEndpointInstance) {
   try {
@@ -147,7 +147,7 @@ onMounted(async () => {
 
                 <!--remove endpoint-->
                 <div class="col-xs-2 col-xl-1 no-side-padding">
-                  <a v-if="isRemovingEndpointEnabled && instance.isStale" class="remove-endpoint" @click="removeEndpoint(endpointName, instance)">
+                  <a v-if="isRemovingEndpointEnabled && instance.isStale && canDeleteMonitoredEndpoint" class="remove-endpoint" @click="removeEndpoint(endpointName, instance)">
                     <FAIcon :icon="faTrash" v-tippy="`Remove endpoint`" />
                   </a>
                 </div>
diff --git a/src/Frontend/src/components/monitoring/monitoringClient.ts b/src/Frontend/src/components/monitoring/monitoringClient.ts
index 5793d5f092..0c6b207851 100644
--- a/src/Frontend/src/components/monitoring/monitoringClient.ts
+++ b/src/Frontend/src/components/monitoring/monitoringClient.ts
@@ -91,6 +91,15 @@ class MonitoringClient {
     return false;
   }
 
+  public async fetchAllowedRoutes() {
+    if (this.isMonitoringDisabled) {
+      return undefined;
+    }
+    // Unlike the other Monitoring endpoints (served at root), MyRoutesController has a class-level
+    // "api" route prefix (it is the shared controller used by both Primary and Monitoring instances).
+    return await authFetch(`${this.url}api/my/routes`);
+  }
+
   public get isMonitoringEnabled() {
     return this.url && this.url !== "!" ? true : false;
   }
diff --git a/src/Frontend/src/composables/apiRoutes.ts b/src/Frontend/src/composables/apiRoutes.ts
new file mode 100644
index 0000000000..3ac666ace9
--- /dev/null
+++ b/src/Frontend/src/composables/apiRoutes.ts
@@ -0,0 +1,37 @@
+// Maps each gated UI capability to the ServiceControl HTTP route it represents.
+// This is the ONLY place coupling ServicePulse to ServiceControl's route surface:
+// the UI gates on routes it already calls, never on the internal permission grammar.
+// Paths use {} for each route parameter; matching is param-name-insensitive (see routeMatching.ts).
+// Each entry tracks a route in ServiceControl's APIApprovals.HttpApiRoutes (Primary or Monitoring instance).
+export type RouteRef = { method: string; path: string };
+
+export const ApiRoutes = {
+  // ---- nav / verb-level (GET routes gated by the matching :view permission) ----
+  viewHeartbeats: { method: "GET", path: "/api/heartbeats/stats" }, // error:heartbeats:view (EndpointsMonitoringController)
+  viewMonitoredEndpoints: { method: "GET", path: "/monitored-endpoints" }, // Monitoring instance serves at root (no /api prefix) — monitoring:endpoint:view (DiagramApiController)
+  viewAuditMessages: { method: "GET", path: "/api/messages2" }, // error:messages:view (GetMessages2Controller)
+  viewFailedMessages: { method: "GET", path: "/api/errors" }, // error:messages:view (GetAllErrorsController)
+  viewCustomChecks: { method: "GET", path: "/api/customchecks" }, // error:customchecks:view (CustomCheckController)
+  viewEventLog: { method: "GET", path: "/api/eventlogitems" }, // error:eventlog:view (EventLogApiController)
+  viewThroughput: { method: "GET", path: "/api/licensing/report/available" }, // error:throughput:view (LicensingController)
+  viewLicense: { method: "GET", path: "/api/license" }, // error:licensing:view (LicenseController)
+  viewConnections: { method: "GET", path: "/api/connection" }, // error:connections:view (ConnectionController)
+  viewNotifications: { method: "GET", path: "/api/notifications/email" }, // error:notifications:view (NotificationsController)
+  viewRedirects: { method: "GET", path: "/api/redirects" }, // error:redirects:view (MessageRedirectsController)
+  viewEndpoints: { method: "GET", path: "/api/endpoints" }, // error:endpoints:view (EndpointsMonitoringController)
+  manageThroughput: { method: "POST", path: "/api/licensing/settings/masks/update" }, // error:throughput:manage (LicensingController)
+  // ---- actions ----
+  manageNotifications: { method: "POST", path: "/api/notifications/email" },
+  testNotifications: { method: "POST", path: "/api/notifications/email/test" },
+  manageRedirects: { method: "POST", path: "/api/redirects" },
+  dismissCustomCheck: { method: "DELETE", path: "/api/customchecks/{}" },
+  retryMessage: { method: "POST", path: "/api/errors/retry" },
+  editMessage: { method: "POST", path: "/api/edit/{}" },
+  deleteMessage: { method: "PATCH", path: "/api/errors/archive" },
+  restoreMessage: { method: "PATCH", path: "/api/errors/unarchive" },
+  retryGroup: { method: "POST", path: "/api/recoverability/groups/{}/errors/retry" },
+  deleteGroup: { method: "POST", path: "/api/recoverability/groups/{}/errors/archive" },
+  restoreGroup: { method: "POST", path: "/api/recoverability/groups/{}/errors/unarchive" },
+  deleteEndpointInstance: { method: "DELETE", path: "/api/endpoints/{}" },
+  deleteMonitoredEndpoint: { method: "DELETE", path: "/monitored-instance/{}/{}" }, // Monitoring instance serves at root (no /api prefix)
+} as const satisfies Record<string, RouteRef>;
diff --git a/src/Frontend/src/composables/routeMatching.spec.ts b/src/Frontend/src/composables/routeMatching.spec.ts
new file mode 100644
index 0000000000..6ebbfd0126
--- /dev/null
+++ b/src/Frontend/src/composables/routeMatching.spec.ts
@@ -0,0 +1,14 @@
+import { describe, it, expect } from "vitest";
+import { normalizeRouteKey } from "@/composables/routeMatching";
+
+describe("normalizeRouteKey", () => {
+  it.each([
+    ["POST", "/api/errors/{id}/retry", "POST /api/errors/{}/retry"],
+    ["post", "/api/errors/{failedMessageId}/retry", "POST /api/errors/{}/retry"], // param-name-insensitive + verb case
+    ["GET", "/api/errors", "GET /api/errors"],
+    ["DELETE", "/api/monitored-instance/{name}/{instanceId}", "DELETE /api/monitored-instance/{}/{}"],
+    ["GET", "api/messages2", "GET /api/messages2"], // adds leading slash
+  ])("normalizes %s %s", (method, path, expected) => {
+    expect(normalizeRouteKey(method, path)).toBe(expected);
+  });
+});
diff --git a/src/Frontend/src/composables/routeMatching.ts b/src/Frontend/src/composables/routeMatching.ts
new file mode 100644
index 0000000000..64e75ba5f9
--- /dev/null
+++ b/src/Frontend/src/composables/routeMatching.ts
@@ -0,0 +1,7 @@
+// Normalizes a (method, path) into a comparison key for allowed-route matching.
+// Param names are collapsed to {} so matching couples only to method + path STRUCTURE
+// (the stable public contract), surviving server route-parameter renames.
+export function normalizeRouteKey(method: string, path: string): string {
+  const normalizedPath = path.replace(/\{[^}]*\}/g, "{}").replace(/^\/?/, "/");
+  return `${method.toUpperCase()} ${normalizedPath}`;
+}
diff --git a/src/Frontend/src/composables/useAllowedRoutes.spec.ts b/src/Frontend/src/composables/useAllowedRoutes.spec.ts
new file mode 100644
index 0000000000..8843a47c40
--- /dev/null
+++ b/src/Frontend/src/composables/useAllowedRoutes.spec.ts
@@ -0,0 +1,61 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { setActivePinia, createPinia } from "pinia";
+import { useAllowedRoutesStore } from "@/stores/AllowedRoutesStore";
+import { useAuthStore } from "@/stores/AuthStore";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
+
+vi.mock("@/components/serviceControlClient", () => ({
+  default: { fetchFromServiceControl: vi.fn(), fetchTypedFromServiceControl: vi.fn() },
+}));
+vi.mock("@/components/monitoring/monitoringClient", () => ({
+  default: { isMonitoringEnabled: false, fetchAllowedRoutes: vi.fn() },
+}));
+
+describe("useAllowedRoutes", () => {
+  beforeEach(() => setActivePinia(createPinia()));
+
+  function arrange(enabled: boolean, authed: boolean, keys: string[]) {
+    const auth = useAuthStore();
+    auth.authEnabled = enabled;
+    auth.isAuthenticated = authed;
+    const store = useAllowedRoutesStore();
+    store.routes = new Map(keys.map((k) => [k, { method: "", url_template: "" }]));
+    store.loaded = keys.length > 0;
+    store.loadAttempted = true;
+  }
+
+  it("allows a granted route", () => {
+    arrange(true, true, ["POST /api/errors/retry"]);
+    expect(useAllowedRoutes().canCall(ApiRoutes.retryMessage)).toBe(true);
+  });
+  it("denies an ungranted route when gating", () => {
+    arrange(true, true, ["GET /api/errors"]);
+    expect(useAllowedRoutes().canCall(ApiRoutes.retryMessage)).toBe(false);
+  });
+  it("fails open when auth disabled", () => {
+    arrange(false, false, []);
+    expect(useAllowedRoutes().canCall(ApiRoutes.retryMessage)).toBe(true);
+  });
+  it("canCall accepts and ignores a resource argument", () => {
+    arrange(true, true, ["POST /api/errors/retry"]);
+    expect(useAllowedRoutes().canCall(ApiRoutes.retryMessage, { queue: "billing" })).toBe(true);
+  });
+  it("canAnyCall is true if any entry is granted", () => {
+    arrange(true, true, ["GET /api/errors"]);
+    expect(useAllowedRoutes().canAnyCall([ApiRoutes.retryMessage, ApiRoutes.viewFailedMessages])).toBe(true);
+  });
+
+  it("ready is false when auth on + authenticated but loadAttempted is false, then true after loadAttempted", () => {
+    const auth = useAuthStore();
+    auth.authEnabled = true;
+    auth.isAuthenticated = true;
+    const store = useAllowedRoutesStore();
+    store.routes = new Map();
+    store.loaded = false;
+    store.loadAttempted = false;
+    expect(useAllowedRoutes().ready.value).toBe(false);
+    store.loadAttempted = true;
+    expect(useAllowedRoutes().ready.value).toBe(true);
+  });
+});
diff --git a/src/Frontend/src/composables/useAllowedRoutes.ts b/src/Frontend/src/composables/useAllowedRoutes.ts
new file mode 100644
index 0000000000..1473963c2a
--- /dev/null
+++ b/src/Frontend/src/composables/useAllowedRoutes.ts
@@ -0,0 +1,33 @@
+import { computed } from "vue";
+import { storeToRefs } from "pinia";
+import { useAllowedRoutesStore } from "@/stores/AllowedRoutesStore";
+import { useAuthStore } from "@/stores/AuthStore";
+import { normalizeRouteKey } from "@/composables/routeMatching";
+import type { RouteRef } from "@/composables/apiRoutes";
+
+// Route-aware gating composable (the primitive). The resource-owning view-model calls canCall and
+// exposes the result; templates bind. Gating is fail-open: only applies once authorization is enabled,
+// the user is authenticated and the manifest has loaded — otherwise everything is shown.
+export function useAllowedRoutes() {
+  const store = useAllowedRoutesStore();
+  const { authEnabled, isAuthenticated } = storeToRefs(useAuthStore());
+
+  const shouldGate = computed(() => authEnabled.value && isAuthenticated.value && store.loaded);
+  const ready = computed(() => !(authEnabled.value && isAuthenticated.value) || store.loadAttempted);
+
+  function fetchManifest(): Promise<void> {
+    return store.refresh();
+  }
+
+  // resource: reserved for future resource-level scope (ignored today). See design Future-proofing.
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  function canCall(entry: RouteRef, _resource?: object): boolean {
+    return !shouldGate.value || store.routes.has(normalizeRouteKey(entry.method, entry.path));
+  }
+
+  function canAnyCall(entries: RouteRef[]): boolean {
+    return entries.some((e) => canCall(e));
+  }
+
+  return { fetchManifest, canCall, canAnyCall, shouldGate, ready };
+}
diff --git a/src/Frontend/src/composables/useAuthenticatedFetch.ts b/src/Frontend/src/composables/useAuthenticatedFetch.ts
index 2fa2d0cfa7..220ea44826 100644
--- a/src/Frontend/src/composables/useAuthenticatedFetch.ts
+++ b/src/Frontend/src/composables/useAuthenticatedFetch.ts
@@ -1,4 +1,6 @@
 import { useAuthStore } from "@/stores/AuthStore";
+import { useShowToast } from "@/composables/toast";
+import { TYPE } from "vue-toastification";
 
 const UNAUTHENTICATED_ENDPOINTS = ["/api/authentication/configuration"];
 
@@ -6,11 +8,24 @@ function isUnauthenticatedEndpoint(url: string): boolean {
   return UNAUTHENTICATED_ENDPOINTS.some((endpoint) => url.includes(endpoint));
 }
 
+async function handle403Toast(response: Response): Promise<void> {
+  let message = "You do not have permission to perform this action.";
+  try {
+    const body = await response.clone().json();
+    if (body?.message) message = body.message;
+  } catch {
+    // keep default message
+  }
+  useShowToast(TYPE.ERROR, "Forbidden", message);
+}
+
 /**
  * Authenticated fetch wrapper that automatically includes JWT token
  * in the Authorization header when authentication is enabled.
+ * When a 403 response is received the denial reason from ServiceControl's
+ * structured body ({ error, message }) is surfaced as an error toast.
  */
-export function authFetch(input: RequestInfo, init?: RequestInit): Promise<Response> {
+export async function authFetch(input: RequestInfo, init?: RequestInit): Promise<Response> {
   const authStore = useAuthStore();
   const url = typeof input === "string" ? input : input.url;
 
@@ -34,5 +49,11 @@ export function authFetch(input: RequestInfo, init?: RequestInit): Promise<Respo
   const headers = new Headers(init?.headers);
   headers.set("Authorization", `Bearer ${token}`);
 
-  return fetch(input, { ...init, headers });
+  const response = await fetch(input, { ...init, headers });
+
+  if (response.status === 403) {
+    await handle403Toast(response);
+  }
+
+  return response;
 }
diff --git a/src/Frontend/src/composables/usePermissionGate.spec.ts b/src/Frontend/src/composables/usePermissionGate.spec.ts
deleted file mode 100644
index a76ed96c60..0000000000
--- a/src/Frontend/src/composables/usePermissionGate.spec.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-import { describe, test, expect, beforeEach } from "vitest";
-import { createTestingPinia } from "@pinia/testing";
-import { setActivePinia } from "pinia";
-import usePermissionGate from "@/composables/usePermissionGate";
-import { useAuthStore } from "@/stores/AuthStore";
-import { useUserPermissionsStore, type PermissionsSummary } from "@/stores/UserPermissionsStore";
-
-const summaryWith = (overrides: Partial<PermissionsSummary> = {}): PermissionsSummary => ({
-  failed_messages_read: false,
-  failed_messages_write: false,
-  auditing_read: false,
-  monitoring_read: false,
-  monitoring_write: false,
-  admin_read: false,
-  admin_write: false,
-  ...overrides,
-});
-
-describe("usePermissionGate", () => {
-  beforeEach(() => {
-    setActivePinia(createTestingPinia({ stubActions: false }));
-  });
-
-  function withState(opts: { authEnabled: boolean; isAuthenticated: boolean; summary: PermissionsSummary | null }) {
-    const auth = useAuthStore();
-    auth.authEnabled = opts.authEnabled;
-    auth.isAuthenticated = opts.isAuthenticated;
-    useUserPermissionsStore().summary = opts.summary;
-    return usePermissionGate();
-  }
-
-  test("fails open (shows everything) when authorization is disabled", () => {
-    const { has, shouldGate } = withState({ authEnabled: false, isAuthenticated: true, summary: summaryWith() });
-
-    expect(shouldGate.value).toBe(false);
-    expect(has("admin_read")).toBe(true);
-    expect(has("failed_messages_read")).toBe(true);
-  });
-
-  test("fails open when the user is not authenticated", () => {
-    const { has, shouldGate } = withState({ authEnabled: true, isAuthenticated: false, summary: summaryWith() });
-
-    expect(shouldGate.value).toBe(false);
-    expect(has("admin_read")).toBe(true);
-  });
-
-  test("fails open while the permission summary has not loaded yet", () => {
-    const { has, shouldGate } = withState({ authEnabled: true, isAuthenticated: true, summary: null });
-
-    expect(shouldGate.value).toBe(false);
-    expect(has("admin_read")).toBe(true);
-  });
-
-  test("gates per flag once enabled, authenticated and loaded", () => {
-    const { has, shouldGate } = withState({ authEnabled: true, isAuthenticated: true, summary: summaryWith({ admin_read: true }) });
-
-    expect(shouldGate.value).toBe(true);
-    expect(has("admin_read")).toBe(true);
-    expect(has("failed_messages_read")).toBe(false);
-  });
-
-  test("reacts to the summary being updated", () => {
-    const auth = useAuthStore();
-    auth.authEnabled = true;
-    auth.isAuthenticated = true;
-    const permissions = useUserPermissionsStore();
-    permissions.summary = summaryWith();
-
-    const { has } = usePermissionGate();
-    expect(has("monitoring_read")).toBe(false);
-
-    permissions.summary = summaryWith({ monitoring_read: true });
-    expect(has("monitoring_read")).toBe(true);
-  });
-});
diff --git a/src/Frontend/src/composables/usePermissionGate.ts b/src/Frontend/src/composables/usePermissionGate.ts
deleted file mode 100644
index 516a3abee5..0000000000
--- a/src/Frontend/src/composables/usePermissionGate.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { computed } from "vue";
-import { storeToRefs } from "pinia";
-import { useAuthStore } from "@/stores/AuthStore";
-import { useUserPermissionsStore, type PermissionsSummary } from "@/stores/UserPermissionsStore";
-
-// Centralises the "should this UI element be shown for the current user" decision.
-// Gating only kicks in once authorization is enabled, the user is authenticated and
-// the permission summary has loaded; otherwise everything is shown (fail-open) so the
-// UI is unchanged for unauthenticated/older-ServiceControl setups. Server-side checks
-// remain the real enforcement — this only hides UI the user cannot use anyway.
-export default function usePermissionGate() {
-  const { authEnabled, isAuthenticated } = storeToRefs(useAuthStore());
-  const { summary } = storeToRefs(useUserPermissionsStore());
-
-  const shouldGate = computed(() => authEnabled.value && isAuthenticated.value && summary.value !== null);
-
-  function has(flag: keyof PermissionsSummary): boolean {
-    return !shouldGate.value || summary.value?.[flag] === true;
-  }
-
-  return { has, shouldGate };
-}
diff --git a/src/Frontend/src/stores/AllowedRoutesStore.spec.ts b/src/Frontend/src/stores/AllowedRoutesStore.spec.ts
new file mode 100644
index 0000000000..b8ffaf9982
--- /dev/null
+++ b/src/Frontend/src/stores/AllowedRoutesStore.spec.ts
@@ -0,0 +1,79 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { setActivePinia, createPinia } from "pinia";
+import { ApiRoutes } from "@/composables/apiRoutes";
+import { normalizeRouteKey } from "@/composables/routeMatching";
+
+const scFetch = vi.fn();
+const monFetch = vi.fn();
+vi.mock("@/components/serviceControlClient", () => ({ default: { fetchFromServiceControl: (s: string) => scFetch(s) } }));
+vi.mock("@/components/monitoring/monitoringClient", () => ({
+  default: {
+    get isMonitoringEnabled() {
+      return true;
+    },
+    fetchAllowedRoutes: () => monFetch(),
+  },
+}));
+
+import { useAllowedRoutesStore } from "@/stores/AllowedRoutesStore";
+
+const ok = (body: unknown) => ({ ok: true, status: 200, json: () => Promise.resolve(body) });
+
+describe("AllowedRoutesStore", () => {
+  beforeEach(() => {
+    setActivePinia(createPinia());
+    scFetch.mockReset();
+    monFetch.mockReset();
+  });
+
+  it("merges Primary and Monitoring manifests into normalized keys", async () => {
+    scFetch.mockResolvedValue(ok([{ method: "POST", url_template: "/api/errors/{id}/retry" }]));
+    monFetch.mockResolvedValue(ok([{ method: "DELETE", url_template: "/api/monitored-instance/{n}/{i}" }]));
+    const store = useAllowedRoutesStore();
+    await store.refresh();
+    expect(store.routes.has("POST /api/errors/{}/retry")).toBe(true);
+    expect(store.routes.has("DELETE /api/monitored-instance/{}/{}")).toBe(true);
+    expect(store.loaded).toBe(true);
+  });
+
+  it("fails open per instance: a 404 from one instance contributes nothing but does not throw", async () => {
+    scFetch.mockResolvedValue(ok([{ method: "GET", url_template: "/api/errors" }]));
+    monFetch.mockResolvedValue({ ok: false, status: 404, json: () => Promise.resolve({}) });
+    const store = useAllowedRoutesStore();
+    await store.refresh();
+    expect(store.routes.has("GET /api/errors")).toBe(true);
+    expect(store.loadAttempted).toBe(true);
+  });
+
+  it("treats a non-array 200 response body as a failed instance: loaded stays false when both return non-array", async () => {
+    scFetch.mockResolvedValue(ok({}));
+    monFetch.mockResolvedValue(ok(null));
+    const store = useAllowedRoutesStore();
+    await store.refresh();
+    expect(store.loaded).toBe(false);
+    expect(store.loadAttempted).toBe(true);
+  });
+
+  it("fails open globally: loaded is false when both instances fail with network errors", async () => {
+    scFetch.mockRejectedValue(new Error("network error"));
+    monFetch.mockRejectedValue(new Error("network error"));
+    const store = useAllowedRoutesStore();
+    await store.refresh();
+    expect(store.loaded).toBe(false);
+    expect(store.loadAttempted).toBe(true);
+  });
+
+  it("Monitoring manifest entry at root (no /api prefix) matches the ApiRoutes registry path", async () => {
+    // The Monitoring instance serves monitored-endpoints at root — no /api prefix.
+    // This test pins the cross-repo path contract: the manifest entry the Monitoring
+    // instance returns must round-trip through normalizeRouteKey to produce the same
+    // key as the registry uses for viewMonitoredEndpoints.
+    scFetch.mockResolvedValue(ok([]));
+    monFetch.mockResolvedValue(ok([{ method: "GET", url_template: "/monitored-endpoints" }]));
+    const store = useAllowedRoutesStore();
+    await store.refresh();
+    const expectedKey = normalizeRouteKey(ApiRoutes.viewMonitoredEndpoints.method, ApiRoutes.viewMonitoredEndpoints.path);
+    expect(expectedKey).toBe("GET /monitored-endpoints");
+    expect(store.routes.has(expectedKey)).toBe(true);
+  });
+});
diff --git a/src/Frontend/src/stores/AllowedRoutesStore.ts b/src/Frontend/src/stores/AllowedRoutesStore.ts
new file mode 100644
index 0000000000..5c19413a3c
--- /dev/null
+++ b/src/Frontend/src/stores/AllowedRoutesStore.ts
@@ -0,0 +1,76 @@
+import { acceptHMRUpdate, defineStore } from "pinia";
+import { ref } from "vue";
+import serviceControlClient from "@/components/serviceControlClient";
+import monitoringClient from "@/components/monitoring/monitoringClient";
+import { normalizeRouteKey } from "@/composables/routeMatching";
+import logger from "@/logger";
+
+export interface ManifestEntry {
+  method: string;
+  // ServiceControl serializes its HTTP API in snake_case, so the manifest field is `url_template`.
+  url_template: string;
+  [k: string]: unknown;
+}
+
+// Holds the allowed-route manifest the current token may call, merged from the instances
+// ServicePulse calls directly (Primary + Monitoring). A Map (not a Set) preserves each entry so a
+// future per-route `scope` field survives (resource-level checks). Keys are normalizeRouteKey().
+export const useAllowedRoutesStore = defineStore("AllowedRoutesStore", () => {
+  const routes = ref<Map<string, ManifestEntry>>(new Map());
+  const loaded = ref(false);
+  const loadAttempted = ref(false);
+
+  // Per-store in-flight guard so concurrent callers share one request. Kept on the store
+  // (not module scope) so each Pinia instance — e.g. a re-mounted app — has its own, and a
+  // stale request can never resolve into a different store instance.
+  let inFlight: Promise<void> | null = null;
+
+  async function fetchInstance(get: () => Promise<Response | undefined>): Promise<ManifestEntry[] | null> {
+    try {
+      const response = await get();
+      if (!response || !response.ok) return null; // per-instance fail-open
+      const json = await response.json();
+      if (!Array.isArray(json)) return null; // guard against non-array bodies (error envelopes, etc.)
+      return json as ManifestEntry[];
+    } catch (error) {
+      logger.warn("Failed to fetch allowed routes", error);
+      return null;
+    }
+  }
+
+  async function load() {
+    try {
+      const [primary, monitoring] = await Promise.all([
+        fetchInstance(() => serviceControlClient.fetchFromServiceControl("my/routes")),
+        fetchInstance(() => (monitoringClient.isMonitoringEnabled ? monitoringClient.fetchAllowedRoutes() : Promise.resolve(undefined))),
+      ]);
+      const merged = new Map<string, ManifestEntry>();
+      for (const list of [primary, monitoring]) {
+        for (const entry of list ?? []) {
+          merged.set(normalizeRouteKey(entry.method, entry.url_template), entry);
+        }
+      }
+      routes.value = merged;
+      loaded.value = primary !== null || monitoring !== null;
+    } finally {
+      loadAttempted.value = true;
+    }
+  }
+
+  // Fetch (or join an in-flight fetch of) the current user's allowed routes.
+  function refresh() {
+    return (inFlight ??= load().finally(() => (inFlight = null)));
+  }
+
+  function clear() {
+    routes.value = new Map();
+    loaded.value = false;
+    loadAttempted.value = false;
+  }
+
+  return { routes, loaded, loadAttempted, refresh, clear };
+});
+
+if (import.meta.hot) {
+  import.meta.hot.accept(acceptHMRUpdate(useAllowedRoutesStore, import.meta.hot));
+}
diff --git a/src/Frontend/src/stores/EnvironmentAndVersionsStore.ts b/src/Frontend/src/stores/EnvironmentAndVersionsStore.ts
index 1ce6b4f097..0f15264f93 100644
--- a/src/Frontend/src/stores/EnvironmentAndVersionsStore.ts
+++ b/src/Frontend/src/stores/EnvironmentAndVersionsStore.ts
@@ -17,9 +17,6 @@ export const useEnvironmentAndVersionsStore = defineStore("EnvironmentAndVersion
     is_compatible_with_sc: true,
     sp_version: window.defaultConfig && window.defaultConfig.version ? window.defaultConfig.version : "1.2.0",
     supportsArchiveGroups: false,
-    supportsUserPermissions: false,
-    mypermissions_all_url: "",
-    mypermissions_summary_url: "",
     endpoints_error_url: "",
     known_endpoints_url: "",
     endpoints_message_search_url: "",
@@ -59,9 +56,6 @@ export const useEnvironmentAndVersionsStore = defineStore("EnvironmentAndVersion
     const [products, scVer] = await Promise.all([productsResult, scResult, mResult]);
     if (scVer) {
       environment.supportsArchiveGroups = !!scVer.archived_groups_url;
-      environment.supportsUserPermissions = !!scVer.mypermissions_all && !!scVer.mypermissions_summary;
-      environment.mypermissions_all_url = scVer.mypermissions_all ?? "";
-      environment.mypermissions_summary_url = scVer.mypermissions_summary ?? "";
       environment.is_compatible_with_sc = isSupported(environment.sc_version, environment.minimum_supported_sc_version);
       environment.endpoints_error_url = scVer && scVer.endpoints_error_url;
       environment.known_endpoints_url = scVer && scVer.known_endpoints_url;
diff --git a/src/Frontend/src/stores/HealthChecksStore.ts b/src/Frontend/src/stores/HealthChecksStore.ts
index 9612b56328..6aff63c4c4 100644
--- a/src/Frontend/src/stores/HealthChecksStore.ts
+++ b/src/Frontend/src/stores/HealthChecksStore.ts
@@ -1,11 +1,13 @@
 import type EmailSettings from "@/components/configuration/EmailSettings";
 import { acceptHMRUpdate, defineStore } from "pinia";
-import { ref } from "vue";
+import { computed, ref } from "vue";
 import serviceControlClient from "@/components/serviceControlClient";
 import type EmailNotifications from "@/resources/EmailNotifications";
 import type UpdateEmailNotificationsSettingsRequest from "@/resources/UpdateEmailNotificationsSettingsRequest";
 import { useEnvironmentAndVersionsStore } from "./EnvironmentAndVersionsStore";
 import logger from "@/logger";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
 export const useHealthChecksStore = defineStore("HealthChecksStore", () => {
   const emailNotifications = ref<EmailSettings>({
@@ -22,6 +24,10 @@ export const useHealthChecksStore = defineStore("HealthChecksStore", () => {
   const environmentStore = useEnvironmentAndVersionsStore();
   const hasResponseStatusInHeaders = environmentStore.serviceControlIsGreaterThan("5.2");
 
+  const { canCall } = useAllowedRoutes();
+  const canManageNotifications = computed(() => canCall(ApiRoutes.manageNotifications));
+  const canTestNotifications = computed(() => canCall(ApiRoutes.testNotifications));
+
   async function refresh() {
     let result: EmailNotifications | null;
     try {
@@ -112,6 +118,8 @@ export const useHealthChecksStore = defineStore("HealthChecksStore", () => {
   return {
     refresh,
     emailNotifications,
+    canManageNotifications,
+    canTestNotifications,
     toggleEmailNotifications,
     saveEmailNotifications,
     testEmailNotifications,
diff --git a/src/Frontend/src/stores/HeartbeatInstancesStore.ts b/src/Frontend/src/stores/HeartbeatInstancesStore.ts
index 98d131bffb..5e329e93aa 100644
--- a/src/Frontend/src/stores/HeartbeatInstancesStore.ts
+++ b/src/Frontend/src/stores/HeartbeatInstancesStore.ts
@@ -7,6 +7,8 @@ import getSortFunction from "@/components/getSortFunction";
 import { useHeartbeatsStore } from "@/stores/HeartbeatsStore";
 import type { EndpointsView } from "@/resources/EndpointView";
 import serviceControlClient from "@/components/serviceControlClient";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
 export enum ColumnNames {
   InstanceName = "name",
@@ -32,6 +34,9 @@ export const useHeartbeatInstancesStore = defineStore("HeartbeatInstancesStore",
   const sortedInstances = computed<EndpointsView[]>(() => endpointInstances.value.sort(getSortFunction(columnSortings.get(sortByInstances.value.property), sortByInstances.value.isAscending ? SortDirection.Ascending : SortDirection.Descending)));
   const filteredInstances = computed<EndpointsView[]>(() => sortedInstances.value.filter((instance) => !instanceFilterString.value || instance.host_display_name.toLowerCase().includes(instanceFilterString.value.toLowerCase())));
 
+  const { canCall } = useAllowedRoutes();
+  const canDeleteEndpointInstance = computed(() => canCall(ApiRoutes.deleteEndpointInstance));
+
   const refresh = () => store.refresh();
 
   watch(instanceFilterString, (newValue) => {
@@ -57,6 +62,7 @@ export const useHeartbeatInstancesStore = defineStore("HeartbeatInstancesStore",
     sortedInstances,
     filteredInstances,
     instanceFilterString,
+    canDeleteEndpointInstance,
     deleteEndpointInstance,
     toggleEndpointMonitor,
     sortByInstances,
diff --git a/src/Frontend/src/stores/MessageStore.ts b/src/Frontend/src/stores/MessageStore.ts
index 424f388bc0..309a7ddb83 100644
--- a/src/Frontend/src/stores/MessageStore.ts
+++ b/src/Frontend/src/stores/MessageStore.ts
@@ -16,6 +16,8 @@ import type EditRetryResponse from "@/resources/EditRetryResponse";
 import type { EditedMessage } from "@/resources/EditMessage";
 import useEnvironmentAndVersionsAutoRefresh from "@/composables/useEnvironmentAndVersionsAutoRefresh";
 import { timeSpanToDuration } from "@/composables/formatter";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
 interface Model {
   id?: string;
@@ -81,6 +83,12 @@ export const useMessageStore = defineStore("MessageStore", () => {
   const { configuration } = storeToRefs(configStore);
   const error_retention_period = computed(() => timeSpanToDuration(configuration.value?.data_retention?.error_retention_period).asHours());
 
+  const { canCall } = useAllowedRoutes();
+  const canRetry = computed(() => canCall(ApiRoutes.retryMessage, state.data));
+  const canEdit = computed(() => canCall(ApiRoutes.editMessage, state.data));
+  const canDelete = computed(() => canCall(ApiRoutes.deleteMessage, state.data));
+  const canRestore = computed(() => canCall(ApiRoutes.restoreMessage, state.data));
+
   async function loadEditAndRetryConfiguration() {
     try {
       const [, data] = await serviceControlClient.fetchTypedFromServiceControl<EditAndRetryConfig>("edit/config");
@@ -367,6 +375,10 @@ export const useMessageStore = defineStore("MessageStore", () => {
     state,
     edit_and_retry_config,
     editRetryResponse,
+    canRetry,
+    canEdit,
+    canDelete,
+    canRestore,
     reset,
     loadMessage,
     loadFailedMessage,
diff --git a/src/Frontend/src/stores/MonitoringEndpointDetailsStore.ts b/src/Frontend/src/stores/MonitoringEndpointDetailsStore.ts
index cb7fb3457d..2b65562212 100644
--- a/src/Frontend/src/stores/MonitoringEndpointDetailsStore.ts
+++ b/src/Frontend/src/stores/MonitoringEndpointDetailsStore.ts
@@ -1,5 +1,5 @@
 import { defineStore, acceptHMRUpdate } from "pinia";
-import { ref } from "vue";
+import { computed, ref } from "vue";
 import MessageTypes from "@/components/monitoring/messageTypes";
 import { formatGraphDuration } from "../components/monitoring/formatGraph";
 import { type ExtendedEndpointDetails, type ExtendedEndpointInstance, type MessageType, type EndpointDetails, type EndpointDetailsError, isError } from "@/resources/MonitoringEndpoint";
@@ -10,6 +10,8 @@ import { emptyEndpointDetails } from "@/components/monitoring/endpoints";
 import { useMemoize } from "@vueuse/core";
 import useConnectionsAndStatsAutoRefresh from "@/composables/useConnectionsAndStatsAutoRefresh";
 import monitoringClient from "@/components/monitoring/monitoringClient";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
 export const useMonitoringEndpointDetailsStore = defineStore("MonitoringEndpointDetailsStore", () => {
   const historyPeriodStore = useMonitoringHistoryPeriodStore();
@@ -43,6 +45,9 @@ export const useMonitoringEndpointDetailsStore = defineStore("MonitoringEndpoint
   const messageTypesUpdatedSet = ref<MessageType[]>([]);
   const negativeCriticalTimeIsPresent = ref<boolean>(false);
 
+  const { canCall } = useAllowedRoutes();
+  const canDeleteMonitoredEndpoint = computed(() => canCall(ApiRoutes.deleteMonitoredEndpoint));
+
   async function getEndpointDetails(name: string) {
     const { data, refresh } = getMemoisedEndpointDetails(name, historyPeriodStore.historyPeriod.pVal);
     if (!connectionStore.monitoringConnectionState.unableToConnect) await refresh();
@@ -115,6 +120,7 @@ export const useMonitoringEndpointDetailsStore = defineStore("MonitoringEndpoint
     messageTypesAvailable,
     messageTypesUpdatedSet,
     negativeCriticalTimeIsPresent,
+    canDeleteMonitoredEndpoint,
     updateMessageTypes,
     getEndpointDetails,
   };
diff --git a/src/Frontend/src/stores/RedirectsStore.ts b/src/Frontend/src/stores/RedirectsStore.ts
index 4c7d364996..1cc7dcc5f2 100644
--- a/src/Frontend/src/stores/RedirectsStore.ts
+++ b/src/Frontend/src/stores/RedirectsStore.ts
@@ -1,10 +1,12 @@
 import type Redirect from "@/resources/Redirect";
 import type QueueAddress from "@/resources/QueueAddress";
 import { acceptHMRUpdate, defineStore } from "pinia";
-import { reactive } from "vue";
+import { computed, reactive } from "vue";
 import serviceControlClient from "@/components/serviceControlClient";
 import useEnvironmentAndVersionsAutoRefresh from "@/composables/useEnvironmentAndVersionsAutoRefresh";
 import type { RetryRedirect } from "@/components/configuration/RetryRedirectEdit.vue";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
 export interface Redirects {
   data: Redirect[];
@@ -22,6 +24,9 @@ export const useRedirectsStore = defineStore("RedirectsStore", () => {
   const { store: environmentStore } = useEnvironmentAndVersionsAutoRefresh();
   const hasResponseStatusInHeader = environmentStore.serviceControlIsGreaterThan("5.2.0");
 
+  const { canCall } = useAllowedRoutes();
+  const canManageRedirects = computed(() => canCall(ApiRoutes.manageRedirects));
+
   async function getKnownQueues() {
     const [, data] = await serviceControlClient.fetchTypedFromServiceControl<QueueAddress[]>("errors/queues/addresses");
     redirects.queues = data.map((x) => x.physical_address);
@@ -79,7 +84,7 @@ export const useRedirectsStore = defineStore("RedirectsStore", () => {
     };
   }
 
-  return { refresh, redirects, retryPendingMessagesForQueue, createRedirect, updateRedirect, deleteRedirect };
+  return { refresh, redirects, canManageRedirects, retryPendingMessagesForQueue, createRedirect, updateRedirect, deleteRedirect };
 });
 
 if (import.meta.hot) {
diff --git a/src/Frontend/src/stores/ThroughputStore.ts b/src/Frontend/src/stores/ThroughputStore.ts
index e90b48cc4f..60e702a07b 100644
--- a/src/Frontend/src/stores/ThroughputStore.ts
+++ b/src/Frontend/src/stores/ThroughputStore.ts
@@ -5,6 +5,7 @@ import createThroughputClient from "@/views/throughputreport/throughputClient";
 import { Transport } from "@/views/throughputreport/transport";
 import useIsThroughputSupported from "@/views/throughputreport/isThroughputSupported";
 import monitoringClient from "@/components/monitoring/monitoringClient";
+import logger from "@/logger";
 
 export const useThroughputStore = defineStore("ThroughputStore", () => {
   const isMonitoringEnabled = monitoringClient.isMonitoringEnabled;
@@ -13,8 +14,15 @@ export const useThroughputStore = defineStore("ThroughputStore", () => {
   const throughputClient = createThroughputClient();
 
   const refresh = async () => {
-    if (isThroughputSupported.value) {
+    if (!isThroughputSupported.value) {
+      return;
+    }
+    try {
       testResults.value = await throughputClient.test();
+    } catch (error) {
+      // This runs on a watch/auto-refresh, so a rejection here would be unhandled. Swallow
+      // and log (e.g. ServiceControl unreachable, or the token cleared during logout).
+      logger.error("Failed to run throughput connection test", error);
     }
   };
 
diff --git a/src/Frontend/src/stores/UserPermissionsStore.spec.ts b/src/Frontend/src/stores/UserPermissionsStore.spec.ts
deleted file mode 100644
index e73270c92b..0000000000
--- a/src/Frontend/src/stores/UserPermissionsStore.spec.ts
+++ /dev/null
@@ -1,89 +0,0 @@
-import { describe, test, expect, beforeEach, vi } from "vitest";
-import { createTestingPinia } from "@pinia/testing";
-import { setActivePinia } from "pinia";
-
-vi.mock("@/components/serviceControlClient", () => ({
-  default: { fetchTypedFromUrl: vi.fn() },
-}));
-
-import serviceControlClient from "@/components/serviceControlClient";
-import logger from "@/logger";
-import { useUserPermissionsStore } from "@/stores/UserPermissionsStore";
-import { useEnvironmentAndVersionsStore } from "@/stores/EnvironmentAndVersionsStore";
-
-const summaryUrl = "http://localhost/my/permissions";
-const allUrl = "http://localhost/my/permissions/all";
-
-const fetchTypedFromUrl = vi.mocked(serviceControlClient.fetchTypedFromUrl);
-
-const summaryData = { failed_messages_read: true, failed_messages_write: false, auditing_read: true, monitoring_read: false, monitoring_write: false, admin_read: false, admin_write: false };
-const descriptorData = { user: "alice", permissions: ["error:messages:view", "audit:view"] };
-
-function ok<T>(data: T): [Response, T] {
-  return [{} as Response, data];
-}
-
-function setup() {
-  setActivePinia(createTestingPinia({ stubActions: false }));
-  const environment = useEnvironmentAndVersionsStore().environment;
-  environment.mypermissions_summary_url = summaryUrl;
-  environment.mypermissions_all_url = allUrl;
-  return useUserPermissionsStore();
-}
-
-describe("UserPermissionsStore", () => {
-  beforeEach(() => {
-    fetchTypedFromUrl.mockReset();
-  });
-
-  test("refresh fetches the discovered URLs and populates summary and descriptor", async () => {
-    const store = setup();
-    fetchTypedFromUrl.mockImplementation((url: string) => Promise.resolve(url === summaryUrl ? ok(summaryData) : ok(descriptorData)));
-
-    await store.refresh();
-
-    expect(fetchTypedFromUrl).toHaveBeenCalledWith(summaryUrl);
-    expect(fetchTypedFromUrl).toHaveBeenCalledWith(allUrl);
-    expect(store.summary).toEqual(summaryData);
-    expect(store.descriptor).toEqual(descriptorData);
-    expect(store.error).toBeNull();
-    expect(store.loading).toBe(false);
-  });
-
-  test("refresh records an error and logs when a request fails", async () => {
-    const store = setup();
-    const loggerError = vi.spyOn(logger, "error").mockImplementation(() => {});
-    const failure = new Error("boom");
-    fetchTypedFromUrl.mockRejectedValue(failure);
-
-    await store.refresh();
-
-    expect(store.summary).toBeNull();
-    expect(store.error).toBe("Failed to load user permissions");
-    expect(store.loading).toBe(false);
-    expect(loggerError).toHaveBeenCalledWith("Failed to load user permissions", failure);
-    loggerError.mockRestore();
-  });
-
-  test("concurrent refreshes share a single in-flight request", async () => {
-    const store = setup();
-    let resolveSummary: (value: [Response, typeof summaryData]) => void = () => {};
-    const pendingSummary = new Promise<[Response, typeof summaryData]>((resolve) => (resolveSummary = resolve));
-    fetchTypedFromUrl.mockImplementation((url: string) => (url === summaryUrl ? pendingSummary : Promise.resolve(ok(descriptorData))));
-
-    const first = store.refresh();
-    const second = store.refresh();
-
-    // One load in flight => two endpoint calls (summary + descriptor), not four.
-    expect(fetchTypedFromUrl).toHaveBeenCalledTimes(2);
-
-    resolveSummary(ok(summaryData));
-    await Promise.all([first, second]);
-
-    expect(store.summary).toEqual(summaryData);
-
-    // Once settled the in-flight slot is released, so a later refresh fetches again.
-    await store.refresh();
-    expect(fetchTypedFromUrl).toHaveBeenCalledTimes(4);
-  });
-});
diff --git a/src/Frontend/src/stores/UserPermissionsStore.ts b/src/Frontend/src/stores/UserPermissionsStore.ts
deleted file mode 100644
index 434adaa32b..0000000000
--- a/src/Frontend/src/stores/UserPermissionsStore.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import { acceptHMRUpdate, defineStore } from "pinia";
-import { ref } from "vue";
-import serviceControlClient from "@/components/serviceControlClient";
-import { useEnvironmentAndVersionsStore } from "@/stores/EnvironmentAndVersionsStore";
-import logger from "@/logger";
-
-interface PermissionsSummary {
-  failed_messages_read: boolean;
-  failed_messages_write: boolean;
-  auditing_read: boolean;
-  monitoring_read: boolean;
-  monitoring_write: boolean;
-  admin_read: boolean;
-  admin_write: boolean;
-}
-
-interface PermissionsDescriptor {
-  user: string;
-  permissions: string[];
-}
-
-export const useUserPermissionsStore = defineStore("UserPermissionsStore", () => {
-  const summary = ref<PermissionsSummary | null>(null);
-  const descriptor = ref<PermissionsDescriptor | null>(null);
-  const loading = ref(false);
-  const error = ref<string | null>(null);
-
-  // Multiple callers can request a refresh in the same tick (the App-level watch
-  // and the User Permissions view's onMounted). Share a single in-flight request
-  // so they don't trigger duplicate fetches.
-  let inFlight: Promise<void> | null = null;
-
-  function refresh() {
-    return (inFlight ??= load().finally(() => (inFlight = null)));
-  }
-
-  async function load() {
-    loading.value = true;
-    error.value = null;
-    const { environment } = useEnvironmentAndVersionsStore();
-    try {
-      const [summaryResult, descriptorResult] = await Promise.all([
-        serviceControlClient.fetchTypedFromUrl<PermissionsSummary>(environment.mypermissions_summary_url),
-        serviceControlClient.fetchTypedFromUrl<PermissionsDescriptor>(environment.mypermissions_all_url),
-      ]);
-      summary.value = summaryResult[1];
-      descriptor.value = descriptorResult[1];
-    } catch (err) {
-      logger.error("Failed to load user permissions", err);
-      error.value = "Failed to load user permissions";
-    } finally {
-      loading.value = false;
-    }
-  }
-
-  return { summary, descriptor, loading, error, refresh };
-});
-
-export type { PermissionsSummary, PermissionsDescriptor };
-
-if (import.meta.hot) {
-  import.meta.hot.accept(acceptHMRUpdate(useUserPermissionsStore, import.meta.hot));
-}
diff --git a/src/Frontend/src/views/ConfigurationView.vue b/src/Frontend/src/views/ConfigurationView.vue
index 0dd4f7ea68..f823e23a18 100644
--- a/src/Frontend/src/views/ConfigurationView.vue
+++ b/src/Frontend/src/views/ConfigurationView.vue
@@ -12,8 +12,8 @@ import useConnectionsAndStatsAutoRefresh from "@/composables/useConnectionsAndSt
 import { useRedirectsStore } from "@/stores/RedirectsStore";
 import { useLicenseStore } from "@/stores/LicenseStore";
 import { useAuthStore } from "@/stores/AuthStore";
-import usePermissionGate from "@/composables/usePermissionGate";
-import { useEnvironmentAndVersionsStore } from "@/stores/EnvironmentAndVersionsStore";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
 const { store: throughputStore } = useThroughputStoreAutoRefresh();
 const { hasErrors } = storeToRefs(throughputStore);
@@ -23,10 +23,10 @@ const redirectsStore = useRedirectsStore();
 const licenseStore = useLicenseStore();
 const { licenseStatus } = licenseStore;
 const authStore = useAuthStore();
-const environmentStore = useEnvironmentAndVersionsStore();
 
-const { has } = usePermissionGate();
-const hasAdminRead = computed(() => has("admin_read"));
+// Each tab gates on the specific route ServiceControl enforces for it. Gate-on-ready:
+// the tab row is held until permissions are known, so tabs don't appear and then disappear.
+const { canCall, ready } = useAllowedRoutes();
 
 onMounted(async () => {
   if (notConnected.value) {
@@ -61,13 +61,13 @@ function preventIfDisabled(e: Event) {
     </div>
     <div class="row">
       <div class="col-sm-12">
-        <div class="nav tabs">
-          <h5 v-if="hasAdminRead" :class="{ active: isRouteSelected(routeLinks.configuration.license.link), disabled: notConnected }" @click.capture="preventIfDisabled" class="nav-item" role="tab" aria-label="license">
+        <div class="nav tabs" v-if="ready">
+          <h5 v-if="canCall(ApiRoutes.viewLicense)" :class="{ active: isRouteSelected(routeLinks.configuration.license.link), disabled: notConnected }" @click.capture="preventIfDisabled" class="nav-item" role="tab" aria-label="license">
             <RouterLink :to="routeLinks.configuration.license.link">License</RouterLink>
             <exclamation-mark :type="convertToWarningLevel(licenseStatus.warningLevel)" />
           </h5>
           <h5
-            v-if="hasAdminRead"
+            v-if="canCall(ApiRoutes.manageThroughput)"
             :class="{ active: isRouteSelected(routeLinks.throughput.setup.root) || isRouteSelected(routeLinks.throughput.setup.mask.link) || isRouteSelected(routeLinks.throughput.setup.diagnostics.link), disabled: notConnected }"
             @click.capture="preventIfDisabled"
             class="nav-item"
@@ -79,7 +79,7 @@ function preventIfDisabled(e: Event) {
           </h5>
           <template v-if="!licenseStatus.isExpired">
             <h5
-              v-if="hasAdminRead"
+              v-if="canCall(ApiRoutes.viewConnections)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.massTransitConnector.link),
                 disabled: notConnected,
@@ -92,7 +92,7 @@ function preventIfDisabled(e: Event) {
               <RouterLink :to="routeLinks.configuration.massTransitConnector.link">MassTransit Connector</RouterLink>
             </h5>
             <h5
-              v-if="hasAdminRead"
+              v-if="canCall(ApiRoutes.viewNotifications)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.healthCheckNotifications.link),
                 disabled: notConnected,
@@ -105,7 +105,7 @@ function preventIfDisabled(e: Event) {
               <RouterLink :to="routeLinks.configuration.healthCheckNotifications.link">Health Check Notifications</RouterLink>
             </h5>
             <h5
-              v-if="hasAdminRead"
+              v-if="canCall(ApiRoutes.viewRedirects)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.retryRedirects.link),
                 disabled: notConnected,
@@ -118,6 +118,7 @@ function preventIfDisabled(e: Event) {
               <RouterLink :to="routeLinks.configuration.retryRedirects.link">Retry Redirects ({{ redirectsStore.redirects.total }})</RouterLink>
             </h5>
             <h5
+              v-if="canCall(ApiRoutes.viewConnections)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.connections.link),
               }"
@@ -131,6 +132,7 @@ function preventIfDisabled(e: Event) {
               </RouterLink>
             </h5>
             <h5
+              v-if="canCall(ApiRoutes.viewEndpoints)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.endpointConnection.link),
                 disabled: notConnected,
@@ -144,21 +146,14 @@ function preventIfDisabled(e: Event) {
             </h5>
           </template>
           <template v-else>
-            <h5 :class="{ active: isRouteSelected(routeLinks.configuration.connections.link) }" class="nav-item" role="tab" aria-label="connections">
+            <h5 v-if="canCall(ApiRoutes.viewConnections)" :class="{ active: isRouteSelected(routeLinks.configuration.connections.link) }" class="nav-item" role="tab" aria-label="connections">
               <RouterLink :to="routeLinks.configuration.connections.link">
                 Connections
                 <exclamation-mark v-if="connectionStore.displayConnectionsWarning" :type="WarningLevel.Danger" />
               </RouterLink>
             </h5>
           </template>
-          <h5
-            v-if="authStore.authEnabled && environmentStore.environment.supportsUserPermissions"
-            :class="{ active: isRouteSelected(routeLinks.configuration.userPermissions.link), disabled: notConnected }"
-            @click.capture="preventIfDisabled"
-            class="nav-item"
-            role="tab"
-            aria-label="user-permissions"
-          >
+          <h5 v-if="authStore.authEnabled" :class="{ active: isRouteSelected(routeLinks.configuration.userPermissions.link), disabled: notConnected }" @click.capture="preventIfDisabled" class="nav-item" role="tab" aria-label="user-permissions">
             <RouterLink :to="routeLinks.configuration.userPermissions.link">User Permissions</RouterLink>
           </h5>
         </div>