diff --git a/README.md b/README.md
index 9d33c0815..f3813a511 100644
--- a/README.md
+++ b/README.md
@@ -73,7 +73,7 @@ for a verification system:
 
 -   [API guide](docs/api.md)
 -   [Exposure Notifications Express SMS / Deep Link Handling](docs/link_handling.md)
--   [Realm admin guide](docs/realm-admin-guide.md)
+-   [Realm administration guide](docs/realm-admin-guide.md)
 -   [Case worker guide](docs/case-worker-guide.md)
 -   [System admin guide](docs/system-admin-guide.md)
 -   [Development](docs/development.md)
diff --git a/cmd/server/assets/401.html b/cmd/server/assets/401.html
new file mode 100644
index 000000000..2531164d4
--- /dev/null
+++ b/cmd/server/assets/401.html
@@ -0,0 +1,21 @@
+{{define "401"}}
+<!doctype html>
+<html lang="en">
+<head>
+  {{template "head" .}}
+</head>
+
+<body>
+  <main role="main" class="container mt-5">
+    <h1>Unauthorized</h1>
+    <p>
+      You are not authorized to perform that action!
+    </p>
+    <div class="d-flex justify-content-between">
+      <a href="#" onclick="history.go(-1); return false;">&larr; Go back</a>
+      <a href="/signout">Sign out</a>
+    </div>
+  </main>
+</body>
+</html>
+{{end}}
diff --git a/cmd/server/assets/404.html b/cmd/server/assets/404.html
new file mode 100644
index 000000000..15b16c18d
--- /dev/null
+++ b/cmd/server/assets/404.html
@@ -0,0 +1,20 @@
+{{define "404"}}
+<!doctype html>
+<html lang="en">
+<head>
+  {{template "head" .}}
+</head>
+
+<body>
+  <main role="main" class="container mt-5">
+    <h1>Not Found</h1>
+    <p>
+      The resource you attempted to access does not exist.
+    </p>
+    <p>
+      <a href="#" onclick="history.go(-1); return false;">&larr; Go back</a>
+    </p>
+  </main>
+</body>
+</html>
+{{end}}
diff --git a/cmd/server/assets/admin/_nav.html b/cmd/server/assets/admin/_nav.html
index bede139cf..dea2af14b 100644
--- a/cmd/server/assets/admin/_nav.html
+++ b/cmd/server/assets/admin/_nav.html
@@ -1,4 +1,7 @@
 {{define "admin/navbar"}}
+
+{{$currentMemberships := .currentMemberships}}
+
 <header class="mb-3">
   <div href="/" class="d-block px-3 py-2 text-center text-bold text-white admin-header">
     System admin
@@ -7,14 +10,22 @@
   <nav class="nav nav-tabs navbar-expand-md navbar-light bg-light">
     <div class="container">
       {{template "navtoggle" .}}
+
       <div class="collapse navbar-collapse mt-2" id="navbar">
-        {{if .currentRealm}}
         <ul class="navbar-nav mr-auto">
           <li class="nav-item">
-            <a class="nav-link" href="/codes/issue">&larr; Back to {{.currentRealm.Name}} </a>
+            {{if eq (len $currentMemberships) 1}}
+              <a class="nav-link" href="/codes/issue">
+                &larr; Back to {{(index $currentMemberships 0).Realm.Name}}
+              </a>
+            {{else if gt (len $currentMemberships) 1}}
+              <a class="nav-link" href="/login/select-realm">
+                &larr; Back to realm selection
+              </a>
+            {{end}}
           </li>
         </ul>
-        {{end}}
+
         {{template "navdropdown" .}}
       </div>
     </div>
diff --git a/cmd/server/assets/admin/info.html b/cmd/server/assets/admin/info.html
index 499c242e1..98d8ad871 100644
--- a/cmd/server/assets/admin/info.html
+++ b/cmd/server/assets/admin/info.html
@@ -12,9 +12,9 @@
   <main role="main" class="container">
     {{template "flash" .}}
 
-    <div class="card mb-3 shadow-sm">
+    <div class="card shadow-sm mb-3">
       <div class="card-header">Info</div>
-      <div class="card-body">
+      <div class="card-body mb-n3">
         <dl>
           <dt>Build ID</dt>
           <dd>{{.buildID}}</dd>
diff --git a/cmd/server/assets/admin/realms/edit.html b/cmd/server/assets/admin/realms/edit.html
index f6bcfffba..3dd1396e4 100644
--- a/cmd/server/assets/admin/realms/edit.html
+++ b/cmd/server/assets/admin/realms/edit.html
@@ -2,6 +2,7 @@
 
 {{$currentUser := .currentUser}}
 {{$realm := .realm}}
+{{$membership := .membership}}
 {{$systemSMSConfig := .systemSMSConfig}}
 {{$systemEmailConfig := .systemEmailConfig}}
 
@@ -23,20 +24,7 @@ <h1>Edit {{$realm.Name}}</h1>
     </p>
 
     <div class="card mb-3 shadow-sm">
-      <div class="card-header">
-        {{if $currentUser.CanAdminRealm $realm.ID}}
-        <a href="/admin/realms/{{$realm.ID}}/realmadmin">
-          <span class="oi oi-wrench text-dark" aria-hidden="true"
-          data-toggle="tooltip" title="Edit as realm admin"></span>
-        </a>
-        {{else}}
-        <span data-toggle="tooltip" title="Join realm to configure as realm admin">
-          <a class="disabled">
-            <span class="oi oi-wrench" aria-hidden="true"></span>
-          </a>
-        </span>
-        {{end}}
-        Details</div>
+      <div class="card-header">Details</div>
       <div class="card-body">
         <form method="POST" action="/admin/realms/{{$realm.ID}}">
           {{ .csrfField }}
@@ -133,7 +121,7 @@ <h6 class="mb-2">View</h6>
       </div>
     </div>
 
-    {{if $currentUser.CanAdminRealm $realm.ID}}
+    {{if $membership.Can rbac.SettingsWrite}}
       <div class="card mb-3 shadow-sm">
         <div class="card-header">Leave realm</div>
         <div class="card-body">
diff --git a/cmd/server/assets/admin/realms/index.html b/cmd/server/assets/admin/realms/index.html
index 24e56766d..a9574c99c 100644
--- a/cmd/server/assets/admin/realms/index.html
+++ b/cmd/server/assets/admin/realms/index.html
@@ -1,6 +1,7 @@
 {{define "admin/realms/index"}}
 
 {{$realms := .realms}}
+{{$memberships := .memberships}}
 
 <!doctype html>
 <html lang="en">
@@ -53,7 +54,13 @@
             <tr>
               <td class="text-center">{{.ID}}</td>
               <td>
-                <a href="/admin/realms/{{.ID}}/edit">{{.Name}}</a>
+                <a href="/admin/realms/{{.ID}}/edit">
+                  {{.Name}}
+                </a>
+                {{if (index $memberships .ID)}}
+                  <span class="small oi oi-circle-check text-success ml-1" aria-hidden="true"
+                    data-toggle="tooltip" title="You have permissions on this realm"></span>
+                {{end}}
               </td>
               <td class="text-center">{{.RegionCode}}</td>
               <td class="text-center">
diff --git a/cmd/server/assets/admin/users/index.html b/cmd/server/assets/admin/users/index.html
index 261570cd7..e41273942 100644
--- a/cmd/server/assets/admin/users/index.html
+++ b/cmd/server/assets/admin/users/index.html
@@ -30,7 +30,6 @@
             <span class="input-group-prepend">
               <select name="filter" id="filter" class="text-truncate custom-select dropdown-toggle border-right-0" style="border-radius:0.25rem 0 0 0.25rem;">
                 <option value="" selected>All users</option>
-                <option value="realmAdmins" {{selectedIf (eq .filter "realmAdmins")}}>Realm admins</option>
                 <option value="systemAdmins" {{selectedIf (eq .filter "systemAdmins")}}>System admins</option>
               </select>
             </span>
@@ -50,7 +49,6 @@
         <table class="table table-bordered table-striped table-fixed table-inner-border-only border-top mb-0" id="results-table">
           <thead>
             <tr>
-              <th scope="col" width="40"></th>
               <th scope="col">Name</th>
               <th scope="col">Email</th>
               <th scope="col" width="40"></th>
@@ -59,17 +57,11 @@
           <tbody>
           {{range $users}}
             <tr>
-              <td class="text-center">
-                {{if .SystemAdmin}}
-                <span class="oi oi-wrench" aria-hidden="true"
-                  data-toggle="tooltip" title="System admin"></span>
-                {{end}}
-              </td>
               <td class="text-truncate">
                 <a href="/admin/users/{{.ID}}">{{.Name}}</a>
-                {{if .IsRealmAdmin}}
-                <span class="oi oi-badge ml-2" aria-hidden="true"
-                  data-toggle="tooltip" title="Realm admin"></span>
+                {{if .SystemAdmin}}
+                  <span class="oi oi-wrench ml-1" aria-hidden="true"
+                    data-toggle="tooltip" title="System admin"></span>
                 {{end}}
               </td>
               <td class="text-truncate">{{.Email}}</td>
diff --git a/cmd/server/assets/admin/users/show.html b/cmd/server/assets/admin/users/show.html
index a333534e0..b7e7bc0bc 100644
--- a/cmd/server/assets/admin/users/show.html
+++ b/cmd/server/assets/admin/users/show.html
@@ -1,6 +1,7 @@
 {{define "admin/users/show"}}
+
 {{$user := .user}}
-{{$stats := .stats}}
+{{$memberships := .memberships}}
 
 <!doctype html>
 <html lang="en">
@@ -49,24 +50,20 @@ <h6 class="mb-2">System admin</h6>
 
     <div class="card mb-3 shadow-sm">
       <div class="card-header">Member of realms</div>
-      {{if $user.Realms}}
+      {{if $memberships}}
         <ul class="list-group list-group-flush">
-          {{range $realm := $user.Realms}}
-          <li class="list-group-item d-flex justify-content-between">
-            <div>
-              {{$realm.Name}}
-              {{if $user.CanAdminRealm $realm.ID}}
-                <span class="badge badge-primary ml-2">Admin</span>
-              {{end}}
-            </div>
+          {{range $membership := $memberships}}
+            {{$realm := $membership.Realm}}
+            {{$user := $membership.User}}
+            <li class="list-group-item d-flex justify-content-between">
+              <span>{{$realm.Name}}</span>
 
-            <a href="/admin/realms/{{$realm.ID}}/remove/{{$user.ID}}" class="text-danger"
-              data-toggle="tooltip" title="Remove from realm"
-              data-method="PATCH" data-confirm="Are you sure you want to remove {{$user.Name}} from {{$realm.Name}}?">
-              <span class="sr-only">Remove from realm</span>
-              <span class="oi oi-x" aria-hidden="true"></span>
-            </a>
-          </li>
+              <a href="/admin/realms/{{$realm.ID}}/remove/{{$user.ID}}" class="text-danger"
+                data-toggle="tooltip" title="Remove from realm"
+                data-method="PATCH" data-confirm="Are you sure you want to remove {{$membership.User.Name}} from {{$realm.Name}}?">
+                <span class="oi oi-x" aria-hidden="true"></span>
+              </a>
+            </li>
           {{end}}
         </ul>
       {{else}}
diff --git a/cmd/server/assets/apikeys/index.html b/cmd/server/assets/apikeys/index.html
index d2e6556d3..dd2d8c19a 100644
--- a/cmd/server/assets/apikeys/index.html
+++ b/cmd/server/assets/apikeys/index.html
@@ -2,6 +2,9 @@
 
 {{$authApp := .authApp}}
 
+{{$currentMembership := .currentMembership}}
+{{$canWrite := $currentMembership.Can rbac.APIKeyWrite}}
+
 <!doctype html>
 <html lang="en">
 <head>
@@ -14,13 +17,15 @@
   <main role="main" class="container">
     {{template "flash" .}}
 
-    <div class="card mt-4 mb-3">
+    <div class="card shadow-sm mt-4 mb-3">
       <div class="card-header">
         <span class="oi oi-key mr-2 ml-n1" aria-hidden="true"></span>
         API keys
-        <a href="/realm/apikeys/new" class="float-right mr-n1 text-secondary" data-toggle="tooltip" title="New API key">
-          <span class="oi oi-plus small" aria-hidden="true"></span>
-        </a>
+        {{if $canWrite}}
+          <a href="/realm/apikeys/new" class="float-right mr-n1 text-secondary" data-toggle="tooltip" title="New API key">
+            <span class="oi oi-plus small" aria-hidden="true"></span>
+          </a>
+        {{end}}
       </div>
 
       <div class="card-body">
@@ -46,7 +51,9 @@
               <th scope="col">App</th>
               <th scope="col" width="90">Key</th>
               <th scope="col" width="90">Type</th>
-              <th scope="col" width="40"></th>
+              {{if $canWrite}}
+                <th scope="col" width="40"></th>
+              {{end}}
             </tr>
           </thead>
           <tbody>
@@ -71,25 +78,27 @@
                 {{if .IsAdminType}}<span class="badge badge-pill badge-primary" data-toggle="tooltip" title="Can be used to issue verification codes">Admin</span>{{end}}
                 {{if .IsDeviceType}}<span class="badge badge-pill badge-secondary" data-toggle="tooltip" title="For use in mobile apps to verify codes and get certificates">Device</span>{{end}}
               </td>
-              <td class="text-center">
-                {{if .DeletedAt}}
-                <a href="/realm/apikeys/{{.ID}}/enable" class="d-block text-danger"
-                  data-method="patch"
-                  data-confirm="Are you sure you want to restore '{{.Name}}'?"
-                  data-toggle="tooltip"
-                  title="Restore this API key">
-                  <span class="oi oi-loop-circular" aria-hidden="true"></span>
-                </a>
-                {{else}}
-                <a href="/realm/apikeys/{{.ID}}/disable" class="d-block text-danger"
-                  data-method="patch"
-                  data-confirm="Are you sure you want to disable '{{.Name}}'?"
-                  data-toggle="tooltip"
-                  title="Disable this API key">
-                  <span class="oi oi-trash" aria-hidden="true"></span>
-                </a>
-                {{end}}
-              </td>
+              {{if $canWrite}}
+                <td class="text-center">
+                  {{if .DeletedAt}}
+                  <a href="/realm/apikeys/{{.ID}}/enable" class="d-block text-danger"
+                    data-method="patch"
+                    data-confirm="Are you sure you want to restore '{{.Name}}'?"
+                    data-toggle="tooltip"
+                    title="Restore this API key">
+                    <span class="oi oi-loop-circular" aria-hidden="true"></span>
+                  </a>
+                  {{else}}
+                  <a href="/realm/apikeys/{{.ID}}/disable" class="d-block text-danger"
+                    data-method="patch"
+                    data-confirm="Are you sure you want to disable '{{.Name}}'?"
+                    data-toggle="tooltip"
+                    title="Disable this API key">
+                    <span class="oi oi-trash" aria-hidden="true"></span>
+                  </a>
+                  {{end}}
+                </td>
+              {{end}}
             </tr>
           {{end}}
           </tbody>
diff --git a/cmd/server/assets/apikeys/show.html b/cmd/server/assets/apikeys/show.html
index f1f5acf8a..8edfe60f7 100644
--- a/cmd/server/assets/apikeys/show.html
+++ b/cmd/server/assets/apikeys/show.html
@@ -4,6 +4,9 @@
 {{$authApp := .authApp}}
 {{$stats := .stats}}
 
+{{$currentMembership := .currentMembership}}
+{{$canWrite := $currentMembership.Can rbac.APIKeyWrite}}
+
 <!doctype html>
 <html lang="en">
 
@@ -40,9 +43,11 @@ <h1>{{$authApp.Name}} API key</h1>
       <div class="card-header">
         <span class="oi oi-key mr-2 ml-n1" aria-hidden="true"></span>
         Details about {{$authApp.Name}}
-        <a href="/realm/apikeys/{{$authApp.ID}}/edit" class="float-right mr-n1 text-body" id="edit" data-toggle="tooltip" title="Edit this API key">
-          <span class="oi oi-pencil" aria-hidden="true"></span>
-        </a>
+        {{if $canWrite}}
+          <a href="/realm/apikeys/{{$authApp.ID}}/edit" class="float-right mr-n1 text-body" id="edit" data-toggle="tooltip" title="Edit this API key">
+            <span class="oi oi-pencil" aria-hidden="true"></span>
+          </a>
+        {{end}}
       </div>
       <div class="card-body">
         <strong>App name</strong>
diff --git a/cmd/server/assets/codes/index.html b/cmd/server/assets/codes/index.html
index 90bcbbb81..99c14000f 100644
--- a/cmd/server/assets/codes/index.html
+++ b/cmd/server/assets/codes/index.html
@@ -53,6 +53,10 @@ <h1>Verification code status</h1>
               {{$code.CreatedAt.Format "2006-02-01 15:04"}}
             </small>
           </a>
+        {{else}}
+          <div class="card-body text-center">
+            <em>You have not issued any codes recently.</em>
+          </div>
         {{end}}
       </div>
     </div>
diff --git a/cmd/server/assets/codes/issue.html b/cmd/server/assets/codes/issue.html
index 6aeeec184..ea289ff87 100644
--- a/cmd/server/assets/codes/issue.html
+++ b/cmd/server/assets/codes/issue.html
@@ -1,6 +1,7 @@
 {{define "codes/issue"}}
 
-{{$currentRealm := .currentRealm}}
+{{$currentMembership := .currentMembership}}
+{{$currentRealm := $currentMembership.Realm}}
 {{$hasSMSConfig := .hasSMSConfig}}
 
 <!doctype html>
diff --git a/cmd/server/assets/codes/show.html b/cmd/server/assets/codes/show.html
index f271792a9..13d7ab8e2 100644
--- a/cmd/server/assets/codes/show.html
+++ b/cmd/server/assets/codes/show.html
@@ -1,5 +1,8 @@
 {{define "codes/show"}}
 
+{{$currentMembership := .currentMembership}}
+{{$canWrite := $currentMembership.Can rbac.CodeExpire}}
+
 <!doctype html>
 <html lang="en">
 
@@ -40,27 +43,28 @@ <h5 class="mb-1">Status</h5>
           <p class="mb-1">{{.code.Status}}</p>
         </div>
         {{if not .code.Claimed}}
-        <div class="list-group-item">
-          <h5 class="mb-1">Short code expiry</h5>
-          <span id="code-expires-at" class="sm text-danger"
-            data-countdown-prefix="{{t $.locale "codes.issue.countdown-expires-in"}}"
-            data-countdown-expired="{{t $.locale "codes.issue.countdown-expired"}}">&nbsp;</span>
-        </div>
-        {{if .code.HasLongExpires}}
-        <div class="list-group-item">
-          <h5 class="mb-1">SMS link expiry</h5>
-          <span id="long-code-expires-at" class="sm text-danger"
-            data-countdown-prefix="{{t $.locale "codes.issue.countdown-expires-in"}}"
-            data-countdown-expired="{{t $.locale "codes.issue.countdown-expired"}}">&nbsp;</span>
-        </div>
-        {{end}}
+          <div class="list-group-item">
+            <h5 class="mb-1">Short code expiry</h5>
+            <span id="code-expires-at" class="sm text-danger"
+              data-countdown-prefix="{{t $.locale "codes.issue.countdown-expires-in"}}"
+              data-countdown-expired="{{t $.locale "codes.issue.countdown-expired"}}">&nbsp;</span>
+          </div>
+          {{if .code.HasLongExpires}}
+            <div class="list-group-item">
+              <h5 class="mb-1">SMS link expiry</h5>
+              <span id="long-code-expires-at" class="sm text-danger"
+                data-countdown-prefix="{{t $.locale "codes.issue.countdown-expires-in"}}"
+                data-countdown-expired="{{t $.locale "codes.issue.countdown-expired"}}">&nbsp;</span>
+            </div>
+          {{end}}
         {{end}}
-        {{if .code.Expires}}
-        <div class="list-group-item">
-          <a href="/codes/{{.code.UUID}}/expire" class="btn btn-danger d-block" data-method="PATCH" data-confirm="Are you sure you want to expire this code?">
-            Invalidate code now
-          </a>
-        </div>
+        {{if and $canWrite .code.Expires}}
+          <div class="list-group-item">
+            <a href="/codes/{{.code.UUID}}/expire" class="btn btn-danger d-block"
+              data-method="PATCH" data-confirm="Are you sure you want to expire this code?">
+              Invalidate code now
+            </a>
+          </div>
         {{end}}
       </div>
     </div>
diff --git a/cmd/server/assets/header.html b/cmd/server/assets/header.html
index 48100cd0b..6c92bbd96 100644
--- a/cmd/server/assets/header.html
+++ b/cmd/server/assets/header.html
@@ -40,16 +40,19 @@
 
 {{/* defines the top navigation bar */}}
 {{define "navbar"}}
+{{$currentMembership := .currentMembership}}
 <header class="mb-3">
-  {{if .currentRealm}}
-  <div href="/" class="d-block px-3 py-2 text-center text-bold text-white bg-primary">
-    {{.currentRealm.Name}}{{if .currentRealm.RegionCode}} - {{.currentRealm.RegionCode}}{{end}}
-  </div>
+  {{if $currentMembership}}
+    {{$currentRealm := $currentMembership.Realm}}
+    <div href="/" class="d-block px-3 py-2 text-center text-bold text-white bg-primary">
+      {{$currentRealm.Name}}{{if $currentRealm.RegionCode}} - {{$currentRealm.RegionCode}}{{end}}
+    </div>
   {{end}}
+
   {{if .maintenanceMode}}
-  <div class="alert alert-danger" role="alert">
-    The server is undergoing maintenance and is read-only. Requests to issue new codes will fail.
-  </div>
+    <div class="alert alert-danger" role="alert">
+      The server is undergoing maintenance and is read-only. Requests to issue new codes will fail.
+    </div>
   {{end}}
 
   <nav class="nav nav-tabs navbar-expand-md navbar-light bg-light">
@@ -57,21 +60,30 @@
       {{template "navtoggle" .}}
 
       <div class="collapse navbar-collapse mt-2" id="navbar">
-        {{if .currentRealm}}
         <ul class="nav mr-auto flex-column flex-md-row">
-          <li class="nav-item">
-            <a class="nav-link {{if .currentPath.IsDir "/codes/issue"}}active{{end}}" href="/codes/issue">{{t $.locale "nav.issue-code"}}</a>
-          </li>
-          {{if .currentRealm}}{{if .currentRealm.AllowBulkUpload}}
-          <li class="nav-item">
-            <a class="nav-link {{if .currentPath.IsDir "/codes/bulk-issue"}}active{{end}}" href="/codes/bulk-issue">{{t $.locale "nav.bulk-issue-codes"}}</a>
-          </li>
-          {{end}}{{end}}
-          <li class="nav-item">
-            <a class="nav-link {{if .currentPath.IsDir "/codes/status"}}active{{end}}" href="/codes/status">{{t $.locale "nav.check-code-status"}}</a>
-          </li>
+          {{if $currentMembership.Can rbac.CodeIssue}}
+            <li class="nav-item">
+              <a class="nav-link {{if .currentPath.IsDir "/codes/issue"}}active{{end}}" href="/codes/issue">
+                {{t $.locale "nav.issue-code"}}
+              </a>
+            </li>
+          {{end}}
+          {{if and $currentMembership.Realm.AllowBulkUpload ($currentMembership.Can rbac.CodeBulkIssue)}}
+            <li class="nav-item">
+              <a class="nav-link {{if .currentPath.IsDir "/codes/bulk-issue"}}active{{end}}" href="/codes/bulk-issue">
+                {{t $.locale "nav.bulk-issue-codes"}}
+              </a>
+            </li>
+          {{end}}
+          {{if $currentMembership.Can rbac.CodeRead}}
+            <li class="nav-item">
+              <a class="nav-link {{if .currentPath.IsDir "/codes/status"}}active{{end}}" href="/codes/status">
+                {{t $.locale "nav.check-code-status"}}
+              </a>
+            </li>
+          {{end}}
         </ul>
-        {{end}}
+
         {{template "navdropdown" .}}
       </div>
     </div>
@@ -89,48 +101,88 @@
 
 {{/* defines the user dropdown menu */}}
 {{define "navdropdown"}}
+{{$currentUser := .currentUser}}
+{{$currentMembership := .currentMembership}}
+{{$currentMemberships := .currentMemberships}}
 <ul class="navbar-nav ml-3">
-  {{if .currentUser}}
-  <li class="nav-item dropdown">
-    <a class="nav-link dropdown-toggle" href="#" id="profile-menu" data-toggle="dropdown" aria-haspopup="true"
-      aria-expanded="false">
-      {{.currentUser.Name}}
-    </a>
-
-    <div class="dropdown-menu dropdown-menu-right" aria-labelledby="profile-menu">
-      {{if .currentRealm }}
-      {{if .currentUser.CanAdminRealm .currentRealm.ID}}
-      <a class="dropdown-item {{if .currentPath.IsDir "/realm/apikeys"}}active{{end}}" href="/realm/apikeys">{{t $.locale "nav.api-keys"}}</a>
-      <a class="dropdown-item {{if .currentPath.IsDir "/realm/mobile-apps"}}active{{end}}" href="/realm/mobile-apps">{{t $.locale "nav.mobile-apps"}}</a>
-      <a class="dropdown-item {{if .currentPath.IsDir "/realm/events"}}active{{end}}" href="/realm/events">{{t $.locale "nav.event-log"}}</a>
-      <a class="dropdown-item {{if .currentPath.IsDir "/realm/keys"}}active{{end}}" href="/realm/keys">{{t $.locale "nav.signing-keys"}}</a>
-      <a class="dropdown-item {{if .currentPath.IsDir "/realm/stats"}}active{{end}}" href="/realm/stats">{{t $.locale "nav.statistics"}}</a>
-      <a class="dropdown-item {{if .currentPath.IsDir "/realm/users"}}active{{end}}" href="/realm/users">{{t $.locale "nav.users"}}</a>
-      <a class="dropdown-item {{if .currentPath.IsDir "/realm/settings"}}active{{end}}" href="/realm/settings#general">{{t $.locale "nav.settings"}}</a>
-      <div class="dropdown-divider"></div>
-      {{end}}
-      {{end}}
-
-      {{if gt (len .currentUser.Realms) 1}}
-      <a class="dropdown-item {{if .currentPath.IsDir "/login/select-realm"}}active{{end}}" href="/login/select-realm">
-        {{if .currentRealm}}{{t $.locale "nav.change-realm"}}{{else}}{{t $.locale "nav.select-realm"}}{{end}}
+  {{if $currentUser}}
+    <li class="nav-item dropdown">
+      <a class="nav-link dropdown-toggle" href="#" id="profile-menu"
+        data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+        <span class="oi oi-person"></span>
       </a>
-      <div class="dropdown-divider"></div>
-      {{end}}
 
-      {{if .currentUser.SystemAdmin}}
-      <a class="dropdown-item {{if .currentPath.IsDir "/admin"}}active{{end}}" href="/admin/realms">{{t $.locale "nav.system-admin"}}</a>
-      <div class="dropdown-divider"></div>
-      {{end}}
+      <div class="dropdown-menu dropdown-menu-right" aria-labelledby="profile-menu">
+        {{if $currentMembership}}
+          {{$showRealmMenu := false}}
+          {{if $currentMembership.Can rbac.APIKeyRead}}
+            {{$showRealmMenu = true}}
+            <a class="dropdown-item {{if .currentPath.IsDir "/realm/apikeys"}}active{{end}}" href="/realm/apikeys">
+              {{t $.locale "nav.api-keys"}}
+            </a>
+          {{end}}
+          {{if $currentMembership.Can rbac.MobileAppRead}}
+            {{$showRealmMenu = true}}
+            <a class="dropdown-item {{if .currentPath.IsDir "/realm/mobile-apps"}}active{{end}}" href="/realm/mobile-apps">
+              {{t $.locale "nav.mobile-apps"}}
+            </a>
+          {{end}}
+          {{if $currentMembership.Can rbac.AuditRead}}
+            {{$showRealmMenu = true}}
+            <a class="dropdown-item {{if .currentPath.IsDir "/realm/events"}}active{{end}}" href="/realm/events">
+              {{t $.locale "nav.event-log"}}
+            </a>
+          {{end}}
+          {{if $currentMembership.Can rbac.SettingsRead}}
+            {{$showRealmMenu = true}}
+            <a class="dropdown-item {{if .currentPath.IsDir "/realm/keys"}}active{{end}}" href="/realm/keys">
+              {{t $.locale "nav.signing-keys"}}
+            </a>
+          {{end}}
+          {{if $currentMembership.Can rbac.StatsRead}}
+            {{$showRealmMenu = true}}
+            <a class="dropdown-item {{if .currentPath.IsDir "/realm/stats"}}active{{end}}" href="/realm/stats">
+              {{t $.locale "nav.statistics"}}
+            </a>
+          {{end}}
+          {{if $currentMembership.Can rbac.UserRead}}
+            {{$showRealmMenu = true}}
+            <a class="dropdown-item {{if .currentPath.IsDir "/realm/users"}}active{{end}}" href="/realm/users">
+              {{t $.locale "nav.users"}}
+            </a>
+          {{end}}
+          {{if $currentMembership.Can rbac.SettingsRead}}
+            {{$showRealmMenu = true}}
+            <a class="dropdown-item {{if .currentPath.IsDir "/realm/settings"}}active{{end}}" href="/realm/settings#general">
+              {{t $.locale "nav.settings"}}
+            </a>
+          {{end}}
+          {{if $showRealmMenu}}
+            <div class="dropdown-divider"></div>
+          {{end}}
+        {{end}}
+
+        {{if gt (len $currentMemberships) 1}}
+          <a class="dropdown-item {{if .currentPath.IsDir "/login/select-realm"}}active{{end}}" href="/login/select-realm">
+            {{t $.locale "nav.change-realm"}}
+          </a>
+          <div class="dropdown-divider"></div>
+        {{end}}
 
-      <a class="dropdown-item {{if .currentPath.IsDir "/account"}}active{{end}}" href="/account">{{t $.locale "nav.my-account"}}</a>
-      <a class="dropdown-item" href="/signout">{{t $.locale "nav.sign-out"}}</a>
-    </div>
-  </li>
+        {{if $currentUser.SystemAdmin}}
+          <a class="dropdown-item {{if .currentPath.IsDir "/admin"}}active{{end}}" href="/admin/realms">{{t $.locale "nav.system-admin"}}</a>
+          <div class="dropdown-divider"></div>
+        {{end}}
+
+        <h6 class="dropdown-header">{{$currentUser.Name}}</h6>
+        <a class="dropdown-item {{if .currentPath.IsDir "/account"}}active{{end}}" href="/account">{{t $.locale "nav.my-account"}}</a>
+        <a class="dropdown-item" href="/signout">{{t $.locale "nav.sign-out"}}</a>
+      </div>
+    </li>
   {{else}}
-  <li class="nav-item">
-    <a class="nav-link" href="/">Sign in</a>
-  </li>
+    <li class="nav-item">
+      <a class="nav-link" href="/">Sign in</a>
+    </li>
   {{end}}
 </ul>
 {{end}}
diff --git a/cmd/server/assets/login/account.html b/cmd/server/assets/login/account.html
index a5c04bda2..127bab905 100644
--- a/cmd/server/assets/login/account.html
+++ b/cmd/server/assets/login/account.html
@@ -1,6 +1,7 @@
 {{define "account"}}
 
 {{$user := .currentUser}}
+{{$currentMemberships := .currentMemberships}}
 
 <!doctype html>
 <html lang="en">
@@ -10,7 +11,7 @@
   {{template "firebase" .}}
 </head>
 
-<body class="bg-light">
+<body>
   {{template "navbar" .}}
 
   <main role="main" class="container">
@@ -58,31 +59,23 @@ <h6 class="card-title  mt-3">System admin</h6>
     </div>
 
     <div class="card mb-3 shadow-sm">
-      <div class="card">
-        <div class="card-header">Member of realms</div>
-        <ul class="list-group list-group-flush">
-          {{range $realm := $user.Realms}}
-          <li class="list-group-item">
-            {{$realm.Name}}
-
-            {{range $admin := $user.AdminRealms}}
-            {{if eq $admin.ID $realm.ID}}
-            <span class="badge badge-primary">Admin</span>
-            {{end}}
-            {{end}}
-
-            {{- /* system admins can remove themselves from realms */ -}}
-            {{if $user.SystemAdmin}}
-            <a href="/realm/users/{{.ID}}" class="d-block text-danger float-right" data-method="DELETE"
-              data-confirm="Are you sure you want to leave {{.Name}}?">
+      <div class="card-header">Member of realms</div>
+      <ul class="list-group list-group-flush">
+        {{range $membership := $currentMemberships}}
+        <li class="list-group-item">
+          {{$membership.Realm.Name}}
+
+          {{- /* system admins can remove themselves from realms */ -}}
+          {{if $user.SystemAdmin}}
+            <a href="/realm/users/{{$membership.Realm.ID}}" class="d-block text-danger float-right" data-method="DELETE"
+              data-confirm="Are you sure you want to leave {{$membership.Realm.Name}}?">
               <span class="oi oi-account-logout" aria-hidden="true"></span>
               Leave realm
             </a>
-            {{end}}
-          </li>
           {{end}}
-        </ul>
-      </div>
+        </li>
+        {{end}}
+      </ul>
     </div>
   </main>
 
diff --git a/cmd/server/assets/login/change-password.html b/cmd/server/assets/login/change-password.html
index 604d6e12c..fd6ac7a47 100644
--- a/cmd/server/assets/login/change-password.html
+++ b/cmd/server/assets/login/change-password.html
@@ -63,6 +63,7 @@
 <script type="text/javascript">
     $(function() {
       {{template "login/requirements" .}}
+
       let $form = $('#password-form');
       let $newPassword = $('#new-password');
       let $email = $('#email');
@@ -70,8 +71,8 @@
       let $submit = $('#submit');
 
       $newPassword.on("change keyup paste", function() {
-          $submit.prop('disabled', !checkPasswordValid($newPassword.val(), $retype.val(), requirements));
-        });
+        $submit.prop('disabled', !checkPasswordValid($newPassword.val(), $retype.val(), requirements));
+      });
       $retype.on("change keyup paste", function() {
         $submit.prop('disabled', !checkPasswordValid($newPassword.val(), $retype.val(), requirements));
       });
diff --git a/cmd/server/assets/login/login.html b/cmd/server/assets/login/login.html
index 33f8a291f..89499a6b0 100644
--- a/cmd/server/assets/login/login.html
+++ b/cmd/server/assets/login/login.html
@@ -1,4 +1,7 @@
 {{define "login"}}
+
+{{$currentUser := .currentUser}}
+
 <!doctype html>
 <html lang="en">
 
@@ -8,8 +11,8 @@
 </head>
 
 <body id="login" class="tab-content">
-  {{if .currentUser}}
-  {{template "navbar" .}}
+  {{if $currentUser}}
+    {{template "navbar" .}}
   {{end}}
   <main role="main" class="container">
     {{template "flash" .}}
@@ -17,18 +20,18 @@
     <div class="d-flex vh-100">
       <div class="d-flex w-100 justify-content-center align-self-center">
         <div class="col-sm-6">
-
           <div class="card shadow-sm" id="login-div">
-            {{if .currentUser}}
-            <div class="card-header">Refresh authentication</div>
+            {{if $currentUser}}
+              <div class="card-header">Refresh authentication</div>
             {{else}}
-            <div class="card-header">COVID-19 test verification</div>
+              <div class="card-header">COVID-19 test verification</div>
             {{end}}
+
             <div class="card-body">
               <form id="login-form" class="floating-form" action="/" method="POST">
                 <div class="form-label-group">
                   <input type="email" id="email" name="email" class="form-control" placeholder="Email address"
-                  autocomplete="username" required autofocus {{if .currentUser}}disabled value="{{.currentUser.Email}}"{{end}}/>
+                  autocomplete="username" required autofocus {{if $currentUser}}disabled value="{{$currentUser.Email}}"{{end}}/>
                   <label for="email">Email address</label>
                 </div>
 
@@ -48,10 +51,11 @@
           {{template "login/factorsdiv" .}}
 
           {{if .loginRedirect}}
-          <div class="card-body">
-            <a class="card-link" href="/{{.loginRedirect}}">&larr; Back</a>
-          </div>
+            <div class="card-body">
+              <a class="card-link" href="/{{.loginRedirect}}">&larr; Back</a>
+            </div>
           {{end}}
+
           <div class="d-flex justify-content-center pt-2">
             <small><a class="text-muted" target="_blank" href="https://www.google.com/covid19/exposurenotifications">About exposure notifications</a></small>
           </div>
@@ -66,15 +70,15 @@
     $(function() {
       let fn = function loginSuccess() {
         {{if .loginRedirect}}
-        window.location.assign('{{.loginRedirect}}');
+          window.location.assign('{{.loginRedirect}}');
         {{else}}
-        {{if .currentUser}}
+        {{if $currentUser}}
           flash.alert('Successfully refreshed auth credentials.');
         {{end}}
         {{end}}
       }
 
-      let hasCurrentUser ={{if .currentUser}}true{{else}}false{{end}};
+      let hasCurrentUser ={{if $currentUser}}true{{else}}false{{end}};
       loginScripts(hasCurrentUser, fn);
     });
   </script>
diff --git a/cmd/server/assets/login/register-phone.html b/cmd/server/assets/login/register-phone.html
index 96b083ee2..73031de6a 100644
--- a/cmd/server/assets/login/register-phone.html
+++ b/cmd/server/assets/login/register-phone.html
@@ -1,5 +1,8 @@
 {{define "login/register-phone"}}
 
+{{$mfaMode := .mfaMode}}
+{{$currentMembership := .currentMembership}}
+
 <!doctype html>
 <html lang="en">
 
@@ -15,35 +18,31 @@
 
     <div class="d-flex vh-100">
       <div class="d-flex w-100 justify-content-center">
-        <div class="col-sm-6">
+        <div class="col-sm-9">
           {{template "login/factorsdiv" .}}
 
           <div class="card shadow-sm" id="register-div">
             <div class="card-header">Multi-factor authentication</div>
             <div class="card-body">
-              {{if eq .mfaMode.String "required"}}
-              <div class="alert alert-warning">
-                <span class="oi oi-warning"></span>
-                This realm <strong>requires</strong> multi-factor authorization.
-              </div>
+              {{if $mfaMode}}
+                {{if eq $mfaMode.String "required"}}
+                  <div class="alert alert-danger" role="alert">
+                    This realm requires all users enable two-factor authentication.
+                  </div>
+                {{else if eq $mfaMode.String "prompt"}}
+                  <div class="alert alert-warning" role="alert">
+                    This realm recommends all users enable two-factor
+                    authentication. It may be required in the future.
+                  </div>
+                {{else}}
+                  <div class="alert alert-info" role="alert">
+                    This realm recommends all users enable two-factor
+                    authentication.
+                  </div>
+                {{end}}
               {{end}}
 
-              <p>
-                <strong>{{if .currentRealm}}{{.currentRealm.Name}}{{else}}System{{end}}</strong>
-                {{if eq .mfaMode.String "required"}}requires{{else}}recommends{{end}}
-                enhanced security via SMS-based 2-factor authentication. Please
-                provide your information below to enroll.
-              </p>
-
               <form id="register-form" class="floating-form" action="/" method="POST">
-                <div class="form-group">
-                  <input type="tel" id="phone" name="phone" class="form-control" required autofocus />
-                  <small class="form-text text-muted">
-                    You will be asked to confirm a code using this phone number at login.
-                    Standard SMS rates may apply.
-                  </small>
-               </div>
-
                 <div class="form-label-group">
                   <input type="text" id="display" name="display" class="form-control" placeholder="Display name" />
                   <label for="display">Display name</label>
@@ -52,16 +51,28 @@
                   </small>
                 </div>
 
+                <div class="form-group">
+                  <input type="tel" id="phone" name="phone" class="form-control" required autofocus />
+                  <small class="form-text text-muted">
+                    You will be asked to confirm a code using this phone number at login.
+                    Standard SMS rates may apply.
+                  </small>
+               </div>
+
                 <button type="submit" id="submit-register" class="btn btn-primary btn-block">Register</button>
               </form>
             </div>
-            <div class="card-footer text-right">
-              <small>
-                <a id="skip" href="/codes/issue" class="text-secondary {{if eq .mfaMode.String "required"}}d-none{{end}}">
-                  Skip for now &rarr;
-                </a>
-              </small>
-            </div>
+            {{if $mfaMode}}
+              {{if ne $mfaMode.String "required"}}
+                <div class="card-footer text-right">
+                  <small>
+                    <a id="skip" href="/codes/issue" class="text-secondary">
+                      Skip for now &rarr;
+                    </a>
+                  </small>
+                </div>
+              {{end}}
+            {{end}}
           </div>
 
           {{template "login/pindiv" .}}
@@ -306,14 +317,10 @@
             headers: { 'X-CSRF-Token': '{{.csrfToken}}' },
             contentType: 'application/x-www-form-urlencoded',
             success: function(returnData) {
-              {{if .isPrompt}}
-              window.location.assign('/codes/issue');
-              {{else}}
               flash.clear();
               flash.alert('SMS authentication enrolled successfully.');
               $skip.text('Continue');
               $skip.removeClass("d-none");
-              {{end}}
             },
             error: function(xhr, status, e) {
               window.location.assign("/signout");
diff --git a/cmd/server/assets/login/select-realm.html b/cmd/server/assets/login/select-realm.html
index b76342a86..48dcc1899 100644
--- a/cmd/server/assets/login/select-realm.html
+++ b/cmd/server/assets/login/select-realm.html
@@ -1,9 +1,9 @@
 {{define "login/select-realm"}}
 
 {{$csrfField := .csrfField}}
-{{$realms := .realms}}
+{{$currentRealms := .realms}}
 {{$currentUser := .currentUser}}
-{{$currentRealm := .currentRealm}}
+{{$memberships := .memberships}}
 
 <!doctype html>
 <html lang="en">
@@ -27,7 +27,7 @@ <h1>Select your realm</h1>
         Realm selector
       </div>
 
-      {{if $realms}}
+      {{if $memberships}}
         <div class="card-body">
           <p class="mb-0">
             You are a member of multiple realms - please select one to continue. You
@@ -36,28 +36,22 @@ <h1>Select your realm</h1>
         </div>
 
         <div class="list-group list-group-flush">
-        {{range $realm := $realms}}
-          <form action="/login/select-realm" method="POST" class="list-group-item p-0">
-            {{$csrfField}}
-            <input type="hidden" name="realm" value="{{$realm.ID}}" />
-            <a href="#" class="w-100 d-flex flex-row justify-content-between align-items-center align-self-center list-group-item-action px-4 py-3" data-submit-form>
-              <div>
-                <h5 class="mb-1">
-                  {{$realm.Name}}
-                  {{if $currentRealm}}{{if eq $currentRealm.ID $realm.ID}}
-                  <span class="badge badge-secondary float-right ml-2">currently selected</span>
-                  {{end}}{{end}}
-                </h5>
-                {{if $realm.RegionCode}}
-                <p class="mb-1">{{$realm.RegionCode}}</p>
-                {{end}}
-              </div>
-              <div>
-                <span class="oi oi-arrow-right" aria-hidden="true"></span>
-              </div>
-            </a>
-          </form>
-        {{end}}
+          {{range $membership := $memberships}}
+            {{$currentRealm := $membership.Realm}}
+            <form action="/login/select-realm" method="POST" class="list-group-item p-0">
+              {{$csrfField}}
+              <input type="hidden" name="realm" value="{{$currentRealm.ID}}" />
+              <a href="#" class="w-100 d-flex flex-row justify-content-between align-items-center align-self-center list-group-item-action px-4 py-3" data-submit-form>
+                <div>
+                  <h5 class="mb-1">{{$currentRealm.Name}}</h5>
+                  <p class="mb-1">{{$currentRealm.RegionCode}}</p>
+                </div>
+                <div>
+                  <span class="oi oi-arrow-right" aria-hidden="true"></span>
+                </div>
+              </a>
+            </form>
+          {{end}}
         </div>
       {{else}}
         <div class="card-body">
@@ -70,21 +64,21 @@ <h5 class="mb-1">
     </div>
 
     {{if $currentUser.SystemAdmin}}
-    <div class="card mb-3 shadow-sm">
-      <div class="card-header text-bold text-white admin-header">
-        System admin
-      </div>
-      <div class="list-group-item p-0">
-        <a href="/admin" class="w-100 d-flex flex-row justify-content-between align-items-center align-self-center list-group-item-action px-4 py-3">
-          <div>
-            <p class="mb-1">Go to system admin</p>
-          </div>
-          <div>
-            <span class="oi oi-arrow-right" aria-hidden="true"></span>
-          </div>
-        </a>
+      <div class="card mb-3 shadow-sm">
+        <div class="card-header text-bold text-white admin-header">
+          System admin
+        </div>
+        <div class="list-group-item p-0">
+          <a href="/admin" class="w-100 d-flex flex-row justify-content-between align-items-center align-self-center list-group-item-action px-4 py-3">
+            <div>
+              <p class="mb-1">Go to system admin</p>
+            </div>
+            <div>
+              <span class="oi oi-arrow-right" aria-hidden="true"></span>
+            </div>
+          </a>
+        </div>
       </div>
-    </div>
     {{end}}
   </main>
 </body>
diff --git a/cmd/server/assets/login/signout.html b/cmd/server/assets/login/signout.html
index 6d22a63c1..7fdb97cc9 100644
--- a/cmd/server/assets/login/signout.html
+++ b/cmd/server/assets/login/signout.html
@@ -12,8 +12,6 @@
   {{template "navbar" .}}
 
   <main role="main" class="container">
-    {{template "flash" .}}
-
     <div id="auth-container">
       <p id="signout">Signing out...</p>
     </div>
@@ -22,14 +20,8 @@
   <script type="text/javascript">
     window.addEventListener('load', function() {
       firebase.auth().signOut().then(function() {
-        if ($('#alerts-container').children().length == 0) {
-          window.location.assign("/");
-        } else {
-          $('#signout').text("Redirecting to login...")
-          window.setTimeout(function() {
-            window.location.assign("/");
-          }, 3000);
-        }
+        $('#signout').text("Redirecting to login...")
+        window.location.assign("/");
       }).catch(function(error) {
         flash.error('Error signing out, close browser window.');
       });
diff --git a/cmd/server/assets/mobileapps/index.html b/cmd/server/assets/mobileapps/index.html
index f37e10941..3a3e35240 100644
--- a/cmd/server/assets/mobileapps/index.html
+++ b/cmd/server/assets/mobileapps/index.html
@@ -2,6 +2,9 @@
 
 {{$apps := .apps}}
 
+{{$currentMembership := .currentMembership}}
+{{$canWrite := $currentMembership.Can rbac.MobileAppWrite}}
+
 <!doctype html>
 <html lang="en">
 <head>
@@ -14,13 +17,15 @@
   <main role="main" class="container">
     {{template "flash" .}}
 
-    <div class="card mt-4 mb-3">
+    <div class="card shadow-sm mt-4 mb-3">
       <div class="card-header">
         <span class="oi oi-phone mr-2 ml-n1" aria-hidden="true"></span>
         Mobile apps
-        <a href="/realm/mobile-apps/new" class="float-right mr-n1 text-secondary" data-toggle="tooltip" title="New mobile app">
-          <span class="oi oi-plus small" aria-hidden="true"></span>
-        </a>
+        {{if $canWrite}}
+          <a href="/realm/mobile-apps/new" class="float-right mr-n1 text-secondary" data-toggle="tooltip" title="New mobile app">
+            <span class="oi oi-plus small" aria-hidden="true"></span>
+          </a>
+        {{end}}
       </div>
 
       <div class="card-body">
@@ -44,7 +49,9 @@
             <tr>
               <th scope="col" width="40"></th>
               <th scope="col">Mobile app</th>
-              <th scope="col" width="40"></th>
+              {{if $canWrite}}
+                <th scope="col" width="40"></th>
+              {{end}}
             </tr>
           </thead>
           <tbody>
@@ -62,25 +69,27 @@
               <td class="text-truncate">
                 <a href="/realm/mobile-apps/{{.ID}}">{{.Name}}</a>
               </td>
-              <td class="text-center">
-                {{if .DeletedAt}}
-                <a href="/realm/mobile-apps/{{.ID}}/enable" class="d-block text-danger"
-                  data-method="patch"
-                  data-confirm="Are you sure you want to restore '{{.Name}}'?"
-                  data-toggle="tooltip"
-                  title="Restore this mobile app">
-                  <span class="oi oi-loop-circular" aria-hidden="true"></span>
-                </a>
-                {{else}}
-                <a href="/realm/mobile-apps/{{.ID}}/disable" class="d-block text-danger"
-                  data-method="patch"
-                  data-confirm="Are you sure you want to disable '{{.Name}}'?"
-                  data-toggle="tooltip"
-                  title="Disable this mobile app">
-                  <span class="oi oi-trash" aria-hidden="true"></span>
-                </a>
-                {{end}}
-              </td>
+              {{if $canWrite}}
+                <td class="text-center">
+                  {{if .DeletedAt}}
+                  <a href="/realm/mobile-apps/{{.ID}}/enable" class="d-block text-danger"
+                    data-method="patch"
+                    data-confirm="Are you sure you want to restore '{{.Name}}'?"
+                    data-toggle="tooltip"
+                    title="Restore this mobile app">
+                    <span class="oi oi-loop-circular" aria-hidden="true"></span>
+                  </a>
+                  {{else}}
+                  <a href="/realm/mobile-apps/{{.ID}}/disable" class="d-block text-danger"
+                    data-method="patch"
+                    data-confirm="Are you sure you want to disable '{{.Name}}'?"
+                    data-toggle="tooltip"
+                    title="Disable this mobile app">
+                    <span class="oi oi-trash" aria-hidden="true"></span>
+                  </a>
+                  {{end}}
+                </td>
+              {{end}}
             </tr>
           {{end}}
           </tbody>
diff --git a/cmd/server/assets/mobileapps/show.html b/cmd/server/assets/mobileapps/show.html
index dca6a5dfc..0ee9a741d 100644
--- a/cmd/server/assets/mobileapps/show.html
+++ b/cmd/server/assets/mobileapps/show.html
@@ -2,6 +2,9 @@
 
 {{$app := .app}}
 
+{{$currentMembership := .currentMembership}}
+{{$canWrite := $currentMembership.Can rbac.MobileAppWrite}}
+
 <!doctype html>
 <html lang="en">
 
@@ -16,15 +19,19 @@
     {{template "flash" .}}
 
     <h1>{{$app.Name}}</h1>
-    <p class="float-right">
-      <a href="/realm/mobile-apps/{{$app.ID}}/edit">Edit</a>
-    </p>
     <p>
       Here is information about the mobile app.
     </p>
 
     <div class="card mb-3 shadow-sm">
-      <div class="card-header">Details</div>
+      <div class="card-header">
+        Details
+        {{if $canWrite}}
+          <a href="/realm/mobile-apps/{{$app.ID}}/edit" class="float-right mr-n1 text-body" id="edit" data-toggle="tooltip" title="Edit this mobile app">
+            <span class="oi oi-pencil" aria-hidden="true"></span>
+          </a>
+        {{end}}
+      </div>
       <div class="card-body">
         <dl class="mb-n1">
           <dt>App name</dt>
diff --git a/cmd/server/assets/realmadmin/_form_abuse_prevention.html b/cmd/server/assets/realmadmin/_form_abuse_prevention.html
index 1a5c1bfdc..cacc42f4a 100644
--- a/cmd/server/assets/realmadmin/_form_abuse_prevention.html
+++ b/cmd/server/assets/realmadmin/_form_abuse_prevention.html
@@ -20,10 +20,10 @@
     subsequently upload many fake keys to the system.
   </p>
 
-  <div class="form-group form-check">
-    <input type="checkbox" name="abuse_prevention_enabled" id="abuse-prevention-enabled" class="form-check-input" value="1" {{if $realm.AbusePreventionEnabled}} checked{{end}}
+  <div class="custom-control custom-checkbox mb-3">
+    <input type="checkbox" name="abuse_prevention_enabled" id="abuse-prevention-enabled" class="custom-control-input" value="1" {{checkedIf $realm.AbusePreventionEnabled}}
       data-toggle="collapse" data-target="#abuse-prevention-configuration">
-    <label class="form-check-label" for="abuse-prevention-enabled">
+    <label class="custom-control-label" for="abuse-prevention-enabled">
       Enable abuse prevention
     </label>
   </div>
@@ -43,7 +43,8 @@
     {{end}}
 
     <div class="form-label-group">
-      <input type="text" name="abuse_prevention_limit" id="abuse-prevention-limit" class="form-control" placeholder="Computed limit" value="{{$realm.AbusePreventionLimit}}" readonly />
+      <input type="text" name="abuse_prevention_limit" id="abuse-prevention-limit" class="form-control"
+        placeholder="Computed limit" value="{{$realm.AbusePreventionLimit}}" readonly />
       <label for="abuse-prevention-limit">Computed limit</label>
       <small class="form-text text-muted">
         This value is computed by the historical daily model and applies
@@ -52,7 +53,8 @@
     </div>
 
     <div class="form-label-group">
-      <input type="text" name="abuse_prevention_limit_factor" id="abuse-prevention-limit-factor" class="form-control" placeholder="Limit factor" value="{{printf "%.3f" $realm.AbusePreventionLimitFactor}}" />
+      <input type="text" name="abuse_prevention_limit_factor" id="abuse-prevention-limit-factor" class="form-control"
+        placeholder="Limit factor" value="{{printf "%.3f" $realm.AbusePreventionLimitFactor}}" />
       <label for="abuse-prevention-limit-factor">Limit factor</label>
       <small class="form-text text-muted">
         This value is factored against the predicted daily model to
@@ -67,7 +69,8 @@
     </div>
 
     <div class="form-label-group">
-      <input type="text" id="abuse-prevention-effective-limit" class="form-control" placeholder="Effective limit" value="{{$realm.AbusePreventionEffectiveLimit}}" readonly />
+      <input type="text" id="abuse-prevention-effective-limit" class="form-control"
+        placeholder="Effective limit" value="{{$realm.AbusePreventionEffectiveLimit}}" readonly />
       <label for="abuse-prevention-effective-limit">Effective limit</label>
       <small class="form-text text-muted">
         This is the effective daily limit for {{$realm.Name}} after
@@ -75,8 +78,9 @@
       </small>
     </div>
 
-    <div class="form-label-group">
-      <input type="text" name="abuse_prevention_burst" id="abuse-prevention-burst" class="form-control" placeholder="Temporary burst" value="0" />
+    <div class="form-label-group mb-0">
+      <input type="text" name="abuse_prevention_burst" id="abuse-prevention-burst" class="form-control"
+        placeholder="Temporary burst" value="0" />
       <label for="abuse-prevention-burst">Temporary burst</label>
       <small class="form-text text-muted">
         Set this value to temporarily add quota to your realm. You
@@ -88,7 +92,8 @@
   </div>
 
   <div class="mt-4">
-    <input type="submit" class="btn btn-primary btn-block" value="Update abuse prevention settings" />
+    <input type="submit" class="btn btn-primary btn-block"
+      value="Update abuse prevention settings" />
   </div>
 </form>
 
diff --git a/cmd/server/assets/realmadmin/_form_codes.html b/cmd/server/assets/realmadmin/_form_codes.html
index ac8093ef5..80cda271b 100644
--- a/cmd/server/assets/realmadmin/_form_codes.html
+++ b/cmd/server/assets/realmadmin/_form_codes.html
@@ -16,7 +16,8 @@
     <label>Bulk issue codes</label>
     <div class="form-group">
       <div class="form-check">
-        <input type="radio" name="allow_bulk" id="allow-bulk-true" class="form-check-input" value="true"{{if $realm.AllowBulkUpload }} checked{{end}}/>
+        <input type="radio" name="allow_bulk" id="allow-bulk-true" class="form-check-input"
+          value="true" {{checkedIf $realm.AllowBulkUpload}} />
         <label for="allow-bulk-true" class="form-check-label">
           Allow
           <small class="form-text text-muted mb-3">
@@ -26,7 +27,8 @@
       </div>
 
       <div class="form-check mb-3">
-        <input type="radio" name="allow_bulk" id="allow-bulk-false" class="form-check-input" value="false"{{if not $realm.AllowBulkUpload }} checked{{end}} />
+        <input type="radio" name="allow_bulk" id="allow-bulk-false" class="form-check-input"
+          value="false" {{checkedIf (not $realm.AllowBulkUpload)}} />
         <label for="allow-bulk-false" class="form-check-label">
           Disallow
           <small class="form-text text-muted mb-3">
@@ -40,40 +42,44 @@
   <div class="form-group">
     <label>Allowed test types</label>
     {{if not $realm.EnableENExpress}}
-    <div class="form-check mb-3">
-      <input type="radio" name="allowed_test_types" id="test-type-negative" class="form-check-input" value="{{$testTypes.negative}}"{{if eq $realm.AllowedTestTypes $testTypes.negative}} checked{{end}}/>
-      <label for="test-type-negative" class="form-check-label">
-        Positive + Likely + Negative
-        <small class="form-text text-muted">
-          Support confirmed positive tests from an official testing
-          source, clinical diagnoses without a test, and confirmed
-          negative test from an official testing source.
-        </small>
-      </label>
-    </div>
+      <div class="form-check mb-3">
+        <input type="radio" name="allowed_test_types" id="test-type-negative" class="form-check-input"
+          value="{{$testTypes.negative}}" {{checkedIf (eq $realm.AllowedTestTypes $testTypes.negative)}} />
+        <label for="test-type-negative" class="form-check-label">
+          Positive + Likely + Negative
+          <small class="form-text text-muted">
+            Support confirmed positive tests from an official testing
+            source, clinical diagnoses without a test, and confirmed
+            negative test from an official testing source.
+          </small>
+        </label>
+      </div>
 
-    <div class="form-check mb-3">
-      <input type="radio" name="allowed_test_types" id="test-type-likely" class="form-check-input" value="{{$testTypes.likely}}"{{if eq $realm.AllowedTestTypes $testTypes.likely}} checked{{end}} />
-      <label for="test-type-likely" class="form-check-label">
-        Positive + Likely
-        <small class="form-text text-muted">
-          Support confirmed positive tests from an official testing
-          source and clinical diagnoses without a test.
-        </small>
-      </label>
-    </div>
+      <div class="form-check mb-3">
+        <input type="radio" name="allowed_test_types" id="test-type-likely" class="form-check-input"
+          value="{{$testTypes.likely}}" {{checkedIf (eq $realm.AllowedTestTypes $testTypes.likely)}} />
+        <label for="test-type-likely" class="form-check-label">
+          Positive + Likely
+          <small class="form-text text-muted">
+            Support confirmed positive tests from an official testing
+            source and clinical diagnoses without a test.
+          </small>
+        </label>
+      </div>
     {{end}}
 
     <div class="form-check mb-3">
-      <input type="radio" name="allowed_test_types" id="test-type-confirmed" class="form-check-input" value="{{$testTypes.confirmed}}"{{if eq $realm.AllowedTestTypes $testTypes.confirmed}} checked{{end}} />
+      <input type="radio" name="allowed_test_types" id="test-type-confirmed"
+        class="form-check-input" value="{{$testTypes.confirmed}}" {{checkedIf (eq $realm.AllowedTestTypes $testTypes.confirmed)}} />
       <label for="test-type-confirmed" class="form-check-label">
         Positive
         <small class="form-text text-muted">
           Only permit confirmed positive tests from an official
           testing source.
-          {{if $realm.EnableENExpress}} <br />
-          You are enrolled in EN Express which only supports the sharing of
-          positive tests.
+          {{if $realm.EnableENExpress}}
+            <br />
+            You are enrolled in EN Express which only supports the sharing of
+            positive tests.
           {{end}}
         </small>
       </label>
@@ -84,7 +90,8 @@
     <label>Date configuration</label>
     <div class="form-group">
       <div class="form-check mb-3">
-        <input type="radio" name="require_date" id="require-date-false" class="form-check-input" value="false"{{if not $realm.RequireDate }} checked{{end}}/>
+        <input type="radio" name="require_date" id="require-date-false" class="form-check-input"
+          value="false" {{checkedIf (not $realm.RequireDate)}} />
         <label for="require-date-false" class="form-check-label">
           Optional date
           <small class="form-text text-muted">
@@ -95,7 +102,8 @@
       </div>
 
       <div class="form-check mb-3">
-        <input type="radio" name="require_date" id="require-date-true" class="form-check-input" value="true"{{if $realm.RequireDate }} checked{{end}} />
+        <input type="radio" name="require_date" id="require-date-true" class="form-check-input"
+          value="true" {{checkedIf $realm.RequireDate}} />
         <label for="require-date-true" class="form-check-label">
           Required date
           <small class="form-text text-muted">
@@ -204,7 +212,7 @@
       length of of the SMS message should not exceed 160 characters, or your message will need to be split
       in transit and may not be joined correctly. There are some special strings that you can use
       to substitute items.<br/>
-      
+
       If your choose to exceed 160 characters, your message will be broken up into
       individual messages of 153 characters and reconstructed at the mobile device.  The user may be
       charged for each individual message. The overall maximum length of an SMS Template is {{.maxSMSTemplate}}
@@ -296,7 +304,8 @@
   </div>
 
   <div class="mt-4">
-    <input type="submit" class="btn btn-primary btn-block" value="Update verification codes settings" />
+    <input type="submit" class="btn btn-primary btn-block"
+      value="Update verification codes settings" />
   </div>
 </form>
 
diff --git a/cmd/server/assets/realmadmin/_form_email.html b/cmd/server/assets/realmadmin/_form_email.html
index 6d9a7c810..7cd3a8e41 100644
--- a/cmd/server/assets/realmadmin/_form_email.html
+++ b/cmd/server/assets/realmadmin/_form_email.html
@@ -34,7 +34,7 @@
   <div id="smtp-form" class="collapse{{if not $realm.UseSystemEmailConfig}} show{{end}}">
     <div class="form-label-group">
       <input type="text" name="smtp_account" id="smtp-account" class="form-control text-monospace{{if $emailConfig.ErrorsFor "smtpAccount"}} is-invalid{{end}}"
-        placeholder="SMTP account" {{if $emailConfig.SMTPAccount}}value="{{$emailConfig.SMTPAccount}}"{{end}} />
+        placeholder="SMTP account" value="{{$emailConfig.SMTPAccount}}" />
       <label for="smtp-account">SMTP account</label>
       {{template "errorable" $emailConfig.ErrorsFor "smtpAccount"}}
       <small class="form-text text-muted">
@@ -54,7 +54,7 @@
 
     <div class="form-label-group">
       <input name="smtp_host" id="smtp-host" class="form-control text-monospace{{if $emailConfig.ErrorsFor "smtpPort"}} is-invalid{{end}}"
-        placeholder="SMTP host" {{if $emailConfig.SMTPHost}}value="{{$emailConfig.SMTPHost}}"{{end}} />
+        placeholder="SMTP host" value="{{$emailConfig.SMTPHost}}" />
       <label for="smtp-port">SMTP host</label>
       {{template "errorable" $emailConfig.ErrorsFor "smtpHost"}}
       <small class="form-text text-muted">
diff --git a/cmd/server/assets/realmadmin/edit.html b/cmd/server/assets/realmadmin/edit.html
index df9fd8b42..89b33c640 100644
--- a/cmd/server/assets/realmadmin/edit.html
+++ b/cmd/server/assets/realmadmin/edit.html
@@ -4,6 +4,9 @@
 {{$smsConfig := .smsConfig}}
 {{$testTypes := .testTypes}}
 
+{{$currentMembership := .currentMembership}}
+{{$canWrite := $currentMembership.Can rbac.SettingsWrite}}
+
 <!doctype html>
 <html lang="en">
 <head>
@@ -25,9 +28,9 @@ <h1>Realm settings</h1>
       <div class="card-header">
         <ul class="nav nav-tabs card-header-tabs" role="tablist">
           {{if not $realm.EnableENExpress}}
-          <li class="nav-item" role="presentation">
-            <a class="nav-link" id="express-tab" data-toggle="tab" href="#express" role="tab" aria-controls="express" aria-selected="true">ENX</a>
-          </li>
+            <li class="nav-item" role="presentation">
+              <a class="nav-link" id="express-tab" data-toggle="tab" href="#express" role="tab" aria-controls="express" aria-selected="true">ENX</a>
+            </li>
           {{end}}
           <li class="nav-item" role="presentation">
             <a class="nav-link active" id="general-tab" data-toggle="tab" href="#general" role="tab" aria-controls="general" aria-selected="true">General</a>
@@ -80,25 +83,42 @@ <h1>Realm settings</h1>
     </div>
 
     {{if $realm.EnableENExpress}}
-    <p class="text-center">
-      <a href="#advanced-settings" class="text-muted small" data-toggle="collapse">
-        Advanced settings
-      </a>
-    </p>
+      <p class="text-center">
+        <a href="#advanced-settings" class="text-muted small" data-toggle="collapse">
+          Advanced settings
+        </a>
+      </p>
 
-    <div id="advanced-settings" class="card mb-3 shadow-sm collapse">
-      <div class="card-header">
-        Advanced settings
-      </div>
-      <div class="card-body">
-        {{template "realmadmin/_form_express" .}}
+      <div id="advanced-settings" class="card mb-3 shadow-sm collapse">
+        <div class="card-header">
+          Advanced settings
+        </div>
+        <div class="card-body">
+          {{template "realmadmin/_form_express" .}}
+        </div>
       </div>
-    </div>
     {{end}}
   </main>
 
   <script type="text/javascript">
     $(function(){
+      {{if not $canWrite}}
+        {{/*
+
+          This is a little bit hacky, since technically the user could disable
+          javascript, but we do server-side validation to prevent actual data
+          mutation without permission.
+
+          We specifically do this before changing tabs to reduce the FOUT.
+
+        */}}
+        $('body').find('input, button, select, textarea, a.btn')
+          .addClass('disabled')
+          .addClass('readonly')
+          .prop('disabled', true)
+          .prop('readonly', true);
+      {{end}}
+
       changeTab(window.location.hash);
 
       $('.nav-tabs a').on('click', function(event) {
diff --git a/cmd/server/assets/realmadmin/events.html b/cmd/server/assets/realmadmin/events.html
index 09c2e689f..a7bdab18e 100644
--- a/cmd/server/assets/realmadmin/events.html
+++ b/cmd/server/assets/realmadmin/events.html
@@ -1,6 +1,5 @@
 {{define "realmadmin/events"}}
 
-{{$realm := .realm}}
 {{$events := .events}}
 
 <!doctype html>
diff --git a/cmd/server/assets/realmadmin/keys.html b/cmd/server/assets/realmadmin/keys.html
index 90bcf0228..782f863e9 100644
--- a/cmd/server/assets/realmadmin/keys.html
+++ b/cmd/server/assets/realmadmin/keys.html
@@ -71,6 +71,9 @@
 {{$publicKeys := .publicKeys}}
 {{$csrfField := .csrfField}}
 
+{{$currentMembership := .currentMembership}}
+{{$canWrite := $currentMembership.Can rbac.SettingsWrite}}
+
 <!doctype html>
 <html lang="en">
 <head>
@@ -303,6 +306,23 @@ <h1>Verification certificate key settings</h1>
       </p>
     {{end}}
   </main>
+
+  <script type="text/javascript">
+    {{if not $canWrite}}
+      {{/*
+
+        This is a little bit hacky, since technically the user could disable
+        javascript, but we do server-side validation to prevent actual data
+        mutation without permission.
+
+      */}}
+      $('body').find('input, button, select, textarea, a.btn')
+        .addClass('disabled')
+        .addClass('readonly')
+        .prop('disabled', true)
+        .prop('readonly', true);
+    {{end}}
+  </script>
 </body>
 </html>
 {{end}}
diff --git a/cmd/server/assets/realmadmin/stats.html b/cmd/server/assets/realmadmin/stats.html
index adbeaebab..a94cf6244 100644
--- a/cmd/server/assets/realmadmin/stats.html
+++ b/cmd/server/assets/realmadmin/stats.html
@@ -1,7 +1,5 @@
 {{define "realmadmin/stats"}}
 
-{{$currentRealm := .currentRealm}}
-
 <!doctype html>
 <html lang="en">
 <head>
@@ -19,7 +17,7 @@ <h1>Realm stats</h1>
       The data below shows realm statistics and visualizations.
     </p>
 
-    <div class="card mb-3">
+    <div class="card shadow-sm mb-3">
       <div class="card-header">
         <span class="oi oi-bar-chart mr-2 ml-n1"></span>
         Codes issued &amp; claimed
@@ -49,7 +47,7 @@ <h5 class="modal-title">Codes issued &amp; claimed</h5>
           <div class="modal-body mb-n3">
             <p>
               This graph reflects the total number of codes issued and claimed
-              for {{$currentRealm.Name}}, grouped by UTC day.
+              for this realm, grouped by UTC day.
             </p>
 
             <strong>Issued</strong>
@@ -70,7 +68,7 @@ <h5 class="modal-title">Codes issued &amp; claimed</h5>
       </div>
     </div>
 
-    <div class="card mb-3">
+    <div class="card shadow-sm mb-3">
       <div class="card-header">
         <span class="oi oi-bar-chart mr-2 ml-n1"></span>
         Daily active users
@@ -100,8 +98,8 @@ <h5 class="modal-title">Daily active users</h5>
           <div class="modal-body mb-n3">
             <p>
               This graph reflects the total number of reported daily active
-              users for {{$currentRealm.Name}}. You may need to alter your iOS
-              and Android applications to publish this metric.
+              users for this realm. You may need to alter your iOS and Android
+              applications to publish this metric.
             </p>
 
             <p>
@@ -119,7 +117,7 @@ <h5 class="modal-title">Daily active users</h5>
 
     <div class="row">
       <div class="col-lg-6 pr-lg-2">
-        <div class="card mb-3">
+        <div class="card shadow-sm mb-3">
           <div class="card-header">
             <span class="oi oi-bar-chart mr-2 ml-n1"></span>
             Codes issued by user by day
@@ -173,7 +171,7 @@ <h5 class="modal-title">Codes issued by user by day</h5>
       </div>
 
       <div class="col-lg-6 pl-lg-2">
-        <div class="card mb-3">
+        <div class="card shadow-sm mb-3">
           <div class="card-header">
             <span class="oi oi-bar-chart mr-2 ml-n1"></span>
             Codes issued by external issuers
diff --git a/cmd/server/assets/users/_form.html b/cmd/server/assets/users/_form.html
index e429c5723..f44eb756d 100644
--- a/cmd/server/assets/users/_form.html
+++ b/cmd/server/assets/users/_form.html
@@ -1,10 +1,13 @@
 {{define "users/_form"}}
 
-{{$currentRealm := .currentRealm}}
 {{$user := .user}}
+{{$userMembership := .userMembership}}
+{{$permissions := .permissions}}
+
+{{$currentMembership := .currentMembership}}
 
 {{if $user.ID}}
-<form method="POST" action="/realm/users/{{$user.ID}}">
+<form method="POST" id="user-form" action="/realm/users/{{$user.ID}}">
   <input type="hidden" name="_method" value="PATCH">
   {{else}}
   <form method="POST" action="/realm/users">
@@ -16,39 +19,43 @@
       <input type="text" id="name" name="name" class="form-control{{if $user.ErrorsFor "name"}} is-invalid{{end}}"
         value="{{$user.Name}}" placeholder="Name" required autofocus />
       <label for="name">Name</label>
-      {{if $user.ErrorsFor "name"}}
-      <div class="invalid-feedback">
-        {{joinStrings ($user.ErrorsFor "name") ", "}}
-      </div>
-      {{end}}
+      {{template "errorable" $user.ErrorsFor "name"}}
     </div>
 
     <div class="form-label-group">
       <input type="email" id="email" name="email" class="form-control{{if $user.ErrorsFor "email"}} is-invalid{{end}}"
         value="{{$user.Email}}" placeholder="Email address" {{if $user.ID}}disabled{{else}}required{{end}} />
       <label for="email">Email address</label>
-      {{if $user.ErrorsFor "email"}}
-      <div class="invalid-feedback">
-        {{joinStrings ($user.ErrorsFor "email") ", "}}
-      </div>
-      {{end}}
+      {{template "errorable" $user.ErrorsFor "email"}}
     </div>
 
-    <div class="form-group">
-      <div class="custom-control custom-checkbox">
-        <input type="checkbox" id="admin" name="admin" class="custom-control-input"
-          {{if $user.CanAdminRealm $currentRealm.ID}} checked{{end}}>
-        <label class="custom-control-label" for="admin">Admin</label>
-      </div>
+    <hr />
+
+    <h6>Permissions</h6>
+    <div id="permissions-list" class="mb-3">
+      {{if (eq $currentMembership.UserID $userMembership.UserID)}}
+        <small class="form-text mb-3">
+          You cannot edit your own permissions.
+        </small>
+      {{end}}
+      {{range $name, $permission := $permissions}}
+        <div class="custom-control custom-checkbox py-1">
+          <input type="checkbox" name="permissions" id="permission-{{$permission.Value}}"
+            class="custom-control-input" value="{{$permission.Value}}"
+            {{checkedIf ($userMembership.Can $permission)}}
+            {{disabledIf (eq $currentMembership.UserID $userMembership.UserID)}}
+            {{readonlyIf (eq $currentMembership.UserID $userMembership.UserID)}}>
+          <label class="custom-control-label" for="permission-{{$permission.Value}}">{{$name}}</label>
+        </div>
+      {{end}}
     </div>
 
-    <button type="submit" id="submit" class="btn btn-primary btn-block" {{if .created}}disabled{{end}}>
+    <button type="submit" class="btn btn-primary btn-block">
       {{if $user.ID}}
-      Update user
+        Update user
       {{else}}
-      Create user
+        Create user
       {{end}}
     </button>
   </form>
-
-  {{end}}
+{{end}}
diff --git a/cmd/server/assets/users/edit.html b/cmd/server/assets/users/edit.html
index fdd8bd52c..2f2976f36 100644
--- a/cmd/server/assets/users/edit.html
+++ b/cmd/server/assets/users/edit.html
@@ -1,8 +1,4 @@
 {{define "users/edit"}}
-
-{{$currentRealm := .currentRealm}}
-{{$user := .user}}
-
 <!doctype html>
 <html lang="en">
 <head>
diff --git a/cmd/server/assets/users/import.html b/cmd/server/assets/users/import.html
index feb0212c9..067e3ae8c 100644
--- a/cmd/server/assets/users/import.html
+++ b/cmd/server/assets/users/import.html
@@ -1,5 +1,8 @@
 {{define "users/import"}}
 
+{{$currentMembership := .currentMembership}}
+{{$permissions := .permissions}}
+
 <!doctype html>
 <html lang="en">
 
@@ -14,7 +17,7 @@
     {{template "flash" .}}
 
     <h1>Import users</h1>
-    <p>Bulk import a list of users to <strong>{{.currentRealm.Name}}</strong>.</p>
+    <p>Bulk import a list of users to <strong>{{$currentMembership.Realm.Name}}</strong>.</p>
 
     <div class="card mb-3 shadow-sm">
       <div class="card-header">Import</div>
@@ -26,7 +29,10 @@ <h1>Import users</h1>
         </div>
 
         <p>
-          Use this form to import a list of users. The server will create them in batches.
+          Use this form to import a list of users. The server will create them
+          in batches. The users will be imported with permissions to issue and
+          lookup codes. You can promote individual users to administrators in
+          the UI after uploading.
         </p>
 
         <pre>Example file contents:
@@ -35,18 +41,20 @@ <h1>Import users</h1>
           another@example.com, Bob
           </code>
         </pre>
+
         <form id="form">
-          <div class="custom-file">
+          <div class="custom-file mb-3">
             <input type="file" class="custom-file-input" id="csv" accept=".csv" required>
             <label class="custom-file-label" for="csv" id="fileLabel">Select a CSV file</label>
           </div>
-          <button class="btn btn-primary" type="submit" id="import" disabled>Import users</button>
-          <button class="btn btn-danger" id="cancel" disabled>Cancel</button>
 
-          <div class="form-group form-check">
-            <input type="checkbox" class="form-check-input" name="sendInvites" id="sendInvites" checked>
-            <label class="form-check-label" for="sendInvites">Send invitations</label>
+          <div class="custom-control custom-checkbox mb-3">
+            <input type="checkbox" class="custom-control-input" name="sendInvites" id="sendInvites" checked>
+            <label class="custom-control-label" for="sendInvites">Send email invitations</label>
           </div>
+
+          <button class="btn btn-primary" type="submit" id="import" disabled>Import users</button>
+          <button class="btn btn-danger" id="cancel" disabled>Cancel</button>
         </form>
       </div>
 
diff --git a/cmd/server/assets/users/index.html b/cmd/server/assets/users/index.html
index 4e808036b..44e6e5728 100644
--- a/cmd/server/assets/users/index.html
+++ b/cmd/server/assets/users/index.html
@@ -1,9 +1,10 @@
 {{define "users/index"}}
 
 {{$csrfField := .csrfField}}
-{{$currentUser := .currentUser}}
-{{$currentRealm := .currentRealm}}
-{{$users := .users}}
+{{$memberships := .memberships}}
+
+{{$currentMembership := .currentMembership}}
+{{$canWrite := $currentMembership.Can rbac.UserWrite}}
 
 <!doctype html>
 <html lang="en">
@@ -18,16 +19,18 @@
   <main role="main" class="container">
     {{template "flash" .}}
 
-    <div class="card mt-4 mb-3">
+    <div class="card shadow-sm mt-4 mb-3">
       <div class="card-header">
         <span class="oi oi-person mr-2 ml-n1" aria-hidden="true"></span>
         Users
-        <a href="/realm/users/new" class="float-right mr-n1 text-secondary" data-toggle="tooltip" title="New user">
-          <span class="oi oi-plus small" aria-hidden="true"></span>
-        </a>
-        <a href="/realm/users/import" class="float-right mr-3 text-secondary" data-toggle="tooltip" title="Bulk import users">
-          <span class="oi oi-data-transfer-upload" aria-hidden="true"></span>
-        </a>
+        {{if $canWrite}}
+          <a href="/realm/users/new" class="float-right mr-n1 text-secondary" data-toggle="tooltip" title="New user">
+            <span class="oi oi-plus small" aria-hidden="true"></span>
+          </a>
+          <a href="/realm/users/import" class="float-right mr-3 text-secondary" data-toggle="tooltip" title="Bulk import users">
+            <span class="oi oi-data-transfer-upload" aria-hidden="true"></span>
+          </a>
+        {{end}}
       </div>
 
       <div class="card-body">
@@ -45,37 +48,39 @@
         </form>
       </div>
 
-      {{if $users}}
+      {{if $memberships}}
         <table class="table table-bordered table-striped table-fixed table-inner-border-only border-top mb-0">
           <thead>
             <tr>
               <th scope="col">Name</th>
               <th scope="col" width="300">Email</th>
-              <th scope="col" width="40"></th>
+              {{if $canWrite}}
+                <th scope="col" width="40"></th>
+              {{end}}
             </tr>
           </thead>
           <tbody>
-            {{range $users}}
-            <tr id="user-{{.ID}}">
+            {{range $membership := $memberships}}
+            {{$user := $membership.User}}
+            <tr id="user-{{$user.ID}}">
               <td>
-                <a href="/realm/users/{{.ID}}">{{.Name}}</a>
-                {{if .CanAdminRealm $currentRealm.ID}}
-                  <span class="ml-1 badge badge-pill badge-primary">Admin</span>
-                {{end}}
+                <a href="/realm/users/{{$user.ID}}">{{$user.Name}}</a>
               </td>
               <td>
-                {{.Email}}
-              </td>
-              <td class="text-center">
-                {{if not (eq .ID $currentUser.ID)}}
-                {{- /* cannot delete yourself */ -}}
-                <a href="/realm/users/{{.ID}}" class="d-block text-danger" data-method="DELETE"
-                  data-confirm="Are you sure you want to remove '{{.Name}}'?" data-toggle="tooltip"
-                  title="Remove this user">
-                  <span class="oi oi-trash" aria-hidden="true"></span>
-                </a>
-                {{end}}
+                {{$user.Email}}
               </td>
+              {{if $canWrite}}
+                <td class="text-center">
+                  {{if not (eq $membership.UserID $currentMembership.UserID)}}
+                  {{- /* cannot delete yourself */ -}}
+                  <a href="/realm/users/{{$user.ID}}" class="d-block text-danger" data-method="DELETE"
+                    data-confirm="Are you sure you want to remove '{{$user.Name}}'?" data-toggle="tooltip"
+                    title="Remove this user">
+                    <span class="oi oi-trash" aria-hidden="true"></span>
+                  </a>
+                  {{end}}
+                </td>
+              {{end}}
             </tr>
             {{end}}
           </tbody>
diff --git a/cmd/server/assets/users/new.html b/cmd/server/assets/users/new.html
index 69d338e35..9d55823ca 100644
--- a/cmd/server/assets/users/new.html
+++ b/cmd/server/assets/users/new.html
@@ -1,10 +1,6 @@
 {{define "users/new"}}
-
-{{$user := .user}}
-
 <!doctype html>
 <html lang="en">
-
 <head>
   {{template "head" .}}
 </head>
@@ -26,6 +22,7 @@ <h1>New user</h1>
         {{template "users/_form" .}}
       </div>
     </div>
+
     <a class="card-link" href="/realm/users" id="all-users">&larr; All users</a>
   </main>
 </body>
diff --git a/cmd/server/assets/users/show.html b/cmd/server/assets/users/show.html
index 0b5862c72..a692e8781 100644
--- a/cmd/server/assets/users/show.html
+++ b/cmd/server/assets/users/show.html
@@ -1,8 +1,12 @@
 {{define "users/show"}}
 
-{{$currentRealm := .currentRealm}}
 {{$user := .user}}
+{{$userMembership := .userMembership}}
 {{$stats := .stats}}
+{{$permissions := .permissions}}
+
+{{$currentMembership := .currentMembership}}
+{{$canWrite := $currentMembership.Can rbac.UserWrite}}
 
 <!doctype html>
 <html lang="en">
@@ -23,9 +27,12 @@ <h1>{{$user.Name}}</h1>
       <div class="card-header">
         <span class="oi oi-person mr-2 ml-n1" aria-hidden="true"></span>
         Details about {{$user.Name}}
-        <a href="/realm/users/{{$user.ID}}/edit" class="float-right mr-n1 text-body" id="edit" data-toggle="tooltip" title="Edit this user">
-          <span class="oi oi-pencil" aria-hidden="true"></span>
-        </a>
+
+        {{if $canWrite}}
+          <a href="/realm/users/{{$user.ID}}/edit" class="float-right mr-n1 text-body" id="edit" data-toggle="tooltip" title="Edit this user">
+            <span class="oi oi-pencil" aria-hidden="true"></span>
+          </a>
+        {{end}}
       </div>
       <div class="card-body mb-n3">
         <h6 class="card-title">Name</h6>
@@ -38,22 +45,31 @@ <h6 class="card-title">Email</h6>
           {{$user.Email}}
         </div>
 
-        <h6 class="card-title">Password</h6>
-        <div class="mb-3 mt-n2">
-          <a href="/realm/users/{{$user.ID}}/reset-password"
-            data-method="POST"
-            data-confirm="Are you sure you want to reset this user's password?">
-            Send password reset
-          </a>
-        </div>
+        {{if $canWrite}}
+          <h6 class="card-title">Password</h6>
+          <div class="mb-3 mt-n2">
+            <a href="/realm/users/{{$user.ID}}/reset-password"
+              data-method="POST"
+              data-confirm="Are you sure you want to reset this user's password?">
+              Send password reset
+            </a>
+          </div>
+        {{end}}
 
-        <h6 class="card-title">Realm admin</h6>
+        <h6 class="card-title">Permissions</h6>
         <div class="mb-3 mt-n2">
-          {{if $user.CanAdminRealm $currentRealm.ID}}
-          <div class="card-text text-success mb-3 mt-n2">Enabled</div>
-          {{else}}
-          <div class="card-text mb-3 mt-n2">Disabled</div>
-          {{end}}
+          <ul class="list-unstyled">
+            {{range $name, $permission := $permissions}}
+              <li class="small">
+                {{if $userMembership.Can $permission}}
+                  <span class="oi oi-circle-check text-success mr-1" aria-hidden="true"></span>
+                {{else}}
+                  <span class="oi oi-circle-x text-muted mr-1" aria-hidden="true"></span>
+                {{end}}
+                {{$name}}
+              </li>
+            {{end}}
+          </ul>
         </div>
       </div>
     </div>
@@ -93,7 +109,8 @@ <h5 class="modal-title">Codes issued by {{$user.Name}}</h5>
           <div class="modal-body mb-n3">
             <p>
               This chart reflects the number of codes issued each by
-              {{$user.Name}} ({{$user.Email}}) for {{$currentRealm.Name}}.
+              {{$user.Name}} ({{$user.Email}}) for
+              {{$currentMembership.Realm.Name}}.
             </p>
             <p>
               This chart does <u>not</u> include codes that were issued via the
diff --git a/docs/images/admin/users02.png b/docs/images/admin/users02.png
index a3c996da5..fb533e9ce 100644
Binary files a/docs/images/admin/users02.png and b/docs/images/admin/users02.png differ
diff --git a/docs/playbooks/alerts/ElevatedRateLimitedCount.md b/docs/playbooks/alerts/ElevatedRateLimitedCount.md
index 0a03ef16c..802e1ad18 100644
--- a/docs/playbooks/alerts/ElevatedRateLimitedCount.md
+++ b/docs/playbooks/alerts/ElevatedRateLimitedCount.md
@@ -1,6 +1,6 @@
 # Elevated Rate Limited Count  Alert
 
-This alert fires when the condition of at least one request per second has been rate limited for a sustained period of more than 5 minutes. If you are paged for this alert the first goal is to make sure the system isn’t under attack. 
+This alert fires when the condition of at least one request per second has been rate limited for a sustained period of more than 5 minutes. If you are paged for this alert the first goal is to make sure the system isn’t under attack.
 
 Start by using the following query to check where the requests are being rate limited on Metrics Explorer:
 
@@ -14,13 +14,13 @@ fetch generic_task
     [value_request_count_aggregate: aggregate(value.request_count)]
 ```
 
-Next you will want to confirm how the requests are being rate limited. There are 3 possible levels of rate limiting: 
+Next you will want to confirm how the requests are being rate limited. There are 3 possible levels of rate limiting:
 * API Keys
 * User ID
-* IP Address. 
+* IP Address.
 
 A simple way to confirm this information is accessing Logs Explorer on Cloud Console and filtering by Debug messages.
-You will be able to find payload messages like `"limiting by realm from apikey"`, `"limiting by user"` or `“limiting by ip”`. 
+You will be able to find payload messages like `"limiting by realm from apikey"`, `"limiting by user"` or `“limiting by ip”`.
 
 ```
 severity=DEBUG
@@ -29,25 +29,27 @@ jsonPayload.message="limiting by realm from apikey"
 
 See what to do in each scenario:
 
-## API keys 
+## API keys
 This will be the first level where requests will be rate limited, if needed.  If an API key is provided,
-the system rate limits by the realm associated with the API key, by client IP address. 
-API keys are specified as the `X-API-Key` HTTP header, but not all endpoints require that header. 
+the system rate limits by the realm associated with the API key, by client IP address.
+API keys are specified as the `X-API-Key` HTTP header, but not all endpoints require that header.
 
-When requests are rate limited by API keys the logs will contain a payload message saying `“limiting by realm from apikey”`.
-If you noticed these entries on the logs, please contact the realm admin of the Realm ID listed in the logs. 
+When requests are rate limited by API keys the logs will contain a payload
+message saying `“limiting by realm from apikey”`. If you noticed these entries
+on the logs, please contact a realm administrator of the Realm ID listed in the
+logs.
 
-## User ID 
-This is the second level of rate limiting and affects users who are directly authenticated to the system through the web interface. 
+## User ID
+This is the second level of rate limiting and affects users who are directly authenticated to the system through the web interface.
 Since a user can be a member of multiple realms, the enforcement mechanism here is per-user, not per-realm.
 
-When requests are rate limited by user ID the logs will contain a payload message saying `“limiting by user”` and the logs will contain the user ID. 
+When requests are rate limited by user ID the logs will contain a payload message saying `“limiting by user”` and the logs will contain the user ID.
 You could verify which user is when accessing https://encv.org/realm/users/USERID.
 
 If you believe this user is abusing the system you can remove the user from the realm or delete the user, if needed.
 
-## IP address 
-If no authentication information is present, rate limiting is applied by the requestor's IP address. 
+## IP address
+If no authentication information is present, rate limiting is applied by the requestor's IP address.
 When requests are rate limited by IP address the logs will contain a payload message saying `“limited by ip”` and the IP address will also be logged.
 It is possible to block the IP address from accessing the system, but first make sure it doesn't match the following scenario.
 
diff --git a/docs/production.md b/docs/production.md
index 0816ec46f..5daae95d3 100644
--- a/docs/production.md
+++ b/docs/production.md
@@ -10,7 +10,7 @@ This page includes helpful tips for configuring things in production.
 - [Rotating secrets](#rotating-secrets)
 - [SMS with Twilio](#sms-with-twilio)
 - [Identity Platform setup](#identity-platform-setup)
-- [End-to-end test runner setup](#End-to-end-test-runner)
+- [End-to-end test runner](#end-to-end-test-runner)
 - [Architecture](#architecture)
 
 <!-- /TOC -->
@@ -104,7 +104,7 @@ configurations are available:
 
 ## User administration
 
-There are three types of "users" for the system:
+There are two types of "users" for the system:
 
 -   **System administrator** - global system administrators are the IT
     administrators of the system. They can create new realms and edit global
@@ -113,20 +113,12 @@ There are three types of "users" for the system:
     Typically a system administrator creates a realm, adds the initial realm
     admin, then removes themselves from the realm.
 
--   **Realm administrator** - realm administrators control the configuration of
-    one or more realms. A user may be an administrator of 0 or more realms. If a
-    user is an administrator of a realm, they have permissions to change
-    realm-specific settings including the realm name, signing keys, SMS
-    configuration, etc. To create a realm administrator, check the "Admin" box
-    in the UI for a new or existing user to promote them to a realm
-    administrator. Note that realm administration is per-realm; making a user an
-    admin of "Realm 1" does not make them an admin of "Realm 2".
-
--   **User** - users have the ability to generate and lookup the status of
-    codes. A user can be a member of multiple realms. To create a user, visit
-    the realm and click "Add User". If a user is a member of multiple realms (by
-    email address), they will be prompted to choose a realm after authenticating
-    to the system.
+-   **Realm users** - users have membership in 0 or more realms, and their
+    permissions in the realm determine their level of access. Most users will
+    only have permission to issue codes. However, some users will have control
+    over administering the realm, viewing statistics, inviting other realm
+    users, or updating realm settings. See the [realm admininistration
+    guide](realm-admin-guide.md) for more information.
 
 When bootstrapping a new system, a default system administrator with the email
 address "super@example.com" is created in the database. This user is **NOT**
@@ -457,7 +449,7 @@ Set the name, issuer, audience and JWKS URI in the configuration.
 
 Navigate back to the admin console home, and then click back into the
 newly created verification key config. Refresh this page until the JWKS
-importer has picked up the public key. 
+importer has picked up the public key.
 
 When that is ready, navigate back to the admin console home and create
 a new authorized health authority.
diff --git a/docs/realm-admin-guide.md b/docs/realm-admin-guide.md
index 56880ff87..0d2db9086 100644
--- a/docs/realm-admin-guide.md
+++ b/docs/realm-admin-guide.md
@@ -33,7 +33,8 @@ We provide a base level of account protection measures that we urge you to share
 * Users should not share logins to the verification system.
 * Users should only issue codes to people who have a verified COVID-19 diagnosis.
 
-Realm administrators should monitor the number of codes issued and take corrective action if needed (suspend a user's access to issue codes)
+A member of the realm should be responsible for monitoring the number of codes issued and take corrective action (including user account suspension) for abuse. Realm administrators can also enable Abuse Prevention.
+
 
 ### API key protection
 
@@ -137,14 +138,19 @@ Go to realm users admin by selecting 'Users' from the drop-down menu (shown unde
 
 ![settings](images/admin/menu_users.png "Click on your name and select 'Users'")
 
-Add users, by clicking on `create a new user`.
-
-![users](images/admin/users01.png "User listing")
+Add users, by clicking on the `+` in the header. If you do not see the `+`, you
+do not have permission to add users.
 
 Enter the name of the user and the email address to add. The email address will need to be verified on the person's first login.
 
-The admin checkbox indicates if this person should be made a realm admin (same powers that you have).
-If a user only needs to be able to issue verification codes, they do not need to be a realm admin.
+Choose the permissions the new user should have. Since permissions are
+constantly evolving, your list might be different than the one shown here. In
+general, permissions take the format: `<Entity><Action>` like `UserRead` and
+`UserWrite`. Read permissions are read-only and Write permissions include
+create, update, and delete permissions. Always practice the Principle of Least
+Privilege and only grant the most minimal set of permissions.
+
+Note, you can only grant permissions at or below your current level.
 
 ![users](images/admin/users02.png "User listing")
 
diff --git a/go.mod b/go.mod
index 31b42c9e7..f00031307 100644
--- a/go.mod
+++ b/go.mod
@@ -67,12 +67,13 @@ require (
 	go.opencensus.io v0.22.5
 	go.uber.org/zap v1.16.0
 	golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897 // indirect
+	golang.org/x/mod v0.4.0 // indirect
 	golang.org/x/net v0.0.0-20201110031124-69a78807bb2b // indirect
 	golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58 // indirect
 	golang.org/x/sys v0.0.0-20201109165425-215b40eba54c // indirect
 	golang.org/x/text v0.3.4
 	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e
-	golang.org/x/tools v0.0.0-20201116182000-1d699438d2cf
+	golang.org/x/tools v0.0.0-20201211185031-d93e913c1a58
 	google.golang.org/api v0.35.0
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a
diff --git a/go.sum b/go.sum
index fe191e22b..dcc046774 100644
--- a/go.sum
+++ b/go.sum
@@ -1466,6 +1466,8 @@ golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0 h1:RM4zey1++hCTbCVQfnWeKs9/IEsaBLA8vTkd0WVtmH4=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.0 h1:8pl+sMODzuvGJkmj2W4kZihvVb5mKm8pB/X44PIQHv8=
+golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1630,8 +1632,8 @@ golang.org/x/tools v0.0.0-20200915173823-2db8f0ff891c/go.mod h1:z6u4i615ZeAfBE4X
 golang.org/x/tools v0.0.0-20200918232735-d647fc253266/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/tools v0.0.0-20200923182640-463111b69878/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/tools v0.0.0-20201030143252-cf7a54d06671/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201116182000-1d699438d2cf h1:sDQg8i3k24bqfv1V4MugOhRCHMRzkrHdLJX5QraRSt4=
-golang.org/x/tools v0.0.0-20201116182000-1d699438d2cf/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201211185031-d93e913c1a58 h1:1Bs6RVeBFtLZ8Yi1Hk07DiOqzvwLD/4hln4iahvFlag=
+golang.org/x/tools v0.0.0-20201211185031-d93e913c1a58/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/internal/envstest/server.go b/internal/envstest/server.go
index 35f9af8a0..3d0a87f10 100644
--- a/internal/envstest/server.go
+++ b/internal/envstest/server.go
@@ -33,6 +33,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 	"github.com/google/exposure-notifications-verification-server/pkg/ratelimit"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 
 	"github.com/gorilla/securecookie"
 	"github.com/gorilla/sessions"
@@ -59,6 +60,36 @@ type TestServerResponse struct {
 	Server       *server.Server
 }
 
+// ProvisionAndLogin provisions and authenticates the initial user, realm,
+// permissions on the realm, and session cookie.
+func (r *TestServerResponse) ProvisionAndLogin() (*database.Realm, *database.User, *sessions.Session, error) {
+	// The migrations scripts create an initial realm and user, fetch them.
+	realm, err := r.Database.FindRealm(1)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	user, err := r.Database.FindUser(1)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	// Grant user permission on the realm.
+	if err := user.AddToRealm(r.Database, realm, rbac.LegacyRealmAdmin, database.SystemTest); err != nil {
+		return nil, nil, nil, err
+	}
+
+	// Build the session.
+	session, err := r.LoggedInSession(nil, user.Email)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	// Save the current realm on the session.
+	controller.StoreSessionRealm(session, realm)
+
+	return realm, user, session, nil
+}
+
 // SessionCookie returns an encrypted cookie for the given session information,
 // capable of being injected into the browser instance and read by the
 // application. Since the cookie contains the session, it can be used to mutate
@@ -264,7 +295,6 @@ func newServerConfig(tb testing.TB, testDatabaseInstance *database.TestInstance)
 		CookieKeys:  config.Base64ByteSlice{RandomBytes(tb, 64), RandomBytes(tb, 32)},
 		CSRFAuthKey: RandomBytes(tb, 32),
 		CertificateSigning: config.CertificateSigningConfig{
-			// TODO(sethvargo): configure this when the first test requires it
 			CertificateSigningKey: "UPDATE_ME",
 			Keys: keys.Config{
 				KeyManagerType: keys.KeyManagerTypeFilesystem,
diff --git a/internal/routes/server.go b/internal/routes/server.go
index 5e170f5f2..9ed8f11e4 100644
--- a/internal/routes/server.go
+++ b/internal/routes/server.go
@@ -132,9 +132,8 @@ func Server(
 	// Create common middleware
 	requireAuth := middleware.RequireAuth(cacher, authProvider, db, h, cfg.SessionIdleTimeout, cfg.SessionDuration)
 	requireVerified := middleware.RequireVerified(authProvider, db, h, cfg.SessionDuration)
-	requireAdmin := middleware.RequireRealmAdmin(h)
-	loadCurrentRealm := middleware.LoadCurrentRealm(cacher, db, h)
-	requireRealm := middleware.RequireRealm(h)
+	loadCurrentMembership := middleware.LoadCurrentMembership(cacher, db, h)
+	requireMembership := middleware.RequireMembership(db, h)
 	requireSystemAdmin := middleware.RequireSystemAdmin(h)
 	requireMFA := middleware.RequireMFA(authProvider, h)
 	processFirewall := middleware.ProcessFirewall(h, "server")
@@ -158,7 +157,7 @@ func Server(
 	}
 
 	{
-		loginController := login.New(ctx, authProvider, cfg, db, h)
+		loginController := login.New(ctx, authProvider, cacher, cfg, db, h)
 		{
 			sub := r.PathPrefix("").Subrouter()
 			sub.Use(rateLimit)
@@ -179,7 +178,7 @@ func Server(
 			sub = r.PathPrefix("").Subrouter()
 			sub.Use(requireAuth)
 			sub.Use(rateLimit)
-			sub.Use(loadCurrentRealm)
+			sub.Use(loadCurrentMembership)
 			sub.Handle("/login", loginController.HandleReauth()).Methods("GET")
 			sub.Handle("/login", loginController.HandleReauth()).Queries("redir", "").Methods("GET")
 			sub.Handle("/login/select-realm", loginController.HandleSelectRealm()).Methods("GET", "POST")
@@ -198,8 +197,8 @@ func Server(
 	{
 		sub := r.PathPrefix("/codes").Subrouter()
 		sub.Use(requireAuth)
-		sub.Use(loadCurrentRealm)
-		sub.Use(requireRealm)
+		sub.Use(loadCurrentMembership)
+		sub.Use(requireMembership)
 		sub.Use(processFirewall)
 		sub.Use(requireVerified)
 		sub.Use(requireMFA)
@@ -221,10 +220,9 @@ func Server(
 	{
 		sub := r.PathPrefix("/realm/mobile-apps").Subrouter()
 		sub.Use(requireAuth)
-		sub.Use(loadCurrentRealm)
-		sub.Use(requireRealm)
+		sub.Use(loadCurrentMembership)
+		sub.Use(requireMembership)
 		sub.Use(processFirewall)
-		sub.Use(requireAdmin)
 		sub.Use(requireVerified)
 		sub.Use(requireMFA)
 		sub.Use(rateLimit)
@@ -237,10 +235,9 @@ func Server(
 	{
 		sub := r.PathPrefix("/realm/apikeys").Subrouter()
 		sub.Use(requireAuth)
-		sub.Use(loadCurrentRealm)
-		sub.Use(requireRealm)
+		sub.Use(loadCurrentMembership)
+		sub.Use(requireMembership)
 		sub.Use(processFirewall)
-		sub.Use(requireAdmin)
 		sub.Use(requireVerified)
 		sub.Use(requireMFA)
 		sub.Use(rateLimit)
@@ -253,10 +250,9 @@ func Server(
 	{
 		sub := r.PathPrefix("/realm/users").Subrouter()
 		sub.Use(requireAuth)
-		sub.Use(loadCurrentRealm)
-		sub.Use(requireRealm)
+		sub.Use(loadCurrentMembership)
+		sub.Use(requireMembership)
 		sub.Use(processFirewall)
-		sub.Use(requireAdmin)
 		sub.Use(requireVerified)
 		sub.Use(requireMFA)
 		sub.Use(rateLimit)
@@ -269,10 +265,9 @@ func Server(
 	{
 		sub := r.PathPrefix("/realm").Subrouter()
 		sub.Use(requireAuth)
-		sub.Use(loadCurrentRealm)
-		sub.Use(requireRealm)
+		sub.Use(loadCurrentMembership)
+		sub.Use(requireMembership)
 		sub.Use(processFirewall)
-		sub.Use(requireAdmin)
 		sub.Use(requireVerified)
 		sub.Use(requireMFA)
 		sub.Use(rateLimit)
@@ -303,7 +298,7 @@ func Server(
 	{
 		sub := r.PathPrefix("/admin").Subrouter()
 		sub.Use(requireAuth)
-		sub.Use(loadCurrentRealm)
+		sub.Use(loadCurrentMembership)
 		sub.Use(requireSystemAdmin)
 		sub.Use(rateLimit)
 
@@ -409,7 +404,6 @@ func systemAdminRoutes(r *mux.Router, c *admin.Controller) {
 	r.Handle("/realms/{id:[0-9]+}/edit", c.HandleRealmsUpdate()).Methods("GET")
 	r.Handle("/realms/{realm_id:[0-9]+}/add/{user_id:[0-9]+}", c.HandleRealmsAdd()).Methods("PATCH")
 	r.Handle("/realms/{realm_id:[0-9]+}/remove/{user_id:[0-9]+}", c.HandleRealmsRemove()).Methods("PATCH")
-	r.Handle("/realms/{id:[0-9]+}/realmadmin", c.HandleRealmsSelectAndAdmin()).Methods("GET")
 	r.Handle("/realms/{id:[0-9]+}", c.HandleRealmsUpdate()).Methods("PATCH")
 
 	r.Handle("/users", c.HandleUsersIndex()).Methods("GET")
diff --git a/internal/routes/server_test.go b/internal/routes/server_test.go
index e07da3fd6..4096f7159 100644
--- a/internal/routes/server_test.go
+++ b/internal/routes/server_test.go
@@ -315,10 +315,6 @@ func TestRoutes_systemAdminRoutes(t *testing.T) {
 			req:  httptest.NewRequest("PATCH", "/realms/12345/remove/67890", nil),
 			vars: map[string]string{"realm_id": "12345", "user_id": "67890"},
 		},
-		{
-			req:  httptest.NewRequest("GET", "/realms/12345/realmadmin", nil), // TODO: better route
-			vars: map[string]string{"id": "12345"},
-		},
 		{
 			req: httptest.NewRequest("GET", "/users", nil),
 		},
diff --git a/pkg/controller/admin/caches.go b/pkg/controller/admin/caches.go
index ac44c1f1a..f68a6597d 100644
--- a/pkg/controller/admin/caches.go
+++ b/pkg/controller/admin/caches.go
@@ -28,12 +28,13 @@ type cacheItem struct {
 }
 
 var caches = map[string]*cacheItem{
-	"authorized_apps:": {"API keys", "Authentication for API keys"},
 	"apps:":            {"Mobile apps", "Registered mobile apps for the redirector service"},
+	"authorized_apps:": {"API keys", "Authentication for API keys"},
 	"jwks:":            {"JWKs", "JSON web key sets"},
+	"memberships:":     {"Memberships", "All membership information"},
+	"public_keys:":     {"Public keys", "PEM data from upstream key provider"},
 	"realms:":          {"Realms", "All realm data"},
 	"stats:":           {"Statistics", "API key, user, and realm statistics"},
-	"public_keys:":     {"Public keys", "PEM data from upstream key provider"},
 	"users:":           {"Users", "All user data"},
 }
 
diff --git a/pkg/controller/admin/caches_test.go b/pkg/controller/admin/caches_test.go
index 2fe949417..0b04990d4 100644
--- a/pkg/controller/admin/caches_test.go
+++ b/pkg/controller/admin/caches_test.go
@@ -22,7 +22,6 @@ import (
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
-	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/chromedp"
 )
@@ -38,15 +37,9 @@ func TestShowAdminCaches(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Create a system admin
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		SystemAdmin: true,
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
+	// Get the system admin
+	admin, err := harness.Database.FindUser(1)
+	if err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/pkg/controller/admin/email_test.go b/pkg/controller/admin/email_test.go
index 3f1dae0cf..f39cd00a8 100644
--- a/pkg/controller/admin/email_test.go
+++ b/pkg/controller/admin/email_test.go
@@ -22,7 +22,6 @@ import (
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
-	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/chromedp"
 )
@@ -38,15 +37,9 @@ func TestShowAdminEmail(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Create a system admin
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		SystemAdmin: true,
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
+	// Get the system admin
+	admin, err := harness.Database.FindUser(1)
+	if err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/pkg/controller/admin/events_test.go b/pkg/controller/admin/events_test.go
index 61ab21ade..bb5b5ec3a 100644
--- a/pkg/controller/admin/events_test.go
+++ b/pkg/controller/admin/events_test.go
@@ -41,15 +41,9 @@ func TestShowAdminEvents(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Create a system admin
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		SystemAdmin: true,
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
+	// Get the system admin
+	admin, err := harness.Database.FindUser(1)
+	if err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/pkg/controller/admin/mobile_apps_test.go b/pkg/controller/admin/mobile_apps_test.go
index 13c4c6040..6792899eb 100644
--- a/pkg/controller/admin/mobile_apps_test.go
+++ b/pkg/controller/admin/mobile_apps_test.go
@@ -38,15 +38,9 @@ func TestShowAdminMobileApps(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Create a system admin
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		SystemAdmin: true,
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
+	// Get the system admin
+	admin, err := harness.Database.FindUser(1)
+	if err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/pkg/controller/admin/realms.go b/pkg/controller/admin/realms.go
index 5ddb74b3e..19e93b667 100644
--- a/pkg/controller/admin/realms.go
+++ b/pkg/controller/admin/realms.go
@@ -16,11 +16,13 @@ package admin
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 	"github.com/google/exposure-notifications-verification-server/pkg/pagination"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -28,6 +30,18 @@ func (c *Controller) HandleRealmsIndex() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
+		currentUser := controller.UserFromContext(ctx)
+		if currentUser == nil {
+			controller.MissingUser(w, r, c.h)
+			return
+		}
+
+		memberships := controller.MembershipsFromContext(ctx)
+		membershipsMap := make(map[uint]bool, len(memberships))
+		for _, m := range memberships {
+			membershipsMap[m.RealmID] = true
+		}
+
 		pageParams, err := pagination.FromRequest(r)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
@@ -45,6 +59,7 @@ func (c *Controller) HandleRealmsIndex() http.Handler {
 		m := controller.TemplateMapFromContext(ctx)
 		m.Title("Realms - System Admin")
 		m["realms"] = realms
+		m["memberships"] = membershipsMap
 		m["query"] = q
 		m["paginator"] = paginator
 		c.h.RenderHTML(w, "admin/realms/index", m)
@@ -119,16 +134,15 @@ func (c *Controller) HandleRealmsCreate() http.Handler {
 			c.renderNewRealm(ctx, w, realm, smsConfig, emailConfig)
 			return
 		}
-		flash.Alert("Created realm: %q.", realm.Name)
+		flash.Alert("Created realm %q", realm.Name)
 
-		currentUser.Realms = append(currentUser.Realms, realm)
-		currentUser.AdminRealms = append(currentUser.AdminRealms, realm)
-		if err := c.db.SaveUser(currentUser, currentUser); err != nil {
+		// Make the current user an admin of the realm they just created.
+		if err := currentUser.AddToRealm(c.db, realm, rbac.LegacyRealmAdmin, currentUser); err != nil {
 			flash.Error("Failed to add you as an admin to the realm: %v", err)
 			c.renderNewRealm(ctx, w, realm, smsConfig, emailConfig)
 			return
 		}
-		flash.Alert("Added you as a user and admin to the realm.")
+		flash.Alert("Added you as an administrator of %q", realm.Name)
 
 		if realm.UseRealmCertificateKey {
 			// If we are using realm specific keys - we need to create the first one.
@@ -138,10 +152,10 @@ func (c *Controller) HandleRealmsCreate() http.Handler {
 				http.Redirect(w, r, "/admin/realms", http.StatusSeeOther)
 				return
 			}
-			flash.Alert("Created initial signing key for realm, id: %q", keyID)
+			flash.Alert("Created initial signing key %q", keyID)
 		}
 
-		http.Redirect(w, r, "/admin/realms", http.StatusSeeOther)
+		http.Redirect(w, r, fmt.Sprintf("/admin/realms/%d/edit", realm.ID), http.StatusSeeOther)
 	})
 }
 
@@ -185,6 +199,12 @@ func (c *Controller) HandleRealmsUpdate() http.Handler {
 			return
 		}
 
+		membership, err := currentUser.FindMembership(c.db, realm.ID)
+		if err != nil && !database.IsNotFound(err) {
+			controller.InternalError(w, r, c.h, err)
+			return
+		}
+
 		smsConfig, err := c.db.SystemSMSConfig()
 		if err != nil && !database.IsNotFound(err) {
 			controller.InternalError(w, r, c.h, err)
@@ -214,14 +234,14 @@ func (c *Controller) HandleRealmsUpdate() http.Handler {
 
 		// Requested form, stop processing.
 		if r.Method == http.MethodGet {
-			c.renderEditRealm(ctx, w, realm, smsConfig, emailConfig, quotaLimit, quotaRemaining)
+			c.renderEditRealm(ctx, w, realm, membership, smsConfig, emailConfig, quotaLimit, quotaRemaining)
 			return
 		}
 
 		var form FormData
 		if err := controller.BindForm(w, r, &form); err != nil {
 			flash.Error("Failed to process form: %v", err)
-			c.renderEditRealm(ctx, w, realm, smsConfig, emailConfig, quotaLimit, quotaRemaining)
+			c.renderEditRealm(ctx, w, realm, membership, smsConfig, emailConfig, quotaLimit, quotaRemaining)
 			return
 		}
 
@@ -229,21 +249,22 @@ func (c *Controller) HandleRealmsUpdate() http.Handler {
 		realm.CanUseSystemEmailConfig = form.CanUseSystemEmailConfig
 		if err := c.db.SaveRealm(realm, currentUser); err != nil {
 			flash.Error("Failed to create realm: %v", err)
-			c.renderEditRealm(ctx, w, realm, smsConfig, emailConfig, quotaLimit, quotaRemaining)
+			c.renderEditRealm(ctx, w, realm, membership, smsConfig, emailConfig, quotaLimit, quotaRemaining)
 			return
 		}
 
 		flash.Alert("Successfully updated realm %q", realm.Name)
-		http.Redirect(w, r, "/admin/realms", http.StatusSeeOther)
+		http.Redirect(w, r, fmt.Sprintf("/admin/realms/%d/edit", realm.ID), http.StatusSeeOther)
 	})
 }
 
 func (c *Controller) renderEditRealm(ctx context.Context, w http.ResponseWriter,
-	realm *database.Realm, smsConfig *database.SMSConfig, emailConfig *database.EmailConfig,
+	realm *database.Realm, membership *database.Membership, smsConfig *database.SMSConfig, emailConfig *database.EmailConfig,
 	quotaLimit, quotaRemaining uint64) {
 	m := controller.TemplateMapFromContext(ctx)
 	m.Title("Realm: %s - System Admin", realm.Name)
 	m["realm"] = realm
+	m["membership"] = membership
 	m["systemSMSConfig"] = smsConfig
 	m["systemEmailConfig"] = emailConfig
 	m["supportsPerRealmSigning"] = c.db.SupportsPerRealmSigning()
@@ -282,19 +303,13 @@ func (c *Controller) HandleRealmsAdd() http.Handler {
 			return
 		}
 
-		user.Realms = append(user.Realms, realm)
-		user.AdminRealms = append(user.AdminRealms, realm)
-
-		// Save the user
-		if err := c.db.SaveUser(user, currentUser); err != nil {
-			flash.Error("Failed to add %q to %q: %v", user.Name, realm.Name, err)
+		// Add the user to the realm.
+		if err := user.AddToRealm(c.db, realm, rbac.LegacyRealmAdmin, currentUser); err != nil {
+			flash.Error("Failed to add %s to %s: %s", user.Name, realm.Name, err)
 			controller.Back(w, r, c.h)
 			return
 		}
 
-		// Store the current realm on the session.
-		controller.StoreSessionRealm(session, realm)
-
 		flash.Alert("Successfully added %q to %q", user.Name, realm.Name)
 		controller.Back(w, r, c.h)
 		return
@@ -331,7 +346,12 @@ func (c *Controller) HandleRealmsRemove() http.Handler {
 			return
 		}
 
-		user.RemoveRealm(realm)
+		// Delete the user from the realm.
+		if err := user.DeleteFromRealm(c.db, realm, currentUser); err != nil {
+			flash.Error("Failed to add %s to %s: %s", user.Name, realm.Name, err)
+			controller.Back(w, r, c.h)
+			return
+		}
 
 		// Save the user
 		if err := c.db.SaveUser(user, currentUser); err != nil {
@@ -340,51 +360,10 @@ func (c *Controller) HandleRealmsRemove() http.Handler {
 			return
 		}
 
-		// If the currently-selected realm is the realm the admin just left, clear
-		// it.
-		if controller.RealmIDFromSession(session) == realm.ID {
-			controller.ClearSessionRealm(session)
-		}
-		flash.Alert("Successfully removed %q from %q", user.Name, realm.Name)
-		controller.Back(w, r, c.h)
-		return
-	})
-}
+		// Clear realm selection from session.
+		controller.ClearSessionRealm(session)
 
-func (c *Controller) HandleRealmsSelectAndAdmin() http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ctx := r.Context()
-		vars := mux.Vars(r)
-
-		session := controller.SessionFromContext(ctx)
-		if session == nil {
-			controller.MissingSession(w, r, c.h)
-			return
-		}
-		flash := controller.Flash(session)
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
-			return
-		}
-
-		realm, err := c.db.FindRealm(vars["id"])
-		if err != nil {
-			controller.InternalError(w, r, c.h, err)
-			return
-		}
-
-		if currentUser.CanAdminRealm(realm.ID) {
-			currentRealm := controller.RealmFromContext(ctx)
-			if currentRealm == nil || currentRealm.ID != realm.ID {
-				flash.Alert("Realm %q selected.", realm.Name)
-				controller.StoreSessionRealm(session, realm)
-			}
-			http.Redirect(w, r, "/realm/settings", http.StatusSeeOther)
-		}
-
-		flash.Error("User is not admin of %q", realm.Name)
+		flash.Alert("Successfully removed %q from %q", user.Name, realm.Name)
 		controller.Back(w, r, c.h)
 		return
 	})
diff --git a/pkg/controller/admin/realms_test.go b/pkg/controller/admin/realms_test.go
index 1ae2a2dda..5894bfa2f 100644
--- a/pkg/controller/admin/realms_test.go
+++ b/pkg/controller/admin/realms_test.go
@@ -22,8 +22,6 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
-	"github.com/google/exposure-notifications-verification-server/pkg/controller"
-	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/cdproto/page"
 	"github.com/chromedp/chromedp"
@@ -34,38 +32,18 @@ func TestShowAdminRealms(t *testing.T) {
 
 	harness := envstest.NewServer(t, testDatabaseInstance)
 
-	// Get the default realm
-	realm, err := harness.Database.FindRealm(1)
+	realm, _, session, err := harness.ProvisionAndLogin()
 	if err != nil {
 		t.Fatal(err)
 	}
-
-	// Create a system admin
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		SystemAdmin: true,
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
-		t.Fatal(err)
-	}
-
-	// Log in the user.
-	session, err := harness.LoggedInSession(nil, admin.Email)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Set the current realm.
-	controller.StoreSessionRealm(session, realm)
+	_ = realm
 
 	// Mint a cookie for the session.
 	cookie, err := harness.SessionCookie(session)
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	// Create a browser runner.
 	browserCtx := browser.New(t)
 	taskCtx, done := context.WithTimeout(browserCtx, 30*time.Second)
diff --git a/pkg/controller/admin/sms_test.go b/pkg/controller/admin/sms_test.go
index 4ad1618a2..c38b26120 100644
--- a/pkg/controller/admin/sms_test.go
+++ b/pkg/controller/admin/sms_test.go
@@ -22,7 +22,6 @@ import (
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
-	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/chromedp"
 )
@@ -38,15 +37,9 @@ func TestShowAdminSMS(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Create a system admin
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		SystemAdmin: true,
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
+	// Get the system admin
+	admin, err := harness.Database.FindUser(1)
+	if err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/pkg/controller/admin/users_list.go b/pkg/controller/admin/users_list.go
index 2ac41e37b..30d8504ba 100644
--- a/pkg/controller/admin/users_list.go
+++ b/pkg/controller/admin/users_list.go
@@ -38,8 +38,6 @@ func (c *Controller) HandleUsersIndex() http.Handler {
 		var scopes []database.Scope
 		filter := strings.TrimSpace(r.FormValue("filter"))
 		switch filter {
-		case "realmAdmins":
-			scopes = append(scopes, database.OnlyRealmAdmins())
 		case "systemAdmins":
 			scopes = append(scopes, database.OnlySystemAdmins())
 		default:
@@ -82,9 +80,16 @@ func (c *Controller) HandleUserShow() http.Handler {
 			return
 		}
 
+		memberships, err := user.ListMemberships(c.db)
+		if err != nil {
+			controller.InternalError(w, r, c.h, err)
+			return
+		}
+
 		m := controller.TemplateMapFromContext(ctx)
 		m.Title("User: %s - System Admin", user.Name)
 		m["user"] = user
+		m["memberships"] = memberships
 		c.h.RenderHTML(w, "admin/users/show", m)
 	})
 }
diff --git a/pkg/controller/admin/users_test.go b/pkg/controller/admin/users_test.go
index f0a22fa2a..f397f6d25 100644
--- a/pkg/controller/admin/users_test.go
+++ b/pkg/controller/admin/users_test.go
@@ -22,7 +22,6 @@ import (
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
-	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/chromedp"
 )
@@ -38,15 +37,9 @@ func TestAdminUsers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Create a system admin
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		SystemAdmin: true,
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
+	// Get the system admin
+	admin, err := harness.Database.FindUser(1)
+	if err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/pkg/controller/apikey/create.go b/pkg/controller/apikey/create.go
index 4d1b5982d..2ef292d6d 100644
--- a/pkg/controller/apikey/create.go
+++ b/pkg/controller/apikey/create.go
@@ -21,6 +21,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleCreate() http.Handler {
@@ -39,18 +40,19 @@ func (c *Controller) HandleCreate() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.APIKeyWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		// Requested form, stop processing.
 		if r.Method == http.MethodGet {
 			var authApp database.AuthorizedApp
@@ -77,7 +79,7 @@ func (c *Controller) HandleCreate() http.Handler {
 			APIKeyType: form.Type,
 		}
 
-		apiKey, err := realm.CreateAuthorizedApp(c.db, authApp, currentUser)
+		apiKey, err := currentRealm.CreateAuthorizedApp(c.db, authApp, currentUser)
 		if err != nil {
 			flash.Error("Failed to create API Key: %v", err)
 			c.renderNew(ctx, w, authApp)
diff --git a/pkg/controller/apikey/create_test.go b/pkg/controller/apikey/create_test.go
index 1fe1f75d3..1837c8ad4 100644
--- a/pkg/controller/apikey/create_test.go
+++ b/pkg/controller/apikey/create_test.go
@@ -22,7 +22,6 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
-	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/chromedp"
@@ -33,37 +32,17 @@ func TestHandleCreate(t *testing.T) {
 
 	harness := envstest.NewServer(t, testDatabaseInstance)
 
-	// Get the default realm
-	realm, err := harness.Database.FindRealm(1)
+	realm, _, session, err := harness.ProvisionAndLogin()
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	// Create a user
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
-		t.Fatal(err)
-	}
-
-	// Log in the user.
-	session, err := harness.LoggedInSession(nil, admin.Email)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Set the current realm.
-	controller.StoreSessionRealm(session, realm)
-
 	// Mint a cookie for the session.
 	cookie, err := harness.SessionCookie(session)
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	// Create a browser runner.
 	browserCtx := browser.New(t)
 	taskCtx, done := context.WithTimeout(browserCtx, 30*time.Second)
@@ -102,12 +81,12 @@ func TestHandleCreate(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Verify name.
+	if got, want := record.RealmID, realm.ID; got != want {
+		t.Errorf("expected %v to be %v", got, want)
+	}
 	if got, want := record.Name, "Example API key"; got != want {
 		t.Errorf("expected %v to be %v", got, want)
 	}
-
-	// Verify API key type.
 	if got, want := record.APIKeyType, database.APIKeyTypeDevice; got != want {
 		t.Errorf("expected %v to be %v", got, want)
 	}
diff --git a/pkg/controller/apikey/disable.go b/pkg/controller/apikey/disable.go
index fe71dc9ca..1e80a560a 100644
--- a/pkg/controller/apikey/disable.go
+++ b/pkg/controller/apikey/disable.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -35,19 +36,20 @@ func (c *Controller) HandleDisable() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.APIKeyWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
-		authApp, err := c.findAuthorizedApp(currentUser, realm, vars["id"])
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
+		authApp, err := c.findAuthorizedApp(currentUser, currentRealm, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
diff --git a/pkg/controller/apikey/enable.go b/pkg/controller/apikey/enable.go
index cefbd1d48..7d80376e5 100644
--- a/pkg/controller/apikey/enable.go
+++ b/pkg/controller/apikey/enable.go
@@ -19,6 +19,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -34,19 +35,20 @@ func (c *Controller) HandleEnable() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.APIKeyWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
-		authApp, err := c.findAuthorizedApp(currentUser, realm, vars["id"])
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
+		authApp, err := c.findAuthorizedApp(currentUser, currentRealm, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
diff --git a/pkg/controller/apikey/index.go b/pkg/controller/apikey/index.go
index 2b1cc422f..0c9b6053c 100644
--- a/pkg/controller/apikey/index.go
+++ b/pkg/controller/apikey/index.go
@@ -21,6 +21,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 	"github.com/google/exposure-notifications-verification-server/pkg/pagination"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 const (
@@ -32,11 +33,21 @@ func (c *Controller) HandleIndex() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.APIKeyRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+		if !membership.Can(rbac.APIKeyRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
 		pageParams, err := pagination.FromRequest(r)
 		if err != nil {
@@ -48,7 +59,7 @@ func (c *Controller) HandleIndex() http.Handler {
 		q := r.FormValue(QueryKeySearch)
 		scopes = append(scopes, database.WithAuthorizedAppSearch(q))
 
-		apps, paginator, err := realm.ListAuthorizedApps(c.db, pageParams, scopes...)
+		apps, paginator, err := currentRealm.ListAuthorizedApps(c.db, pageParams, scopes...)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
diff --git a/pkg/controller/apikey/show.go b/pkg/controller/apikey/show.go
index c07c84c43..ab018ef85 100644
--- a/pkg/controller/apikey/show.go
+++ b/pkg/controller/apikey/show.go
@@ -21,6 +21,7 @@ import (
 	"github.com/google/exposure-notifications-server/pkg/logging"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 
 	"github.com/gorilla/mux"
 )
@@ -39,18 +40,19 @@ func (c *Controller) HandleShow() http.Handler {
 			return
 		}
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.APIKeyRead) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		// If the API key is present, add it to the variables map and then delete it
 		// from the session.
 		apiKey, ok := session.Values["apiKey"]
@@ -61,7 +63,7 @@ func (c *Controller) HandleShow() http.Handler {
 		}
 
 		// Pull the authorized app from the id.
-		authApp, err := c.findAuthorizedApp(currentUser, realm, vars["id"])
+		authApp, err := c.findAuthorizedApp(currentUser, currentRealm, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				logger.Debugw("auth app does not exist", "id", vars["id"])
diff --git a/pkg/controller/apikey/stats.go b/pkg/controller/apikey/stats.go
index 3f1e4a2b3..f7607b449 100644
--- a/pkg/controller/apikey/stats.go
+++ b/pkg/controller/apikey/stats.go
@@ -27,6 +27,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/cache"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -45,20 +46,21 @@ func (c *Controller) HandleStats() http.Handler {
 			return
 		}
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !(membership.Can(rbac.APIKeyRead) || membership.Can(rbac.StatsRead)) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		// Pull the authorized app from the id.
-		authApp, err := c.findAuthorizedApp(currentUser, realm, vars["id"])
+		authApp, err := c.findAuthorizedApp(currentUser, currentRealm, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				logger.Debugw("auth app does not exist", "id", vars["id"])
@@ -70,7 +72,7 @@ func (c *Controller) HandleStats() http.Handler {
 			return
 		}
 
-		stats, err := c.getStats(ctx, authApp, realm)
+		stats, err := c.getStats(ctx, authApp, currentRealm)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
diff --git a/pkg/controller/apikey/update.go b/pkg/controller/apikey/update.go
index d7839d5cc..71c6ddb3b 100644
--- a/pkg/controller/apikey/update.go
+++ b/pkg/controller/apikey/update.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 	"github.com/gorilla/schema"
 )
@@ -41,19 +42,20 @@ func (c *Controller) HandleUpdate() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.APIKeyWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
-		authApp, err := realm.FindAuthorizedApp(c.db, vars["id"])
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
+		authApp, err := currentRealm.FindAuthorizedApp(c.db, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
@@ -104,5 +106,5 @@ func (c *Controller) renderEdit(ctx context.Context, w http.ResponseWriter, auth
 	m := controller.TemplateMapFromContext(ctx)
 	m.Title("Edit API key: %s", authApp.Name)
 	m["authApp"] = authApp
-	c.h.RenderHTML(w, "/realm/apikeys/edit", m)
+	c.h.RenderHTML(w, "apikeys/edit", m)
 }
diff --git a/pkg/controller/codes/bulk_issue.go b/pkg/controller/codes/bulk_issue.go
index 7c360a09a..041875374 100644
--- a/pkg/controller/codes/bulk_issue.go
+++ b/pkg/controller/codes/bulk_issue.go
@@ -18,6 +18,7 @@ import (
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 // HandleBulkIssue shows the page for bulk-issuing codes.
@@ -25,18 +26,24 @@ func (c *Controller) HandleBulkIssue() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.CodeBulkIssue) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
-		if !realm.AllowBulkUpload {
+		if !currentRealm.AllowBulkUpload {
 			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
-		hasSMSConfig, err := realm.HasSMSConfig(c.db)
+		hasSMSConfig, err := currentRealm.HasSMSConfig(c.db)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
diff --git a/pkg/controller/codes/expire.go b/pkg/controller/codes/expire.go
index 9935a6f88..b87b4d07c 100644
--- a/pkg/controller/codes/expire.go
+++ b/pkg/controller/codes/expire.go
@@ -19,6 +19,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/api"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -56,18 +57,19 @@ func (c *Controller) HandleExpirePage() http.Handler {
 		ctx := r.Context()
 		vars := mux.Vars(r)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.CodeExpire) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		session := controller.SessionFromContext(ctx)
 		if session == nil {
 			controller.MissingSession(w, r, c.h)
@@ -79,7 +81,7 @@ func (c *Controller) HandleExpirePage() http.Handler {
 		code, _, apiErr := c.CheckCodeStatus(r, vars["uuid"])
 		if apiErr != nil {
 			flash.Error("Failed to expire code: %v.", apiErr.Error)
-			if err := c.renderStatus(ctx, w, realm, currentUser, code); err != nil {
+			if err := c.renderStatus(ctx, w, currentRealm, currentUser, code); err != nil {
 				controller.InternalError(w, r, c.h, err)
 				return
 			}
@@ -94,8 +96,12 @@ func (c *Controller) HandleExpirePage() http.Handler {
 			flash.Alert("Expired code.")
 		}
 
-		retCode := Code{}
-		c.responseCode(ctx, r, expiredCode, &retCode)
+		retCode, err := c.responseCode(ctx, expiredCode)
+		if err != nil {
+			controller.InternalError(w, r, c.h, err)
+			return
+		}
+
 		c.renderShow(ctx, w, retCode)
 	})
 }
diff --git a/pkg/controller/codes/index.go b/pkg/controller/codes/index.go
index 7130cc88d..df95a5498 100644
--- a/pkg/controller/codes/index.go
+++ b/pkg/controller/codes/index.go
@@ -20,26 +20,28 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleIndex() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.CodeRead) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		var code database.VerificationCode
-		if err := c.renderStatus(ctx, w, realm, currentUser, &code); err != nil {
+		if err := c.renderStatus(ctx, w, currentRealm, currentUser, &code); err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
 		}
diff --git a/pkg/controller/codes/issue.go b/pkg/controller/codes/issue.go
index ae49cd37b..65923c215 100644
--- a/pkg/controller/codes/issue.go
+++ b/pkg/controller/codes/issue.go
@@ -22,6 +22,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/internal/project"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleIssue() http.Handler {
@@ -34,13 +35,19 @@ func (c *Controller) HandleIssue() http.Handler {
 			return
 		}
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.CodeIssue) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
-		hasSMSConfig, err := realm.HasSMSConfig(c.db)
+		hasSMSConfig, err := currentRealm.HasSMSConfig(c.db)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
@@ -56,18 +63,18 @@ func (c *Controller) HandleIssue() http.Handler {
 		m["maxDate"] = now.Format(project.RFC3339Date)
 		m["minDate"] = now.Add(pastDaysDuration).Format(project.RFC3339Date)
 		m["maxSymptomDays"] = displayAllowedDays
-		m["duration"] = realm.CodeDuration.Duration.String()
+		m["duration"] = currentRealm.CodeDuration.Duration.String()
 		m["hasSMSConfig"] = hasSMSConfig
 
 		// If the realm has a welcome message and it has not been displayed this
 		// session, display it.
-		if realm.WelcomeMessage != "" && !controller.WelcomeMessageDisplayedFromSession(session) {
+		if currentRealm.WelcomeMessage != "" && !controller.WelcomeMessageDisplayedFromSession(session) {
 			// Don't display it again.
 			controller.StoreSessionWelcomeMessageDisplayed(session, true)
 
 			// This is marked as HTML safe because it's run through bluemonday during
 			// parsing. Also, realm admins are mostly trusted to not XSS themselves.
-			m["welcomeMessage"] = template.HTML(realm.RenderWelcomeMessage())
+			m["welcomeMessage"] = template.HTML(currentRealm.RenderWelcomeMessage())
 		}
 
 		// Render
diff --git a/pkg/controller/codes/issue_test.go b/pkg/controller/codes/issue_test.go
index a8b375c0c..ae4f88d72 100644
--- a/pkg/controller/codes/issue_test.go
+++ b/pkg/controller/codes/issue_test.go
@@ -23,8 +23,6 @@ import (
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
 	"github.com/google/exposure-notifications-verification-server/internal/project"
 	"github.com/google/exposure-notifications-verification-server/pkg/api"
-	"github.com/google/exposure-notifications-verification-server/pkg/controller"
-	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/chromedp"
 )
@@ -34,32 +32,11 @@ func TestHandleIssue_IssueCode(t *testing.T) {
 
 	harness := envstest.NewServer(t, testDatabaseInstance)
 
-	// Get the default realm
-	realm, err := harness.Database.FindRealm(1)
+	realm, user, session, err := harness.ProvisionAndLogin()
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	// Create a user
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
-		t.Fatal(err)
-	}
-
-	// Log in the user.
-	session, err := harness.LoggedInSession(nil, admin.Email)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Set the current realm.
-	controller.StoreSessionRealm(session, realm)
-
 	// Mint a cookie for the session.
 	cookie, err := harness.SessionCookie(session)
 	if err != nil {
@@ -117,6 +94,10 @@ func TestHandleIssue_IssueCode(t *testing.T) {
 		t.Errorf("expected %v to be %v", got, want)
 	}
 
+	if got, want := dbCode.IssuingUserID, user.ID; got != want {
+		t.Errorf("expected %v to be %v", got, want)
+	}
+
 	// Exchange the code for a verification certificate.
 	allowedTypes := api.AcceptTypes{api.TestTypeConfirmed: struct{}{}}
 	token, err := harness.Database.VerifyCodeAndIssueToken(realm.ID, code, allowedTypes, 30*time.Minute)
diff --git a/pkg/controller/codes/logic.go b/pkg/controller/codes/logic.go
index b5476a17b..1455ac4bf 100644
--- a/pkg/controller/codes/logic.go
+++ b/pkg/controller/codes/logic.go
@@ -15,6 +15,7 @@
 package codes
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 
@@ -22,6 +23,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/api"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) CheckCodeStatus(r *http.Request, uuid string) (*database.VerificationCode, int, *api.ErrorReturn) {
@@ -29,26 +31,11 @@ func (c *Controller) CheckCodeStatus(r *http.Request, uuid string) (*database.Ve
 
 	logger := logging.FromContext(ctx).Named("codes.CheckCodeStatus")
 
-	authApp, user, err := c.getAuthorizationFromContext(r)
+	authApp, membership, realm, err := c.getAuthorizationFromContext(ctx)
 	if err != nil {
 		return nil, http.StatusUnauthorized, api.Error(err)
 	}
 
-	var realm *database.Realm
-	if authApp != nil {
-		realm, err = authApp.Realm(c.db)
-		if err != nil {
-			logger.Errorw("internal error", "error", err)
-			return nil, http.StatusInternalServerError, api.InternalError()
-		}
-	} else {
-		// if it's a user logged in, we can pull realm from the context.
-		realm = controller.RealmFromContext(ctx)
-	}
-	if realm == nil {
-		return nil, http.StatusBadRequest, api.Errorf("missing realm")
-	}
-
 	code, err := realm.FindVerificationCodeByUUID(c.db, uuid)
 	if err != nil {
 		if database.IsNotFound(err) {
@@ -70,30 +57,37 @@ func (c *Controller) CheckCodeStatus(r *http.Request, uuid string) (*database.Ve
 	}
 
 	// The current user must have issued the code or be a realm admin.
-	if user != nil && !(code.IssuingUserID == user.ID || user.CanAdminRealm(realm.ID)) {
-		logger.Errorw("failed to check otp code status", "error", "user email does not match issuing user")
+	if membership != nil && !membership.Can(rbac.CodeRead) {
 		return nil, http.StatusUnauthorized,
-			api.Errorf("failed to check otp code status: user does not match issuing user").WithCode(api.ErrVerifyCodeUserUnauth)
+			api.Errorf("user does not have permission to check code statuses").WithCode(api.ErrVerifyCodeUserUnauth)
 	}
 
 	// The current app must have issued the code or be a realm admin.
 	if authApp != nil && !(code.IssuingAppID == authApp.ID || authApp.IsAdminType()) {
-		logger.Errorw("failed to check otp code status", "error", "auth app does not match issuing app")
 		return nil, http.StatusUnauthorized,
-			api.Errorf("failed to check otp code status: auth app does not match issuing app").WithCode(api.ErrVerifyCodeUserUnauth)
+			api.Errorf("API key does not match issuer").WithCode(api.ErrVerifyCodeUserUnauth)
 	}
 	return code, 0, nil
 }
 
-func (c *Controller) getAuthorizationFromContext(r *http.Request) (*database.AuthorizedApp, *database.User, error) {
-	ctx := r.Context()
-
+// getAuthorizationFromContext pulls the authorization from the context. If an
+// API key is provided, it's used to lookup the realm. If a membership exists,
+// it's used to provide the realm.
+func (c *Controller) getAuthorizationFromContext(ctx context.Context) (*database.AuthorizedApp, *database.Membership, *database.Realm, error) {
 	authorizedApp := controller.AuthorizedAppFromContext(ctx)
-	currentUser := controller.UserFromContext(ctx)
+	if authorizedApp != nil {
+		realm, err := authorizedApp.Realm(c.db)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		return authorizedApp, nil, realm, nil
+	}
 
-	if authorizedApp == nil && currentUser == nil {
-		return nil, nil, fmt.Errorf("unable to identify authorized requestor")
+	membership := controller.MembershipFromContext(ctx)
+	if membership != nil {
+		realm := membership.Realm
+		return nil, membership, realm, nil
 	}
 
-	return authorizedApp, currentUser, nil
+	return nil, nil, nil, fmt.Errorf("unable to identify authorized requestor")
 }
diff --git a/pkg/controller/codes/show.go b/pkg/controller/codes/show.go
index 2325c953d..b56d0f394 100644
--- a/pkg/controller/codes/show.go
+++ b/pkg/controller/codes/show.go
@@ -22,6 +22,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -30,30 +31,30 @@ func (c *Controller) HandleShow() http.Handler {
 		ctx := r.Context()
 		vars := mux.Vars(r)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		session := controller.SessionFromContext(ctx)
+		if session == nil {
+			controller.MissingSession(w, r, c.h)
 			return
 		}
 
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		session := controller.SessionFromContext(ctx)
-		if session == nil {
-			controller.MissingSession(w, r, c.h)
+		if !membership.Can(rbac.CodeRead) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
-		retCode := Code{}
+
+		currentRealm := membership.Realm
+		currentUser := membership.User
 
 		if vars["uuid"] == "" {
 			var code database.VerificationCode
 			code.AddError("uuid", "cannot be blank")
 
-			if err := c.renderStatus(ctx, w, realm, currentUser, &code); err != nil {
+			if err := c.renderStatus(ctx, w, currentRealm, currentUser, &code); err != nil {
 				controller.InternalError(w, r, c.h, err)
 				return
 			}
@@ -66,7 +67,7 @@ func (c *Controller) HandleShow() http.Handler {
 			code.UUID = vars["uuid"]
 			code.AddError("uuid", apiErr.Error)
 
-			if err := c.renderStatus(ctx, w, realm, currentUser, &code); err != nil {
+			if err := c.renderStatus(ctx, w, currentRealm, currentUser, &code); err != nil {
 				controller.InternalError(w, r, c.h, err)
 				return
 			}
@@ -81,21 +82,59 @@ func (c *Controller) HandleShow() http.Handler {
 			return
 		}
 
-		c.responseCode(ctx, r, code, &retCode)
+		retCode, err := c.responseCode(ctx, code)
+		if err != nil {
+			controller.InternalError(w, r, c.h, err)
+			return
+		}
+
 		c.renderShow(ctx, w, retCode)
 	})
 }
 
-func (c *Controller) responseCode(ctx context.Context, r *http.Request, code *database.VerificationCode, retCode *Code) {
+func (c *Controller) responseCode(ctx context.Context, code *database.VerificationCode) (*Code, error) {
+	if code == nil {
+		return nil, fmt.Errorf("code is nil")
+	}
+
+	// Build initial code.
+	var retCode Code
 	retCode.UUID = code.UUID
 	retCode.TestType = strings.Title(code.TestType)
 
+	// Get realm from context.
+	_, _, realm, err := c.getAuthorizationFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	// Return "best" status message but looking up issuer.
 	if code.IssuingUserID != 0 {
+		user, err := realm.FindUser(c.db, code.IssuingUserID)
+		if err != nil {
+			if !database.IsNotFound(err) {
+				return nil, err
+			}
+
+			// User has since been deleted.
+			user = &database.User{Name: "Unknown user"}
+		}
+
 		retCode.IssuerType = "Issuing user"
-		retCode.Issuer = c.getUserName(ctx, r, code.IssuingUserID)
+		retCode.Issuer = user.Name
 	} else if code.IssuingAppID != 0 {
+		authApp, err := realm.FindAuthorizedApp(c.db, code.IssuingAppID)
+		if err != nil {
+			if !database.IsNotFound(err) {
+				return nil, err
+			}
+
+			// App has since been deleted
+			authApp = &database.AuthorizedApp{Name: "Unknown app"}
+		}
+
 		retCode.IssuerType = "Issuing app"
-		retCode.Issuer = c.getAuthAppName(ctx, r, code.IssuingAppID)
+		retCode.Issuer = authApp.Name
 	}
 
 	retCode.Claimed = code.Claimed
@@ -104,65 +143,14 @@ func (c *Controller) responseCode(ctx context.Context, r *http.Request, code *da
 	} else {
 		retCode.Status = "Not yet claimed"
 	}
+
 	if !code.IsExpired() && !code.Claimed {
 		retCode.Expires = code.ExpiresAt.UTC().Unix()
 		retCode.LongExpires = code.LongExpiresAt.UTC().Unix()
 		retCode.HasLongExpires = retCode.LongExpires > retCode.Expires
 	}
-}
-
-func (c *Controller) getUserName(ctx context.Context, r *http.Request, id uint) (userName string) {
-	userName = "Unknown user"
-	_, user, err := c.getAuthorizationFromContext(r)
-	if err != nil {
-		return
-	}
-
-	// The current user is the issuer
-	if user != nil && user.ID == id {
-		return user.Name
-	}
-
-	// The current user is admin, issuer is someone else
-
-	realm := controller.RealmFromContext(ctx)
-	if realm == nil {
-		return
-	}
-
-	user, err = realm.FindUser(c.db, id)
-	if err != nil {
-		return
-	}
-
-	return user.Name
-}
-
-func (c *Controller) getAuthAppName(ctx context.Context, r *http.Request, id uint) (appName string) {
-	appName = "Unknown app"
-	authApp, _, err := c.getAuthorizationFromContext(r)
-	if err != nil {
-		return
-	}
-
-	// The current app is the issuer
-	if authApp != nil && authApp.ID == id {
-		return authApp.Name
-	}
-
-	// The current app is admin, issuer is a different app
-
-	realm := controller.RealmFromContext(ctx)
-	if realm == nil {
-		return
-	}
-
-	authApp, err = realm.FindAuthorizedApp(c.db, id)
-	if err != nil {
-		return
-	}
 
-	return authApp.Name
+	return &retCode, nil
 }
 
 type Code struct {
@@ -177,7 +165,7 @@ type Code struct {
 	HasLongExpires bool   `json:"hasLongExpires"`
 }
 
-func (c *Controller) renderShow(ctx context.Context, w http.ResponseWriter, code Code) {
+func (c *Controller) renderShow(ctx context.Context, w http.ResponseWriter, code *Code) {
 	m := controller.TemplateMapFromContext(ctx)
 	m.Title("Verification code status")
 	m["code"] = code
diff --git a/pkg/controller/context.go b/pkg/controller/context.go
index 192cbe794..77470941b 100644
--- a/pkg/controller/context.go
+++ b/pkg/controller/context.go
@@ -31,6 +31,8 @@ type contextKey string
 const (
 	contextKeyAuthorizedApp = contextKey("authorizedApp")
 	contextKeyFirebaseUser  = contextKey("firebaseUser")
+	contextKeyMembership    = contextKey("membership")
+	contextKeyMemberships   = contextKey("memberships")
 	contextKeyRealm         = contextKey("realm")
 	contextKeyRequestID     = contextKey("requestID")
 	contextKeySession       = contextKey("session")
@@ -202,6 +204,54 @@ func UserFromContext(ctx context.Context) *database.User {
 	return t
 }
 
+// WithMemberships stores the user's available memberships on the context.
+func WithMemberships(ctx context.Context, u []*database.Membership) context.Context {
+	m := TemplateMapFromContext(ctx)
+	m["currentMemberships"] = u
+	ctx = WithTemplateMap(ctx, m)
+
+	return context.WithValue(ctx, contextKeyMemberships, u)
+}
+
+// MembershipsFromContext retrieves the membership from the context. If no value
+// exists, it returns nil.
+func MembershipsFromContext(ctx context.Context) []*database.Membership {
+	v := ctx.Value(contextKeyMemberships)
+	if v == nil {
+		return nil
+	}
+
+	t, ok := v.([]*database.Membership)
+	if !ok {
+		return nil
+	}
+	return t
+}
+
+// WithMembership stores the current membership on the context.
+func WithMembership(ctx context.Context, u *database.Membership) context.Context {
+	m := TemplateMapFromContext(ctx)
+	m["currentMembership"] = u
+	ctx = WithTemplateMap(ctx, m)
+
+	return context.WithValue(ctx, contextKeyMembership, u)
+}
+
+// MembershipFromContext retrieves the membership from the context. If no value
+// exists, it returns nil.
+func MembershipFromContext(ctx context.Context) *database.Membership {
+	v := ctx.Value(contextKeyMembership)
+	if v == nil {
+		return nil
+	}
+
+	t, ok := v.(*database.Membership)
+	if !ok {
+		return nil
+	}
+	return t
+}
+
 // WithFirebaseUser stores the current firebase user on the context.
 func WithFirebaseUser(ctx context.Context, u *auth.UserRecord) context.Context {
 	return context.WithValue(ctx, contextKeyFirebaseUser, u)
diff --git a/pkg/controller/controller.go b/pkg/controller/controller.go
index fb714b35c..69e2607cb 100644
--- a/pkg/controller/controller.go
+++ b/pkg/controller/controller.go
@@ -95,24 +95,24 @@ func NotFound(w http.ResponseWriter, r *http.Request, h *render.Renderer) {
 
 	switch {
 	case prefixInList(accept, ContentTypeHTML):
-		h.RenderHTMLStatus(w, http.StatusNotFound, "400", nil)
+		h.RenderHTMLStatus(w, http.StatusNotFound, "404", nil)
 	case prefixInList(accept, ContentTypeJSON):
 		h.RenderJSON(w, http.StatusNotFound, http.StatusText(http.StatusNotFound))
 	default:
-		http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+		http.Error(w, http.StatusText(http.StatusNotFound), http.StatusNotFound)
 	}
 }
 
-// Unauthorized returns an error indicating the request was unauthorized.
+// Unauthorized returns an error indicating the request was unauthorized. The
+// system always returns 401 (even with authentication is provided but
+// authorization fails).
 func Unauthorized(w http.ResponseWriter, r *http.Request, h *render.Renderer) {
 	accept := strings.Split(r.Header.Get("Accept"), ",")
 	accept = append(accept, strings.Split(r.Header.Get("Content-Type"), ",")...)
 
 	switch {
 	case prefixInList(accept, ContentTypeHTML):
-		flash := Flash(SessionFromContext(r.Context()))
-		flash.Error("You are not authorized to perform that action!")
-		http.Redirect(w, r, "/signout", http.StatusSeeOther)
+		h.RenderHTMLStatus(w, http.StatusUnauthorized, "401", nil)
 	case prefixInList(accept, ContentTypeJSON):
 		h.RenderJSON(w, http.StatusUnauthorized, apiErrorUnauthorized)
 	default:
@@ -120,9 +120,9 @@ func Unauthorized(w http.ResponseWriter, r *http.Request, h *render.Renderer) {
 	}
 }
 
-// MissingRealm returns an error indicating that the request requires a realm
-// selection, but one was not present.
-func MissingRealm(w http.ResponseWriter, r *http.Request, h *render.Renderer) {
+// MissingMembership returns an error indicating that the request requires a
+// realm selection, but one was not present.
+func MissingMembership(w http.ResponseWriter, r *http.Request, h *render.Renderer) {
 	accept := strings.Split(r.Header.Get("Accept"), ",")
 	accept = append(accept, strings.Split(r.Header.Get("Content-Type"), ",")...)
 
diff --git a/pkg/controller/issueapi/issue.go b/pkg/controller/issueapi/issue.go
index 39fb30588..1c740b8eb 100644
--- a/pkg/controller/issueapi/issue.go
+++ b/pkg/controller/issueapi/issue.go
@@ -39,6 +39,7 @@ func (c *Controller) HandleIssue() http.Handler {
 				api.Errorf("server is read-only for maintenance").WithCode(api.ErrMaintenanceMode))
 			return
 		}
+
 		ctx := r.Context()
 		result := &issueResult{
 			httpCode:  http.StatusOK,
@@ -55,7 +56,7 @@ func (c *Controller) HandleIssue() http.Handler {
 			return
 		}
 
-		_, _, err := c.getAuthorizationFromContext(r)
+		authApp, membership, realm, err := c.getAuthorizationFromContext(ctx)
 		if err != nil {
 			result.obsBlame = observability.BlameClient
 			result.obsResult = observability.ResultError("MISSING_AUTHORIZED_APP")
@@ -64,7 +65,7 @@ func (c *Controller) HandleIssue() http.Handler {
 		}
 
 		// Add realm so that metrics are groupable on a per-realm basis.
-		result, resp := c.issue(ctx, &request)
+		result, resp := c.issue(ctx, authApp, membership, realm, &request)
 		if result.errorReturn != nil {
 			if result.httpCode == http.StatusInternalServerError {
 				controller.InternalError(w, r, c.h, errors.New(result.errorReturn.Error))
diff --git a/pkg/controller/issueapi/issue_batch.go b/pkg/controller/issueapi/issue_batch.go
index ae40df48f..711b53be3 100644
--- a/pkg/controller/issueapi/issue_batch.go
+++ b/pkg/controller/issueapi/issue_batch.go
@@ -54,7 +54,7 @@ func (c *Controller) HandleBatchIssue() http.Handler {
 			return
 		}
 
-		_, _, err := c.getAuthorizationFromContext(r)
+		authApp, membership, realm, err := c.getAuthorizationFromContext(ctx)
 		if err != nil {
 			result.obsBlame = observability.BlameClient
 			result.obsResult = observability.ResultError("MISSING_AUTHORIZED_APP")
@@ -62,8 +62,8 @@ func (c *Controller) HandleBatchIssue() http.Handler {
 			return
 		}
 
-		// Add realm so that metrics are groupable on a per-realm basis.
-		if realm := controller.RealmFromContext(ctx); !realm.AllowBulkUpload {
+		// Ensure bulk upload is enabled on this realm.
+		if !realm.AllowBulkUpload {
 			result.obsBlame = observability.BlameClient
 			result.obsResult = observability.ResultError("BULK_ISSUE_NOT_ENABLED")
 			c.h.RenderJSON(w, http.StatusBadRequest, api.Errorf("bulk issuing is not enabled on this realm"))
@@ -83,7 +83,7 @@ func (c *Controller) HandleBatchIssue() http.Handler {
 
 		resp.Codes = make([]*api.IssueCodeResponse, l)
 		for i, singleIssue := range request.Codes {
-			result, resp.Codes[i] = c.issue(ctx, singleIssue)
+			result, resp.Codes[i] = c.issue(ctx, authApp, membership, realm, singleIssue)
 			if result.errorReturn != nil {
 				if result.httpCode == http.StatusInternalServerError {
 					controller.InternalError(w, r, c.h, errors.New(result.errorReturn.Error))
diff --git a/pkg/controller/issueapi/logic.go b/pkg/controller/issueapi/logic.go
index 1836b6868..f678616a8 100644
--- a/pkg/controller/issueapi/logic.go
+++ b/pkg/controller/issueapi/logic.go
@@ -33,10 +33,8 @@ import (
 	"go.opencensus.io/stats"
 )
 
-func (c *Controller) issue(ctx context.Context, request *api.IssueCodeRequest) (*issueResult, *api.IssueCodeResponse) {
+func (c *Controller) issue(ctx context.Context, authApp *database.AuthorizedApp, membership *database.Membership, realm *database.Realm, request *api.IssueCodeRequest) (*issueResult, *api.IssueCodeResponse) {
 	logger := logging.FromContext(ctx).Named("issueapi.issue")
-	realm := controller.RealmFromContext(ctx)
-	var err error
 
 	// If this realm requires a date but no date was specified, return an error.
 	if realm.RequireDate && request.SymptomDate == "" && request.TestDate == "" {
@@ -72,6 +70,7 @@ func (c *Controller) issue(ctx context.Context, request *api.IssueCodeRequest) (
 	// Verify SMS configuration if phone was provided
 	var smsProvider sms.Provider
 	if request.Phone != "" {
+		var err error
 		smsProvider, err = realm.SMSProvider(c.db)
 		if err != nil {
 			logger.Errorw("failed to get sms provider", "error", err)
@@ -191,7 +190,7 @@ func (c *Controller) issue(ctx context.Context, request *api.IssueCodeRequest) (
 					obsBlame:    observability.BlameClient,
 					obsResult:   observability.ResultError("QUOTA_EXCEEDED"),
 					httpCode:    http.StatusTooManyRequests,
-					errorReturn: api.Errorf("exceeded realm quota, please contact the realm admin.").WithCode(api.ErrQuotaExceeded),
+					errorReturn: api.Errorf("exceeded realm quota, please contact a realm administrator").WithCode(api.ErrQuotaExceeded),
 				}, nil
 			}
 		}
@@ -206,6 +205,12 @@ func (c *Controller) issue(ctx context.Context, request *api.IssueCodeRequest) (
 		longExpiryTime = expiryTime
 	}
 
+	// Compute issuing user - the membership will be nil when called via the API.
+	var user *database.User
+	if membership != nil {
+		user = membership.User
+	}
+
 	// Generate verification code
 	codeRequest := otp.Request{
 		DB:             c.db,
@@ -220,8 +225,8 @@ func (c *Controller) issue(ctx context.Context, request *api.IssueCodeRequest) (
 		RealmID:        realm.ID,
 		UUID:           rUUID,
 
-		IssuingUser:       controller.UserFromContext(ctx),
-		IssuingApp:        controller.AuthorizedAppFromContext(ctx),
+		IssuingUser:       user,
+		IssuingApp:        authApp,
 		IssuingExternalID: request.ExternalIssuerID,
 	}
 
@@ -287,17 +292,26 @@ func (c *Controller) issue(ctx context.Context, request *api.IssueCodeRequest) (
 	}
 }
 
-func (c *Controller) getAuthorizationFromContext(r *http.Request) (*database.AuthorizedApp, *database.User, error) {
-	ctx := r.Context()
-
+// getAuthorizationFromContext pulls the authorization from the context. If an
+// API key is provided, it's used to lookup the realm. If a membership exists,
+// it's used to provide the realm.
+func (c *Controller) getAuthorizationFromContext(ctx context.Context) (*database.AuthorizedApp, *database.Membership, *database.Realm, error) {
 	authorizedApp := controller.AuthorizedAppFromContext(ctx)
-	currentUser := controller.UserFromContext(ctx)
+	if authorizedApp != nil {
+		realm, err := authorizedApp.Realm(c.db)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		return authorizedApp, nil, realm, nil
+	}
 
-	if authorizedApp == nil && currentUser == nil {
-		return nil, nil, fmt.Errorf("unable to identify authorized requestor")
+	membership := controller.MembershipFromContext(ctx)
+	if membership != nil {
+		realm := membership.Realm
+		return nil, membership, realm, nil
 	}
 
-	return authorizedApp, currentUser, nil
+	return nil, nil, nil, fmt.Errorf("unable to identify authorized requestor")
 }
 
 func recordObservability(ctx context.Context, result *issueResult) {
diff --git a/pkg/controller/login/controller.go b/pkg/controller/login/controller.go
index 8a2286936..54213d412 100644
--- a/pkg/controller/login/controller.go
+++ b/pkg/controller/login/controller.go
@@ -19,6 +19,7 @@ import (
 	"context"
 
 	"github.com/google/exposure-notifications-verification-server/internal/auth"
+	"github.com/google/exposure-notifications-verification-server/pkg/cache"
 	"github.com/google/exposure-notifications-verification-server/pkg/config"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 	"github.com/google/exposure-notifications-verification-server/pkg/render"
@@ -26,6 +27,7 @@ import (
 
 type Controller struct {
 	authProvider auth.Provider
+	cacher       cache.Cacher
 	config       *config.ServerConfig
 	db           *database.Database
 	h            *render.Renderer
@@ -35,12 +37,14 @@ type Controller struct {
 func New(
 	ctx context.Context,
 	authProvider auth.Provider,
+	cacher cache.Cacher,
 	config *config.ServerConfig,
 	db *database.Database,
 	h *render.Renderer) *Controller {
 
 	return &Controller{
 		authProvider: authProvider,
+		cacher:       cacher,
 		config:       config,
 		db:           db,
 		h:            h,
diff --git a/pkg/controller/login/register.go b/pkg/controller/login/register.go
index 7205a05af..2e4e0b212 100644
--- a/pkg/controller/login/register.go
+++ b/pkg/controller/login/register.go
@@ -16,9 +16,11 @@
 package login
 
 import (
+	"context"
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/database"
 )
 
 func (c *Controller) HandleRegisterPhone() http.Handler {
@@ -31,27 +33,30 @@ func (c *Controller) HandleRegisterPhone() http.Handler {
 			return
 		}
 
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
-			return
-		}
-		realm := controller.RealmFromContext(ctx)
-
-		m := controller.TemplateMapFromContext(ctx)
-		m.Title("Multi-factor authentication registration")
-
-		mode := realm.EffectiveMFAMode(currentUser)
-		m["mfaMode"] = &mode
+		// Mark that the user was prompted.
+		controller.StoreSessionMFAPrompted(session, true)
 
-		if controller.MFAPromptedFromSession(session) {
-			m["isPrompt"] = true
-		} else {
-			// Mark prompted so we only prompt once.
-			controller.StoreSessionMFAPrompted(session, true)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			// The user landed on this page but does not have a realm selected. They
+			// could have navigated here from their profile page, or they could be a
+			// system admin and were redirected here.
+			c.renderRegisterPhone(ctx, w, nil)
+			return
 		}
 
-		m["firebase"] = c.config.Firebase
-		c.h.RenderHTML(w, "login/register-phone", m)
+		currentRealm := membership.Realm
+		currentUser := membership.User
+		mode := currentRealm.EffectiveMFAMode(currentUser)
+		c.renderRegisterPhone(ctx, w, &mode)
 	})
 }
+
+func (c *Controller) renderRegisterPhone(ctx context.Context, w http.ResponseWriter,
+	mode *database.AuthRequirement) {
+	m := controller.TemplateMapFromContext(ctx)
+	m.Title("Multi-factor authentication registration")
+	m["mfaMode"] = mode
+	m["firebase"] = c.config.Firebase
+	c.h.RenderHTML(w, "login/register-phone", m)
+}
diff --git a/pkg/controller/login/select.go b/pkg/controller/login/select.go
index a019cddad..055d5a47c 100644
--- a/pkg/controller/login/select.go
+++ b/pkg/controller/login/select.go
@@ -42,8 +42,9 @@ func (c *Controller) HandleSelectRealm() http.Handler {
 			controller.MissingUser(w, r, c.h)
 			return
 		}
+		memberships := controller.MembershipsFromContext(ctx)
 
-		switch len(currentUser.Realms) {
+		switch len(memberships) {
 		case 0:
 			// If the user is a member of zero realms, it's possible they are an
 			// admin. If so, redirect them to the admin page.
@@ -53,7 +54,7 @@ func (c *Controller) HandleSelectRealm() http.Handler {
 			}
 		case 1:
 			// If the user is only a member of one realm, set that and bypass selection.
-			realm := currentUser.Realms[0]
+			realm := memberships[0].Realm
 
 			// The user is already logged in and the current realm matches the
 			// expected realm - just redirect.
@@ -81,40 +82,38 @@ func (c *Controller) HandleSelectRealm() http.Handler {
 
 		// Requested form, stop processing.
 		if r.Method == http.MethodGet {
-			c.renderSelect(ctx, w, currentUser.Realms)
+			c.renderSelect(ctx, w, memberships)
 			return
 		}
 
 		var form FormData
 		if err := controller.BindForm(w, r, &form); err != nil {
 			flash.Error(err.Error())
-			c.renderSelect(ctx, w, currentUser.Realms)
+			c.renderSelect(ctx, w, memberships)
 			return
 		}
 
-		realm := currentUser.GetRealm(form.RealmID)
-		if realm == nil {
-			flash.Error("Please select a realm to continue.")
-			c.renderSelect(ctx, w, currentUser.Realms)
-			return
-		}
+		membership, err := currentUser.FindMembership(c.db, form.RealmID)
+		if err != nil {
+			if database.IsNotFound(err) {
+				flash.Error("Invalid realm selection.")
+				c.renderSelect(ctx, w, memberships)
+				return
+			}
 
-		// Verify that the user has access to the realm.
-		if !currentUser.CanViewRealm(realm.ID) {
-			flash.Error("Invalid realm selection.")
-			c.renderSelect(ctx, w, currentUser.Realms)
+			controller.InternalError(w, r, c.h, err)
 			return
 		}
 
-		controller.StoreSessionRealm(session, realm)
+		controller.StoreSessionRealm(session, membership.Realm)
 		http.Redirect(w, r, "/codes/issue", http.StatusSeeOther)
 	})
 }
 
 // renderSelect renders the realm selection page.
-func (c *Controller) renderSelect(ctx context.Context, w http.ResponseWriter, realms []*database.Realm) {
+func (c *Controller) renderSelect(ctx context.Context, w http.ResponseWriter, memberships []*database.Membership) {
 	m := controller.TemplateMapFromContext(ctx)
 	m.Title("Realm selector")
-	m["realms"] = realms
+	m["memberships"] = memberships
 	c.h.RenderHTML(w, "login/select-realm", m)
 }
diff --git a/pkg/controller/middleware/auth.go b/pkg/controller/middleware/auth.go
index 6239f26e6..d5ea9fed9 100644
--- a/pkg/controller/middleware/auth.go
+++ b/pkg/controller/middleware/auth.go
@@ -29,11 +29,10 @@ import (
 	"github.com/gorilla/mux"
 )
 
-// RequireAuth requires a user to be logged in. It also ensures that currentUser
-// is set in the template map. It fetches a user from the session and stores the
-// full record in the request context.
+// RequireAuth requires a user to be logged in. It also fetches and stores
+// information about the user on the request context.
 func RequireAuth(cacher cache.Cacher, authProvider auth.Provider, db *database.Database, h *render.Renderer, sessionIdleTTL, expiryCheckTTL time.Duration) mux.MiddlewareFunc {
-	cacheTTL := 15 * time.Minute
+	cacheTTL := 30 * time.Minute
 
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -76,11 +75,11 @@ func RequireAuth(cacher cache.Cacher, authProvider auth.Provider, db *database.D
 			// Load the user by using the cache to alleviate pressure on the database
 			// layer.
 			var user database.User
-			cacheKey := &cache.Key{
+			userCacheKey := &cache.Key{
 				Namespace: "users:by_email",
 				Key:       email,
 			}
-			if err := cacher.Fetch(ctx, cacheKey, &user, cacheTTL, func() (interface{}, error) {
+			if err := cacher.Fetch(ctx, userCacheKey, &user, cacheTTL, func() (interface{}, error) {
 				return db.FindUserByEmail(email)
 			}); err != nil {
 				authProvider.ClearSession(ctx, session)
@@ -115,15 +114,23 @@ func RequireAuth(cacher cache.Cacher, authProvider auth.Provider, db *database.D
 				}
 
 				// Update the user in the cache so it has the new revoke check time.
-				if err := cacher.Write(ctx, cacheKey, &user, cacheTTL); err != nil {
-					logger.Errorw("failed to cached user revocation check time", "error", err)
+				if err := cacher.Write(ctx, userCacheKey, &user, cacheTTL); err != nil {
+					logger.Errorw("failed to cache user revocation check time", "error", err)
 					controller.InternalError(w, r, h, err)
 					return
 				}
 			}
 
+			// Look up the user's memberships.
+			memberships, err := user.ListMemberships(db)
+			if err != nil {
+				controller.InternalError(w, r, h, err)
+				return
+			}
+
 			// Save the user on the context.
 			ctx = controller.WithUser(ctx, &user)
+			ctx = controller.WithMemberships(ctx, memberships)
 			r = r.Clone(ctx)
 
 			next.ServeHTTP(w, r)
diff --git a/pkg/controller/middleware/csrf.go b/pkg/controller/middleware/csrf.go
index b74603b55..75718359d 100644
--- a/pkg/controller/middleware/csrf.go
+++ b/pkg/controller/middleware/csrf.go
@@ -31,8 +31,6 @@ import (
 // ConfigureCSRF injects the CSRF handling and populates the global template map
 // with the csrfToken and csrfTemplate.
 func ConfigureCSRF(ctx context.Context, config *config.ServerConfig, h *render.Renderer) mux.MiddlewareFunc {
-	// TODO(mikehelmick) - there are more configuration options for CSRF
-	// protection.
 	protect := csrf.Protect(config.CSRFAuthKey,
 		csrf.Secure(!config.DevMode),
 		csrf.ErrorHandler(handleCSRFError(ctx, h)),
diff --git a/pkg/controller/middleware/emailverified.go b/pkg/controller/middleware/emailverified.go
index 427f9f5f7..da814f31e 100644
--- a/pkg/controller/middleware/emailverified.go
+++ b/pkg/controller/middleware/emailverified.go
@@ -45,26 +45,17 @@ func RequireVerified(authProvider auth.Provider, db *database.Database, h *rende
 				controller.MissingSession(w, r, h)
 				return
 			}
-			flash := controller.Flash(session)
 
-			currentUser := controller.UserFromContext(ctx)
-			if currentUser == nil {
-				authProvider.ClearSession(ctx, session)
-
-				flash.Error("Log in first to verify email.")
-				controller.MissingUser(w, r, h)
-				return
-			}
-
-			realm := controller.RealmFromContext(ctx)
-			if realm == nil {
-				controller.MissingRealm(w, r, h)
+			membership := controller.MembershipFromContext(ctx)
+			if membership == nil {
+				controller.MissingMembership(w, r, h)
 				return
 			}
+			currentRealm := membership.Realm
 
 			// Only try to verify email if the realm requires it.
-			if realm.EmailVerifiedMode == database.MFARequired ||
-				(realm.EmailVerifiedMode == database.MFAOptionalPrompt && !controller.EmailVerificationPromptedFromSession(session)) {
+			if currentRealm.EmailVerifiedMode == database.MFARequired ||
+				(currentRealm.EmailVerifiedMode == database.MFAOptionalPrompt && !controller.EmailVerificationPromptedFromSession(session)) {
 				verified, err := authProvider.EmailVerified(ctx, session)
 				if err != nil {
 					controller.InternalError(w, r, h, err)
diff --git a/pkg/controller/middleware/firewall.go b/pkg/controller/middleware/firewall.go
index da58153ef..425e168ef 100644
--- a/pkg/controller/middleware/firewall.go
+++ b/pkg/controller/middleware/firewall.go
@@ -37,20 +37,21 @@ func ProcessFirewall(h *render.Renderer, typ string) mux.MiddlewareFunc {
 
 			logger := logging.FromContext(ctx).Named("middleware.ProcessFirewall")
 
-			realm := controller.RealmFromContext(ctx)
-			if realm == nil {
-				controller.MissingRealm(w, r, h)
+			membership := controller.MembershipFromContext(ctx)
+			if membership == nil {
+				controller.MissingMembership(w, r, h)
 				return
 			}
+			currentRealm := membership.Realm
 
 			var allowedCIDRs []string
 			switch typ {
 			case "adminapi":
-				allowedCIDRs = realm.AllowedCIDRsAdminAPI
+				allowedCIDRs = currentRealm.AllowedCIDRsAdminAPI
 			case "apiserver":
-				allowedCIDRs = realm.AllowedCIDRsAPIServer
+				allowedCIDRs = currentRealm.AllowedCIDRsAPIServer
 			case "server":
-				allowedCIDRs = realm.AllowedCIDRsServer
+				allowedCIDRs = currentRealm.AllowedCIDRsServer
 			default:
 				logger.Errorw("unknown firewall type", "type", typ)
 			}
diff --git a/pkg/controller/middleware/realm.go b/pkg/controller/middleware/membership.go
similarity index 51%
rename from pkg/controller/middleware/realm.go
rename to pkg/controller/middleware/membership.go
index 5102410df..0d0a424ad 100644
--- a/pkg/controller/middleware/realm.go
+++ b/pkg/controller/middleware/membership.go
@@ -19,11 +19,9 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"strconv"
 	"strings"
 	"time"
 
-	"github.com/google/exposure-notifications-server/pkg/logging"
 	"github.com/google/exposure-notifications-verification-server/pkg/cache"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
@@ -32,137 +30,89 @@ import (
 	"github.com/gorilla/mux"
 )
 
-// LoadCurrentRealm loads the selected realm from the cache to the context
-func LoadCurrentRealm(cacher cache.Cacher, db *database.Database, h *render.Renderer) mux.MiddlewareFunc {
-	cacheTTL := 5 * time.Minute
-
+// LoadCurrentMembership attempts to load the current membership. If there is no
+// current membership in the session, it does nothing. If a membership exists,
+// but fails to load from the database/cache, it returns an error. Use
+// RequireMembership to enforce membership.
+//
+// This must come after RequireAuth so that the user is loaded onto the context.
+func LoadCurrentMembership(cacher cache.Cacher, db *database.Database, h *render.Renderer) mux.MiddlewareFunc {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
 
-			logger := logging.FromContext(ctx).Named("middleware.LoadCurrentRealm")
-
 			session := controller.SessionFromContext(ctx)
 			if session == nil {
 				controller.MissingSession(w, r, h)
 				return
 			}
 
-			realmID := controller.RealmIDFromSession(session)
-			if realmID == 0 {
-				logger.Debugw("realm does not exist in session")
-				// If no realm on session, continue serving.
-				// If realm is non-optional the caller should RequireRealm or RequireAdmin.
-				next.ServeHTTP(w, r)
-				return
-			}
-
-			// Load the realm by using the cache to alleviate pressure on the database
-			// layer.
-			var realm database.Realm
-			cacheKey := &cache.Key{
-				Namespace: "realms:by_id",
-				Key:       strconv.FormatUint(uint64(realmID), 10),
-			}
-			if err := cacher.Fetch(ctx, cacheKey, &realm, cacheTTL, func() (interface{}, error) {
-				return db.FindRealm(realmID)
-			}); err != nil {
-				if database.IsNotFound(err) {
-					logger.Debugw("realm does not exist")
-					controller.MissingRealm(w, r, h)
-					return
-				}
-
-				logger.Errorw("failed to lookup realm", "error", err)
-				controller.InternalError(w, r, h, err)
-				return
-			}
-
-			// Save the realm on the context.
-			ctx = controller.WithRealm(ctx, &realm)
-			r = r.Clone(ctx)
-
-			next.ServeHTTP(w, r)
-		})
-	}
-}
-
-// RequireRealm requires a realm to exist in the session. It also ensures the
-// realm is set as currentRealm in the template map.
-//
-// Must come after:
-//   LoadCurrentRealm to populate the current realm.
-//   RequireAuth so that a user is set on the context.
-func RequireRealm(h *render.Renderer) mux.MiddlewareFunc {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			ctx := r.Context()
-
-			logger := logging.FromContext(ctx).Named("middleware.RequireRealm")
-
 			currentUser := controller.UserFromContext(ctx)
 			if currentUser == nil {
 				controller.MissingUser(w, r, h)
 				return
 			}
 
-			realm := controller.RealmFromContext(ctx)
-			if realm == nil {
-				controller.MissingRealm(w, r, h)
+			// Extract the current realm ID from the session.
+			realmID := controller.RealmIDFromSession(session)
+			if realmID == 0 {
+				// No realm in session, continue serving
+				next.ServeHTTP(w, r)
 				return
 			}
 
-			if !currentUser.CanViewRealm(realm.ID) {
-				logger.Debugw("user cannot view realm")
-				// Technically this is unauthorized, but we don't want to leak the
-				// existence of a realm by returning a different error.
-				controller.MissingRealm(w, r, h)
-				return
+			// Find the correct membership. The RequireAuth middleware loads the user
+			// and all their memberships, so just iterate over that list instead of
+			// doing a database lookup. Most users will be a member of a single realm,
+			// so N is very, very small.
+			var membership *database.Membership
+			memberships := controller.MembershipsFromContext(ctx)
+			for _, v := range memberships {
+				if v.RealmID == realmID {
+					membership = v
+					break
+				}
 			}
-
-			if passwordRedirectRequired(ctx, currentUser, realm) {
-				controller.RedirectToChangePassword(w, r, h)
+			if membership == nil {
+				// There was a realm in the session, but it does not match a membership
+				// of the user. Clear and move along.
+				controller.ClearSessionRealm(session)
+				next.ServeHTTP(w, r)
 				return
 			}
 
+			// Save the membership on the context.
+			ctx = controller.WithMembership(ctx, membership)
+			r = r.Clone(ctx)
+
 			next.ServeHTTP(w, r)
 		})
 	}
 }
 
-// RequireRealmAdmin verifies the user is an admin of the current realm.
+// RequireMembership requires a membership (realm selection) to exist in the
+// session.
 //
-// Must come after:
-//   LoadCurrentRealm to populate the current realm.
-//   RequireAuth so that a user is set on the context.
-func RequireRealmAdmin(h *render.Renderer) mux.MiddlewareFunc {
+// This must come after LoadCurrentMembership so the membership is on the
+// context
+func RequireMembership(db *database.Database, h *render.Renderer) mux.MiddlewareFunc {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
 
-			logger := logging.FromContext(ctx).Named("middleware.RequireRealmAdmin")
-
-			currentUser := controller.UserFromContext(ctx)
-			if currentUser == nil {
-				controller.MissingUser(w, r, h)
-				return
-			}
-
-			realm := controller.RealmFromContext(ctx)
-			if realm == nil {
-				controller.MissingRealm(w, r, h)
+			session := controller.SessionFromContext(ctx)
+			if session == nil {
+				controller.MissingSession(w, r, h)
 				return
 			}
 
-			if !currentUser.CanAdminRealm(realm.ID) {
-				logger.Debugw("user cannot manage realm")
-				// Technically this is unauthorized, but we don't want to leak the
-				// existence of a realm by returning a different error.
-				controller.MissingRealm(w, r, h)
+			membership := controller.MembershipFromContext(ctx)
+			if membership == nil {
+				controller.MissingMembership(w, r, h)
 				return
 			}
 
-			if passwordRedirectRequired(ctx, currentUser, realm) {
+			if passwordRedirectRequired(ctx, membership.User, membership.Realm) {
 				controller.RedirectToChangePassword(w, r, h)
 				return
 			}
diff --git a/pkg/controller/middleware/mfa.go b/pkg/controller/middleware/mfa.go
index 1a0feab3f..cdb711636 100644
--- a/pkg/controller/middleware/mfa.go
+++ b/pkg/controller/middleware/mfa.go
@@ -39,11 +39,13 @@ func RequireMFA(authProvider auth.Provider, h *render.Renderer) mux.MiddlewareFu
 				return
 			}
 
-			currentUser := controller.UserFromContext(ctx)
-			if currentUser == nil {
-				controller.MissingUser(w, r, h)
+			membership := controller.MembershipFromContext(ctx)
+			if membership == nil {
+				controller.MissingMembership(w, r, h)
 				return
 			}
+			currentRealm := membership.Realm
+			currentUser := membership.User
 
 			mfaEnabled, err := authProvider.MFAEnabled(ctx, session)
 			if err != nil {
@@ -53,13 +55,7 @@ func RequireMFA(authProvider auth.Provider, h *render.Renderer) mux.MiddlewareFu
 
 			prompted := controller.MFAPromptedFromSession(session)
 			if !mfaEnabled {
-				realm := controller.RealmFromContext(ctx)
-				if realm == nil {
-					controller.MissingRealm(w, r, h)
-					return
-				}
-
-				if mode := realm.EffectiveMFAMode(currentUser); mode == database.MFARequired ||
+				if mode := currentRealm.EffectiveMFAMode(currentUser); mode == database.MFARequired ||
 					mode == database.MFAOptionalPrompt && !prompted {
 					controller.RedirectToMFA(w, r, h)
 					return
diff --git a/pkg/controller/mobileapps/create.go b/pkg/controller/mobileapps/create.go
index 1bdc3d34b..7ccb7d810 100644
--- a/pkg/controller/mobileapps/create.go
+++ b/pkg/controller/mobileapps/create.go
@@ -21,6 +21,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleCreate() http.Handler {
@@ -42,18 +43,19 @@ func (c *Controller) HandleCreate() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.MobileAppWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		// Requested form, stop processing.
 		if r.Method == http.MethodGet {
 			var app database.MobileApp
@@ -79,7 +81,7 @@ func (c *Controller) HandleCreate() http.Handler {
 		// Build the authorized app struct
 		app := &database.MobileApp{
 			Name:    form.Name,
-			RealmID: realm.ID,
+			RealmID: currentRealm.ID,
 			URL:     form.URL,
 			OS:      form.OS,
 			AppID:   form.AppID,
diff --git a/pkg/controller/mobileapps/create_test.go b/pkg/controller/mobileapps/create_test.go
index 4a58fa6fd..b52f50a8a 100644
--- a/pkg/controller/mobileapps/create_test.go
+++ b/pkg/controller/mobileapps/create_test.go
@@ -22,7 +22,6 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
-	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/chromedp"
@@ -33,37 +32,17 @@ func TestHandleCreate(t *testing.T) {
 
 	harness := envstest.NewServer(t, testDatabaseInstance)
 
-	// Get the default realm
-	realm, err := harness.Database.FindRealm(1)
+	realm, _, session, err := harness.ProvisionAndLogin()
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	// Create a user
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
-		t.Fatal(err)
-	}
-
-	// Log in the user.
-	session, err := harness.LoggedInSession(nil, admin.Email)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Set the current realm.
-	controller.StoreSessionRealm(session, realm)
-
 	// Mint a cookie for the session.
 	cookie, err := harness.SessionCookie(session)
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	// Create a browser runner.
 	browserCtx := browser.New(t)
 	taskCtx, done := context.WithTimeout(browserCtx, 30*time.Second)
@@ -93,4 +72,20 @@ func TestHandleCreate(t *testing.T) {
 	); err != nil {
 		t.Fatal(err)
 	}
+
+	// Ensure valid
+	record, err := realm.FindMobileApp(harness.Database, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if got, want := record.RealmID, realm.ID; got != want {
+		t.Errorf("expected %v to be %v", got, want)
+	}
+	if got, want := record.Name, "Example mobile app"; got != want {
+		t.Errorf("expected %v to be %v", got, want)
+	}
+	if got, want := record.URL, "https://example.com"; got != want {
+		t.Errorf("expected %v to be %v", got, want)
+	}
 }
diff --git a/pkg/controller/mobileapps/disable.go b/pkg/controller/mobileapps/disable.go
index f2b5f07dd..9b289992e 100644
--- a/pkg/controller/mobileapps/disable.go
+++ b/pkg/controller/mobileapps/disable.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -35,19 +36,20 @@ func (c *Controller) HandleDisable() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.MobileAppWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
-		app, err := realm.FindMobileApp(c.db, vars["id"])
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
+		app, err := currentRealm.FindMobileApp(c.db, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
diff --git a/pkg/controller/mobileapps/enable.go b/pkg/controller/mobileapps/enable.go
index 7be6998cb..d12be73dd 100644
--- a/pkg/controller/mobileapps/enable.go
+++ b/pkg/controller/mobileapps/enable.go
@@ -19,6 +19,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -34,19 +35,20 @@ func (c *Controller) HandleEnable() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.MobileAppWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
-		app, err := realm.FindMobileApp(c.db, vars["id"])
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
+		app, err := currentRealm.FindMobileApp(c.db, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
diff --git a/pkg/controller/mobileapps/index.go b/pkg/controller/mobileapps/index.go
index 1203819e3..e29c7e2ea 100644
--- a/pkg/controller/mobileapps/index.go
+++ b/pkg/controller/mobileapps/index.go
@@ -21,6 +21,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 	"github.com/google/exposure-notifications-verification-server/pkg/pagination"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 const (
@@ -32,11 +33,17 @@ func (c *Controller) HandleIndex() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.MobileAppRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
 		pageParams, err := pagination.FromRequest(r)
 		if err != nil {
@@ -49,7 +56,7 @@ func (c *Controller) HandleIndex() http.Handler {
 		scopes = append(scopes, database.WithMobileAppSearch(q))
 
 		// Perform the lazy load on authorized apps for the realm.
-		apps, paginator, err := realm.ListMobileApps(c.db, pageParams, scopes...)
+		apps, paginator, err := currentRealm.ListMobileApps(c.db, pageParams, scopes...)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
diff --git a/pkg/controller/mobileapps/show.go b/pkg/controller/mobileapps/show.go
index 27de286a3..8c0f3ae6b 100644
--- a/pkg/controller/mobileapps/show.go
+++ b/pkg/controller/mobileapps/show.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 
 	"github.com/gorilla/mux"
 )
@@ -36,14 +37,20 @@ func (c *Controller) HandleShow() http.Handler {
 			return
 		}
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.MobileAppRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
 		// Pull the authorized app from the id.
-		app, err := realm.FindMobileApp(c.db, vars["id"])
+		app, err := currentRealm.FindMobileApp(c.db, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
diff --git a/pkg/controller/mobileapps/update.go b/pkg/controller/mobileapps/update.go
index 0e53a6ce1..f5028fb8b 100644
--- a/pkg/controller/mobileapps/update.go
+++ b/pkg/controller/mobileapps/update.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 	"github.com/gorilla/schema"
 )
@@ -45,19 +46,20 @@ func (c *Controller) HandleUpdate() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.MobileAppWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
-		app, err := realm.FindMobileApp(c.db, vars["id"])
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
+		app, err := currentRealm.FindMobileApp(c.db, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
diff --git a/pkg/controller/realmadmin/events.go b/pkg/controller/realmadmin/events.go
index afbae1c8e..47c673b25 100644
--- a/pkg/controller/realmadmin/events.go
+++ b/pkg/controller/realmadmin/events.go
@@ -21,6 +21,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 	"github.com/google/exposure-notifications-verification-server/pkg/pagination"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 const (
@@ -35,11 +36,17 @@ func (c *Controller) HandleEvents() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.AuditRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
 		var scopes []database.Scope
 		from := r.FormValue(QueryFromSearch)
@@ -52,13 +59,13 @@ func (c *Controller) HandleEvents() http.Handler {
 			return
 		}
 
-		events, paginator, err := realm.ListAudits(c.db, pageParams, scopes...)
+		events, paginator, err := currentRealm.ListAudits(c.db, pageParams, scopes...)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
 		}
 
-		c.renderEvents(ctx, w, realm, events, paginator, from, to)
+		c.renderEvents(ctx, w, currentRealm, events, paginator, from, to)
 	})
 }
 
diff --git a/pkg/controller/realmadmin/express.go b/pkg/controller/realmadmin/express.go
index 63ff0f166..7b5a2690e 100644
--- a/pkg/controller/realmadmin/express.go
+++ b/pkg/controller/realmadmin/express.go
@@ -19,6 +19,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleDisableExpress() http.Handler {
@@ -32,31 +33,31 @@ func (c *Controller) HandleDisableExpress() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.SettingsWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
+		currentRealm := membership.Realm
+		currentUser := membership.User
 
-		if !realm.EnableENExpress {
+		if !currentRealm.EnableENExpress {
 			flash.Error("Realm is not currently enrolled in EN Express.")
-			c.renderSettings(ctx, w, r, realm, nil, nil, 0, 0)
+			c.renderSettings(ctx, w, r, currentRealm, nil, nil, 0, 0)
 			return
 		}
 
 		defaultSettings := database.NewRealmWithDefaults("--")
-		realm.EnableENExpress = false
-		realm.SMSTextTemplate = defaultSettings.SMSTextTemplate
-		if err := c.db.SaveRealm(realm, currentUser); err != nil {
+		currentRealm.EnableENExpress = false
+		currentRealm.SMSTextTemplate = defaultSettings.SMSTextTemplate
+		if err := c.db.SaveRealm(currentRealm, currentUser); err != nil {
 			flash.Error("Failed to disable EN Express: %v", err)
 
-			c.renderSettings(ctx, w, r, realm, nil, nil, 0, 0)
+			c.renderSettings(ctx, w, r, currentRealm, nil, nil, 0, 0)
 			return
 		}
 
@@ -76,41 +77,41 @@ func (c *Controller) HandleEnableExpress() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.SettingsWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
+		currentRealm := membership.Realm
+		currentUser := membership.User
 
-		if realm.EnableENExpress {
+		if currentRealm.EnableENExpress {
 			flash.Error("Realm already has EN Express Enabled.")
-			c.renderSettings(ctx, w, r, realm, nil, nil, 0, 0)
+			c.renderSettings(ctx, w, r, currentRealm, nil, nil, 0, 0)
 			return
 		}
 
 		// Enable EN Express by setting default settings.
 		enxSettings := database.NewRealmWithDefaults("--")
-		realm.EnableENExpress = true
-		realm.CodeLength = enxSettings.CodeLength
-		realm.CodeDuration = enxSettings.CodeDuration
-		realm.LongCodeLength = enxSettings.LongCodeLength
-		realm.LongCodeDuration = enxSettings.LongCodeDuration
-		realm.SMSTextTemplate = "Your Exposure Notifications verification link: [enslink] Expires in [longexpires] hours (click for mobile device only)"
+		currentRealm.EnableENExpress = true
+		currentRealm.CodeLength = enxSettings.CodeLength
+		currentRealm.CodeDuration = enxSettings.CodeDuration
+		currentRealm.LongCodeLength = enxSettings.LongCodeLength
+		currentRealm.LongCodeDuration = enxSettings.LongCodeDuration
+		currentRealm.SMSTextTemplate = "Your Exposure Notifications verification link: [enslink] Expires in [longexpires] hours (click for mobile device only)"
 		// Confirmed is the only allowed test type for EN Express.
-		realm.AllowedTestTypes = database.TestTypeConfirmed
+		currentRealm.AllowedTestTypes = database.TestTypeConfirmed
 
-		if err := c.db.SaveRealm(realm, currentUser); err != nil {
+		if err := c.db.SaveRealm(currentRealm, currentUser); err != nil {
 			flash.Error("Failed to enable EN Express: %v", err)
 			// This will allow the user to correct other validation errors and then click "uprade" again.
-			realm.EnableENExpress = false
-			realm.SMSTextTemplate = enxSettings.SMSTextTemplate
-			c.renderSettings(ctx, w, r, realm, nil, nil, 0, 0)
+			currentRealm.EnableENExpress = false
+			currentRealm.SMSTextTemplate = enxSettings.SMSTextTemplate
+			c.renderSettings(ctx, w, r, currentRealm, nil, nil, 0, 0)
 			return
 		}
 
diff --git a/pkg/controller/realmadmin/settings.go b/pkg/controller/realmadmin/settings.go
index 88cdff0ff..8ebe0aac1 100644
--- a/pkg/controller/realmadmin/settings.go
+++ b/pkg/controller/realmadmin/settings.go
@@ -24,6 +24,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 	"github.com/google/exposure-notifications-verification-server/pkg/email"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/google/exposure-notifications-verification-server/pkg/sms"
 )
 
@@ -105,21 +106,22 @@ func (c *Controller) HandleSettings() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.SettingsRead) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		var quotaLimit, quotaRemaining uint64
-		if realm.AbusePreventionEnabled {
-			key, err := realm.QuotaKey(c.config.RateLimit.HMACKey)
+		if currentRealm.AbusePreventionEnabled {
+			key, err := currentRealm.QuotaKey(c.config.RateLimit.HMACKey)
 			if err != nil {
 				controller.InternalError(w, r, c.h, err)
 				return
@@ -133,96 +135,103 @@ func (c *Controller) HandleSettings() http.Handler {
 		}
 
 		if r.Method == http.MethodGet {
-			c.renderSettings(ctx, w, r, realm, nil, nil, quotaLimit, quotaRemaining)
+			c.renderSettings(ctx, w, r, currentRealm, nil, nil, quotaLimit, quotaRemaining)
+			return
+		}
+
+		// If we got this far, we're about to update settings, upsert the higher
+		// permission.
+		if !membership.Can(rbac.SettingsWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
 		var form FormData
 		if err := controller.BindForm(w, r, &form); err != nil {
 			flash.Error("Failed to process form: %v", err)
-			c.renderSettings(ctx, w, r, realm, nil, nil, quotaLimit, quotaRemaining)
+			c.renderSettings(ctx, w, r, currentRealm, nil, nil, quotaLimit, quotaRemaining)
 			return
 		}
 
 		// General
 		if form.General {
-			realm.Name = form.Name
-			realm.RegionCode = form.RegionCode
-			realm.WelcomeMessage = form.WelcomeMessage
+			currentRealm.Name = form.Name
+			currentRealm.RegionCode = form.RegionCode
+			currentRealm.WelcomeMessage = form.WelcomeMessage
 		}
 
 		// Codes
 		if form.Codes {
-			realm.AllowedTestTypes = form.AllowedTestTypes
-			realm.RequireDate = form.RequireDate
-			realm.AllowBulkUpload = form.AllowBulkUpload
-			realm.SMSTextTemplate = form.SMSTextTemplate
+			currentRealm.AllowedTestTypes = form.AllowedTestTypes
+			currentRealm.RequireDate = form.RequireDate
+			currentRealm.AllowBulkUpload = form.AllowBulkUpload
+			currentRealm.SMSTextTemplate = form.SMSTextTemplate
 
 			// These fields can only be set if ENX is disabled
-			if !realm.EnableENExpress {
-				realm.CodeLength = form.CodeLength
-				realm.CodeDuration.Duration = time.Duration(form.CodeDurationMinutes) * time.Minute
-				realm.LongCodeLength = form.LongCodeLength
-				realm.LongCodeDuration.Duration = time.Duration(form.LongCodeDurationHours) * time.Hour
+			if !currentRealm.EnableENExpress {
+				currentRealm.CodeLength = form.CodeLength
+				currentRealm.CodeDuration.Duration = time.Duration(form.CodeDurationMinutes) * time.Minute
+				currentRealm.LongCodeLength = form.LongCodeLength
+				currentRealm.LongCodeDuration.Duration = time.Duration(form.LongCodeDurationHours) * time.Hour
 			}
 		}
 
 		// SMS
 		if form.SMS {
-			realm.UseSystemSMSConfig = form.UseSystemSMSConfig
-			realm.SMSCountry = form.SMSCountry
-			realm.SMSFromNumberID = form.SMSFromNumberID
+			currentRealm.UseSystemSMSConfig = form.UseSystemSMSConfig
+			currentRealm.SMSCountry = form.SMSCountry
+			currentRealm.SMSFromNumberID = form.SMSFromNumberID
 		}
 
 		// Email
 		if form.Email {
-			realm.UseSystemEmailConfig = form.UseSystemEmailConfig
-			realm.EmailInviteTemplate = form.EmailInviteTemplate
+			currentRealm.UseSystemEmailConfig = form.UseSystemEmailConfig
+			currentRealm.EmailInviteTemplate = form.EmailInviteTemplate
 		}
 
 		// Security
 		if form.Security {
-			realm.EmailVerifiedMode = database.AuthRequirement(form.EmailVerifiedMode)
-			realm.MFAMode = database.AuthRequirement(form.MFAMode)
-			realm.MFARequiredGracePeriod = database.FromDuration(time.Duration(form.MFARequiredGracePeriod) * 24 * time.Hour)
-			realm.PasswordRotationPeriodDays = form.PasswordRotationPeriodDays
-			realm.PasswordRotationWarningDays = form.PasswordRotationWarningDays
+			currentRealm.EmailVerifiedMode = database.AuthRequirement(form.EmailVerifiedMode)
+			currentRealm.MFAMode = database.AuthRequirement(form.MFAMode)
+			currentRealm.MFARequiredGracePeriod = database.FromDuration(time.Duration(form.MFARequiredGracePeriod) * 24 * time.Hour)
+			currentRealm.PasswordRotationPeriodDays = form.PasswordRotationPeriodDays
+			currentRealm.PasswordRotationWarningDays = form.PasswordRotationWarningDays
 
 			allowedCIDRsAdminADPI, err := database.ToCIDRList(form.AllowedCIDRsAdminAPI)
 			if err != nil {
-				realm.AddError("allowedCIDRsAdminAPI", err.Error())
+				currentRealm.AddError("allowedCIDRsAdminAPI", err.Error())
 				flash.Error("Failed to update realm")
-				c.renderSettings(ctx, w, r, realm, nil, nil, quotaLimit, quotaRemaining)
+				c.renderSettings(ctx, w, r, currentRealm, nil, nil, quotaLimit, quotaRemaining)
 				return
 			}
-			realm.AllowedCIDRsAdminAPI = allowedCIDRsAdminADPI
+			currentRealm.AllowedCIDRsAdminAPI = allowedCIDRsAdminADPI
 
 			allowedCIDRsAPIServer, err := database.ToCIDRList(form.AllowedCIDRsAPIServer)
 			if err != nil {
-				realm.AddError("allowedCIDRsAPIServer", err.Error())
+				currentRealm.AddError("allowedCIDRsAPIServer", err.Error())
 				flash.Error("Failed to update realm")
-				c.renderSettings(ctx, w, r, realm, nil, nil, quotaLimit, quotaRemaining)
+				c.renderSettings(ctx, w, r, currentRealm, nil, nil, quotaLimit, quotaRemaining)
 				return
 			}
-			realm.AllowedCIDRsAPIServer = allowedCIDRsAPIServer
+			currentRealm.AllowedCIDRsAPIServer = allowedCIDRsAPIServer
 
 			allowedCIDRsServer, err := database.ToCIDRList(form.AllowedCIDRsServer)
 			if err != nil {
-				realm.AddError("allowedCIDRsServer", err.Error())
+				currentRealm.AddError("allowedCIDRsServer", err.Error())
 				flash.Error("Failed to update realm")
-				c.renderSettings(ctx, w, r, realm, nil, nil, quotaLimit, quotaRemaining)
+				c.renderSettings(ctx, w, r, currentRealm, nil, nil, quotaLimit, quotaRemaining)
 				return
 			}
-			realm.AllowedCIDRsServer = allowedCIDRsServer
+			currentRealm.AllowedCIDRsServer = allowedCIDRsServer
 		}
 
 		// Abuse prevention
 		var abusePreventionJustEnabled bool
 		if form.AbusePrevention {
-			abusePreventionJustEnabled = !realm.AbusePreventionEnabled && form.AbusePreventionEnabled
+			abusePreventionJustEnabled = !currentRealm.AbusePreventionEnabled && form.AbusePreventionEnabled
 
-			realm.AbusePreventionEnabled = form.AbusePreventionEnabled
-			realm.AbusePreventionLimitFactor = form.AbusePreventionLimitFactor
+			currentRealm.AbusePreventionEnabled = form.AbusePreventionEnabled
+			currentRealm.AbusePreventionLimitFactor = form.AbusePreventionLimitFactor
 		}
 
 		// If abuse prevention was just enabled, create the initial bucket so
@@ -235,12 +244,12 @@ func (c *Controller) HandleSettings() http.Handler {
 		// Even if saving the realm fails, there's no harm in doing this early. It's
 		// an idempotent operation that TTLs out after a week anyway.
 		if abusePreventionJustEnabled {
-			key, err := realm.QuotaKey(c.config.RateLimit.HMACKey)
+			key, err := currentRealm.QuotaKey(c.config.RateLimit.HMACKey)
 			if err != nil {
 				controller.InternalError(w, r, c.h, err)
 				return
 			}
-			limit := uint64(realm.AbusePreventionEffectiveLimit())
+			limit := uint64(currentRealm.AbusePreventionEffectiveLimit())
 			ttl := 7 * 24 * time.Hour
 			if err := c.limiter.Set(ctx, key, limit, ttl); err != nil {
 				controller.InternalError(w, r, c.h, err)
@@ -249,16 +258,16 @@ func (c *Controller) HandleSettings() http.Handler {
 		}
 
 		// Save realm
-		if err := c.db.SaveRealm(realm, currentUser); err != nil {
+		if err := c.db.SaveRealm(currentRealm, currentUser); err != nil {
 			flash.Error("Failed to update realm: %v", err)
-			c.renderSettings(ctx, w, r, realm, nil, nil, quotaLimit, quotaRemaining)
+			c.renderSettings(ctx, w, r, currentRealm, nil, nil, quotaLimit, quotaRemaining)
 			return
 		}
 
 		// SMS
 		if form.SMS && !form.UseSystemSMSConfig {
 			// Fetch the existing SMS config record, if one exists
-			smsConfig, err := realm.SMSConfig(c.db)
+			smsConfig, err := currentRealm.SMSConfig(c.db)
 			if err != nil && !database.IsNotFound(err) {
 				controller.InternalError(w, r, c.h, err)
 				return
@@ -275,14 +284,14 @@ func (c *Controller) HandleSettings() http.Handler {
 
 				if err := c.db.SaveSMSConfig(smsConfig); err != nil {
 					flash.Error("Failed to update realm: %v", err)
-					c.renderSettings(ctx, w, r, realm, smsConfig, nil, quotaLimit, quotaRemaining)
+					c.renderSettings(ctx, w, r, currentRealm, smsConfig, nil, quotaLimit, quotaRemaining)
 					return
 				}
 			} else {
 				// There's no record or the existing record was the system config so we
 				// want to create our own.
 				smsConfig := &database.SMSConfig{
-					RealmID:          realm.ID,
+					RealmID:          currentRealm.ID,
 					ProviderType:     sms.ProviderTypeTwilio,
 					TwilioAccountSid: form.TwilioAccountSid,
 					TwilioAuthToken:  form.TwilioAuthToken,
@@ -291,7 +300,7 @@ func (c *Controller) HandleSettings() http.Handler {
 
 				if err := c.db.SaveSMSConfig(smsConfig); err != nil {
 					flash.Error("Failed to update realm: %v", err)
-					c.renderSettings(ctx, w, r, realm, smsConfig, nil, quotaLimit, quotaRemaining)
+					c.renderSettings(ctx, w, r, currentRealm, smsConfig, nil, quotaLimit, quotaRemaining)
 					return
 				}
 			}
@@ -300,7 +309,7 @@ func (c *Controller) HandleSettings() http.Handler {
 		// Email
 		if form.Email && !form.UseSystemEmailConfig {
 			// Fetch the existing Email config record, if one exists
-			emailConfig, err := realm.EmailConfig(c.db)
+			emailConfig, err := currentRealm.EmailConfig(c.db)
 			if err != nil && !database.IsNotFound(err) {
 				controller.InternalError(w, r, c.h, err)
 				return
@@ -318,14 +327,14 @@ func (c *Controller) HandleSettings() http.Handler {
 
 				if err := c.db.SaveEmailConfig(emailConfig); err != nil {
 					flash.Error("Failed to update realm: %v", err)
-					c.renderSettings(ctx, w, r, realm, nil, emailConfig, quotaLimit, quotaRemaining)
+					c.renderSettings(ctx, w, r, currentRealm, nil, emailConfig, quotaLimit, quotaRemaining)
 					return
 				}
 			} else {
 				// There's no record or the existing record was the system config so we
 				// want to create our own.
 				emailConfig := &database.EmailConfig{
-					RealmID:      realm.ID,
+					RealmID:      currentRealm.ID,
 					ProviderType: email.ProviderTypeSMTP,
 					SMTPAccount:  form.SMTPAccount,
 					SMTPPassword: form.SMTPPassword,
@@ -335,7 +344,7 @@ func (c *Controller) HandleSettings() http.Handler {
 
 				if err := c.db.SaveEmailConfig(emailConfig); err != nil {
 					flash.Error("Failed to update realm: %v", err)
-					c.renderSettings(ctx, w, r, realm, nil, emailConfig, quotaLimit, quotaRemaining)
+					c.renderSettings(ctx, w, r, currentRealm, nil, emailConfig, quotaLimit, quotaRemaining)
 					return
 				}
 			}
@@ -343,7 +352,7 @@ func (c *Controller) HandleSettings() http.Handler {
 
 		// Process temporary abuse prevention bursts
 		if burst := form.AbusePreventionBurst; burst > 0 {
-			key, err := realm.QuotaKey(c.config.RateLimit.HMACKey)
+			key, err := currentRealm.QuotaKey(c.config.RateLimit.HMACKey)
 			if err != nil {
 				controller.InternalError(w, r, c.h, err)
 				return
@@ -354,7 +363,7 @@ func (c *Controller) HandleSettings() http.Handler {
 			}
 
 			msg := fmt.Sprintf("added %d quota capacity", burst)
-			audit := database.BuildAuditEntry(currentUser, msg, realm, realm.ID)
+			audit := database.BuildAuditEntry(currentUser, msg, currentRealm, currentRealm.ID)
 			if err := c.db.SaveAuditEntry(audit); err != nil {
 				controller.InternalError(w, r, c.h, err)
 				return
@@ -369,11 +378,11 @@ func (c *Controller) HandleSettings() http.Handler {
 }
 
 func (c *Controller) renderSettings(
-	ctx context.Context, w http.ResponseWriter, r *http.Request, realm *database.Realm,
+	ctx context.Context, w http.ResponseWriter, r *http.Request, currentRealm *database.Realm,
 	smsConfig *database.SMSConfig, emailConfig *database.EmailConfig, quotaLimit, quotaRemaining uint64) {
 	if smsConfig == nil {
 		var err error
-		smsConfig, err = realm.SMSConfig(c.db)
+		smsConfig, err = currentRealm.SMSConfig(c.db)
 		if err != nil {
 			if !database.IsNotFound(err) {
 				controller.InternalError(w, r, c.h, err)
@@ -385,7 +394,7 @@ func (c *Controller) renderSettings(
 
 	if emailConfig == nil {
 		var err error
-		emailConfig, err = realm.EmailConfig(c.db)
+		emailConfig, err = currentRealm.EmailConfig(c.db)
 		if err != nil {
 			if !database.IsNotFound(err) {
 				controller.InternalError(w, r, c.h, err)
@@ -409,7 +418,7 @@ func (c *Controller) renderSettings(
 	// blank values if they were previously using their own SMS configs.
 	if smsConfig.IsSystem {
 		var tmpRealm database.Realm
-		tmpRealm.ID = realm.ID
+		tmpRealm.ID = currentRealm.ID
 		tmpRealm.UseSystemSMSConfig = false
 
 		var err error
@@ -425,7 +434,7 @@ func (c *Controller) renderSettings(
 
 	if emailConfig.IsSystem {
 		var tmpRealm database.Realm
-		tmpRealm.ID = realm.ID
+		tmpRealm.ID = currentRealm.ID
 		tmpRealm.UseSystemEmailConfig = false
 
 		var err error
@@ -441,7 +450,7 @@ func (c *Controller) renderSettings(
 
 	m := controller.TemplateMapFromContext(ctx)
 	m.Title("Realm settings")
-	m["realm"] = realm
+	m["realm"] = currentRealm
 	m["smsConfig"] = smsConfig
 	m["smsFromNumbers"] = smsFromNumbers
 	m["emailConfig"] = emailConfig
diff --git a/pkg/controller/realmadmin/sms_test.go b/pkg/controller/realmadmin/sms_test.go
index 5d33ab069..7716926b6 100644
--- a/pkg/controller/realmadmin/sms_test.go
+++ b/pkg/controller/realmadmin/sms_test.go
@@ -22,7 +22,6 @@ import (
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
 	"github.com/google/exposure-notifications-verification-server/internal/project"
-	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/chromedp"
@@ -33,23 +32,11 @@ func TestHandleSettings_SMS(t *testing.T) {
 
 	harness := envstest.NewServer(t, testDatabaseInstance)
 
-	// Get the default realm
-	realm, err := harness.Database.FindRealm(1)
+	realm, _, session, err := harness.ProvisionAndLogin()
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	// Create a user
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.System); err != nil {
-		t.Fatal(err)
-	}
-
 	// Create a system configuration.
 	if err := harness.Database.SaveSMSConfig(&database.SMSConfig{
 		TwilioAccountSid: "sid",
@@ -67,15 +54,6 @@ func TestHandleSettings_SMS(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Log in the user.
-	session, err := harness.LoggedInSession(nil, admin.Email)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Set the current realm.
-	controller.StoreSessionRealm(session, realm)
-
 	// Mint a cookie for the session.
 	cookie, err := harness.SessionCookie(session)
 	if err != nil {
diff --git a/pkg/controller/realmadmin/smtp_test.go b/pkg/controller/realmadmin/smtp_test.go
index 7a0b70345..c6ce6b0d7 100644
--- a/pkg/controller/realmadmin/smtp_test.go
+++ b/pkg/controller/realmadmin/smtp_test.go
@@ -22,7 +22,6 @@ import (
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
 	"github.com/google/exposure-notifications-verification-server/internal/project"
-	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 
 	"github.com/chromedp/chromedp"
@@ -33,32 +32,11 @@ func TestHandleSettings_SMTP(t *testing.T) {
 
 	harness := envstest.NewServer(t, testDatabaseInstance)
 
-	// Get the default realm
-	realm, err := harness.Database.FindRealm(1)
+	realm, _, session, err := harness.ProvisionAndLogin()
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	// Create a user
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.System); err != nil {
-		t.Fatal(err)
-	}
-
-	// Log in the user.
-	session, err := harness.LoggedInSession(nil, admin.Email)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Set the current realm.
-	controller.StoreSessionRealm(session, realm)
-
 	// Mint a cookie for the session.
 	cookie, err := harness.SessionCookie(session)
 	if err != nil {
diff --git a/pkg/controller/realmadmin/stats.go b/pkg/controller/realmadmin/stats.go
index 6e4fff304..b433e9756 100644
--- a/pkg/controller/realmadmin/stats.go
+++ b/pkg/controller/realmadmin/stats.go
@@ -28,6 +28,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/cache"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 const cacheTimeout = 30 * time.Minute
@@ -36,11 +37,17 @@ func (c *Controller) HandleStats() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.StatsRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
 		now := time.Now().UTC()
 		past := now.Add(-30 * 24 * time.Hour)
@@ -57,13 +64,13 @@ func (c *Controller) HandleStats() http.Handler {
 			switch r.URL.Query().Get("scope") {
 			case "external":
 				filename = fmt.Sprintf("%s-external-issuer-stats.csv", nowFormatted)
-				stats, err = c.getExternalIssuerStats(ctx, realm, now, past)
+				stats, err = c.getExternalIssuerStats(ctx, currentRealm, now, past)
 			case "user":
 				filename = fmt.Sprintf("%s-user-stats.csv", nowFormatted)
-				stats, err = c.getUserStats(ctx, realm, now, past)
+				stats, err = c.getUserStats(ctx, currentRealm, now, past)
 			default:
 				filename = fmt.Sprintf("%s-realm-stats.csv", nowFormatted)
-				stats, err = c.getRealmStats(ctx, realm, now, past)
+				stats, err = c.getRealmStats(ctx, currentRealm, now, past)
 			}
 
 			if err != nil {
@@ -78,11 +85,11 @@ func (c *Controller) HandleStats() http.Handler {
 
 			switch r.URL.Query().Get("scope") {
 			case "external":
-				stats, err = c.getExternalIssuerStats(ctx, realm, now, past)
+				stats, err = c.getExternalIssuerStats(ctx, currentRealm, now, past)
 			case "user":
-				stats, err = c.getUserStats(ctx, realm, now, past)
+				stats, err = c.getUserStats(ctx, currentRealm, now, past)
 			default:
-				stats, err = c.getRealmStats(ctx, realm, now, past)
+				stats, err = c.getRealmStats(ctx, currentRealm, now, past)
 			}
 
 			if err != nil {
@@ -93,7 +100,7 @@ func (c *Controller) HandleStats() http.Handler {
 			c.h.RenderJSON(w, http.StatusOK, stats)
 		default:
 			// Fallback to HTML
-			c.renderHTML(ctx, w, realm)
+			c.renderHTML(ctx, w, currentRealm)
 			return
 		}
 	})
diff --git a/pkg/controller/realmkeys/activate.go b/pkg/controller/realmkeys/activate.go
index 35b97cf8f..d8d8efb04 100644
--- a/pkg/controller/realmkeys/activate.go
+++ b/pkg/controller/realmkeys/activate.go
@@ -18,6 +18,7 @@ import (
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleActivate() http.Handler {
@@ -35,23 +36,29 @@ func (c *Controller) HandleActivate() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.SettingsWrite) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
 		var form FormData
 		if err := controller.BindForm(w, r, &form); err != nil {
 			flash.Error("Failed to process form: %v", err)
-			c.renderShow(ctx, w, r, realm)
+			c.renderShow(ctx, w, r, currentRealm)
 			return
 		}
 
-		kid, err := realm.SetActiveSigningKey(c.db, form.SigningKeyID)
+		kid, err := currentRealm.SetActiveSigningKey(c.db, form.SigningKeyID)
 		if err != nil {
 			flash.Error("Unable to set active signing key: %v", err)
-			c.renderShow(ctx, w, r, realm)
+			c.renderShow(ctx, w, r, currentRealm)
 			return
 		}
 		flash.Alert("Updated active signing key to %q", kid)
diff --git a/pkg/controller/realmkeys/new.go b/pkg/controller/realmkeys/create.go
similarity index 74%
rename from pkg/controller/realmkeys/new.go
rename to pkg/controller/realmkeys/create.go
index 594b8ac99..f14e50508 100644
--- a/pkg/controller/realmkeys/new.go
+++ b/pkg/controller/realmkeys/create.go
@@ -18,6 +18,7 @@ import (
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleCreateKey() http.Handler {
@@ -31,16 +32,21 @@ func (c *Controller) HandleCreateKey() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.SettingsWrite) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+		currentRealm := membership.Realm
 
-		kid, err := realm.CreateSigningKeyVersion(ctx, c.db)
+		kid, err := currentRealm.CreateSigningKeyVersion(ctx, c.db)
 		if err != nil {
 			flash.Error("Unable to create a new signing key: %v", err)
-			c.renderShow(ctx, w, r, realm)
+			c.renderShow(ctx, w, r, currentRealm)
 			return
 		}
 
diff --git a/pkg/controller/realmkeys/destroy.go b/pkg/controller/realmkeys/destroy.go
index ca514a876..42aa860b2 100644
--- a/pkg/controller/realmkeys/destroy.go
+++ b/pkg/controller/realmkeys/destroy.go
@@ -18,6 +18,7 @@ import (
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -33,15 +34,20 @@ func (c *Controller) HandleDestroy() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.SettingsWrite) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+		currentRealm := membership.Realm
 
-		if err := realm.DestroySigningKeyVersion(ctx, c.db, vars["id"]); err != nil {
+		if err := currentRealm.DestroySigningKeyVersion(ctx, c.db, vars["id"]); err != nil {
 			flash.Error("Failed to destroy signing key version: %v", err)
-			c.renderShow(ctx, w, r, realm)
+			c.renderShow(ctx, w, r, currentRealm)
 			return
 		}
 
diff --git a/pkg/controller/realmkeys/index.go b/pkg/controller/realmkeys/index.go
index d59e45333..fd8411341 100644
--- a/pkg/controller/realmkeys/index.go
+++ b/pkg/controller/realmkeys/index.go
@@ -18,18 +18,24 @@ import (
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleIndex() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.SettingsRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+		currentRealm := membership.Realm
 
-		c.renderShow(ctx, w, r, realm)
+		c.renderShow(ctx, w, r, currentRealm)
 	})
 }
diff --git a/pkg/controller/realmkeys/save.go b/pkg/controller/realmkeys/save.go
index 6d1449909..3aa85c7c5 100644
--- a/pkg/controller/realmkeys/save.go
+++ b/pkg/controller/realmkeys/save.go
@@ -18,6 +18,7 @@ import (
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleSave() http.Handler {
@@ -37,34 +38,35 @@ func (c *Controller) HandleSave() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.SettingsWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		var form FormData
 		if err := controller.BindForm(w, r, &form); err != nil {
 			flash.Error("Failed to process form: %v", err)
-			c.renderShow(ctx, w, r, realm)
+			c.renderShow(ctx, w, r, currentRealm)
 			return
 		}
 
 		// Update settings.
-		realm.CertificateIssuer = form.Issuer
-		realm.CertificateAudience = form.Audience
+		currentRealm.CertificateIssuer = form.Issuer
+		currentRealm.CertificateAudience = form.Audience
 		// AsString delgates the duration parsing and validation to the model.
-		realm.CertificateDuration.AsString = form.DurationString
+		currentRealm.CertificateDuration.AsString = form.DurationString
 
-		if err := c.db.SaveRealm(realm, currentUser); err != nil {
+		if err := c.db.SaveRealm(currentRealm, currentUser); err != nil {
 			flash.Error("Failed to update realm: %v", err)
-			c.renderShow(ctx, w, r, realm)
+			c.renderShow(ctx, w, r, currentRealm)
 		}
 
 		flash.Alert("Updated realm certificate settings.")
diff --git a/pkg/controller/realmkeys/upgrade.go b/pkg/controller/realmkeys/upgrade.go
index e20e929d0..fb5c24a06 100644
--- a/pkg/controller/realmkeys/upgrade.go
+++ b/pkg/controller/realmkeys/upgrade.go
@@ -18,6 +18,7 @@ import (
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleUpgrade() http.Handler {
@@ -31,23 +32,23 @@ func (c *Controller) HandleUpgrade() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.SettingsWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
+		currentRealm := membership.Realm
+		currentUser := membership.User
 
-		if realm.CanUpgradeToRealmSigningKeys() {
-			realm.UseRealmCertificateKey = true
-			if err := c.db.SaveRealm(realm, currentUser); err != nil {
+		if currentRealm.CanUpgradeToRealmSigningKeys() {
+			currentRealm.UseRealmCertificateKey = true
+			if err := c.db.SaveRealm(currentRealm, currentUser); err != nil {
 				flash.Error("Error upgrading realm: %v", err)
-				c.renderShow(ctx, w, r, realm)
+				c.renderShow(ctx, w, r, currentRealm)
 				return
 			} else {
 				flash.Alert("Successfully switched to realm specific signing keys.")
diff --git a/pkg/controller/user/controller.go b/pkg/controller/user/controller.go
index 58386a0aa..714eec774 100644
--- a/pkg/controller/user/controller.go
+++ b/pkg/controller/user/controller.go
@@ -51,9 +51,24 @@ func New(
 	}
 }
 
-func (c *Controller) findUser(currentUser *database.User, realm *database.Realm, id interface{}) (*database.User, error) {
+func (c *Controller) findUser(currentUser *database.User, realm *database.Realm, id interface{}) (*database.User, *database.Membership, error) {
+	var user *database.User
+	var err error
+
+	// Look up the user.
 	if currentUser.SystemAdmin {
-		return c.db.FindUser(id)
+		user, err = c.db.FindUser(id)
+	} else {
+		user, err = realm.FindUser(c.db, id)
+	}
+	if err != nil {
+		return nil, nil, err
 	}
-	return realm.FindUser(c.db, id)
+
+	membership, err := user.FindMembership(c.db, realm.ID)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return user, membership, nil
 }
diff --git a/pkg/controller/user/create.go b/pkg/controller/user/create.go
index 0cd201361..3f2609313 100644
--- a/pkg/controller/user/create.go
+++ b/pkg/controller/user/create.go
@@ -16,17 +16,19 @@ package user
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleCreate() http.Handler {
 	type FormData struct {
-		Email string `form:"email"`
-		Name  string `form:"name"`
-		Admin bool   `form:"admin"`
+		Email       string            `form:"email"`
+		Name        string            `form:"name"`
+		Permissions []rbac.Permission `form:"permissions"`
 	}
 
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -39,18 +41,19 @@ func (c *Controller) HandleCreate() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.UserWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		// Requested form, stop processing.
 		if r.Method == http.MethodGet {
 			c.renderNew(ctx, w)
@@ -77,19 +80,25 @@ func (c *Controller) HandleCreate() http.Handler {
 			user.Email = form.Email
 			user.Name = form.Name
 		}
-
-		// Build the user struct
-		user.Realms = append(user.Realms, realm)
-		if form.Admin {
-			user.AdminRealms = append(user.AdminRealms, realm)
-		}
-
 		if err := c.db.SaveUser(user, currentUser); err != nil {
 			flash.Error("Failed to create user: %v", err)
 			c.renderNew(ctx, w)
 			return
 		}
 
+		// Create membership properties.
+		permission, err := rbac.CompileAndAuthorize(membership.Permissions, form.Permissions)
+		if err != nil {
+			flash.Error("Failed to update user permissions: %s", err)
+			c.renderNew(ctx, w)
+			return
+		}
+		if err := user.AddToRealm(c.db, currentRealm, permission, currentUser); err != nil {
+			flash.Error("Failed to update user in realm: %v", err)
+			c.renderNew(ctx, w)
+			return
+		}
+
 		inviteComposer, err := controller.SendInviteEmailFunc(ctx, c.db, c.h, user.Email)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
@@ -103,11 +112,17 @@ func (c *Controller) HandleCreate() http.Handler {
 		}
 
 		flash.Alert("Successfully created user %v.", user.Name)
+		http.Redirect(w, r, fmt.Sprintf("/realm/users/%d", user.ID), http.StatusSeeOther)
+		return
 
-		c.renderShow(ctx, w, user)
 	})
 }
 
 func (c *Controller) renderNew(ctx context.Context, w http.ResponseWriter) {
-	c.renderUpdate(ctx, w, &database.User{})
+	m := controller.TemplateMapFromContext(ctx)
+	m.Title("New user")
+	m["user"] = &database.User{}
+	m["userMembership"] = &database.Membership{}
+	m["permissions"] = rbac.PermissionMap()
+	c.h.RenderHTML(w, "users/new", m)
 }
diff --git a/pkg/controller/user/delete.go b/pkg/controller/user/delete.go
index a4b024463..67b578a6a 100644
--- a/pkg/controller/user/delete.go
+++ b/pkg/controller/user/delete.go
@@ -19,6 +19,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -34,19 +35,20 @@ func (c *Controller) HandleDelete() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.UserWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
-		user, err := c.findUser(currentUser, realm, vars["id"])
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
+		user, _, err := c.findUser(currentUser, currentRealm, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
@@ -65,9 +67,7 @@ func (c *Controller) HandleDelete() http.Handler {
 			return
 		}
 
-		user.RemoveRealm(realm)
-
-		if err := c.db.SaveUser(user, currentUser); err != nil {
+		if err := user.DeleteFromRealm(c.db, currentRealm, currentUser); err != nil {
 			flash.Error("Failed to remove user from realm: %v", err)
 			http.Redirect(w, r, "/realm/users", http.StatusSeeOther)
 			return
diff --git a/pkg/controller/user/export.go b/pkg/controller/user/export.go
index 3b19fe2f3..764a533a3 100644
--- a/pkg/controller/user/export.go
+++ b/pkg/controller/user/export.go
@@ -21,6 +21,7 @@ import (
 	"github.com/google/exposure-notifications-server/pkg/logging"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/pagination"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleExport() http.Handler {
@@ -28,17 +29,23 @@ func (c *Controller) HandleExport() http.Handler {
 		ctx := r.Context()
 		logger := logging.FromContext(ctx)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.UserRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
 		pageParams := &pagination.PageParams{
 			Page:  0,
 			Limit: 10000,
 		}
-		users, _, err := realm.ListUsers(c.db, pageParams)
+		memberships, _, err := currentRealm.ListMemberships(c.db, pageParams)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
@@ -48,7 +55,8 @@ func (c *Controller) HandleExport() http.Handler {
 		w.Header().Add("Content-Type", "text/CSV")
 
 		csvWriter := csv.NewWriter(w)
-		for _, user := range users {
+		for _, membership := range memberships {
+			user := membership.User
 			if err := csvWriter.Write([]string{user.Email, user.Name}); err != nil {
 				logger.Errorw("error writing record to csv:", "error", err)
 				break
diff --git a/pkg/controller/user/import.go b/pkg/controller/user/import.go
index d68d83fd2..000252dc4 100644
--- a/pkg/controller/user/import.go
+++ b/pkg/controller/user/import.go
@@ -19,12 +19,23 @@ import (
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleImport() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
+			return
+		}
+		if !membership.Can(rbac.UserWrite) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
 		c.renderImport(ctx, w)
 	})
 }
diff --git a/pkg/controller/user/importbatch.go b/pkg/controller/user/importbatch.go
index 86d560351..5d4ee9db0 100644
--- a/pkg/controller/user/importbatch.go
+++ b/pkg/controller/user/importbatch.go
@@ -23,6 +23,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/api"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/hashicorp/go-multierror"
 )
 
@@ -32,15 +33,13 @@ func (c *Controller) HandleImportBatch() http.Handler {
 
 		logger := logging.FromContext(ctx).Named("user.HandleImportBatch")
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.UserWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
@@ -51,7 +50,13 @@ func (c *Controller) HandleImportBatch() http.Handler {
 			return
 		}
 
-		newUsers, batchErr := c.importUsers(ctx, request.Users, request.SendInvites)
+		realmMemberships, err := membership.Realm.MembershipPermissionMap(c.db)
+		if err != nil {
+			controller.InternalError(w, r, c.h, err)
+			return
+		}
+
+		newUsers, batchErr := c.importUsers(ctx, membership.Realm, realmMemberships, membership.User, request.Users, request.SendInvites)
 
 		response := &api.UserBatchResponse{
 			NewUsers: newUsers,
@@ -71,10 +76,10 @@ func (c *Controller) HandleImportBatch() http.Handler {
 	})
 }
 
-func (c *Controller) importUsers(ctx context.Context, users []api.BatchUser, sendInvites bool) ([]*api.BatchUser, *multierror.Error) {
+func (c *Controller) importUsers(ctx context.Context,
+	realm *database.Realm, realmMemberships map[uint]rbac.Permission, actor database.Auditable,
+	users []api.BatchUser, sendInvites bool) ([]*api.BatchUser, *multierror.Error) {
 	logger := logging.FromContext(ctx).Named("user.importUsers")
-	realm := controller.RealmFromContext(ctx)
-	currentUser := controller.UserFromContext(ctx)
 
 	newUsers := make([]*api.BatchUser, 0, len(users))
 	var batchErr *multierror.Error
@@ -94,15 +99,25 @@ func (c *Controller) importUsers(ctx context.Context, users []api.BatchUser, sen
 			user.Email = batchUser.Email
 			user.Name = batchUser.Name
 		}
-		user.Realms = append(user.Realms, realm)
-
-		// Save the user in the database.
-		if err := c.db.SaveUser(user, currentUser); err != nil {
+		if err := c.db.SaveUser(user, actor); err != nil {
 			logger.Errorw("error saving user", "error", err)
 			batchErr = multierror.Append(batchErr, err)
 			continue
 		}
 
+		// Create the user's membership in the realm.
+		var permission rbac.Permission
+		if existing, ok := realmMemberships[user.ID]; ok {
+			permission = existing
+		}
+		permission = permission | rbac.CodeIssue | rbac.CodeBulkIssue | rbac.CodeRead | rbac.CodeExpire
+		if err := user.AddToRealm(c.db, realm, permission, actor); err != nil {
+			logger.Errorw("failed to add user to realm",
+				"user_id", user.ID, "realm_id", realm.ID, "error", err)
+			batchErr = multierror.Append(batchErr, err)
+			continue
+		}
+
 		// Create the invitation email composer.
 		inviteComposer, err := controller.SendInviteEmailFunc(ctx, c.db, c.h, user.Email)
 		if err != nil {
diff --git a/pkg/controller/user/index.go b/pkg/controller/user/index.go
index c8a55097b..28b36e78e 100644
--- a/pkg/controller/user/index.go
+++ b/pkg/controller/user/index.go
@@ -21,6 +21,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
 	"github.com/google/exposure-notifications-verification-server/pkg/pagination"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 const (
@@ -32,11 +33,17 @@ func (c *Controller) HandleIndex() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.UserRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
 		pageParams, err := pagination.FromRequest(r)
 		if err != nil {
@@ -48,22 +55,22 @@ func (c *Controller) HandleIndex() http.Handler {
 		q := r.FormValue(QueryKeySearch)
 		scopes = append(scopes, database.WithUserSearch(q))
 
-		users, paginator, err := realm.ListUsers(c.db, pageParams, scopes...)
+		memberships, paginator, err := currentRealm.ListMemberships(c.db, pageParams, scopes...)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
 		}
 
-		c.renderIndex(ctx, w, users, paginator, q)
+		c.renderIndex(ctx, w, memberships, paginator, q)
 	})
 }
 
 func (c *Controller) renderIndex(
 	ctx context.Context, w http.ResponseWriter,
-	users []*database.User, paginator *pagination.Paginator, query string) {
+	memberships []*database.Membership, paginator *pagination.Paginator, query string) {
 	m := controller.TemplateMapFromContext(ctx)
 	m.Title("Users")
-	m["users"] = users
+	m["memberships"] = memberships
 	m["paginator"] = paginator
 	m["query"] = query
 	c.h.RenderHTML(w, "users/index", m)
diff --git a/pkg/controller/user/reset_password.go b/pkg/controller/user/reset_password.go
index 6447d5f20..d4aadb723 100644
--- a/pkg/controller/user/reset_password.go
+++ b/pkg/controller/user/reset_password.go
@@ -19,6 +19,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -34,14 +35,20 @@ func (c *Controller) HandleResetPassword() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
+		if !membership.Can(rbac.UserWrite) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
+
+		currentRealm := membership.Realm
 
 		// Pull the user from the id.
-		user, err := realm.FindUser(c.db, vars["id"])
+		user, err := currentRealm.FindUser(c.db, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
diff --git a/pkg/controller/user/search_test.go b/pkg/controller/user/search_test.go
index 0d7ff2a01..b2632452a 100644
--- a/pkg/controller/user/search_test.go
+++ b/pkg/controller/user/search_test.go
@@ -22,8 +22,8 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/internal/browser"
 	"github.com/google/exposure-notifications-verification-server/internal/envstest"
-	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 
 	"github.com/chromedp/chromedp"
 )
@@ -33,32 +33,11 @@ func TestHandleSearch(t *testing.T) {
 
 	harness := envstest.NewServer(t, testDatabaseInstance)
 
-	// Get the default realm
-	realm, err := harness.Database.FindRealm(1)
+	realm, _, session, err := harness.ProvisionAndLogin()
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	// Create a user.
-	admin := &database.User{
-		Email:       "admin@example.com",
-		Name:        "Admin",
-		Realms:      []*database.Realm{realm},
-		AdminRealms: []*database.Realm{realm},
-	}
-	if err := harness.Database.SaveUser(admin, database.SystemTest); err != nil {
-		t.Fatal(err)
-	}
-
-	// Log in the user.
-	session, err := harness.LoggedInSession(nil, admin.Email)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Set the current realm.
-	controller.StoreSessionRealm(session, realm)
-
 	// Mint a cookie for the session.
 	cookie, err := harness.SessionCookie(session)
 	if err != nil {
@@ -67,13 +46,15 @@ func TestHandleSearch(t *testing.T) {
 
 	// Create another user.
 	user := &database.User{
-		Email:  "user@example.com",
-		Name:   "User",
-		Realms: []*database.Realm{realm},
+		Email: "user@example.com",
+		Name:  "User",
 	}
 	if err := harness.Database.SaveUser(user, database.SystemTest); err != nil {
 		t.Fatal(err)
 	}
+	if err := user.AddToRealm(harness.Database, realm, rbac.LegacyRealmUser, database.SystemTest); err != nil {
+		t.Fatal(err)
+	}
 
 	// Create a browser runner.
 	browserCtx := browser.New(t)
diff --git a/pkg/controller/user/show.go b/pkg/controller/user/show.go
index 2603baf3c..07115ec31 100644
--- a/pkg/controller/user/show.go
+++ b/pkg/controller/user/show.go
@@ -20,55 +20,55 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
 func (c *Controller) HandleShow() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		c.Show(w, r, false /*resetPassword*/)
-	})
-}
+		ctx := r.Context()
+		vars := mux.Vars(r)
 
-func (c *Controller) Show(w http.ResponseWriter, r *http.Request, resetPassword bool) {
-	ctx := r.Context()
-	vars := mux.Vars(r)
+		session := controller.SessionFromContext(ctx)
+		if session == nil {
+			controller.MissingSession(w, r, c.h)
+			return
+		}
 
-	session := controller.SessionFromContext(ctx)
-	if session == nil {
-		controller.MissingSession(w, r, c.h)
-		return
-	}
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
+			return
+		}
+		if !membership.Can(rbac.UserRead) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
 
-	realm := controller.RealmFromContext(ctx)
-	if realm == nil {
-		controller.MissingRealm(w, r, c.h)
-		return
-	}
+		currentRealm := membership.Realm
+		currentUser := membership.User
 
-	currentUser := controller.UserFromContext(ctx)
-	if currentUser == nil {
-		controller.MissingUser(w, r, c.h)
-		return
-	}
+		// Pull the user from the id.
+		user, userMembership, err := c.findUser(currentUser, currentRealm, vars["id"])
+		if err != nil {
+			if database.IsNotFound(err) {
+				controller.Unauthorized(w, r, c.h)
+				return
+			}
 
-	// Pull the user from the id.
-	user, err := c.findUser(currentUser, realm, vars["id"])
-	if err != nil {
-		if database.IsNotFound(err) {
-			controller.Unauthorized(w, r, c.h)
+			controller.InternalError(w, r, c.h, err)
 			return
 		}
 
-		controller.InternalError(w, r, c.h, err)
-		return
-	}
-
-	c.renderShow(ctx, w, user)
+		c.renderShow(ctx, w, user, userMembership)
+	})
 }
 
-func (c *Controller) renderShow(ctx context.Context, w http.ResponseWriter, user *database.User) {
+func (c *Controller) renderShow(ctx context.Context, w http.ResponseWriter, user *database.User, membership *database.Membership) {
 	m := controller.TemplateMapFromContext(ctx)
 	m.Title("User: %s", user.Name)
 	m["user"] = user
+	m["userMembership"] = membership
+	m["permissions"] = rbac.PermissionMap()
 	c.h.RenderHTML(w, "users/show", m)
 }
diff --git a/pkg/controller/user/stats.go b/pkg/controller/user/stats.go
index 304b5df51..28be430b8 100644
--- a/pkg/controller/user/stats.go
+++ b/pkg/controller/user/stats.go
@@ -25,6 +25,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/cache"
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
 )
 
@@ -41,20 +42,21 @@ func (c *Controller) HandleUserStats() http.Handler {
 			return
 		}
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.UserRead) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
 		// Pull the user from the id.
-		user, err := c.findUser(currentUser, realm, vars["id"])
+		user, _, err := c.findUser(currentUser, currentRealm, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
@@ -65,7 +67,7 @@ func (c *Controller) HandleUserStats() http.Handler {
 			return
 		}
 
-		stats, err := c.getStats(ctx, user, realm)
+		stats, err := c.getStats(ctx, user, currentRealm)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return
diff --git a/pkg/controller/user/update.go b/pkg/controller/user/update.go
index 9327d4f49..6190d5da4 100644
--- a/pkg/controller/user/update.go
+++ b/pkg/controller/user/update.go
@@ -16,18 +16,20 @@ package user
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/gorilla/mux"
-	"github.com/gorilla/schema"
 )
 
 func (c *Controller) HandleUpdate() http.Handler {
 	type FormData struct {
-		Name  string `form:"name"`
-		Admin bool   `form:"admin"`
+		Name        string            `form:"name"`
+		Admin       bool              `form:"admin"`
+		Permissions []rbac.Permission `form:"permissions"`
 	}
 
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -41,19 +43,20 @@ func (c *Controller) HandleUpdate() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		realm := controller.RealmFromContext(ctx)
-		if realm == nil {
-			controller.MissingRealm(w, r, c.h)
+		membership := controller.MembershipFromContext(ctx)
+		if membership == nil {
+			controller.MissingMembership(w, r, c.h)
 			return
 		}
-
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
+		if !membership.Can(rbac.UserWrite) {
+			controller.Unauthorized(w, r, c.h)
 			return
 		}
 
-		user, err := c.findUser(currentUser, realm, vars["id"])
+		currentRealm := membership.Realm
+		currentUser := membership.User
+
+		user, userMembership, err := c.findUser(currentUser, currentRealm, vars["id"])
 		if err != nil {
 			if database.IsNotFound(err) {
 				controller.Unauthorized(w, r, c.h)
@@ -66,55 +69,50 @@ func (c *Controller) HandleUpdate() http.Handler {
 
 		// Requested form, stop processing.
 		if r.Method == http.MethodGet {
-			c.renderEdit(ctx, w, user)
+			c.renderEdit(ctx, w, user, userMembership)
 			return
 		}
 
 		var form FormData
-		err = controller.BindForm(w, r, &form)
-
-		// Build the user struct
-		user.Name = form.Name
-		if err != nil {
-			if terr, ok := err.(schema.MultiError); ok {
-				for k, err := range terr {
-					user.AddError(k, err.Error())
-				}
-			}
-
-			flash.Error("Failed to process form: %v", err)
-			c.renderEdit(ctx, w, user)
+		if err := controller.BindForm(w, r, &form); err != nil {
+			flash.Error("failed to process form: %v", err)
+			c.renderEdit(ctx, w, user, userMembership)
 			return
 		}
 
-		// Manage realm admin permissions.
-		if form.Admin {
-			user.AddRealmAdmin(realm)
-		} else {
-			user.RemoveRealmAdmin(realm)
-		}
-
+		// Update user properties.
+		user.Name = form.Name
 		if err := c.db.SaveUser(user, currentUser); err != nil {
 			flash.Error("Failed to update user: %v", err)
-			c.renderUpdate(ctx, w, user)
+			c.renderEdit(ctx, w, user, userMembership)
 			return
 		}
 
+		// Update membership properties, iff the target user differs
+		if currentUser.ID != user.ID {
+			permission, err := rbac.CompileAndAuthorize(membership.Permissions, form.Permissions)
+			if err != nil {
+				flash.Error("Failed to update user permissions: %s", err)
+				c.renderEdit(ctx, w, user, userMembership)
+				return
+			}
+			if err := user.AddToRealm(c.db, currentRealm, permission, currentUser); err != nil {
+				flash.Error("Failed to update user in realm: %v", err)
+				c.renderEdit(ctx, w, user, membership)
+				return
+			}
+		}
+
 		flash.Alert("Successfully updated user '%v'", form.Name)
-		http.Redirect(w, r, "/realm/users", http.StatusSeeOther)
+		http.Redirect(w, r, fmt.Sprintf("/realm/users/%d", user.ID), http.StatusSeeOther)
 	})
 }
 
-func (c *Controller) renderUpdate(ctx context.Context, w http.ResponseWriter, user *database.User) {
-	m := controller.TemplateMapFromContext(ctx)
-	m.Title("New user")
-	m["user"] = user
-	c.h.RenderHTML(w, "users/new", m)
-}
-
-func (c *Controller) renderEdit(ctx context.Context, w http.ResponseWriter, user *database.User) {
+func (c *Controller) renderEdit(ctx context.Context, w http.ResponseWriter, user *database.User, membership *database.Membership) {
 	m := controller.TemplateMapFromContext(ctx)
 	m.Title("Edit user: %s", user.Name)
 	m["user"] = user
+	m["userMembership"] = membership
+	m["permissions"] = rbac.PermissionMap()
 	c.h.RenderHTML(w, "users/edit", m)
 }
diff --git a/pkg/controller/user/update_test.go b/pkg/controller/user/update_test.go
new file mode 100644
index 000000000..1794c2f11
--- /dev/null
+++ b/pkg/controller/user/update_test.go
@@ -0,0 +1,139 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package user_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/exposure-notifications-verification-server/internal/browser"
+	"github.com/google/exposure-notifications-verification-server/internal/envstest"
+	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
+
+	"github.com/chromedp/chromedp"
+)
+
+func TestUpdate(t *testing.T) {
+	t.Parallel()
+
+	harness := envstest.NewServer(t, testDatabaseInstance)
+
+	realm, _, session, err := harness.ProvisionAndLogin()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Mint a cookie for the session.
+	cookie, err := harness.SessionCookie(session)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Create another user.
+	user := &database.User{
+		Email: "user@example.com",
+		Name:  "User",
+	}
+	if err := harness.Database.SaveUser(user, database.SystemTest); err != nil {
+		t.Fatal(err)
+	}
+	if err := user.AddToRealm(harness.Database, realm, rbac.LegacyRealmAdmin, database.SystemTest); err != nil {
+		t.Fatal(err)
+	}
+
+	// Create a browser runner.
+	browserCtx := browser.New(t)
+	taskCtx, done := context.WithTimeout(browserCtx, 30*time.Second)
+	defer done()
+
+	for _, permission := range rbac.PermissionMap() {
+		target := fmt.Sprintf(`input#permission-%d`, permission)
+
+		if err := chromedp.Run(taskCtx,
+			// Pre-authenticate the user.
+			browser.SetCookie(cookie),
+
+			// Visit /realm/users.
+			chromedp.Navigate(fmt.Sprintf(`http://`+harness.Server.Addr()+`/realm/users/%d/edit`, user.ID)),
+
+			// Wait for render.
+			chromedp.WaitVisible(`body#users-edit`, chromedp.ByQuery),
+
+			// Fill out the form.
+			chromedp.Click(target, chromedp.ByQuery),
+			chromedp.Submit(`form#user-form`, chromedp.ByQuery),
+
+			// Wait for render.
+			chromedp.WaitVisible(`body#users-show`, chromedp.ByQuery),
+		); err != nil {
+			t.Fatal(err)
+		}
+
+		membership, err := user.FindMembership(harness.Database, realm.ID)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if membership.Can(permission) {
+			t.Errorf("expected %s to be removed", permission)
+		}
+	}
+
+	// Assert the user has no permissions left
+	membership, err := user.FindMembership(harness.Database, realm.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := int64(membership.Permissions), int64(0); got != want {
+		t.Errorf("expected %v to be %v", got, want)
+	}
+
+	// Now add permissions back
+	for _, permission := range rbac.PermissionMap() {
+		target := fmt.Sprintf(`input#permission-%d`, permission)
+
+		if err := chromedp.Run(taskCtx,
+			// Pre-authenticate the user.
+			browser.SetCookie(cookie),
+
+			// Visit /realm/users.
+			chromedp.Navigate(fmt.Sprintf(`http://`+harness.Server.Addr()+`/realm/users/%d/edit`, user.ID)),
+
+			// Wait for render.
+			chromedp.WaitVisible(`body#users-edit`, chromedp.ByQuery),
+
+			// Fill out the form.
+			chromedp.Click(target, chromedp.ByQuery),
+			chromedp.Submit(`form#user-form`, chromedp.ByQuery),
+
+			// Wait for render.
+			chromedp.WaitVisible(`body#users-show`, chromedp.ByQuery),
+		); err != nil {
+			t.Fatal(err)
+		}
+
+		membership, err := user.FindMembership(harness.Database, realm.ID)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if !membership.Can(permission) {
+			t.Errorf("expected %s to be added", permission)
+		}
+	}
+}
diff --git a/pkg/database/authorized_app_test.go b/pkg/database/authorized_app_test.go
index c092e58fb..82f8a6008 100644
--- a/pkg/database/authorized_app_test.go
+++ b/pkg/database/authorized_app_test.go
@@ -26,8 +26,8 @@ func TestDatabase_CreateFindAPIKey(t *testing.T) {
 
 	db, _ := testDatabaseInstance.NewDatabase(t, nil)
 
-	realm, err := db.CreateRealm("foo")
-	if err != nil {
+	realm := NewRealmWithDefaults("foo")
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
 		t.Fatal(err)
 	}
 
@@ -79,8 +79,8 @@ func TestDatabase_GenerateAPIKey(t *testing.T) {
 
 	db, _ := testDatabaseInstance.NewDatabase(t, nil)
 
-	realm, err := db.CreateRealm("bar")
-	if err != nil {
+	realm := NewRealmWithDefaults("bar")
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/pkg/database/database.go b/pkg/database/database.go
index ec72afa79..9c905ec2e 100644
--- a/pkg/database/database.go
+++ b/pkg/database/database.go
@@ -24,6 +24,7 @@ import (
 	"io/ioutil"
 	"log"
 	"os"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
@@ -326,8 +327,9 @@ func callbackIncrementMetric(ctx context.Context, m *stats.Int64Measure, table s
 	}
 }
 
-// callbackPurgeCache purges the cache key for the given record.
-func callbackPurgeCache(ctx context.Context, cacher cache.Cacher, namespace, table, column string) func(scope *gorm.Scope) {
+// callbackPurgeCache purges the cache key for the given record. If multiple
+// columns are provided, their values are combined with a pipe.
+func callbackPurgeCache(ctx context.Context, cacher cache.Cacher, namespace, table string, columns ...string) func(scope *gorm.Scope) {
 	return func(scope *gorm.Scope) {
 		if scope.TableName() != table {
 			return
@@ -337,25 +339,30 @@ func callbackPurgeCache(ctx context.Context, cacher cache.Cacher, namespace, tab
 			return
 		}
 
-		field, ok := scope.FieldByName(column)
-		if !ok {
-			_ = scope.Err(fmt.Errorf("table %q has no column %q", table, column))
-			return
-		}
+		keys := make([]string, 0, len(columns))
+		for _, column := range columns {
+			field, ok := scope.FieldByName(column)
+			if !ok {
+				_ = scope.Err(fmt.Errorf("table %q has no column %q", table, column))
+				return
+			}
 
-		if !field.Field.CanInterface() {
-			_ = scope.Err(fmt.Errorf("%q.%q cannot interface", table, column))
-			return
-		}
+			if !field.Field.CanInterface() {
+				_ = scope.Err(fmt.Errorf("%q.%q cannot interface", table, column))
+				return
+			}
 
-		val := field.Field.Interface()
-		if val == nil {
-			return
+			val := field.Field.Interface()
+			if val == nil {
+				return
+			}
+
+			keys = append(keys, fmt.Sprintf("%v", val))
 		}
 
 		key := &cache.Key{
 			Namespace: namespace,
-			Key:       fmt.Sprintf("%v", val),
+			Key:       strings.Join(keys, "|"),
 		}
 		if err := cacher.Delete(ctx, key); err != nil {
 			scope.Log(fmt.Sprintf("failed to delete cache key: %v", err))
@@ -606,6 +613,42 @@ func stringDiff(old, new string) string {
 	return w.String()
 }
 
+func stringSliceDiff(old, new []string) string {
+	oldMap := make(map[string]struct{}, len(old))
+	for _, k := range old {
+		oldMap[k] = struct{}{}
+	}
+	newMap := make(map[string]struct{}, len(new))
+	for _, k := range new {
+		newMap[k] = struct{}{}
+	}
+
+	added := make([]string, 0, len(new))
+	for k := range newMap {
+		if _, ok := oldMap[k]; !ok {
+			added = append(added, k)
+		}
+	}
+	sort.Strings(added)
+
+	removed := make([]string, 0, len(old))
+	for k := range oldMap {
+		if _, ok := newMap[k]; !ok {
+			removed = append(removed, k)
+		}
+	}
+	sort.Strings(removed)
+
+	var w strings.Builder
+	for _, line := range removed {
+		fmt.Fprintf(&w, "-%s\n", line)
+	}
+	for _, line := range added {
+		fmt.Fprintf(&w, "+%s\n", line)
+	}
+	return w.String()
+}
+
 func boolDiff(old, new bool) string {
 	return stringDiff(strconv.FormatBool(old), strconv.FormatBool(new))
 }
diff --git a/pkg/database/email_config_test.go b/pkg/database/email_config_test.go
index 51c2fb64e..61e3c046a 100644
--- a/pkg/database/email_config_test.go
+++ b/pkg/database/email_config_test.go
@@ -26,10 +26,9 @@ func TestEmailConfig_Lifecycle(t *testing.T) {
 	db, _ := testDatabaseInstance.NewDatabase(t, nil)
 
 	// Create realm
-	realmName := t.Name()
-	realm, err := db.CreateRealm(realmName)
-	if err != nil {
-		t.Fatalf("unable to cerate test realm: %v", err)
+	realm := NewRealmWithDefaults(t.Name())
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
+		t.Fatal(err)
 	}
 
 	// Initial config should be nil
@@ -56,7 +55,7 @@ func TestEmailConfig_Lifecycle(t *testing.T) {
 	}
 
 	// Get the realm to verify email configs are NOT preloaded
-	realm, err = db.FindRealm(realm.ID)
+	realm, err := db.FindRealm(realm.ID)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -118,9 +117,9 @@ func TestEmailProvider(t *testing.T) {
 
 	db, _ := testDatabaseInstance.NewDatabase(t, nil)
 
-	realm, err := db.CreateRealm("test-email-realm-1")
-	if err != nil {
-		t.Fatalf("realm create failed: %v", err)
+	realm := NewRealmWithDefaults("test-email-realm-1")
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
+		t.Fatal(err)
 	}
 
 	provider, err := realm.EmailProvider(db)
diff --git a/pkg/database/membership.go b/pkg/database/membership.go
new file mode 100644
index 000000000..f4a6c6d36
--- /dev/null
+++ b/pkg/database/membership.go
@@ -0,0 +1,55 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package database
+
+import (
+	"fmt"
+
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
+)
+
+// Membership represents a user's membership in a realm.
+type Membership struct {
+	UserID uint
+	User   *User
+
+	RealmID uint
+	Realm   *Realm
+
+	Permissions rbac.Permission
+}
+
+// AfterFind does a sanity check to ensure the User and Realm properties were
+// preloaded and the referenced values exist.
+func (m *Membership) AfterFind() error {
+	if m.User == nil {
+		return fmt.Errorf("membership user does not exist")
+	}
+
+	if m.Realm == nil {
+		return fmt.Errorf("membership realm does not exist")
+	}
+
+	return nil
+}
+
+// Can returns true if the membership has the checked permission on the realm,
+// false otherwise.
+func (m *Membership) Can(p rbac.Permission) bool {
+	if m == nil {
+		return false
+	}
+	return rbac.Can(m.Permissions, p)
+}
diff --git a/pkg/database/migrations.go b/pkg/database/migrations.go
index 9017c097f..1c7a7f743 100644
--- a/pkg/database/migrations.go
+++ b/pkg/database/migrations.go
@@ -21,6 +21,7 @@ import (
 	"time"
 
 	"github.com/google/exposure-notifications-server/pkg/logging"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 
 	"github.com/jinzhu/gorm"
 	"gopkg.in/gormigrate.v1"
@@ -48,12 +49,9 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 			Migrate: func(tx *gorm.DB) error {
 				// This is "out of order" as it were, but is needed to bootstrap fresh systems.
 				// Also in migration 8
-				logger.Debugw("creating realms table")
 				if err := tx.AutoMigrate(&Realm{}).Error; err != nil {
 					return err
 				}
-
-				logger.Debugw("creating users table")
 				return tx.AutoMigrate(&User{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -66,7 +64,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00002-CreateVerificationCodes",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("creating verification codes table")
 				return tx.AutoMigrate(&VerificationCode{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -76,7 +73,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00003-CreateAuthorizedApps",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("creating authorized apps table")
 				return tx.AutoMigrate(&AuthorizedApp{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -86,7 +82,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00004-CreateTokens",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("creating tokens table")
 				return tx.AutoMigrate(&Token{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -96,7 +91,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00005-CreateCleanups",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("creating cleanup status table")
 				if err := tx.AutoMigrate(&CleanupStatus{}).Error; err != nil {
 					return err
 				}
@@ -113,30 +107,24 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00006-AddIndexes",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("add users purge index")
 				if err := tx.Model(&User{}).AddIndex("users_purge_index", "updated_at").Error; err != nil {
 					return err
 				}
-				logger.Debugw("add verification code purge index")
 				if err := tx.Model(&VerificationCode{}).AddIndex("ver_code_purge_index", "expires_at").Error; err != nil {
 					return err
 				}
-				logger.Debugw("add tokens purge index")
 				if err := tx.Model(&VerificationCode{}).AddIndex("token_purge_index", "expires_at").Error; err != nil {
 					return err
 				}
 				return nil
 			},
 			Rollback: func(tx *gorm.DB) error {
-				logger.Debugw("drop users purge index")
 				if err := tx.Model(&User{}).RemoveIndex("users_purge_index").Error; err != nil {
 					return err
 				}
-				logger.Debugw("drop verification code purge index")
 				if err := tx.Model(&VerificationCode{}).RemoveIndex("ver_code_purge_index").Error; err != nil {
 					return err
 				}
-				logger.Debugw("drop tokens purge index")
 				if err := tx.Model(&VerificationCode{}).RemoveIndex("token_purge_index").Error; err != nil {
 					return err
 				}
@@ -146,7 +134,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00007-AddSymptomOnset",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("rename test_date to symptom_date")
 				// AutoMigrate will add missing fields.
 				if err := tx.AutoMigrate(&VerificationCode{}).Error; err != nil {
 					return err
@@ -170,7 +157,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 				return nil
 			},
 			Rollback: func(tx *gorm.DB) error {
-				logger.Debugw("rename symptom_date to test_date")
 				if err := tx.Model(&VerificationCode{}).DropColumn("symptom_date").Error; err != nil {
 					return err
 				}
@@ -183,7 +169,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00008-AddKeyTypes",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("upgrading authorized_apps table.")
 				return tx.AutoMigrate(&AuthorizedApp{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -196,7 +181,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00009-AddIssuerColumns",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding issuer columns to issued codes")
 				return tx.AutoMigrate(&VerificationCode{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -212,7 +196,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00010-AddSMSConfig",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding sms_configs table")
 				return tx.AutoMigrate(&SMSConfig{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -222,12 +205,10 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00011-AddRealms",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("creating realms table")
 				// Add the realms table.
 				if err := tx.AutoMigrate(&Realm{}).Error; err != nil {
 					return err
 				}
-				logger.Debugw("creating default realm")
 				// Create the default realm with all of the default settings.
 				defaultRealm := NewRealmWithDefaults("Default")
 				defaultRealm.RequireDate = false
@@ -236,29 +217,23 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 				}
 
 				// Add realm relations to the rest of the tables.
-				logger.Debugw("adding RealmID to users")
 				if err := tx.AutoMigrate(&User{}).Error; err != nil {
 					return err
 				}
-				logger.Debugw("joining users to the default realm")
 				var users []*User
 				if err := tx.Find(&users).Error; err != nil {
 					return err
 				}
 				for _, u := range users {
-					logger.Debugw("adding user to default realm", "user", u.ID)
-
-					u.AddRealm(defaultRealm)
+					permission := rbac.LegacyRealmUser
 					if u.SystemAdmin {
-						u.AddRealmAdmin(defaultRealm)
+						permission = rbac.LegacyRealmAdmin
 					}
-
-					if err := tx.Save(u).Error; err != nil {
+					if err := u.AddToRealm(db, defaultRealm, permission, System); err != nil {
 						return err
 					}
 				}
 
-				logger.Debugw("adding RealmID to authorized_apps")
 				if err := tx.AutoMigrate(&AuthorizedApp{}).Error; err != nil {
 					return err
 				}
@@ -267,36 +242,29 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 					return err
 				}
 				for _, a := range authApps {
-					logger.Debugw("added auth app to default realm", "app", a.Name)
 					a.RealmID = defaultRealm.ID
 					if err := tx.Save(a).Error; err != nil {
 						return err
 					}
 				}
 
-				logger.Debugw("adding RealmID to VerificationCodes")
 				if err := tx.AutoMigrate(&VerificationCode{}).Error; err != nil {
 					return err
 				}
-				logger.Debugw("joining existing VerificationCodes to default realm")
 				if err := tx.Exec("UPDATE verification_codes SET realm_id=?", defaultRealm.ID).Error; err != nil {
 					return err
 				}
 
-				logger.Debugw("adding RealmID to Tokens")
 				if err := tx.AutoMigrate(&Token{}).Error; err != nil {
 					return err
 				}
-				logger.Debugw("joining existing tokens to default realm")
 				if err := tx.Exec("UPDATE tokens SET realm_id=?", defaultRealm.ID).Error; err != nil {
 					return err
 				}
 
-				logger.Debugw("adding RealmID to SMSConfig")
 				if err := tx.AutoMigrate(&SMSConfig{}).Error; err != nil {
 					return err
 				}
-				logger.Debugw("joining existing SMS config to default realm")
 				if err := tx.Exec("UPDATE sms_configs SET realm_id=?", defaultRealm.ID).Error; err != nil {
 					return err
 				}
@@ -324,7 +292,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00012-DropAuthorizedAppUniqueNameIndex",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("dropping authorized apps unique name index")
 				sql := "DROP INDEX IF EXISTS uix_authorized_apps_name"
 				if err := tx.Exec(sql).Error; err != nil {
 					return err
@@ -338,7 +305,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00013-AddCompositeIndexOnAuthorizedApp",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding authorized apps realm/name composite index")
 				if err := tx.AutoMigrate(&AuthorizedApp{}).Error; err != nil {
 					return err
 				}
@@ -351,7 +317,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00014-DropUserPurgeIndex",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("dropping user purge index")
 				sql := "DROP INDEX IF EXISTS users_purge_index"
 				return tx.Exec(sql).Error
 			},
@@ -362,7 +327,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00015-DropUserDisabled",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("dropping user disabled column")
 				sql := "ALTER TABLE users DROP COLUMN IF EXISTS disabled"
 				return tx.Exec(sql).Error
 			},
@@ -374,7 +338,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00016-MigrateSMSConfigs",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("migrating sms configs")
 
 				var sms SMSConfig
 				rows, err := tx.Model(&SMSConfig{}).Rows()
@@ -414,7 +377,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00017-AddIssuerIDColumns",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding issuer id columns to verification codes")
 				err := tx.AutoMigrate(&VerificationCode{}, &UserStat{}, &AuthorizedAppStat{}).Error
 				return err
 
@@ -439,7 +401,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00018-IncreaseAPIKeySize",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("increasing API key size")
 				sql := "ALTER TABLE authorized_apps ALTER COLUMN api_key TYPE varchar(512)"
 				return tx.Exec(sql).Error
 			},
@@ -451,7 +412,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00019-AddAPIKeyPreviewAuthApp",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("migrating authapp")
 				return tx.AutoMigrate(AuthorizedApp{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -461,7 +421,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00020-HMACAPIKeys",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("HMACing existing api keys")
 
 				var apps []AuthorizedApp
 				if err := tx.Model(AuthorizedApp{}).Find(&apps).Error; err != nil {
@@ -496,7 +455,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00021-AddUUIDExtension",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding uuid extension")
 				return tx.Exec("CREATE EXTENSION IF NOT EXISTS \"uuid-ossp\"").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -506,7 +464,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00022-AddUUIDToVerificationCodes",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("migrating verification code uuid")
 
 				if err := tx.AutoMigrate(VerificationCode{}).Error; err != nil {
 					return fmt.Errorf("failed to auto migrate: %w", err)
@@ -533,7 +490,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00023-MakeUUIDVerificationCodesNotNull",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("making verification code uuid not null")
 
 				if err := tx.Exec("ALTER TABLE verification_codes ALTER COLUMN uuid SET NOT NULL").Error; err != nil {
 					return fmt.Errorf("failed to set null: %w", err)
@@ -552,7 +508,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00024-AddTestTypesToRealms",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding test types to realm")
 
 				sql := fmt.Sprintf("ALTER TABLE realms ADD COLUMN IF NOT EXISTS allowed_test_types INTEGER DEFAULT %d",
 					TestTypeConfirmed|TestTypeLikely|TestTypeNegative)
@@ -573,7 +528,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00025-SetTestTypesNotNull",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("setting test types to not-null")
 
 				if err := tx.Exec("ALTER TABLE realms ALTER COLUMN allowed_test_types SET NOT NULL").Error; err != nil {
 					return err
@@ -592,7 +546,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00026-EnableExtension_citext",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("enabling citext extension")
 				return tx.Exec("CREATE EXTENSION citext").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -602,7 +555,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00027-AlterColumns_citext",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("setting columns to case insensitive")
 				sqls := []string{
 					"ALTER TABLE authorized_apps ALTER COLUMN name TYPE CITEXT",
 					"ALTER TABLE realms ALTER COLUMN name TYPE CITEXT",
@@ -634,7 +586,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00028-AddSMSDeeplinkFields",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding long_code and SMS deeplink settings")
 				// long_code cannot be auto migrated because of unique index.
 				// manually create long_code and long_expires_at and backfill with existing data.
 				sqls := []string{
@@ -658,7 +609,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 					return err
 				}
 
-				logger.Debugw("add verification code purge index")
 				if err := tx.Model(&VerificationCode{}).AddIndex("ver_code_long_purge_index", "long_expires_at").Error; err != nil {
 					return err
 				}
@@ -686,7 +636,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00029-IncreaseVerificationCodeSizes",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("increasing verification code sizes")
 				sqls := []string{
 					"ALTER TABLE verification_codes ALTER COLUMN code TYPE varchar(512)",
 					"ALTER TABLE verification_codes ALTER COLUMN long_code TYPE varchar(512)",
@@ -716,7 +665,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00030-HMACCodes",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("HMACing existing tokens")
 				if err := tx.AutoMigrate(&Realm{}).Error; err != nil {
 					return err
 				}
@@ -764,7 +712,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00031-AlterStatsColumns",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("changing stats columns")
 
 				sqls := []string{
 					// AuthorizedApps
@@ -816,7 +763,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00032-RegionCodeSize",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("increasing region code sizes")
 				sqls := []string{
 					"ALTER TABLE realms ALTER COLUMN region_code TYPE varchar(10)",
 				}
@@ -835,7 +781,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00033-PerlRealmSigningKeys",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding signing_keys table")
 				if err := tx.AutoMigrate(&Realm{}).Error; err != nil {
 					return err
 				}
@@ -853,7 +798,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00034-AddENExpressSettings",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding EN Express settings")
 				if err := tx.AutoMigrate(&Realm{}).Error; err != nil {
 					return err
 				}
@@ -867,7 +811,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00035-AddMFARequiredToRealms",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding MFA required to realm")
 				return tx.Exec("ALTER TABLE realms ADD COLUMN IF NOT EXISTS mfa_mode INTEGER DEFAULT 0").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -877,7 +820,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00036-AddRealmStats",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("db migrations: adding realm stats")
 				if err := tx.AutoMigrate(&RealmStat{}).Error; err != nil {
 					return err
 				}
@@ -902,7 +844,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00037-AddRealmRequireDate",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("db migrations: adding require_date to realms")
 				return tx.Exec("ALTER TABLE realms ADD COLUMN IF NOT EXISTS require_date bool DEFAULT false").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -912,7 +853,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00038-AddRealmRequireDateNotNull",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("db migrations: adding not null requirement to require_date on realms")
 				return tx.Exec("ALTER TABLE realms ALTER COLUMN require_date SET NOT NULL").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -922,7 +862,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00039-RealmStatsToDate",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("db migrations: changing realm stats to date")
 				return tx.Exec("ALTER TABLE realm_stats ALTER COLUMN date TYPE date").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -932,7 +871,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00040-BackfillRealmStats",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("db migrations: back-filling realm stats")
 				sqls := []string{
 					`
 					INSERT INTO realm_stats (
@@ -1050,7 +988,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00044-AddEmailVerifiedRequiredToRealms",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding email verification required to realm")
 				return tx.Exec("ALTER TABLE realms ADD COLUMN IF NOT EXISTS email_verified_mode INTEGER DEFAULT 0").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -1077,7 +1014,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 					Email:       "super@example.com",
 					SystemAdmin: true,
 				}
-
 				if err := tx.Save(&user).Error; err != nil {
 					return err
 				}
@@ -1099,7 +1035,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00047-AddPasswordLastChangedToUsers",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding email verification required to realm")
 				return tx.Exec("ALTER TABLE users ADD COLUMN IF NOT EXISTS last_password_change DATE DEFAULT CURRENT_DATE").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -1231,7 +1166,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00050-CreateMobileApps",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("creating authorized apps table")
 				return tx.AutoMigrate(&MobileApp{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -1426,7 +1360,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00057-AddMFARequiredGracePeriod",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding email verification required to realm")
 				return tx.Exec("ALTER TABLE realms ADD COLUMN IF NOT EXISTS mfa_required_grace_period BIGINT DEFAULT 0").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -1472,7 +1405,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00060-AddEmailConfig",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding email_configs table")
 				return tx.AutoMigrate(&EmailConfig{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -1551,7 +1483,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00062-AddTestDate",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding verification code test date")
 				return tx.AutoMigrate(&VerificationCode{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -1561,7 +1492,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00063-AddTokenTestDate",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("adding token test date")
 				return tx.AutoMigrate(&Token{}).Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -1571,7 +1501,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00064-RescopeVerificationCodeIndices",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("realm enable verification_code index")
 				sqls := []string{
 					"ALTER TABLE verification_codes ALTER COLUMN long_code DROP NOT NULL",
 					"CREATE UNIQUE INDEX IF NOT EXISTS uix_verification_codes_realm_code ON verification_codes (realm_id,code) WHERE code != ''",
@@ -1589,7 +1518,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 				return nil
 			},
 			Rollback: func(tx *gorm.DB) error {
-				logger.Debugw("partial verification code cleanup")
 				sqls := []string{
 					"DELETE FROM verification_codes WHERE code = '' or long_code = ''",
 				}
@@ -1675,7 +1603,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00067-AddRealmAllowBulkUpload",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("db migrations: adding allow_bulk_upload to realms")
 
 				sqls := []string{
 					`ALTER TABLE realms ADD COLUMN IF NOT EXISTS allow_bulk_upload BOOL`,
@@ -1739,7 +1666,6 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 		{
 			ID: "00072-ChangeSMSTemplateType",
 			Migrate: func(tx *gorm.DB) error {
-				logger.Debugw("changing type of SMS Template text")
 				return tx.Exec("ALTER TABLE realms ALTER COLUMN sms_text_template TYPE text").Error
 			},
 			Rollback: func(tx *gorm.DB) error {
@@ -1801,16 +1727,112 @@ func (db *Database) getMigrations(ctx context.Context) *gormigrate.Gormigrate {
 				return nil
 			},
 		},
+		{
+			ID: "00075-CreateRBAC",
+			Migrate: func(tx *gorm.DB) error {
+				// These tables will already exist for existing apps, but it will NOT
+				// exist for apps running migrations for the first time. The reason is
+				// because Gorm's automigrate created the join tables automagically in
+				// the past because the models were annotated. But the models are no
+				// longer annotated, so the join table is not created.
+				if err := tx.Exec(`CREATE TABLE IF NOT EXISTS user_realms (
+					realm_id INTEGER,
+					user_id INTEGER,
+					PRIMARY KEY (realm_id, user_id)
+				)`).Error; err != nil {
+					return err
+				}
+				if err := tx.Exec(`CREATE TABLE IF NOT EXISTS admin_realms (
+					realm_id INTEGER,
+					user_id INTEGER,
+					PRIMARY KEY (realm_id, user_id)
+				)`).Error; err != nil {
+					return err
+				}
+
+				// Update existing columns defaults.
+				if err := tx.Exec(`ALTER TABLE user_realms ALTER COLUMN realm_id SET NOT NULL`).Error; err != nil {
+					return err
+				}
+				if err := tx.Exec(`ALTER TABLE user_realms ALTER COLUMN user_id SET NOT NULL`).Error; err != nil {
+					return err
+				}
+
+				// Convert realm and user into real foreign keys. If the parent record
+				// is deleted, also delete the membership record.
+				if err := tx.Exec(`ALTER TABLE user_realms ADD CONSTRAINT fk_realm FOREIGN KEY (realm_id) REFERENCES realms(id) ON DELETE CASCADE`).Error; err != nil {
+					return err
+				}
+				if err := tx.Exec(`ALTER TABLE user_realms ADD CONSTRAINT fk_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE`).Error; err != nil {
+					return err
+				}
+
+				// Create new column in user_realms.
+				if err := tx.Exec(`ALTER TABLE user_realms ADD COLUMN IF NOT EXISTS permissions BIGINT`).Error; err != nil {
+					return err
+				}
+
+				// Update all existing permissions to be RealmUser.
+				if err := tx.Exec(
+					`UPDATE user_realms SET permissions = $1`,
+					int64(rbac.LegacyRealmUser),
+				).Error; err != nil {
+					return err
+				}
+
+				// Set the default for new permissions to 0 (none) and disallow NULL.
+				if err := tx.Exec(`ALTER TABLE user_realms ALTER COLUMN permissions SET DEFAULT 0`).Error; err != nil {
+					return err
+				}
+				if err := tx.Exec(`ALTER TABLE user_realms ALTER COLUMN permissions SET NOT NULL`).Error; err != nil {
+					return err
+				}
+
+				// Migrate existing admin_realms permissions into user_realms with the
+				// legacy realm admin permission.
+				if err := tx.Exec(
+					`INSERT INTO user_realms(user_id, realm_id, permissions)
+						SELECT user_id, realm_id, $1 FROM admin_realms
+						ON CONFLICT (user_id, realm_id) DO UPDATE SET permissions = $1`,
+					int64(rbac.LegacyRealmAdmin|rbac.LegacyRealmUser),
+				).Error; err != nil {
+					return err
+				}
+
+				// Rename user_realms.
+				if err := tx.Exec(`ALTER TABLE user_realms RENAME TO memberships`).Error; err != nil {
+					return err
+				}
+				if err := tx.Exec(`ALTER INDEX user_realms_pkey RENAME TO memberships_pkey`).Error; err != nil {
+					return err
+				}
+
+				// Add indexes on realm_id and user_id individually for lookups.
+				if err := tx.Exec(`CREATE INDEX IF NOT EXISTS idx_memberships_realm_id ON memberships(realm_id)`).Error; err != nil {
+					return err
+				}
+				if err := tx.Exec(`CREATE INDEX IF NOT EXISTS idx_memberships_user_id ON memberships(user_id)`).Error; err != nil {
+					return err
+				}
+
+				// Drop admin_realms.
+				if err := tx.Exec(`DROP TABLE IF EXISTS admin_realms`).Error; err != nil {
+					return err
+				}
+
+				return nil
+			},
+			Rollback: func(tx *gorm.DB) error {
+				// No rollback for this
+				return nil
+			},
+		},
 	})
 }
 
 // MigrateTo migrates the database to a specific target migration ID.
 func (db *Database) MigrateTo(ctx context.Context, target string, rollback bool) error {
-	logger := logging.FromContext(ctx).Named("migrate")
-	ctx = logging.WithLogger(ctx, logger)
-
 	m := db.getMigrations(ctx)
-	logger.Debugw("migrations starting")
 
 	var err error
 	if target == "" {
@@ -1828,24 +1850,16 @@ func (db *Database) MigrateTo(ctx context.Context, target string, rollback bool)
 	}
 
 	if err != nil {
-		logger.Errorw("failed to migrate", "error", err)
 		return err
 	}
-	logger.Debugw("migrations complete")
 	return nil
 }
 
 // RunMigrations will apply sequential, transactional migrations to the database
 func (db *Database) RunMigrations(ctx context.Context) error {
-	logger := logging.FromContext(ctx).Named("migrate")
-	ctx = logging.WithLogger(ctx, logger)
-
 	m := db.getMigrations(ctx)
-	logger.Debugw("migrations starting")
 	if err := m.Migrate(); err != nil {
-		logger.Errorw("failed to migrate", "error", err)
 		return err
 	}
-	logger.Debugw("migrations complete")
 	return nil
 }
diff --git a/pkg/database/realm.go b/pkg/database/realm.go
index b47fdbf4d..d43883b4d 100644
--- a/pkg/database/realm.go
+++ b/pkg/database/realm.go
@@ -21,6 +21,7 @@ import (
 	"math"
 	"net"
 	"os"
+	"reflect"
 	"sort"
 	"strings"
 	"time"
@@ -30,6 +31,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/digest"
 	"github.com/google/exposure-notifications-verification-server/pkg/email"
 	"github.com/google/exposure-notifications-verification-server/pkg/pagination"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/google/exposure-notifications-verification-server/pkg/sms"
 	"github.com/microcosm-cc/bluemonday"
 
@@ -240,19 +242,13 @@ type Realm struct {
 	// before triggering abuse protections.
 	AbusePreventionLimitFactor float32 `gorm:"type:numeric(6, 3); not null; default:1.0"`
 
-	// These are here for gorm to setup the association. You should NOT call them
-	// directly, ever. Use the ListUsers function instead. The have to be public
-	// for reflection.
-	RealmUsers  []*User `gorm:"many2many:user_realms; PRELOAD:false; SAVE_ASSOCIATIONS:false; ASSOCIATION_AUTOUPDATE:false, ASSOCIATION_SAVE_REFERENCE:false"`
-	RealmAdmins []*User `gorm:"many2many:admin_realms; PRELOAD:false; SAVE_ASSOCIATIONS:false; ASSOCIATION_AUTOUPDATE:false, ASSOCIATION_SAVE_REFERENCE:false"`
-
 	// Relations to items that belong to a realm.
 	Codes  []*VerificationCode `gorm:"PRELOAD:false; SAVE_ASSOCIATIONS:false; ASSOCIATION_AUTOUPDATE:false, ASSOCIATION_SAVE_REFERENCE:false"`
 	Tokens []*Token            `gorm:"PRELOAD:false; SAVE_ASSOCIATIONS:false; ASSOCIATION_AUTOUPDATE:false, ASSOCIATION_SAVE_REFERENCE:false"`
 }
 
 // EffectiveMFAMode returns the realm's default MFAMode but first
-// checks if the user is in the grace-period (if so, required becomes promp).
+// checks if the user is in the grace-period (if so, required becomes prompt).
 func (r *Realm) EffectiveMFAMode(user *User) AuthRequirement {
 	if r == nil {
 		return MFARequired
@@ -808,13 +804,65 @@ func (r *Realm) FindMobileApp(db *Database, id interface{}) (*MobileApp, error)
 	return &app, nil
 }
 
-// ListUsers returns the list of users which match the given criteria.
-func (r *Realm) ListUsers(db *Database, p *pagination.PageParams, scopes ...Scope) ([]*User, *pagination.Paginator, error) {
-	scopes = append(scopes, func(db *gorm.DB) *gorm.DB {
-		return db.Joins("INNER JOIN user_realms ON realm_id = ? AND user_id = users.id", r.ID)
-	})
+// ListMemberships lists the realm's memberships.
+func (r *Realm) ListMemberships(db *Database, p *pagination.PageParams, scopes ...Scope) ([]*Membership, *pagination.Paginator, error) {
+	var memberships []*Membership
+	query := db.db.
+		Preload("Realm").
+		Preload("User").
+		Model(&Membership{}).
+		Scopes(scopes...).
+		Where("realm_id = ?", r.ID).
+		Joins("JOIN users ON users.id = memberships.user_id").
+		Order("LOWER(users.name)")
 
-	return db.ListUsers(p, scopes...)
+	if p == nil {
+		p = new(pagination.PageParams)
+	}
+
+	paginator, err := Paginate(query, &memberships, p.Page, p.Limit)
+	if err != nil {
+		if IsNotFound(err) {
+			return memberships, nil, nil
+		}
+		return nil, nil, err
+	}
+
+	return memberships, paginator, nil
+}
+
+// FindMembership finds the membership with the given id, if it exists.
+func (r *Realm) FindMembership(db *Database, userID interface{}) (*Membership, error) {
+	var membership Membership
+	if err := db.db.
+		Preload("User").
+		Preload("Realm").
+		Model(&Membership{}).
+		Where("realm_id = ? AND user_id = ?", r.ID, userID).
+		First(&membership).
+		Error; err != nil {
+		return nil, err
+	}
+	return &membership, nil
+}
+
+// MembershipPermissionMap returns a map where the key is the ID of a user and
+// the value is the permissions for that user.
+func (r *Realm) MembershipPermissionMap(db *Database) (map[uint]rbac.Permission, error) {
+	var memberships []*Membership
+	if err := db.db.
+		Model(&Membership{}).
+		Find(&memberships).Error; err != nil {
+		if !IsNotFound(err) {
+			return nil, err
+		}
+	}
+
+	m := make(map[uint]rbac.Permission, len(memberships))
+	for _, v := range memberships {
+		m[v.UserID] = v.Permissions
+	}
+	return m, nil
 }
 
 // FindUser finds the given user in the realm by ID.
@@ -822,7 +870,7 @@ func (r *Realm) FindUser(db *Database, id interface{}) (*User, error) {
 	var user User
 	if err := db.db.
 		Table("users").
-		Joins("INNER JOIN user_realms ON user_id = ? AND realm_id = ?", id, r.ID).
+		Joins("INNER JOIN memberships ON user_id = ? AND realm_id = ?", id, r.ID).
 		Find(&user, "users.id = ?", id).
 		Error; err != nil {
 		return nil, err
@@ -845,15 +893,6 @@ func (r *Realm) ValidTestType(typ string) bool {
 	}
 }
 
-func (db *Database) CreateRealm(name string) (*Realm, error) {
-	realm := NewRealmWithDefaults(name)
-
-	if err := db.db.Create(realm).Error; err != nil {
-		return nil, fmt.Errorf("unable to save realm: %w", err)
-	}
-	return realm, nil
-}
-
 func (db *Database) FindRealmByRegion(region string) (*Realm, error) {
 	var realm Realm
 
@@ -1071,7 +1110,23 @@ func (db *Database) SaveRealm(r *Realm, actor Auditable) error {
 				audits = append(audits, audit)
 			}
 
-			// TODO(sethvargo): diff allowed CIDRs
+			if old, new := existing.AllowedCIDRsAdminAPI, r.AllowedCIDRsAdminAPI; !reflect.DeepEqual(old, new) {
+				audit := BuildAuditEntry(actor, "updated adminapi allowed cidrs", r, r.ID)
+				audit.Diff = stringSliceDiff(old, new)
+				audits = append(audits, audit)
+			}
+
+			if old, new := existing.AllowedCIDRsAPIServer, r.AllowedCIDRsAPIServer; !reflect.DeepEqual(old, new) {
+				audit := BuildAuditEntry(actor, "updated apiserver allowed cidrs", r, r.ID)
+				audit.Diff = stringSliceDiff(old, new)
+				audits = append(audits, audit)
+			}
+
+			if old, new := existing.AllowedCIDRsServer, r.AllowedCIDRsServer; !reflect.DeepEqual(old, new) {
+				audit := BuildAuditEntry(actor, "updated server allowed cidrs", r, r.ID)
+				audit.Diff = stringSliceDiff(old, new)
+				audits = append(audits, audit)
+			}
 
 			if existing.AllowedTestTypes != r.AllowedTestTypes {
 				audit := BuildAuditEntry(actor, "updated allowed test types", r, r.ID)
diff --git a/pkg/database/realm_test.go b/pkg/database/realm_test.go
index 8b7733269..1e6d16e05 100644
--- a/pkg/database/realm_test.go
+++ b/pkg/database/realm_test.go
@@ -24,6 +24,7 @@ import (
 
 	"github.com/google/exposure-notifications-server/pkg/timeutils"
 	"github.com/google/exposure-notifications-verification-server/internal/project"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func TestSMS(t *testing.T) {
@@ -222,17 +223,20 @@ func TestPerUserRealmStats(t *testing.T) {
 	users := []*User{}
 	for userIdx, name := range []string{"Rocky", "Bullwinkle", "Boris", "Natasha"} {
 		user := &User{
-			Realms:      []*Realm{realm},
 			Name:        name,
 			Email:       name + "@gmail.com",
 			SystemAdmin: false,
 		}
-
 		if err := db.SaveUser(user, SystemTest); err != nil {
 			t.Fatalf("[%v] error creating user: %v", name, err)
 		}
 		users = append(users, user)
 
+		// Add to realm
+		if err := user.AddToRealm(db, realm, rbac.CodeIssue, SystemTest); err != nil {
+			t.Fatal(err)
+		}
+
 		// Add some stats per user.
 		for i := 0; i < numDays; i++ {
 			stat := &UserStat{
diff --git a/pkg/database/scopes.go b/pkg/database/scopes.go
index 94655a7e9..bf9db38fe 100644
--- a/pkg/database/scopes.go
+++ b/pkg/database/scopes.go
@@ -31,15 +31,6 @@ func OnlySystemAdmins() Scope {
 	}
 }
 
-// OnlyRealmAdmins returns a scope that restricts the query to users that are
-// administrators of 1 or more realms. It's only applicable to functions that
-// query User.
-func OnlyRealmAdmins() Scope {
-	return func(db *gorm.DB) *gorm.DB {
-		return db.Joins("INNER JOIN (SELECT DISTINCT user_id FROM admin_realms) ar ON users.id = ar.user_id")
-	}
-}
-
 // WithUserSearch returns a scope that adds querying for users by email and
 // name, case-insensitive. It's only applicable to functions that query User.
 func WithUserSearch(q string) Scope {
diff --git a/pkg/database/sms_config_test.go b/pkg/database/sms_config_test.go
index 28631584b..34dcde84f 100644
--- a/pkg/database/sms_config_test.go
+++ b/pkg/database/sms_config_test.go
@@ -26,10 +26,9 @@ func TestSMSConfig_Lifecycle(t *testing.T) {
 	db, _ := testDatabaseInstance.NewDatabase(t, nil)
 
 	// Create realm
-	realmName := t.Name()
-	realm, err := db.CreateRealm(realmName)
-	if err != nil {
-		t.Fatalf("unable to cerate test realm: %v", err)
+	realm := NewRealmWithDefaults(t.Name())
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
+		t.Fatal(err)
 	}
 
 	// Initial config should be nil
@@ -56,7 +55,7 @@ func TestSMSConfig_Lifecycle(t *testing.T) {
 	}
 
 	// Get the realm to verify SMS configs are NOT preloaded
-	realm, err = db.FindRealm(realm.ID)
+	realm, err := db.FindRealm(realm.ID)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -118,9 +117,9 @@ func TestSMSProvider(t *testing.T) {
 
 	db, _ := testDatabaseInstance.NewDatabase(t, nil)
 
-	realm, err := db.CreateRealm("test-sms-realm-1")
-	if err != nil {
-		t.Fatalf("realm create failed: %v", err)
+	realm := NewRealmWithDefaults("test-sms-realm-1")
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
+		t.Fatal(err)
 	}
 
 	provider, err := realm.SMSProvider(db)
diff --git a/pkg/database/user.go b/pkg/database/user.go
index 032f46e75..cf61a77b5 100644
--- a/pkg/database/user.go
+++ b/pkg/database/user.go
@@ -16,13 +16,13 @@ package database
 
 import (
 	"fmt"
-	"sort"
 	"strings"
 	"time"
 
 	"github.com/google/exposure-notifications-server/pkg/timeutils"
 	"github.com/google/exposure-notifications-verification-server/internal/project"
 	"github.com/google/exposure-notifications-verification-server/pkg/pagination"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/jinzhu/gorm"
 )
 
@@ -43,9 +43,6 @@ type User struct {
 	Name        string `gorm:"type:varchar(100)"`
 	SystemAdmin bool   `gorm:"column:system_admin; default:false;"`
 
-	Realms      []*Realm `gorm:"many2many:user_realms"`
-	AdminRealms []*Realm `gorm:"many2many:admin_realms"`
-
 	LastRevokeCheck    time.Time
 	LastPasswordChange time.Time
 }
@@ -58,20 +55,6 @@ func (u *User) PasswordChanged() time.Time {
 	return u.LastPasswordChange
 }
 
-// AfterFind runs after the record is found.
-func (u *User) AfterFind(tx *gorm.DB) error {
-	// Sort Realms and Admin realms. Unfortunately gorm provides no way to do this
-	// via sql hooks or default scopes.
-	sort.Slice(u.Realms, func(i, j int) bool {
-		return strings.ToLower(u.Realms[i].Name) < strings.ToLower(u.Realms[j].Name)
-	})
-	sort.Slice(u.AdminRealms, func(i, j int) bool {
-		return strings.ToLower(u.AdminRealms[i].Name) < strings.ToLower(u.AdminRealms[j].Name)
-	})
-
-	return nil
-}
-
 // PasswordAgeString displays the age of the password in friendly text.
 func (u *User) PasswordAgeString() string {
 	ago := time.Since(u.PasswordChanged())
@@ -115,69 +98,6 @@ func (u *User) BeforeSave(tx *gorm.DB) error {
 	return nil
 }
 
-func (u *User) GetRealm(realmID uint) *Realm {
-	for _, r := range u.Realms {
-		if r.ID == realmID {
-			return r
-		}
-	}
-	return nil
-}
-
-func (u *User) CanViewRealm(realmID uint) bool {
-	for _, r := range u.Realms {
-		if r.ID == realmID {
-			return true
-		}
-	}
-	return false
-}
-
-func (u *User) IsRealmAdmin() bool {
-	return len(u.AdminRealms) > 0
-}
-
-func (u *User) CanAdminRealm(realmID uint) bool {
-	for _, r := range u.AdminRealms {
-		if r.ID == realmID {
-			return true
-		}
-	}
-	return false
-}
-
-// AddRealm adds the user to the realm.
-func (u *User) AddRealm(realm *Realm) {
-	u.Realms = append(u.Realms, realm)
-}
-
-// AddRealmAdmin adds the user to the realm as an admin.
-func (u *User) AddRealmAdmin(realm *Realm) {
-	u.AdminRealms = append(u.AdminRealms, realm)
-	u.AddRealm(realm)
-}
-
-// RemoveRealm removes the user from the realm. It also removes the user as an
-// admin of that realm. You must save the user to persist the changes.
-func (u *User) RemoveRealm(realm *Realm) {
-	for i, r := range u.Realms {
-		if r.ID == realm.ID {
-			u.Realms = append(u.Realms[:i], u.Realms[i+1:]...)
-		}
-	}
-	u.RemoveRealmAdmin(realm)
-}
-
-// RemoveRealmAdmin removes the user from the realm. You must save the user to
-// persist the changes.
-func (u *User) RemoveRealmAdmin(realm *Realm) {
-	for i, r := range u.AdminRealms {
-		if r.ID == realm.ID {
-			u.AdminRealms = append(u.AdminRealms[:i], u.AdminRealms[i+1:]...)
-		}
-	}
-}
-
 // FindUser finds a user by the given id, if one exists. The id can be a string
 // or integer value. It returns an error if the record is not found.
 func (db *Database) FindUser(id interface{}) (*User, error) {
@@ -204,6 +124,149 @@ func (db *Database) FindUserByEmail(email string) (*User, error) {
 	return &user, nil
 }
 
+// ListMemberships lists the memberships for this user. Use
+// ListMembershipsCached where possible.
+func (u *User) ListMemberships(db *Database) ([]*Membership, error) {
+	var memberships []*Membership
+
+	if err := db.db.
+		Preload("Realm").
+		Preload("User").
+		Model(&Membership{}).
+		Where("user_id = ?", u.ID).
+		Joins("JOIN realms ON realms.id = memberships.realm_id").
+		Order("realms.name").
+		Find(&memberships).
+		Error; err != nil {
+		if IsNotFound(err) {
+			return memberships, nil
+		}
+		return nil, err
+	}
+	return memberships, nil
+}
+
+// FindMembership finds the corresponding membership for the given realm ID, if
+// one exists. If not does not exist, an error is returned that satisfies
+// IsNotFound.
+func (u *User) FindMembership(db *Database, realmID interface{}) (*Membership, error) {
+	var membership Membership
+	if err := db.db.
+		Model(&Membership{}).
+		Preload("Realm").
+		Preload("User").
+		Where("user_id = ? AND realm_id = ?", u.ID, realmID).
+		First(&membership).
+		Error; err != nil {
+		return nil, err
+	}
+	return &membership, nil
+}
+
+// AddToRealm adds the current user to the realm with the given permissions. If
+// a record already exists, the permissions are overwritten with the new
+// permissions.
+func (u *User) AddToRealm(db *Database, r *Realm, permissions rbac.Permission, actor Auditable) error {
+	if actor == nil {
+		return fmt.Errorf("auditable actor cannot be nil")
+	}
+
+	return db.db.Transaction(func(tx *gorm.DB) error {
+		var existing Membership
+		if err := tx.
+			Model(&Membership{}).
+			Where("user_id = ? AND realm_id = ?", u.ID, r.ID).
+			First(&existing).
+			Error; err != nil {
+			if !IsNotFound(err) {
+				return err
+			}
+		}
+
+		conflict := fmt.Sprintf(`ON CONFLICT (user_id, realm_id) DO UPDATE
+			SET permissions = %d`, permissions)
+		if err := tx.
+			Set("gorm:insert_option", conflict).
+			Model(&Membership{}).
+			Create(&Membership{
+				UserID:      u.ID,
+				RealmID:     r.ID,
+				Permissions: permissions,
+			}).
+			Error; err != nil {
+			return err
+		}
+
+		// Brand new member?
+		if existing.UserID == 0 {
+			audit := BuildAuditEntry(actor, "added user to realm", u, r.ID)
+			if err := tx.Save(audit).Error; err != nil {
+				return fmt.Errorf("failed to save audit: %w", err)
+			}
+		}
+
+		// Audit if permissions were changed.
+		if old, new := existing.Permissions, permissions; old != new {
+			audit := BuildAuditEntry(actor, "updated user permissions", u, r.ID)
+			audit.Diff = stringSliceDiff(rbac.PermissionNames(old), rbac.PermissionNames(new))
+			if err := tx.Save(audit).Error; err != nil {
+				return fmt.Errorf("failed to save audit: %w", err)
+			}
+		}
+
+		// Cascade updated_at on user
+		if err := tx.
+			Model(&User{}).
+			Where("id = ?", u.ID).
+			UpdateColumn("updated_at", time.Now().UTC()).
+			Error; err != nil {
+			return fmt.Errorf("failed to update user updated_at: %w", err)
+		}
+
+		return nil
+	})
+}
+
+// DeleteFromRealm removes this user from the given realm. If the user does not
+// exist in the realm, no action is taken.
+func (u *User) DeleteFromRealm(db *Database, r *Realm, actor Auditable) error {
+	if actor == nil {
+		return fmt.Errorf("auditable actor cannot be nil")
+	}
+
+	return db.db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Unscoped().
+			Model(&Membership{}).
+			Where("user_id = ? AND realm_id = ?", u.ID, r.ID).
+			Delete(&Membership{
+				UserID:  u.ID,
+				RealmID: r.ID,
+			}).
+			Error; err != nil {
+			if !IsNotFound(err) {
+				return err
+			}
+		}
+
+		// Generate audit
+		audit := BuildAuditEntry(actor, "removed user from realm", u, r.ID)
+		if err := tx.Save(audit).Error; err != nil {
+			return fmt.Errorf("failed to save audit: %w", err)
+		}
+
+		// Cascade updated_at on user
+		if err := tx.
+			Model(&User{}).
+			Where("id = ?", u.ID).
+			UpdateColumn("updated_at", time.Now().UTC()).
+			Error; err != nil {
+			return fmt.Errorf("failed to update user updated_at: %w", err)
+		}
+
+		return nil
+	})
+}
+
 // Stats returns the usage statistics for this user at the provided realm. If no
 // stats exist, it returns an empty array.
 func (u *User) Stats(db *Database, realmID uint, start, stop time.Time) (UserStats, error) {
@@ -361,7 +424,7 @@ func (db *Database) PurgeUsers(maxAge time.Duration) (int64, error) {
 	// Delete users who were created/updated before the expiry time.
 	rtn := db.db.Unscoped().
 		Where("users.system_admin = false AND users.created_at < ? AND users.updated_at < ?", deleteBefore, deleteBefore).
-		Where("NOT EXISTS(SELECT 1 FROM user_realms WHERE user_realms.user_id = users.id)"). // delete where no realm association exists.
+		Where("NOT EXISTS(SELECT 1 FROM memberships WHERE memberships.user_id = users.id LIMIT 1)"). // delete where no realm association exists.
 		Delete(&User{})
 	return rtn.RowsAffected, rtn.Error
 }
@@ -388,10 +451,6 @@ func (db *Database) SaveUser(u *User, actor Auditable) error {
 			return fmt.Errorf("failed to get existing user")
 		}
 
-		// Force-update associations
-		tx.Model(u).Association("Realms").Replace(u.Realms)
-		tx.Model(u).Association("AdminRealms").Replace(u.AdminRealms)
-
 		// Save the user
 		if err := tx.Save(u).Error; err != nil {
 			return fmt.Errorf("failed to save user: %w", err)
@@ -421,53 +480,6 @@ func (db *Database) SaveUser(u *User, actor Auditable) error {
 			}
 		}
 
-		// Diff realms - this intentionally happens for both new and existing users
-		existingRealms := make(map[uint]struct{}, len(existing.Realms))
-		for _, v := range existing.Realms {
-			existingRealms[v.ID] = struct{}{}
-		}
-		existingAdminRealms := make(map[uint]struct{}, len(existing.AdminRealms))
-		for _, v := range existing.AdminRealms {
-			existingAdminRealms[v.ID] = struct{}{}
-		}
-
-		newRealms := make(map[uint]struct{}, len(u.Realms))
-		for _, v := range u.Realms {
-			newRealms[v.ID] = struct{}{}
-		}
-		newAdminRealms := make(map[uint]struct{}, len(u.AdminRealms))
-		for _, v := range u.AdminRealms {
-			newAdminRealms[v.ID] = struct{}{}
-		}
-
-		for ear := range existingAdminRealms {
-			if _, ok := newAdminRealms[ear]; !ok {
-				audit := BuildAuditEntry(actor, "demoted user from realm admin", u, ear)
-				audits = append(audits, audit)
-			}
-		}
-
-		for er := range existingRealms {
-			if _, ok := newRealms[er]; !ok {
-				audit := BuildAuditEntry(actor, "removed user from realm", u, er)
-				audits = append(audits, audit)
-			}
-		}
-
-		for nr := range newRealms {
-			if _, ok := existingRealms[nr]; !ok {
-				audit := BuildAuditEntry(actor, "added user to realm", u, nr)
-				audits = append(audits, audit)
-			}
-		}
-
-		for nr := range newAdminRealms {
-			if _, ok := existingAdminRealms[nr]; !ok {
-				audit := BuildAuditEntry(actor, "promoted user to realm admin", u, nr)
-				audits = append(audits, audit)
-			}
-		}
-
 		// Save all audits
 		for _, audit := range audits {
 			if err := tx.Save(audit).Error; err != nil {
diff --git a/pkg/database/user_test.go b/pkg/database/user_test.go
index 8f1d4b135..825a2c276 100644
--- a/pkg/database/user_test.go
+++ b/pkg/database/user_test.go
@@ -17,6 +17,8 @@ package database
 import (
 	"testing"
 	"time"
+
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func TestUserLifecycle(t *testing.T) {
@@ -102,14 +104,18 @@ func TestPurgeUsers(t *testing.T) {
 
 	db, _ := testDatabaseInstance.NewDatabase(t, nil)
 
+	realm := NewRealmWithDefaults("test")
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
+		t.Fatal(err)
+	}
+
 	email := "purge@example.com"
-	user := User{
+	user := &User{
 		Email:       email,
 		Name:        "Dr Delete",
 		SystemAdmin: true,
 	}
-
-	if err := db.SaveUser(&user, System); err != nil {
+	if err := db.SaveUser(user, System); err != nil {
 		t.Fatalf("error creating user: %v", err)
 	}
 	expectExists(t, db, user.ID)
@@ -122,18 +128,20 @@ func TestPurgeUsers(t *testing.T) {
 
 	// Update an attribute
 	user.SystemAdmin = false
-	realm := NewRealmWithDefaults("test")
-	user.AddRealm(realm)
-	if err := db.SaveUser(&user, System); err != nil {
+	if err := db.SaveUser(user, SystemTest); err != nil {
+		t.Fatal(err)
+	}
+	if err := user.AddToRealm(db, realm, rbac.LegacyRealmAdmin, SystemTest); err != nil {
 		t.Fatal(err)
 	}
+
 	// has a realm
 	if _, err := db.PurgeUsers(time.Duration(0)); err != nil {
 		t.Fatal(err)
 	}
 
-	user.RemoveRealm(realm)
-	if err := db.SaveUser(&user, System); err != nil {
+	// remove realm
+	if err := user.DeleteFromRealm(db, realm, SystemTest); err != nil {
 		t.Fatal(err)
 	}
 
@@ -143,6 +151,7 @@ func TestPurgeUsers(t *testing.T) {
 	}
 	expectExists(t, db, user.ID)
 
+	// should delete now
 	if _, err := db.PurgeUsers(time.Duration(0)); err != nil {
 		t.Fatal(err)
 	}
@@ -151,10 +160,10 @@ func TestPurgeUsers(t *testing.T) {
 	{
 		got, err := db.FindUser(user.ID)
 		if err != nil && !IsNotFound(err) {
-			t.Fatalf("expected user to be deleted. got: %v", err)
+			t.Fatal(err)
 		}
 		if got != nil {
-			t.Fatalf("expected user to be deleted. got: %v", got)
+			t.Errorf("expected user to be deleted, got: %#v", got)
 		}
 	}
 }
@@ -165,17 +174,24 @@ func TestRemoveRealmUpdatesTime(t *testing.T) {
 	db, _ := testDatabaseInstance.NewDatabase(t, nil)
 
 	realm := NewRealmWithDefaults("test")
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
+		t.Fatal(err)
+	}
 
 	email := "purge@example.com"
-	user := User{
+	user := &User{
 		Email: email,
 		Name:  "Dr Delete",
 	}
-	user.AddRealm(realm)
+	if err := db.SaveUser(user, SystemTest); err != nil {
+		t.Fatal(err)
+	}
 
-	if err := db.SaveUser(&user, System); err != nil {
-		t.Fatalf("error creating user: %v", err)
+	// Add to realm
+	if err := user.AddToRealm(db, realm, rbac.LegacyRealmAdmin, SystemTest); err != nil {
+		t.Fatal(err)
 	}
+
 	got, err := db.FindUser(user.ID)
 	if err != nil {
 		t.Fatal(err)
@@ -188,8 +204,7 @@ func TestRemoveRealmUpdatesTime(t *testing.T) {
 	time.Sleep(time.Second) // in case this executes in under a nanosecond.
 
 	originalTime := got.Model.UpdatedAt
-	user.RemoveRealm(realm)
-	if err := db.SaveUser(&user, System); err != nil {
+	if err := user.DeleteFromRealm(db, realm, SystemTest); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/pkg/database/vercode.go b/pkg/database/vercode.go
index 04d3953aa..ee02f9626 100644
--- a/pkg/database/vercode.go
+++ b/pkg/database/vercode.go
@@ -171,8 +171,6 @@ func (v *VerificationCode) AfterCreate(scope *gorm.Scope) {
 }
 
 // TODO(mikehelmick) - Add method to soft delete expired codes
-// TODO(mikehelmick) - Add method to purge verification codes that are > XX hours old
-//   Keeping expired codes prevents a code from being regenerated during that period of time.
 
 // FormatSymptomDate returns YYYY-MM-DD formatted test date, or "" if nil.
 func (v *VerificationCode) FormatSymptomDate() string {
diff --git a/pkg/database/vercode_test.go b/pkg/database/vercode_test.go
index 31724a72a..4ce9c7dd9 100644
--- a/pkg/database/vercode_test.go
+++ b/pkg/database/vercode_test.go
@@ -82,13 +82,14 @@ func TestVerificationCode_FindVerificationCodeByUUID(t *testing.T) {
 
 	db, _ := testDatabaseInstance.NewDatabase(t, nil)
 
-	realm, err := db.CreateRealm("testRealm")
-	if err != nil {
-		t.Fatalf("failed to create realm: %v", err)
+	realm := NewRealmWithDefaults("testRealm")
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
+		t.Fatal(err)
 	}
-	otherRealm, err := db.CreateRealm("notThetestRealm")
-	if err != nil {
-		t.Fatalf("failed to create realm: %v", err)
+
+	otherRealm := NewRealmWithDefaults("notThetestRealm")
+	if err := db.SaveRealm(otherRealm, SystemTest); err != nil {
+		t.Fatal(err)
 	}
 
 	vc := &VerificationCode{
@@ -338,9 +339,9 @@ func TestVerificationCodesCleanup(t *testing.T) {
 	now := time.Now()
 	maxAge := time.Hour // not important to this test case
 
-	realm, err := db.CreateRealm("realmy")
-	if err != nil {
-		t.Fatalf("couldn't create test realm: %v", realm)
+	realm := NewRealmWithDefaults("realmy")
+	if err := db.SaveRealm(realm, SystemTest); err != nil {
+		t.Fatal(err)
 	}
 
 	cleanUpTo := 1
diff --git a/pkg/rbac/rbac.go b/pkg/rbac/rbac.go
new file mode 100644
index 000000000..4848e2e8b
--- /dev/null
+++ b/pkg/rbac/rbac.go
@@ -0,0 +1,129 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:generate stringer -output=rbac_gen.go -type=Permission
+
+// Package rbac implements authorization.
+package rbac
+
+import (
+	"database/sql/driver"
+	"fmt"
+	"sort"
+)
+
+// Can returns true if the given resource has permission to perform ALL of the
+// provided permissions.
+func Can(given Permission, target Permission) bool {
+	return int64(given)&int64(target) != 0
+}
+
+// CompileAndAuthorize compiles a new permission bit from the given toUpdate
+// permissions. It verifies that the calling permission has a superset of all
+// provided permissions (to prevent privilege escalation).
+func CompileAndAuthorize(actorPermission Permission, toUpdate []Permission) (Permission, error) {
+	var permission Permission
+	for _, update := range toUpdate {
+		// Verify that the user making changes has the permissions they are trying
+		// to grant. It is not valid for someone to grant permissions larger than
+		// they currently have.
+		if !Can(actorPermission, update) {
+			return 0, fmt.Errorf("actor does not have all scopes which are being granted")
+		}
+		permission = permission | update
+	}
+	return permission, nil
+}
+
+// PermissionMap is a map of permissions to their names. It requires the
+// stringer generation.
+func PermissionMap() map[string]Permission {
+	m := make(map[string]Permission, len(_Permission_map)+2)
+	for k, v := range _Permission_map {
+		m[v] = k
+	}
+	return m
+}
+
+// PermissionNames returns the list of permissions included in the given
+// permission.
+func PermissionNames(p Permission) []string {
+	names := make([]string, 0, len(_Permission_map))
+	for v, k := range _Permission_map {
+		if Can(p, v) {
+			names = append(names, k)
+		}
+	}
+	sort.Strings(names)
+	return names
+}
+
+// Permission is a granular permission. It is an integer instead of a uint
+// because most database systems lack unsigned integer types.
+type Permission int64
+
+// Value returns the permissions value as an integer for sql drivers.
+func (p Permission) Value() (driver.Value, error) {
+	return int64(p), nil
+}
+
+const (
+	_ Permission = 1 << iota
+
+	// Audit
+	AuditRead
+
+	// API keys
+	APIKeyRead
+	APIKeyWrite
+
+	// Codes
+	CodeIssue
+	CodeBulkIssue
+	CodeRead
+	CodeExpire
+
+	// Realm settings
+	SettingsRead
+	SettingsWrite
+
+	// Realm statistics
+	StatsRead
+
+	// Mobile apps
+	MobileAppRead
+	MobileAppWrite
+
+	// Users
+	UserRead
+	UserWrite
+)
+
+// --
+// Legacy permissions
+// --
+
+const (
+	// LegacyRealmUser is a quick reference to the old "user" permissions.
+	LegacyRealmUser = CodeIssue | CodeBulkIssue | CodeRead | CodeExpire
+
+	// LegacyRealmAdmin is a quick reference to the old "realm admin" permissions.
+	LegacyRealmAdmin = AuditRead |
+		APIKeyRead | APIKeyWrite |
+		CodeIssue | CodeBulkIssue | CodeRead | CodeExpire |
+		SettingsRead | SettingsWrite |
+		StatsRead |
+		MobileAppRead | MobileAppWrite |
+		UserRead | UserWrite
+)
diff --git a/pkg/rbac/rbac_gen.go b/pkg/rbac/rbac_gen.go
new file mode 100644
index 000000000..2cc196186
--- /dev/null
+++ b/pkg/rbac/rbac_gen.go
@@ -0,0 +1,65 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by "stringer -output=rbac_gen.go -type=Permission"; DO NOT EDIT.
+
+package rbac
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[AuditRead-2]
+	_ = x[APIKeyRead-4]
+	_ = x[APIKeyWrite-8]
+	_ = x[CodeIssue-16]
+	_ = x[CodeBulkIssue-32]
+	_ = x[CodeRead-64]
+	_ = x[CodeExpire-128]
+	_ = x[SettingsRead-256]
+	_ = x[SettingsWrite-512]
+	_ = x[StatsRead-1024]
+	_ = x[MobileAppRead-2048]
+	_ = x[MobileAppWrite-4096]
+	_ = x[UserRead-8192]
+	_ = x[UserWrite-16384]
+}
+
+const _Permission_name = "AuditReadAPIKeyReadAPIKeyWriteCodeIssueCodeBulkIssueCodeReadCodeExpireSettingsReadSettingsWriteStatsReadMobileAppReadMobileAppWriteUserReadUserWrite"
+
+var _Permission_map = map[Permission]string{
+	2:     _Permission_name[0:9],
+	4:     _Permission_name[9:19],
+	8:     _Permission_name[19:30],
+	16:    _Permission_name[30:39],
+	32:    _Permission_name[39:52],
+	64:    _Permission_name[52:60],
+	128:   _Permission_name[60:70],
+	256:   _Permission_name[70:82],
+	512:   _Permission_name[82:95],
+	1024:  _Permission_name[95:104],
+	2048:  _Permission_name[104:117],
+	4096:  _Permission_name[117:131],
+	8192:  _Permission_name[131:139],
+	16384: _Permission_name[139:148],
+}
+
+func (i Permission) String() string {
+	if str, ok := _Permission_map[i]; ok {
+		return str
+	}
+	return "Permission(" + strconv.FormatInt(int64(i), 10) + ")"
+}
diff --git a/pkg/rbac/rbac_test.go b/pkg/rbac/rbac_test.go
new file mode 100644
index 000000000..9da6ac03f
--- /dev/null
+++ b/pkg/rbac/rbac_test.go
@@ -0,0 +1,56 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rbac
+
+import "testing"
+
+func TestRBAC_Permissions(t *testing.T) {
+	t.Parallel()
+
+	// This test might seem like it's redundant with the content in rbac.go, but
+	// it's designed to ensure that the exact values for existing RBAC permissions
+	// remain unchanged.
+	cases := []struct {
+		p   Permission
+		exp int64
+	}{
+		{AuditRead, 2},
+		{APIKeyRead, 4},
+		{APIKeyWrite, 8},
+		{CodeIssue, 16},
+		{CodeBulkIssue, 32},
+		{CodeRead, 64},
+		{CodeExpire, 128},
+		{SettingsRead, 256},
+		{SettingsWrite, 512},
+		{StatsRead, 1024},
+		{MobileAppRead, 2048},
+		{MobileAppWrite, 4096},
+		{UserRead, 8192},
+		{UserWrite, 16384},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+
+		t.Run(tc.p.String(), func(t *testing.T) {
+			t.Parallel()
+
+			if got, want := int64(tc.p), tc.exp; got != want {
+				t.Errorf("expected %d to be %d", got, want)
+			}
+		})
+	}
+}
diff --git a/pkg/render/render.go b/pkg/render/render.go
index ada42ebc2..a787eec21 100644
--- a/pkg/render/render.go
+++ b/pkg/render/render.go
@@ -30,6 +30,7 @@ import (
 
 	"github.com/google/exposure-notifications-server/pkg/logging"
 	"github.com/google/exposure-notifications-verification-server/internal/project"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/leonelquinteros/gotext"
 
 	"go.uber.org/zap"
@@ -147,23 +148,30 @@ func safeHTML(s string) htmltemplate.HTML {
 	return htmltemplate.HTML(s)
 }
 
-func selectedIf(v bool) htmltemplate.HTML {
+func selectedIf(v bool) htmltemplate.HTMLAttr {
 	if v {
-		return htmltemplate.HTML("selected")
+		return "selected"
 	}
 	return ""
 }
 
-func readonlyIf(v bool) htmltemplate.HTML {
+func readonlyIf(v bool) htmltemplate.HTMLAttr {
 	if v {
-		return htmltemplate.HTML("readonly")
+		return "readonly"
 	}
 	return ""
 }
 
-func disabledIf(v bool) htmltemplate.HTML {
+func checkedIf(v bool) htmltemplate.HTMLAttr {
 	if v {
-		return htmltemplate.HTML("disabled")
+		return "checked"
+	}
+	return ""
+}
+
+func disabledIf(v bool) htmltemplate.HTMLAttr {
+	if v {
+		return "disabled"
 	}
 	return ""
 }
@@ -193,11 +201,14 @@ func templateFuncs() htmltemplate.FuncMap {
 		"toJSON":           json.Marshal,
 		"toBase64":         base64.StdEncoding.EncodeToString,
 		"safeHTML":         safeHTML,
+		"checkedIf":        checkedIf,
 		"selectedIf":       selectedIf,
 		"readonlyIf":       readonlyIf,
 		"disabledIf":       disabledIf,
 		"t":                translate,
 		"passwordSentinel": pwdSentinel,
+
+		"rbac": rbac.PermissionMap,
 	}
 }
 
diff --git a/terraform/service_redirect.tf b/terraform/service_redirect.tf
index ed4b8d93d..b820eadaa 100644
--- a/terraform/service_redirect.tf
+++ b/terraform/service_redirect.tf
@@ -14,8 +14,7 @@
 # limitations under the License.
 
 resource "google_service_account" "enx-redirect" {
-  project = var.project
-  # TODO(sethvargo): namespace this, but SA are limited to 28 characters :(
+  project      = var.project
   account_id   = "enx-redirect-sa"
   display_name = "Verification enx-redirect"
 }
diff --git a/tools/seed/main.go b/tools/seed/main.go
index debcaac42..66cc5f9ca 100644
--- a/tools/seed/main.go
+++ b/tools/seed/main.go
@@ -30,6 +30,7 @@ import (
 	"github.com/google/exposure-notifications-verification-server/pkg/api"
 	"github.com/google/exposure-notifications-verification-server/pkg/config"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 	"github.com/jinzhu/gorm"
 
 	"github.com/google/exposure-notifications-server/pkg/logging"
@@ -127,13 +128,17 @@ func realMain(ctx context.Context) error {
 	// Create users
 	user := &database.User{Email: "user@example.com", Name: "Demo User"}
 	if _, err := db.FindUserByEmail(user.Email); database.IsNotFound(err) {
-		user.AddRealm(realm1)
-		user.AddRealm(realm2)
 		if err := db.SaveUser(user, database.System); err != nil {
 			return fmt.Errorf("failed to create user: %w: %v", err, user.ErrorMessages())
 		}
 		logger.Infow("created user", "user", user)
 	}
+	if err := user.AddToRealm(db, realm1, rbac.LegacyRealmUser, database.System); err != nil {
+		return fmt.Errorf("failed to add user to realm 1: %w", err)
+	}
+	if err := user.AddToRealm(db, realm2, rbac.LegacyRealmUser, database.System); err != nil {
+		return fmt.Errorf("failed to add user to realm 2: %w", err)
+	}
 
 	if err := createFirebaseUser(ctx, firebaseAuth, user); err != nil {
 		return err
@@ -142,22 +147,25 @@ func realMain(ctx context.Context) error {
 
 	unverified := &database.User{Email: "unverified@example.com", Name: "Unverified User"}
 	if _, err := db.FindUserByEmail(unverified.Email); database.IsNotFound(err) {
-		unverified.AddRealm(realm1)
 		if err := db.SaveUser(unverified, database.System); err != nil {
 			return fmt.Errorf("failed to create unverified: %w: %v", err, unverified.ErrorMessages())
 		}
 		logger.Infow("created user", "user", unverified)
 	}
+	if err := unverified.AddToRealm(db, realm1, rbac.LegacyRealmUser, database.System); err != nil {
+		return fmt.Errorf("failed to add user to realm 1: %w", err)
+	}
 
 	admin := &database.User{Email: "admin@example.com", Name: "Admin User"}
 	if _, err := db.FindUserByEmail(admin.Email); database.IsNotFound(err) {
-		admin.AddRealm(realm1)
-		admin.AddRealmAdmin(realm1)
 		if err := db.SaveUser(admin, database.System); err != nil {
 			return fmt.Errorf("failed to create admin: %w: %v", err, admin.ErrorMessages())
 		}
 		logger.Infow("created admin", "admin", admin)
 	}
+	if err := admin.AddToRealm(db, realm1, rbac.LegacyRealmAdmin, database.System); err != nil {
+		return fmt.Errorf("failed to add user to realm 1: %w", err)
+	}
 
 	if err := createFirebaseUser(ctx, firebaseAuth, admin); err != nil {
 		return err
