diff --git a/ui/packages/consul-ui/app/abilities/operator.js b/ui/packages/consul-ui/app/abilities/operator.js
new file mode 100644
index 0000000000..4cec68fad7
--- /dev/null
+++ b/ui/packages/consul-ui/app/abilities/operator.js
@@ -0,0 +1,10 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import BaseAbility from './base';
+
+export default class OperatorAbility extends BaseAbility {
+  resource = 'operator';
+}
diff --git a/ui/packages/consul-ui/app/services/hcp-link-status.js b/ui/packages/consul-ui/app/services/hcp-link-status.js
index 4fec7f5bab..6eaa932f10 100644
--- a/ui/packages/consul-ui/app/services/hcp-link-status.js
+++ b/ui/packages/consul-ui/app/services/hcp-link-status.js
@@ -3,19 +3,24 @@
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Service from '@ember/service';
+import Service, { inject as service } from '@ember/service';
 import { tracked } from '@glimmer/tracking';
 
 const LOCAL_STORAGE_KEY = 'consul:hideHcpLinkBanner';
 
 export default class HcpLinkStatus extends Service {
+  @service abilities;
   @tracked
   alreadyLinked = false;
   @tracked
   userDismissedBanner = false;
 
   get shouldDisplayBanner() {
-    return !this.alreadyLinked && !this.userDismissedBanner;
+    return !this.alreadyLinked && !this.userDismissedBanner && this.hasPermissionToLink;
+  }
+
+  get hasPermissionToLink() {
+    return this.abilities.can('write operators') && this.abilities.can('write acls');
   }
 
   constructor() {