diff --git a/src/Frontend/src/components/configuration/UserPermissions.vue b/src/Frontend/src/components/configuration/UserPermissions.vue
index 4f1eaccbe..f7c559641 100644
--- a/src/Frontend/src/components/configuration/UserPermissions.vue
+++ b/src/Frontend/src/components/configuration/UserPermissions.vue
@@ -73,6 +73,7 @@ export const groups: ApplicationCapabilityGroup[] = [
     capabilities: [
       { label: "View", ref: ApiRoutes.viewEndpoints },
       { label: "View heartbeats", ref: ApiRoutes.viewHeartbeats },
+      { label: "Manage heartbeat tracking", ref: ApiRoutes.manageEndpointSettings },
       { label: "Remove instance", ref: ApiRoutes.deleteEndpointInstance },
     ],
   },
@@ -93,7 +94,7 @@ import FAIcon from "@/components/FAIcon.vue";
 import ConditionalRender from "@/components/ConditionalRender.vue";
 import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
 
-const { canCall, supported } = useAllowedRoutes();
+const { canCall, supported, roles } = useAllowedRoutes();
 
 const rows = computed(() =>
   groups.map((g) => ({
@@ -108,6 +109,11 @@ const rows = computed(() =>
     <div class="box">
       <h3>Your permissions</h3>
 
+      <div v-if="roles.length" class="user-roles">
+        <span class="roles-label">Roles:</span>
+        <span v-for="role in roles" :key="role" class="role-badge">{{ role }}</span>
+      </div>
+
       <ConditionalRender :supported="supported">
         <template #unsupported>
           <div class="container not-supported">
@@ -153,6 +159,28 @@ const rows = computed(() =>
 <style scoped>
 @import "@/components/notsupported.css";
 
+.user-roles {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-bottom: 16px;
+}
+
+.roles-label {
+  font-weight: 600;
+  color: #6c757d;
+}
+
+.role-badge {
+  padding: 2px 10px;
+  font-size: 13px;
+  font-weight: 600;
+  color: #2a2a2a;
+  background-color: #e9ecef;
+  border-radius: 12px;
+}
+
 .permissions-table {
   border-collapse: collapse;
   table-layout: fixed;
diff --git a/src/Frontend/src/components/heartbeats/HeartbeatConfiguration.vue b/src/Frontend/src/components/heartbeats/HeartbeatConfiguration.vue
index eb3a6fe1f..34ac5108e 100644
--- a/src/Frontend/src/components/heartbeats/HeartbeatConfiguration.vue
+++ b/src/Frontend/src/components/heartbeats/HeartbeatConfiguration.vue
@@ -13,14 +13,17 @@ import ResultsCount from "../ResultsCount.vue";
 import FAIcon from "@/components/FAIcon.vue";
 import { faCloud, faServer } from "@fortawesome/free-solid-svg-icons";
 import useHeartbeatsStoreAutoRefresh from "@/composables/useHeartbeatsStoreAutoRefresh";
+import PermissionGate from "@/components/PermissionGate.vue";
 
 enum Operation {
   Track = "track",
   DoNotTrack = "do not track",
 }
 
+const manageDeniedTooltip = "You don't have permission to manage heartbeat tracking.";
+
 const { store } = useHeartbeatsStoreAutoRefresh();
-const { sortedEndpoints, filteredEndpoints, defaultTrackingInstancesValue } = storeToRefs(store);
+const { sortedEndpoints, filteredEndpoints, defaultTrackingInstancesValue, canManageEndpointSettings } = storeToRefs(store);
 const showBulkWarningDialog = ref(false);
 const dialogWarningOperation = ref(Operation.Track);
 
@@ -70,14 +73,18 @@ async function toggleDefaultSetting() {
     <div class="row filters">
       <div class="col-sm-12">
         <span class="buttonsContainer">
-          <button type="button" class="btn btn-default btn-sm" :disabled="filteredEndpoints.length === 0" @click="showBulkOperationWarningDialog(Operation.Track)">
-            <FAIcon :icon="faServer" class="icon" :class="{ 'text-black': filteredEndpoints.length > 0 }" />
-            Track Instances on All Endpoints
-          </button>
-          <button type="button" class="btn btn-default btn-sm" :disabled="filteredEndpoints.length === 0" @click="showBulkOperationWarningDialog(Operation.DoNotTrack)">
-            <FAIcon :icon="faCloud" class="icon" :class="{ 'text-black': filteredEndpoints.length > 0 }" />
-            Do Not Track Instances on All Endpoints
-          </button>
+          <PermissionGate :allowed="canManageEndpointSettings" :reason="manageDeniedTooltip">
+            <button type="button" class="btn btn-default btn-sm" :disabled="filteredEndpoints.length === 0 || !canManageEndpointSettings" @click="showBulkOperationWarningDialog(Operation.Track)">
+              <FAIcon :icon="faServer" class="icon" :class="{ 'text-black': filteredEndpoints.length > 0 }" />
+              Track Instances on All Endpoints
+            </button>
+          </PermissionGate>
+          <PermissionGate :allowed="canManageEndpointSettings" :reason="manageDeniedTooltip">
+            <button type="button" class="btn btn-default btn-sm" :disabled="filteredEndpoints.length === 0 || !canManageEndpointSettings" @click="showBulkOperationWarningDialog(Operation.DoNotTrack)">
+              <FAIcon :icon="faCloud" class="icon" :class="{ 'text-black': filteredEndpoints.length > 0 }" />
+              Do Not Track Instances on All Endpoints
+            </button>
+          </PermissionGate>
         </span>
       </div>
     </div>
@@ -96,7 +103,9 @@ async function toggleDefaultSetting() {
           <div class="defaultSetting">
             <label>Track Instances by default on new endpoints</label>
             <div class="switch">
-              <OnOffSwitch id="defaultTIV" @toggle="toggleDefaultSetting" :value="defaultTrackingInstancesValue" />
+              <PermissionGate :allowed="canManageEndpointSettings" :reason="manageDeniedTooltip">
+                <OnOffSwitch id="defaultTIV" @toggle="toggleDefaultSetting" :value="defaultTrackingInstancesValue" :disabled="!canManageEndpointSettings" />
+              </PermissionGate>
             </div>
           </div>
           <p>
diff --git a/src/Frontend/src/components/heartbeats/HeartbeatsList.vue b/src/Frontend/src/components/heartbeats/HeartbeatsList.vue
index f2a156f30..a12c7f552 100644
--- a/src/Frontend/src/components/heartbeats/HeartbeatsList.vue
+++ b/src/Frontend/src/components/heartbeats/HeartbeatsList.vue
@@ -14,14 +14,17 @@ import ColumnHeader from "../ColumnHeader.vue";
 import FAIcon from "@/components/FAIcon.vue";
 import { faBellSlash, faCheck, faCloud, faServer } from "@fortawesome/free-solid-svg-icons";
 import useHeartbeatsStoreAutoRefresh from "@/composables/useHeartbeatsStoreAutoRefresh";
+import PermissionGate from "@/components/PermissionGate.vue";
 
 defineProps<{
   data: LogicalEndpoint[];
   columns: ColumnNames[];
 }>();
 
+const manageDeniedTooltip = "You don't have permission to manage heartbeat tracking.";
+
 const { store } = useHeartbeatsStoreAutoRefresh();
-const { sortByInstances, itemsPerPage } = storeToRefs(store);
+const { sortByInstances, itemsPerPage, canManageEndpointSettings } = storeToRefs(store);
 const route = useRoute();
 
 async function changeEndpointSettings(endpoint: LogicalEndpoint) {
@@ -97,7 +100,9 @@ function endpointHealth(endpoint: LogicalEndpoint) {
             </div>
             <div v-if="columns.includes(ColumnNames.TrackToggle)" role="cell" aria-label="tracked-instances" class="col-2 centre">
               <div class="switch">
-                <OnOffSwitch :id="endpoint.name" @toggle="changeEndpointSettings(endpoint)" :value="endpoint.track_instances" />
+                <PermissionGate :allowed="canManageEndpointSettings" :reason="manageDeniedTooltip">
+                  <OnOffSwitch :id="endpoint.name" @toggle="changeEndpointSettings(endpoint)" :value="endpoint.track_instances" :disabled="!canManageEndpointSettings" />
+                </PermissionGate>
               </div>
             </div>
             <div v-if="columns.includes(ColumnNames.Muted)" role="cell" aria-label="muted" class="col-1 centre">
diff --git a/src/Frontend/src/composables/apiRoutes.ts b/src/Frontend/src/composables/apiRoutes.ts
index 93e8776b1..16d721417 100644
--- a/src/Frontend/src/composables/apiRoutes.ts
+++ b/src/Frontend/src/composables/apiRoutes.ts
@@ -23,6 +23,7 @@ export const ApiRoutes = {
   viewEndpoints: { method: "GET", path: "/api/endpoints" }, // error:endpoints:view (EndpointsMonitoringController)
   manageThroughput: { method: "POST", path: "/api/licensing/settings/masks/update" }, // error:throughput:manage (LicensingController)
   // ---- actions ----
+  manageEndpointSettings: { method: "PATCH", path: "/api/endpointssettings/{}" },
   manageNotifications: { method: "POST", path: "/api/notifications/email" },
   testNotifications: { method: "POST", path: "/api/notifications/email/test" },
   manageRedirects: { method: "POST", path: "/api/redirects" },
diff --git a/src/Frontend/src/composables/useAllowedRoutes.spec.ts b/src/Frontend/src/composables/useAllowedRoutes.spec.ts
index 8843a47c4..9e842f624 100644
--- a/src/Frontend/src/composables/useAllowedRoutes.spec.ts
+++ b/src/Frontend/src/composables/useAllowedRoutes.spec.ts
@@ -4,9 +4,10 @@ import { useAllowedRoutesStore } from "@/stores/AllowedRoutesStore";
 import { useAuthStore } from "@/stores/AuthStore";
 import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
 import { ApiRoutes } from "@/composables/apiRoutes";
+import serviceControlClient from "@/components/serviceControlClient";
 
 vi.mock("@/components/serviceControlClient", () => ({
-  default: { fetchFromServiceControl: vi.fn(), fetchTypedFromServiceControl: vi.fn() },
+  default: { fetchFromServiceControl: vi.fn(), fetchTypedFromServiceControl: vi.fn(), fetchFromUrl: vi.fn() },
 }));
 vi.mock("@/components/monitoring/monitoringClient", () => ({
   default: { isMonitoringEnabled: false, fetchAllowedRoutes: vi.fn() },
@@ -58,4 +59,29 @@ describe("useAllowedRoutes", () => {
     store.loadAttempted = true;
     expect(useAllowedRoutes().ready.value).toBe(true);
   });
+
+  it("ensureManifestLoaded awaits the real load, closing the race where canCall fails open before the manifest arrives", async () => {
+    const auth = useAuthStore();
+    auth.authEnabled = true;
+    auth.isAuthenticated = true;
+
+    vi.mocked(serviceControlClient.fetchTypedFromServiceControl).mockResolvedValue([{} as Response, { my_routes_url: "http://sc/my-routes" }]);
+    vi.mocked(serviceControlClient.fetchFromUrl).mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ roles: [], routes: [{ method: "POST", url_template: "/api/errors/retry" }] }),
+    } as Response);
+
+    const { ensureManifestLoaded, canCall, ready } = useAllowedRoutes();
+
+    // Before the manifest resolves, gating hasn't kicked in yet: this is the fail-open window a
+    // caller must not act on.
+    expect(ready.value).toBe(false);
+    expect(canCall(ApiRoutes.retryMessage)).toBe(true);
+
+    await ensureManifestLoaded();
+
+    expect(ready.value).toBe(true);
+    expect(canCall(ApiRoutes.retryMessage)).toBe(true);
+    expect(canCall(ApiRoutes.viewFailedMessages)).toBe(false);
+  });
 });
diff --git a/src/Frontend/src/composables/useAllowedRoutes.ts b/src/Frontend/src/composables/useAllowedRoutes.ts
index 56508966a..bff9166cb 100644
--- a/src/Frontend/src/composables/useAllowedRoutes.ts
+++ b/src/Frontend/src/composables/useAllowedRoutes.ts
@@ -17,11 +17,23 @@ export function useAllowedRoutes() {
   // Whether ServiceControl advertised my_routes_url, i.e. whether this version supports
   // reporting the allowed-route manifest at all (independent of whether it loaded successfully).
   const supported = computed(() => store.supported);
+  // The current user's role claims, as reported by the my/routes manifest.
+  const roles = computed(() => store.roles);
 
   function fetchManifest(): Promise<void> {
     return store.refresh();
   }
 
+  // Callers that gate a network call (rather than just a template) on canCall must await this
+  // first: otherwise a call made before the manifest finishes loading races fetchManifest() and
+  // fails open (shouldGate is false until store.loaded flips), letting the request through
+  // regardless of permission. No-ops once the manifest load has been attempted (or doesn't apply).
+  async function ensureManifestLoaded(): Promise<void> {
+    if (!ready.value) {
+      await fetchManifest();
+    }
+  }
+
   // resource: reserved for future resource-level scope (ignored today). See design Future-proofing.
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
   function canCall(entry: RouteRef, _resource?: object): boolean {
@@ -32,5 +44,5 @@ export function useAllowedRoutes() {
     return entries.some((e) => canCall(e));
   }
 
-  return { fetchManifest, canCall, canAnyCall, shouldGate, ready, supported };
+  return { fetchManifest, ensureManifestLoaded, canCall, canAnyCall, shouldGate, ready, supported, roles };
 }
diff --git a/src/Frontend/src/stores/AllowedRoutesStore.spec.ts b/src/Frontend/src/stores/AllowedRoutesStore.spec.ts
index aea3e735e..facc6220b 100644
--- a/src/Frontend/src/stores/AllowedRoutesStore.spec.ts
+++ b/src/Frontend/src/stores/AllowedRoutesStore.spec.ts
@@ -37,8 +37,8 @@ describe("AllowedRoutesStore", () => {
   });
 
   it("merges Primary and Monitoring manifests into normalized keys", async () => {
-    scFetch.mockResolvedValue(ok([{ method: "POST", url_template: "/api/errors/{id}/retry" }]));
-    monFetch.mockResolvedValue(ok([{ method: "DELETE", url_template: "/api/monitored-instance/{n}/{i}" }]));
+    scFetch.mockResolvedValue(ok({ roles: [], routes: [{ method: "POST", url_template: "/api/errors/{id}/retry" }] }));
+    monFetch.mockResolvedValue(ok({ roles: [], routes: [{ method: "DELETE", url_template: "/api/monitored-instance/{n}/{i}" }] }));
     const store = useAllowedRoutesStore();
     await store.refresh();
     expect(scFetch).toHaveBeenCalledWith(MY_ROUTES_URL);
@@ -47,8 +47,16 @@ describe("AllowedRoutesStore", () => {
     expect(store.loaded).toBe(true);
   });
 
+  it("merges and deduplicates roles from Primary and Monitoring", async () => {
+    scFetch.mockResolvedValue(ok({ roles: ["admin", "support"], routes: [] }));
+    monFetch.mockResolvedValue(ok({ roles: ["support"], routes: [] }));
+    const store = useAllowedRoutesStore();
+    await store.refresh();
+    expect(store.roles.sort()).toEqual(["admin", "support"]);
+  });
+
   it("fails open per instance: a 404 from one instance contributes nothing but does not throw", async () => {
-    scFetch.mockResolvedValue(ok([{ method: "GET", url_template: "/api/errors" }]));
+    scFetch.mockResolvedValue(ok({ roles: [], routes: [{ method: "GET", url_template: "/api/errors" }] }));
     monFetch.mockResolvedValue({ ok: false, status: 404, json: () => Promise.resolve({}) });
     const store = useAllowedRoutesStore();
     await store.refresh();
@@ -56,7 +64,7 @@ describe("AllowedRoutesStore", () => {
     expect(store.loadAttempted).toBe(true);
   });
 
-  it("treats a non-array 200 response body as a failed instance: loaded stays false when both return non-array", async () => {
+  it("treats a body without a routes array as a failed instance: loaded stays false when both return malformed bodies", async () => {
     scFetch.mockResolvedValue(ok({}));
     monFetch.mockResolvedValue(ok(null));
     const store = useAllowedRoutesStore();
@@ -79,8 +87,8 @@ describe("AllowedRoutesStore", () => {
     // This test pins the cross-repo path contract: the manifest entry the Monitoring
     // instance returns must round-trip through normalizeRouteKey to produce the same
     // key as the registry uses for viewMonitoredEndpoints.
-    scFetch.mockResolvedValue(ok([]));
-    monFetch.mockResolvedValue(ok([{ method: "GET", url_template: "/monitored-endpoints" }]));
+    scFetch.mockResolvedValue(ok({ roles: [], routes: [] }));
+    monFetch.mockResolvedValue(ok({ roles: [], routes: [{ method: "GET", url_template: "/monitored-endpoints" }] }));
     const store = useAllowedRoutesStore();
     await store.refresh();
     const expectedKey = normalizeRouteKey(ApiRoutes.viewMonitoredEndpoints.method, ApiRoutes.viewMonitoredEndpoints.path);
@@ -91,8 +99,8 @@ describe("AllowedRoutesStore", () => {
   it("skips a malformed entry instead of aborting the load and failing gates open", async () => {
     // Regression: an entry without a template once threw inside the merge, leaving the store
     // unloaded so every gate failed OPEN. A bad entry must be skipped and the rest still load.
-    scFetch.mockResolvedValue(ok([{ method: "GET", url_template: "/api/errors" }, { method: "POST" }]));
-    monFetch.mockResolvedValue(ok([]));
+    scFetch.mockResolvedValue(ok({ roles: [], routes: [{ method: "GET", url_template: "/api/errors" }, { method: "POST" }] }));
+    monFetch.mockResolvedValue(ok({ roles: [], routes: [] }));
     const store = useAllowedRoutesStore();
     await store.refresh();
     expect(store.loaded).toBe(true);
@@ -102,7 +110,7 @@ describe("AllowedRoutesStore", () => {
 
   it("skips the primary fetch entirely when the root document omits my_routes_url", async () => {
     rootFetch.mockResolvedValue(rootDoc());
-    monFetch.mockResolvedValue(ok([{ method: "GET", url_template: "/monitored-endpoints" }]));
+    monFetch.mockResolvedValue(ok({ roles: [], routes: [{ method: "GET", url_template: "/monitored-endpoints" }] }));
     const store = useAllowedRoutesStore();
     await store.refresh();
     expect(scFetch).not.toHaveBeenCalled();
@@ -112,7 +120,7 @@ describe("AllowedRoutesStore", () => {
 
   it("skips the primary fetch and fails open when the root document request itself rejects", async () => {
     rootFetch.mockRejectedValue(new Error("network error"));
-    monFetch.mockResolvedValue(ok([{ method: "GET", url_template: "/monitored-endpoints" }]));
+    monFetch.mockResolvedValue(ok({ roles: [], routes: [{ method: "GET", url_template: "/monitored-endpoints" }] }));
     const store = useAllowedRoutesStore();
     await store.refresh();
     expect(scFetch).not.toHaveBeenCalled();
diff --git a/src/Frontend/src/stores/AllowedRoutesStore.ts b/src/Frontend/src/stores/AllowedRoutesStore.ts
index 1b6515585..6a4f8cab0 100644
--- a/src/Frontend/src/stores/AllowedRoutesStore.ts
+++ b/src/Frontend/src/stores/AllowedRoutesStore.ts
@@ -14,11 +14,21 @@ export interface ManifestEntry {
   [k: string]: unknown;
 }
 
+// The my/routes payload: the caller's role claims alongside the routes they may invoke
+// (ServiceControl's MyRoutesResponse — roles reported once at the top level, not per entry).
+interface ManifestResponse {
+  roles: string[];
+  routes: ManifestEntry[];
+}
+
 // Holds the allowed-route manifest the current token may call, merged from the instances
 // ServicePulse calls directly (Primary + Monitoring). A Map (not a Set) preserves each entry so a
 // future per-route `scope` field survives (resource-level checks). Keys are normalizeRouteKey().
 export const useAllowedRoutesStore = defineStore("AllowedRoutesStore", () => {
   const routes = ref<Map<string, ManifestEntry>>(new Map());
+  // Role claims reported by the instances, deduplicated (Primary and Monitoring authenticate the
+  // same token, so their role sets are expected to overlap or match).
+  const roles = ref<string[]>([]);
   const loaded = ref(false);
   const loadAttempted = ref(false);
   // Whether the primary ServiceControl instance's root document advertised my_routes_url,
@@ -30,13 +40,16 @@ export const useAllowedRoutesStore = defineStore("AllowedRoutesStore", () => {
   // stale request can never resolve into a different store instance.
   let inFlight: Promise<void> | null = null;
 
-  async function fetchInstance(get: () => Promise<Response | undefined>): Promise<ManifestEntry[] | null> {
+  async function fetchInstance(get: () => Promise<Response | undefined>): Promise<ManifestResponse | null> {
     try {
       const response = await get();
       if (!response || !response.ok) return null; // per-instance fail-open
       const json = await response.json();
-      if (!Array.isArray(json)) return null; // guard against non-array bodies (error envelopes, etc.)
-      return json as ManifestEntry[];
+      // Guard against malformed bodies (error envelopes, etc.): routes must be an array; roles
+      // defaults to empty rather than failing the whole instance, since it is supplementary.
+      if (!json || !Array.isArray(json.routes)) return null;
+      const entryRoles = Array.isArray(json.roles) ? json.roles.filter((r: unknown): r is string => typeof r === "string") : [];
+      return { roles: entryRoles, routes: json.routes as ManifestEntry[] };
     } catch (error) {
       logger.warn("Failed to fetch allowed routes", error);
       return null;
@@ -64,8 +77,9 @@ export const useAllowedRoutesStore = defineStore("AllowedRoutesStore", () => {
         fetchInstance(() => (monitoringClient.isMonitoringEnabled ? monitoringClient.fetchAllowedRoutes() : Promise.resolve(undefined))),
       ]);
       const merged = new Map<string, ManifestEntry>();
-      for (const list of [primary, monitoring]) {
-        for (const entry of list ?? []) {
+      const mergedRoles = new Set<string>();
+      for (const result of [primary, monitoring]) {
+        for (const entry of result?.routes ?? []) {
           // Skip any entry missing a method or template rather than throwing: a single malformed
           // entry must never abort the load, which would leave the store unloaded and silently
           // fail every permission gate OPEN (showing actions the user cannot perform).
@@ -75,8 +89,12 @@ export const useAllowedRoutesStore = defineStore("AllowedRoutesStore", () => {
           }
           merged.set(normalizeRouteKey(entry.method, entry.url_template), entry);
         }
+        for (const role of result?.roles ?? []) {
+          mergedRoles.add(role);
+        }
       }
       routes.value = merged;
+      roles.value = [...mergedRoles];
       loaded.value = primary !== null || monitoring !== null;
     } finally {
       loadAttempted.value = true;
@@ -90,12 +108,13 @@ export const useAllowedRoutesStore = defineStore("AllowedRoutesStore", () => {
 
   function clear() {
     routes.value = new Map();
+    roles.value = [];
     loaded.value = false;
     loadAttempted.value = false;
     supported.value = false;
   }
 
-  return { routes, loaded, loadAttempted, supported, refresh, clear };
+  return { routes, roles, loaded, loadAttempted, supported, refresh, clear };
 });
 
 if (import.meta.hot) {
diff --git a/src/Frontend/src/stores/HeartbeatsStore.ts b/src/Frontend/src/stores/HeartbeatsStore.ts
index 00c1831e7..f30d42db1 100644
--- a/src/Frontend/src/stores/HeartbeatsStore.ts
+++ b/src/Frontend/src/stores/HeartbeatsStore.ts
@@ -9,6 +9,8 @@ import type { SortInfo } from "@/components/SortInfo";
 import type { EndpointSettings } from "@/resources/EndpointSettings";
 import serviceControlClient from "@/components/serviceControlClient";
 import { useEndpointSettingsStore } from "./EndpointSettingsStore";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
 export enum ColumnNames {
   Name = "name",
@@ -50,6 +52,8 @@ const columnSortings = new Map<string, (endpoint: LogicalEndpoint) => GroupPrope
 
 export const useHeartbeatsStore = defineStore("HeartbeatsStore", () => {
   const endpointSettingsStore = useEndpointSettingsStore();
+  const { canCall } = useAllowedRoutes();
+  const canManageEndpointSettings = computed(() => canCall(ApiRoutes.manageEndpointSettings));
 
   const sortByInstances = ref<SortInfo>({
     property: ColumnNames.Name,
@@ -173,6 +177,7 @@ export const useHeartbeatsStore = defineStore("HeartbeatsStore", () => {
     refresh,
     defaultTrackingInstancesValue,
     updateEndpointSettings,
+    canManageEndpointSettings,
     sortedEndpoints,
     filteredEndpoints,
     endpointInstances,
diff --git a/src/Frontend/src/stores/LicenseStore.ts b/src/Frontend/src/stores/LicenseStore.ts
index 0a784e706..71fbbe0dc 100644
--- a/src/Frontend/src/stores/LicenseStore.ts
+++ b/src/Frontend/src/stores/LicenseStore.ts
@@ -5,6 +5,8 @@ import serviceControlClient from "@/components/serviceControlClient";
 import { type default as LicenseInfo, LicenseStatus } from "@/resources/LicenseInfo";
 import { LicenseWarningLevel } from "@/composables/LicenseStatus";
 import { useGetDayDiffFromToday } from "@/composables/formatter";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
 export const useLicenseStore = defineStore("LicenseStore", () => {
   const license = reactive<LicenseInfo>({
@@ -40,6 +42,7 @@ export const useLicenseStore = defineStore("LicenseStore", () => {
   });
 
   const loading = ref(false);
+  const { canCall, ensureManifestLoaded } = useAllowedRoutes();
 
   // Computed properties for license formatting
   const licenseEdition = computed(() => {
@@ -59,6 +62,11 @@ export const useLicenseStore = defineStore("LicenseStore", () => {
   });
 
   async function refresh() {
+    await ensureManifestLoaded();
+    if (!canCall(ApiRoutes.viewLicense)) {
+      return;
+    }
+
     loading.value = true;
     try {
       const lic = await getLicense();
diff --git a/src/Frontend/src/stores/RedirectsStore.ts b/src/Frontend/src/stores/RedirectsStore.ts
index 1cc7dcc5f..63dbc2cde 100644
--- a/src/Frontend/src/stores/RedirectsStore.ts
+++ b/src/Frontend/src/stores/RedirectsStore.ts
@@ -24,7 +24,7 @@ export const useRedirectsStore = defineStore("RedirectsStore", () => {
   const { store: environmentStore } = useEnvironmentAndVersionsAutoRefresh();
   const hasResponseStatusInHeader = environmentStore.serviceControlIsGreaterThan("5.2.0");
 
-  const { canCall } = useAllowedRoutes();
+  const { canCall, ensureManifestLoaded } = useAllowedRoutes();
   const canManageRedirects = computed(() => canCall(ApiRoutes.manageRedirects));
 
   async function getKnownQueues() {
@@ -39,6 +39,11 @@ export const useRedirectsStore = defineStore("RedirectsStore", () => {
   }
 
   async function refresh() {
+    await ensureManifestLoaded();
+    if (!canCall(ApiRoutes.viewRedirects)) {
+      return;
+    }
+
     await Promise.all([getRedirects(), getKnownQueues()]);
   }
 
diff --git a/src/Frontend/src/stores/ThroughputStore.spec.ts b/src/Frontend/src/stores/ThroughputStore.spec.ts
index 0a97893fa..1fa4dbb39 100644
--- a/src/Frontend/src/stores/ThroughputStore.spec.ts
+++ b/src/Frontend/src/stores/ThroughputStore.spec.ts
@@ -9,11 +9,16 @@ import { setActivePinia, storeToRefs } from "pinia";
 import type { Driver } from "../../test/driver";
 import { disableMonitoring } from "../../test/drivers/vitest/setup";
 import { useEnvironmentAndVersionsStore } from "./EnvironmentAndVersionsStore";
+import type { ManifestEntry } from "@/stores/AllowedRoutesStore";
+
+function makeRoutes(keys: string[]): Map<string, ManifestEntry> {
+  return new Map(keys.map((k) => [k, { method: "", url_template: "" }]));
+}
 
 describe("ThroughputStore tests", () => {
-  async function setup(preSetup: (driver: Driver) => Promise<void>) {
+  async function setup(preSetup: (driver: Driver) => Promise<void>, initialState?: Record<string, unknown>) {
     const driver = makeDriverForTests();
-    setActivePinia(createTestingPinia({ stubActions: false }));
+    setActivePinia(createTestingPinia({ stubActions: false, initialState }));
 
     await preSetup(driver);
     await driver.setUp(serviceControlWithThroughput);
@@ -37,6 +42,26 @@ describe("ThroughputStore tests", () => {
     expect(hasErrors.value).toBe(false);
   });
 
+  test("does not call the licensing connection test when lacking permission to view the license", async () => {
+    let called = false;
+    const { testResults } = await setup(
+      async (driver) => {
+        await driver.setUp(precondition.hasLicensingSettingTest({ transport: Transport.AmazonSQS }));
+        driver.mockEndpointDynamic(`${window.defaultConfig.service_control_url}licensing/settings/test`, "get", () => {
+          called = true;
+          return Promise.resolve({ body: {} });
+        });
+      },
+      {
+        auth: { authEnabled: true, isAuthenticated: true },
+        AllowedRoutesStore: { routes: makeRoutes([]), loaded: true, loadAttempted: true },
+      }
+    );
+
+    expect(called).toBe(false);
+    expect(testResults.value).toBe(null);
+  });
+
   describe("when transport is a broker", () => {
     const transport = Transport.AmazonSQS;
 
diff --git a/src/Frontend/src/stores/ThroughputStore.ts b/src/Frontend/src/stores/ThroughputStore.ts
index 60e702a07..70d759c44 100644
--- a/src/Frontend/src/stores/ThroughputStore.ts
+++ b/src/Frontend/src/stores/ThroughputStore.ts
@@ -6,17 +6,24 @@ import { Transport } from "@/views/throughputreport/transport";
 import useIsThroughputSupported from "@/views/throughputreport/isThroughputSupported";
 import monitoringClient from "@/components/monitoring/monitoringClient";
 import logger from "@/logger";
+import { useAllowedRoutes } from "@/composables/useAllowedRoutes";
+import { ApiRoutes } from "@/composables/apiRoutes";
 
 export const useThroughputStore = defineStore("ThroughputStore", () => {
   const isMonitoringEnabled = monitoringClient.isMonitoringEnabled;
   const testResults = ref<ConnectionTestResults | null>(null);
   const isThroughputSupported = useIsThroughputSupported();
   const throughputClient = createThroughputClient();
+  const { canCall, ensureManifestLoaded } = useAllowedRoutes();
 
   const refresh = async () => {
     if (!isThroughputSupported.value) {
       return;
     }
+    await ensureManifestLoaded();
+    if (!canCall(ApiRoutes.viewLicense)) {
+      return;
+    }
     try {
       testResults.value = await throughputClient.test();
     } catch (error) {
diff --git a/src/Frontend/src/views/ConfigurationView.vue b/src/Frontend/src/views/ConfigurationView.vue
index f823e23a1..bb700d78e 100644
--- a/src/Frontend/src/views/ConfigurationView.vue
+++ b/src/Frontend/src/views/ConfigurationView.vue
@@ -28,6 +28,14 @@ const authStore = useAuthStore();
 // the tab row is held until permissions are known, so tabs don't appear and then disappear.
 const { canCall, ready } = useAllowedRoutes();
 
+const licenseDeniedTooltip = "You don't have permission to view License.";
+const usageSetupDeniedTooltip = "You don't have permission to view Usage Setup.";
+const massTransitConnectorDeniedTooltip = "You don't have permission to view MassTransit Connector.";
+const healthCheckNotificationsDeniedTooltip = "You don't have permission to view Health Check Notifications.";
+const retryRedirectsDeniedTooltip = "You don't have permission to view Retry Redirects.";
+const connectionsDeniedTooltip = "You don't have permission to view Connections.";
+const endpointConnectionDeniedTooltip = "You don't have permission to view Endpoint Connection.";
+
 onMounted(async () => {
   if (notConnected.value) {
     const router = useRouter();
@@ -45,8 +53,8 @@ const notConnected = computed(() => !connectionState.connected && !connectionSta
 
 const defaultRouteNotConnected = useLink({ to: routeLinks.configuration.connections.link }).route.value;
 
-function preventIfDisabled(e: Event) {
-  if (notConnected.value) {
+function preventIfDisabled(e: Event, disabled: boolean) {
+  if (disabled) {
     e.preventDefault();
   }
 }
@@ -62,14 +70,24 @@ function preventIfDisabled(e: Event) {
     <div class="row">
       <div class="col-sm-12">
         <div class="nav tabs" v-if="ready">
-          <h5 v-if="canCall(ApiRoutes.viewLicense)" :class="{ active: isRouteSelected(routeLinks.configuration.license.link), disabled: notConnected }" @click.capture="preventIfDisabled" class="nav-item" role="tab" aria-label="license">
+          <h5
+            :class="{ active: isRouteSelected(routeLinks.configuration.license.link), disabled: notConnected || !canCall(ApiRoutes.viewLicense) }"
+            @click.capture="preventIfDisabled($event, notConnected || !canCall(ApiRoutes.viewLicense))"
+            v-tippy="!canCall(ApiRoutes.viewLicense) ? licenseDeniedTooltip : ''"
+            class="nav-item"
+            role="tab"
+            aria-label="license"
+          >
             <RouterLink :to="routeLinks.configuration.license.link">License</RouterLink>
             <exclamation-mark :type="convertToWarningLevel(licenseStatus.warningLevel)" />
           </h5>
           <h5
-            v-if="canCall(ApiRoutes.manageThroughput)"
-            :class="{ active: isRouteSelected(routeLinks.throughput.setup.root) || isRouteSelected(routeLinks.throughput.setup.mask.link) || isRouteSelected(routeLinks.throughput.setup.diagnostics.link), disabled: notConnected }"
-            @click.capture="preventIfDisabled"
+            :class="{
+              active: isRouteSelected(routeLinks.throughput.setup.root) || isRouteSelected(routeLinks.throughput.setup.mask.link) || isRouteSelected(routeLinks.throughput.setup.diagnostics.link),
+              disabled: notConnected || !canCall(ApiRoutes.manageThroughput),
+            }"
+            @click.capture="preventIfDisabled($event, notConnected || !canCall(ApiRoutes.manageThroughput))"
+            v-tippy="!canCall(ApiRoutes.manageThroughput) ? usageSetupDeniedTooltip : ''"
             class="nav-item"
             role="tab"
             aria-label="usage-setup"
@@ -79,12 +97,12 @@ function preventIfDisabled(e: Event) {
           </h5>
           <template v-if="!licenseStatus.isExpired">
             <h5
-              v-if="canCall(ApiRoutes.viewConnections)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.massTransitConnector.link),
-                disabled: notConnected,
+                disabled: notConnected || !canCall(ApiRoutes.viewConnections),
               }"
-              @click.capture="preventIfDisabled"
+              @click.capture="preventIfDisabled($event, notConnected || !canCall(ApiRoutes.viewConnections))"
+              v-tippy="!canCall(ApiRoutes.viewConnections) ? massTransitConnectorDeniedTooltip : ''"
               class="nav-item"
               role="tab"
               aria-label="mass-transit-connector"
@@ -92,12 +110,12 @@ function preventIfDisabled(e: Event) {
               <RouterLink :to="routeLinks.configuration.massTransitConnector.link">MassTransit Connector</RouterLink>
             </h5>
             <h5
-              v-if="canCall(ApiRoutes.viewNotifications)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.healthCheckNotifications.link),
-                disabled: notConnected,
+                disabled: notConnected || !canCall(ApiRoutes.viewNotifications),
               }"
-              @click.capture="preventIfDisabled"
+              @click.capture="preventIfDisabled($event, notConnected || !canCall(ApiRoutes.viewNotifications))"
+              v-tippy="!canCall(ApiRoutes.viewNotifications) ? healthCheckNotificationsDeniedTooltip : ''"
               class="nav-item"
               role="tab"
               aria-label="health-check-notifications"
@@ -105,12 +123,12 @@ function preventIfDisabled(e: Event) {
               <RouterLink :to="routeLinks.configuration.healthCheckNotifications.link">Health Check Notifications</RouterLink>
             </h5>
             <h5
-              v-if="canCall(ApiRoutes.viewRedirects)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.retryRedirects.link),
-                disabled: notConnected,
+                disabled: notConnected || !canCall(ApiRoutes.viewRedirects),
               }"
-              @click.capture="preventIfDisabled"
+              @click.capture="preventIfDisabled($event, notConnected || !canCall(ApiRoutes.viewRedirects))"
+              v-tippy="!canCall(ApiRoutes.viewRedirects) ? retryRedirectsDeniedTooltip : ''"
               class="nav-item"
               role="tab"
               aria-label="retry-redirects"
@@ -118,10 +136,12 @@ function preventIfDisabled(e: Event) {
               <RouterLink :to="routeLinks.configuration.retryRedirects.link">Retry Redirects ({{ redirectsStore.redirects.total }})</RouterLink>
             </h5>
             <h5
-              v-if="canCall(ApiRoutes.viewConnections)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.connections.link),
+                disabled: !canCall(ApiRoutes.viewConnections),
               }"
+              @click.capture="preventIfDisabled($event, !canCall(ApiRoutes.viewConnections))"
+              v-tippy="!canCall(ApiRoutes.viewConnections) ? connectionsDeniedTooltip : ''"
               class="nav-item"
               role="tab"
               aria-label="connections"
@@ -132,12 +152,12 @@ function preventIfDisabled(e: Event) {
               </RouterLink>
             </h5>
             <h5
-              v-if="canCall(ApiRoutes.viewEndpoints)"
               :class="{
                 active: isRouteSelected(routeLinks.configuration.endpointConnection.link),
-                disabled: notConnected,
+                disabled: notConnected || !canCall(ApiRoutes.viewEndpoints),
               }"
-              @click.capture="preventIfDisabled"
+              @click.capture="preventIfDisabled($event, notConnected || !canCall(ApiRoutes.viewEndpoints))"
+              v-tippy="!canCall(ApiRoutes.viewEndpoints) ? endpointConnectionDeniedTooltip : ''"
               class="nav-item"
               role="tab"
               aria-label="endpoint-connection"
@@ -146,14 +166,28 @@ function preventIfDisabled(e: Event) {
             </h5>
           </template>
           <template v-else>
-            <h5 v-if="canCall(ApiRoutes.viewConnections)" :class="{ active: isRouteSelected(routeLinks.configuration.connections.link) }" class="nav-item" role="tab" aria-label="connections">
+            <h5
+              :class="{ active: isRouteSelected(routeLinks.configuration.connections.link), disabled: !canCall(ApiRoutes.viewConnections) }"
+              @click.capture="preventIfDisabled($event, !canCall(ApiRoutes.viewConnections))"
+              v-tippy="!canCall(ApiRoutes.viewConnections) ? connectionsDeniedTooltip : ''"
+              class="nav-item"
+              role="tab"
+              aria-label="connections"
+            >
               <RouterLink :to="routeLinks.configuration.connections.link">
                 Connections
                 <exclamation-mark v-if="connectionStore.displayConnectionsWarning" :type="WarningLevel.Danger" />
               </RouterLink>
             </h5>
           </template>
-          <h5 v-if="authStore.authEnabled" :class="{ active: isRouteSelected(routeLinks.configuration.userPermissions.link), disabled: notConnected }" @click.capture="preventIfDisabled" class="nav-item" role="tab" aria-label="user-permissions">
+          <h5
+            v-if="authStore.authEnabled"
+            :class="{ active: isRouteSelected(routeLinks.configuration.userPermissions.link), disabled: notConnected }"
+            @click.capture="preventIfDisabled($event, notConnected)"
+            class="nav-item"
+            role="tab"
+            aria-label="user-permissions"
+          >
             <RouterLink :to="routeLinks.configuration.userPermissions.link">User Permissions</RouterLink>
           </h5>
         </div>