diff --git a/zero.Core/Api/PermissionsApi.cs b/zero.Core/Api/PermissionsApi.cs
index 3e589e9c..5a3b9497 100644
--- a/zero.Core/Api/PermissionsApi.cs
+++ b/zero.Core/Api/PermissionsApi.cs
@@ -1,5 +1,6 @@
 using Microsoft.Extensions.Options;
 using System.Collections.Generic;
+using zero.Core.Entities;
 using zero.Core.Identity;
 
 namespace zero.Core.Api
@@ -16,15 +17,68 @@ namespace zero.Core.Api
 
 
     /// <inheritdoc />
-    //public IList<PermissionCollection> GetPermissions()
-    //{
+    public IList<PermissionCollection> GetAll()
+    {
+      IList<PermissionCollection> result = new List<PermissionCollection>();
 
-    //}
+      PermissionCollection permissionSections = new PermissionCollection()
+      {
+        Label = "@permission.collections.sections",
+        Description = "@permission.collections.sections_description"
+      };
+
+      permissionSections.Items.Add(new Permission(Permissions.Sections.Dashboard, "@sections.item.dashboard", null, PermissionValueType.Boolean));
+      permissionSections.Items.Add(new Permission(Permissions.Sections.Pages, "@sections.item.pages", null, PermissionValueType.Boolean));
+      permissionSections.Items.Add(new Permission(Permissions.Sections.Spaces, "@sections.item.spaces", null, PermissionValueType.Boolean));
+      permissionSections.Items.Add(new Permission(Permissions.Sections.Media, "@sections.item.media", null, PermissionValueType.Boolean));
+      permissionSections.Items.Add(new Permission(Permissions.Sections.Settings, "@sections.item.settings", null, PermissionValueType.Boolean));
+
+      result.Add(permissionSections);
+
+      if (Options.Spaces.Count > 0)
+      {
+        PermissionCollection permissionSpaces = new PermissionCollection()
+        {
+          Label = "@permission.collections.spaces",
+          Description = "@permission.collections.spaces_description"
+        };
+
+        foreach (Space space in Options.Spaces)
+        {
+          permissionSpaces.Items.Add(new Permission(Permissions.Spaces.PREFIX + space.Alias, space.Name, null, PermissionValueType.ReadWrite));
+        }
+
+        result.Add(permissionSpaces);
+      }
+
+      PermissionCollection permissionSettings = new PermissionCollection()
+      {
+        Label = "@permission.collections.settings",
+        Description = "@permission.collections.settings_description"
+      };
+
+      permissionSettings.Items.Add(new Permission(Permissions.Settings.Updates, "@settings.system.updates.name", "@settings.system.updates.text_default", PermissionValueType.ReadWrite));
+      permissionSettings.Items.Add(new Permission(Permissions.Settings.Applications, "@settings.system.applications.name", "@settings.system.applications.text", PermissionValueType.ReadWrite));
+      permissionSettings.Items.Add(new Permission(Permissions.Settings.Users, "@settings.system.users.name", "@settings.system.users.text", PermissionValueType.ReadWrite));
+      permissionSettings.Items.Add(new Permission(Permissions.Settings.Languages, "@settings.system.languages.name", "@settings.system.languages.text", PermissionValueType.ReadWrite));
+      permissionSettings.Items.Add(new Permission(Permissions.Settings.Countries, "@settings.system.countries.name", "@settings.system.countries.text", PermissionValueType.ReadWrite));
+      permissionSettings.Items.Add(new Permission(Permissions.Settings.Translations, "@settings.system.translations.name", "@settings.system.translations.text", PermissionValueType.ReadWrite));
+      permissionSettings.Items.Add(new Permission(Permissions.Settings.Logging, "@settings.system.logs.name", "@settings.system.logs.text", PermissionValueType.ReadWrite));
+      permissionSettings.Items.Add(new Permission(Permissions.Settings.Plugins, "@settings.plugins.installed.name", "@settings.plugins.installed.text_default", PermissionValueType.ReadWrite));
+      permissionSettings.Items.Add(new Permission(Permissions.Settings.CreatePlugin, "@settings.plugins.create.name", "@settings.plugins.create.text", PermissionValueType.ReadWrite));
+
+      result.Add(permissionSettings);
+
+      return result;
+    }
   }
 
 
   public interface IPermissionsApi
   {
-    
+    /// <summary>
+    /// Get all available permissions to choose from
+    /// </summary>
+    IList<PermissionCollection> GetAll();
   }
 }
diff --git a/zero.Core/Api/SpacesApi.cs b/zero.Core/Api/SpacesApi.cs
index c094bd7f..d59adfc6 100644
--- a/zero.Core/Api/SpacesApi.cs
+++ b/zero.Core/Api/SpacesApi.cs
@@ -17,12 +17,15 @@ namespace zero.Core.Api
   {
     protected IDocumentStore Raven { get; private set; }
 
+    protected IPermissionsApi PermissionsApi { get; private set; }
+
     protected ZeroOptions Options { get; private set; }
 
 
-    public SpacesApi(IDocumentStore raven, IOptionsMonitor<ZeroOptions> options)
+    public SpacesApi(IDocumentStore raven, IPermissionsApi permissionsApi, IOptionsMonitor<ZeroOptions> options)
     {
       Raven = raven;
+      PermissionsApi = permissionsApi;
       Options = options.CurrentValue;
     }
 
diff --git a/zero.Core/Api/UserApi.cs b/zero.Core/Api/UserApi.cs
index 1f7b08a4..f3b37672 100644
--- a/zero.Core/Api/UserApi.cs
+++ b/zero.Core/Api/UserApi.cs
@@ -79,6 +79,15 @@ namespace zero.Core.Api
     }
 
 
+    /// <inheritdoc />
+    public Permission GetPermission(string key = null)
+    {
+      Claim claim = Principal.Claims.FirstOrDefault(claim => claim.Type == Constants.Auth.Claims.Permission && claim.Value.StartsWith(key + ":"));
+
+      return Permission.FromClaim(claim);
+    }
+
+
     /// <inheritdoc />
     public async Task<IList<User>> GetAll(string appId = null)
     {
@@ -138,6 +147,11 @@ namespace zero.Core.Api
     /// </summary>
     IList<Permission> GetPermissions(string prefix = null);
 
+    /// <summary>
+    /// Get a single permissions by key
+    /// </summary>
+    public Permission GetPermission(string key = null);
+
     /// <summary>
     /// Get all users for the selected application
     /// </summary>
diff --git a/zero.Core/Identity/Permission.cs b/zero.Core/Identity/Permission.cs
index 21ef61f5..6d2a75c9 100644
--- a/zero.Core/Identity/Permission.cs
+++ b/zero.Core/Identity/Permission.cs
@@ -104,6 +104,10 @@ namespace zero.Core.Identity
     /// </summary>
     public static Permission FromClaim(Claim claim, string prefixToRemove = null)
     {
+      if (claim == null)
+      {
+        return null;
+      }
       return FromClaim(claim.Value, prefixToRemove);
     }
 
diff --git a/zero.Core/Identity/Permissions.cs b/zero.Core/Identity/Permissions.cs
index 81383856..c40ce291 100644
--- a/zero.Core/Identity/Permissions.cs
+++ b/zero.Core/Identity/Permissions.cs
@@ -33,6 +33,12 @@
       public const string Media = PREFIX + Constants.Sections.Media;
       public const string Settings = PREFIX + Constants.Sections.Settings;
     }
+
+
+    public struct Spaces
+    {
+      public const string PREFIX = "space.";
+    }
   }
 
 
diff --git a/zero.Web/App/Components/Tabs/tabs.vue b/zero.Web/App/Components/Tabs/tabs.vue
index b12a3d44..5798271e 100644
--- a/zero.Web/App/Components/Tabs/tabs.vue
+++ b/zero.Web/App/Components/Tabs/tabs.vue
@@ -114,7 +114,7 @@
     position: relative;
     transition: color 0.2s ease;
     border-radius: var(--radius) var(--radius) 0 0;
-    background: var(--color-bg);
+    background: rgba(white, 0.4);
 
     .theme-dark &
     {
diff --git a/zero.Web/App/Pages/settings/role.vue b/zero.Web/App/Pages/settings/role.vue
index af4ba367..f11d11e9 100644
--- a/zero.Web/App/Pages/settings/role.vue
+++ b/zero.Web/App/Pages/settings/role.vue
@@ -38,7 +38,7 @@
         </aside>
       </ui-tab>
 
-      <ui-tab label="Permissions">
+      <ui-tab label="Permissions" :count="claimCount">
         <ui-permissions v-model="model.claims" :disabled="disabled" />
       </ui-tab>
     </ui-tabs>
@@ -47,6 +47,7 @@
 
 
 <script>
+  import { filter as _filter } from 'underscore';
   import UserRolesApi from 'zero/resources/userRoles';
   import Overlay from 'zero/services/overlay.js';
 
@@ -59,7 +60,8 @@
       actions: [],
       model: {
         name: null,
-        email: null
+        email: null,
+        claims: []
       },
       disabled: false
     }),
@@ -73,6 +75,17 @@
       });
     },
 
+    computed: {
+      claimCount()
+      {
+        return _filter(this.model.claims, claim =>
+        {
+          const value = claim.value.split(':')[1];
+          return value !== 'none' && value !== 'false' && !!value;
+        }).length;
+      }
+    },
+
 
     beforeRouteLeave(to, from, next) 
     {
diff --git a/zero.Web/App/Services/auth.js b/zero.Web/App/Services/auth.js
index 758ec9d8..6ed618ab 100644
--- a/zero.Web/App/Services/auth.js
+++ b/zero.Web/App/Services/auth.js
@@ -55,7 +55,6 @@ export default new Vue({
     {
       return Axios.post('authentication/loginUser', model).then(res =>
       {
-        console.info(res);
         return new Promise((resolve, reject) =>
         {
           if (res.data.success)
diff --git a/zero.Web/Controllers/SpacesController.cs b/zero.Web/Controllers/SpacesController.cs
index 7903f4cb..cf1523d5 100644
--- a/zero.Web/Controllers/SpacesController.cs
+++ b/zero.Web/Controllers/SpacesController.cs
@@ -1,6 +1,8 @@
 using Microsoft.AspNetCore.Mvc;
 using Newtonsoft.Json;
+using System.Collections.Generic;
 using System.IO;
+using System.Linq;
 using System.Text;
 using System.Threading.Tasks;
 using zero.Core;
@@ -19,9 +21,12 @@ namespace zero.Web.Controllers
   {
     private ISpacesApi Api { get; set; }
 
-    public SpacesController(IZeroConfiguration config, ISpacesApi api, IMapper mapper, IToken token) : base(config, mapper, token)
+    private IUserApi UserApi { get; set; }
+
+    public SpacesController(IZeroConfiguration config, ISpacesApi api, IUserApi userApi, IMapper mapper, IToken token) : base(config, mapper, token)
     {
       Api = api;
+      UserApi = userApi;
     }
 
 
@@ -30,6 +35,11 @@ namespace zero.Web.Controllers
     /// </summary>
     public IActionResult GetByAlias([FromQuery] string alias)
     {
+      if (!CanReadSpace(alias))
+      {
+        return new StatusCodeResult(403);
+      }
+
       return Json(Api.GetByAlias(alias));
     }
 
@@ -39,7 +49,8 @@ namespace zero.Web.Controllers
     /// </summary>
     public IActionResult GetAll()
     {
-      return Json(Api.GetAll());
+      IList<Space> spaces = Api.GetAll().Where(space => CanReadSpace(space.Alias)).ToList();
+      return Json(spaces);
     }
 
 
@@ -48,6 +59,11 @@ namespace zero.Web.Controllers
     /// </summary>    
     public async Task<IActionResult> GetList([FromQuery] string alias, [FromQuery] ListQuery<SpaceContent> query = null)
     {
+      if (!CanReadSpace(alias))
+      {
+        return new StatusCodeResult(403);
+      }
+
       return Json(await Api.GetListByQuery(alias, query));
     }
 
@@ -57,6 +73,11 @@ namespace zero.Web.Controllers
     /// </summary>    
     public async Task<IActionResult> GetContent([FromQuery] string alias, [FromQuery] string contentId = null)
     {
+      if (!CanReadSpace(alias))
+      {
+        return new StatusCodeResult(403);
+      }
+
       TeamMember model = new TeamMember();
 
       if (!contentId.IsNullOrEmpty())
@@ -82,6 +103,11 @@ namespace zero.Web.Controllers
     /// </summary>
     public async Task<IActionResult> Save([FromBody] SpaceContentEditModel model)
     {
+      if (!CanWriteSpace(model.Alias))
+      {
+        return new StatusCodeResult(403);
+      }
+
       return Json(await Api.Save(model.Alias, model.Model));
     }
 
@@ -91,7 +117,32 @@ namespace zero.Web.Controllers
     /// </summary>
     public async Task<IActionResult> Delete([FromQuery] string alias, [FromQuery] string id)
     {
+      if (!CanWriteSpace(alias))
+      {
+        return new StatusCodeResult(403);
+      }
+
       return Json(await Api.Delete(alias, id));
     }
+
+
+    /// <summary>
+    /// Whether the current user can read a space
+    /// </summary>
+    bool CanReadSpace(string alias)
+    {
+      Permission permission = UserApi.GetPermission(Permissions.Spaces.PREFIX + alias);
+      return permission != null && permission.CanRead;
+    }
+
+
+    /// <summary>
+    /// Whether the current user can read a space
+    /// </summary>
+    bool CanWriteSpace(string alias)
+    {
+      Permission permission = UserApi.GetPermission(Permissions.Spaces.PREFIX + alias);
+      return permission != null && permission.CanWrite;
+    }
   }
 }
diff --git a/zero.Web/Controllers/UserRolesController.cs b/zero.Web/Controllers/UserRolesController.cs
index ce9c05b6..089da538 100644
--- a/zero.Web/Controllers/UserRolesController.cs
+++ b/zero.Web/Controllers/UserRolesController.cs
@@ -16,12 +16,15 @@ namespace zero.Web.Controllers
   {
     private IUserRolesApi Api { get; set; }
 
+    private IPermissionsApi PermissionsApi { get; set; }
+
     private ZeroOptions Options { get; set; }
 
 
-    public UserRolesController(IZeroConfiguration config, IUserRolesApi api, IMapper mapper, IToken token, IOptionsMonitor<ZeroOptions> options) : base(config, mapper, token)
+    public UserRolesController(IZeroConfiguration config, IUserRolesApi api, IPermissionsApi permissionsApi, IMapper mapper, IToken token, IOptionsMonitor<ZeroOptions> options) : base(config, mapper, token)
     {
       Api = api;
+      PermissionsApi = permissionsApi;
       Options = options.CurrentValue;
     }
 
@@ -49,7 +52,7 @@ namespace zero.Web.Controllers
     /// </summary>    
     public IActionResult GetAllPermissions()
     {
-      return Json(Options.Authorization.Permissions);
+      return Json(PermissionsApi.GetAll());
     }
 
 
diff --git a/zero.Web/Resources/Localization/zero.en-us.json b/zero.Web/Resources/Localization/zero.en-us.json
index c29a52f2..92488b2f 100644
--- a/zero.Web/Resources/Localization/zero.en-us.json
+++ b/zero.Web/Resources/Localization/zero.en-us.json
@@ -168,7 +168,9 @@
       "sections": "Access to sections",
       "sections_description": "Allow access to the following sections",
       "settings": "Access to settings",
-      "settings_description": "Define read and write access for settings areas"
+      "settings_description": "Define read and write access for settings areas",
+      "spaces": "Access to spaces",
+      "spaces_description": "Granular control of spaces"
     }
   },
 
diff --git a/zero.Web/Startup.cs b/zero.Web/Startup.cs
index 6117d968..396989c5 100644
--- a/zero.Web/Startup.cs
+++ b/zero.Web/Startup.cs
@@ -166,6 +166,7 @@ namespace zero.Web
       services.AddTransient<ISpacesApi, SpacesApi>();
       services.AddTransient<ITranslationsApi, TranslationsApi>();
       services.AddTransient<ILanguagesApi, LanguagesApi>();
+      services.AddTransient<IPermissionsApi, PermissionsApi>();
     }
 
     /// <summary>
diff --git a/zero.Web/ZeroBuilder.cs b/zero.Web/ZeroBuilder.cs
index 904df7b7..b0dc9057 100644
--- a/zero.Web/ZeroBuilder.cs
+++ b/zero.Web/ZeroBuilder.cs
@@ -115,37 +115,6 @@ namespace zero.Web
 
       opts.SettingsAreas.Add(systemSettings);
       opts.SettingsAreas.Add(pluginSettings);
-
-      PermissionCollection permissionSettings = new PermissionCollection()
-      {
-        Label = "@permission.collections.settings",
-        Description = "@permission.collections.settings_description"
-      };
-
-      permissionSettings.Items.Add(new Permission(Permissions.Settings.Updates, "@settings.system.updates.name", "@settings.system.updates.text_default", PermissionValueType.ReadWrite));
-      permissionSettings.Items.Add(new Permission(Permissions.Settings.Applications, "@settings.system.applications.name", "@settings.system.applications.text", PermissionValueType.ReadWrite));
-      permissionSettings.Items.Add(new Permission(Permissions.Settings.Users, "@settings.system.users.name", "@settings.system.users.text", PermissionValueType.ReadWrite));
-      permissionSettings.Items.Add(new Permission(Permissions.Settings.Languages, "@settings.system.languages.name", "@settings.system.languages.text", PermissionValueType.ReadWrite));
-      permissionSettings.Items.Add(new Permission(Permissions.Settings.Countries, "@settings.system.countries.name", "@settings.system.countries.text", PermissionValueType.ReadWrite));
-      permissionSettings.Items.Add(new Permission(Permissions.Settings.Translations, "@settings.system.translations.name", "@settings.system.translations.text", PermissionValueType.ReadWrite));
-      permissionSettings.Items.Add(new Permission(Permissions.Settings.Logging, "@settings.system.logs.name", "@settings.system.logs.text", PermissionValueType.ReadWrite));
-      permissionSettings.Items.Add(new Permission(Permissions.Settings.Plugins, "@settings.plugins.installed.name", "@settings.plugins.installed.text_default", PermissionValueType.ReadWrite));
-      permissionSettings.Items.Add(new Permission(Permissions.Settings.CreatePlugin, "@settings.plugins.create.name", "@settings.plugins.create.text", PermissionValueType.ReadWrite));
-
-      PermissionCollection permissionSections = new PermissionCollection()
-      {
-        Label = "@permission.collections.sections",
-        Description = "@permission.collections.sections_description"
-      };
-
-      permissionSections.Items.Add(new Permission(Permissions.Sections.Dashboard, "@sections.item.dashboard", null, PermissionValueType.Boolean));
-      permissionSections.Items.Add(new Permission(Permissions.Sections.Pages, "@sections.item.pages", null, PermissionValueType.Boolean));
-      permissionSections.Items.Add(new Permission(Permissions.Sections.Spaces, "@sections.item.spaces", null, PermissionValueType.Boolean));
-      permissionSections.Items.Add(new Permission(Permissions.Sections.Media, "@sections.item.media", null, PermissionValueType.Boolean));
-      permissionSections.Items.Add(new Permission(Permissions.Sections.Settings, "@sections.item.settings", null, PermissionValueType.Boolean));
-
-      opts.Authorization.Permissions.Add(permissionSections);
-      opts.Authorization.Permissions.Add(permissionSettings);
     }