diff --git a/uma-server-webapp/src/main/webapp/resources/js/admin.js b/uma-server-webapp/src/main/webapp/resources/js/admin.js
index a23fe3fb9..3637b1091 100644
--- a/uma-server-webapp/src/main/webapp/resources/js/admin.js
+++ b/uma-server-webapp/src/main/webapp/resources/js/admin.js
@@ -1109,13 +1109,15 @@ var AppRouter = Backbone.Router.extend({
     	this.updateSidebar('user/policy');
     	
     	var rs = this.resourceSetList.get(rsid);
+    	var policies = null;
     	if (rs == null) {
     		// need to load it directly
-    		var policies = new PolicyCollection([], {rsid: rsid});
+    		policies = new PolicyCollection([], {rsid: rsid});
+    		rs = new ResourceSetModel({id: rsid});
     	} else {
     		// the resource set is loaded, preload the claims
-    		var policies = new PolicyCollection(rs.get('policies'), {rsid: rsid});
-    		policy.isFetched = true;
+    		policies = new PolicyCollection(rs.get('policies'), {rsid: rsid});
+    		policies.isFetched = true;
     	}
     	
     	var view = new PolicyListView({model: policies, rs: rs, systemScopeList: this.systemScopeList});
diff --git a/uma-server-webapp/src/main/webapp/resources/js/policy.js b/uma-server-webapp/src/main/webapp/resources/js/policy.js
index 7d56ef8d8..1550aa0e6 100644
--- a/uma-server-webapp/src/main/webapp/resources/js/policy.js
+++ b/uma-server-webapp/src/main/webapp/resources/js/policy.js
@@ -16,17 +16,17 @@
  *******************************************************************************/
 
 var ResourceSetModel = Backbone.Model.extend({
-	
+	urlRoot: 'api/resourceset'
 });
 
 var ResourceSetCollection = Backbone.Collection.extend({
 	model: ResourceSetModel,
-	url: 'api/policy'
+	url: 'api/resourceset'
 });
 
 var PolicyModel = Backbone.Model.extend({
 	urlRoot: function() {
-		return 'api/policy/' + this.options.rsid + '/';
+		return 'api/resourceset/' + this.options.rsid + '/policy/';
 	},
 	initialize: function(model, options) {
 		this.options = options;
@@ -36,7 +36,7 @@ var PolicyModel = Backbone.Model.extend({
 var PolicyCollection = Backbone.Collection.extend({
 	model: PolicyModel,
 	url: function() {
-		return 'api/policy/' + this.options.rsid;
+		return 'api/resourceset/' + this.options.rsid + '/policy/';
 	},
 	initialize: function(models, options) {
 		this.options = options;
@@ -352,6 +352,11 @@ var PolicyView = Backbone.View.extend({
 			this.template = _.template($('#tmpl-policy').html());
 		}
 
+		if (!this.scopeTemplate) {
+        	this.scopeTemplate = _.template($('#tmpl-scope-list').html());
+        }
+
+
 	},
 	
 	events:{
@@ -448,8 +453,9 @@ var PolicyFormView = Backbone.View.extend({
 
     render:function (eventName) {
 		var json = this.model.toJSON();
+		var rs = this.options.rs.toJSON();
 		
-		this.$el.html(this.template({policy: json, rs: this.options.rs}));
+		this.$el.html(this.template({policy: json, rs: rs}));
 		
 		return this;
 	}
diff --git a/uma-server-webapp/src/main/webapp/resources/template/policy.html b/uma-server-webapp/src/main/webapp/resources/template/policy.html
index 45b83a6aa..a12320066 100644
--- a/uma-server-webapp/src/main/webapp/resources/template/policy.html
+++ b/uma-server-webapp/src/main/webapp/resources/template/policy.html
@@ -163,6 +163,7 @@
             <div class="control-group" id="scopes">
                 <label class="control-label" data-i18n="common.scope">Scopes</label>
                 <div class="controls">
+					<% console.log(rs); console.log(policy); %>
 					<% _.each(rs.scopes, function(scope) { %>
                     <div>
                         <input type="checkbox"
diff --git a/uma-server/src/main/java/org/mitre/uma/web/PolicyAPI.java b/uma-server/src/main/java/org/mitre/uma/web/PolicyAPI.java
index 03862397e..7896c1427 100644
--- a/uma-server/src/main/java/org/mitre/uma/web/PolicyAPI.java
+++ b/uma-server/src/main/java/org/mitre/uma/web/PolicyAPI.java
@@ -60,7 +60,8 @@ public class PolicyAPI {
 	// Logger for this class
 	private static final Logger logger = LoggerFactory.getLogger(PolicyAPI.class);
 	
-	public static final String URL = RootController.API_URL + "/policy";
+	public static final String URL = RootController.API_URL + "/resourceset";
+	public static final String POLICYURL = "/policy";
 	
 	private Gson gson = new Gson();
 	
@@ -91,6 +92,36 @@ public class PolicyAPI {
 	 * @return
 	 */
 	@RequestMapping(value = "/{rsid}", method = RequestMethod.GET, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+	public String getResourceSet(@PathVariable (value = "rsid") Long rsid, Model m, Authentication auth) {
+		
+		ResourceSet rs = resourceSetService.getById(rsid);
+
+		if (rs == null) {
+			m.addAttribute(HttpCodeView.CODE, HttpStatus.NOT_FOUND);
+			return HttpCodeView.VIEWNAME;
+		}
+		
+		if (!rs.getOwner().equals(auth.getName())) {
+			logger.warn("Unauthorized resource set request from bad user; expected " + rs.getOwner() + " got " + auth.getName());
+
+			// authenticated user didn't match the owner of the resource set
+			m.addAttribute(HttpCodeView.CODE, HttpStatus.FORBIDDEN);
+			return HttpCodeView.VIEWNAME;
+		}
+				
+		m.addAttribute(JsonEntityView.ENTITY, rs);
+		
+		return JsonEntityView.VIEWNAME;
+	}
+	
+	/**
+	 * List all the policies for the given resource set
+	 * @param rsid
+	 * @param m
+	 * @param auth
+	 * @return
+	 */
+	@RequestMapping(value = "/{rsid}" + POLICYURL, method = RequestMethod.GET, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
 	public String getPoliciesForResourceSet(@PathVariable (value = "rsid") Long rsid, Model m, Authentication auth) {
 		
 		ResourceSet rs = resourceSetService.getById(rsid);
@@ -120,7 +151,7 @@ public class PolicyAPI {
 	 * @param auth
 	 * @return
 	 */
-	@RequestMapping(value = "/{rsid}", method = RequestMethod.POST, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+	@RequestMapping(value = "/{rsid}" + POLICYURL, method = RequestMethod.POST, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
 	public String createNewPolicyForResourceSet(@PathVariable (value = "rsid") Long rsid, @RequestBody String jsonString, Model m, Authentication auth) {
 		ResourceSet rs = resourceSetService.getById(rsid);
 
@@ -179,7 +210,7 @@ public class PolicyAPI {
 	 * @param auth
 	 * @return
 	 */
-	@RequestMapping(value = "/{rsid}/{pid}", method = RequestMethod.GET, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+	@RequestMapping(value = "/{rsid}" + POLICYURL + "/{pid}", method = RequestMethod.GET, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
 	public String getPolicy(@PathVariable (value = "rsid") Long rsid, @PathVariable (value = "pid") Long pid, Model m, Authentication auth) {
 		
 		ResourceSet rs = resourceSetService.getById(rsid);
@@ -219,7 +250,7 @@ public class PolicyAPI {
 	 * @param auth
 	 * @return
 	 */
-	@RequestMapping(value = "/{rsid}/{pid}", method = RequestMethod.PUT, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+	@RequestMapping(value = "/{rsid}" + POLICYURL + "/{pid}", method = RequestMethod.PUT, consumes = MimeTypeUtils.APPLICATION_JSON_VALUE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
 	public String setClaimsForResourceSet(@PathVariable (value = "rsid") Long rsid, @PathVariable (value = "pid") Long pid, @RequestBody String jsonString, Model m, Authentication auth) {
 
 		ResourceSet rs = resourceSetService.getById(rsid);
@@ -289,7 +320,7 @@ public class PolicyAPI {
 	 * @param auth
 	 * @return
 	 */
-	@RequestMapping(value = "/{rsid}/{pid}", method = RequestMethod.DELETE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+	@RequestMapping(value = "/{rsid}" + POLICYURL + "/{pid}", method = RequestMethod.DELETE, produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
 	public String deleteResourceSet(@PathVariable ("rsid") Long rsid, @PathVariable (value = "pid") Long pid, Model m, Authentication auth) {
 
 		ResourceSet rs = resourceSetService.getById(rsid);