diff --git a/app/controllers/admin/admin_invitations_controller.rb b/app/controllers/admin/admin_invitations_controller.rb
index 438eaed355f..7ff8181d40d 100644
--- a/app/controllers/admin/admin_invitations_controller.rb
+++ b/app/controllers/admin/admin_invitations_controller.rb
@@ -1,19 +1,19 @@
 class Admin::AdminInvitationsController < Admin::BaseController
-
   def index
+    authorize Invitation
   end
 
   def create
-    @invitation = current_admin.invitations.new(invitation_params)
+    @invitation = authorize current_admin.invitations.new(invitation_params)
 
     if @invitation.invitee_email.blank?
-      flash[:error] = t('no_email', default: "Please enter an email address.")
-      render action: 'index'
+      flash[:error] = t(".no_email")
+      render :index
     elsif @invitation.save
-      flash[:notice] = t('sent', default: "An invitation was sent to %{email_address}", email_address: @invitation.invitee_email)
+      flash[:notice] = t(".sent", email_address: @invitation.invitee_email)
       redirect_to admin_invitations_path
     else
-      render action: 'index'
+      render :index
     end
   end
 
@@ -35,7 +35,7 @@ def grant_invites_to_users
     else
       Invitation.grant_empty(invitation_params[:number_of_invites].to_i)
     end
-    flash[:notice] = t('invites_created', default: 'Invitations successfully created.')
+    flash[:notice] = t(".invites_created")
     redirect_to admin_invitations_path
   end
 
diff --git a/app/policies/invitation_policy.rb b/app/policies/invitation_policy.rb
index 7f82d371a8a..1542ec95caf 100644
--- a/app/policies/invitation_policy.rb
+++ b/app/policies/invitation_policy.rb
@@ -1,6 +1,7 @@
 class InvitationPolicy < ApplicationPolicy
   EXTRA_INFO_ROLES = %w[superadmin open_doors policy_and_abuse support tag_wrangling].freeze
   FIND_ROLES = %w[superadmin open_doors policy_and_abuse support].freeze
+  CREATE_ROLES = %w[superadmin policy_and_abuse support tag_wrangling].freeze
   INVITE_FROM_QUEUE_ROLES = %w[superadmin policy_and_abuse].freeze
   INVITE_ALL_ROLES = %w[superadmin].freeze
 
@@ -8,6 +9,14 @@ def access_invitee_details?
     user_has_roles?(EXTRA_INFO_ROLES)
   end
 
+  def index?
+    user_has_roles?(FIND_ROLES | CREATE_ROLES)
+  end
+
+  def create?
+    user_has_roles?(CREATE_ROLES)
+  end
+
   def find?
     user_has_roles?(FIND_ROLES)
   end
diff --git a/app/views/admin/_header.html.erb b/app/views/admin/_header.html.erb
index 8c4e3fc15d5..bf8c40c2e96 100644
--- a/app/views/admin/_header.html.erb
+++ b/app/views/admin/_header.html.erb
@@ -10,18 +10,20 @@
       </li>
     <% end %>
 
-    <li class="dropdown">
-      <%= link_to t(".nav.invitations.invitations"), admin_invitations_path %>
-      <ul class="menu">
-        <li><%= link_to t(".nav.invitations.new"), admin_invitations_path %></li>
-        <% if policy(UserInviteRequest).index? %>
-          <li><%= link_to t(".nav.invitations.requests"), user_invite_requests_path %></li>
-        <% end %>
-        <% if policy(InviteRequest).can_manage? %>
-          <li><%= link_to t(".nav.invitations.queue"), manage_invite_requests_path %></li>
-        <% end %>
-      </ul>
-    </li>
+    <% if policy(Invitation).index? %>
+      <li class="dropdown">
+        <%= link_to t(".nav.invitations.invitations"), admin_invitations_path %>
+        <ul class="menu">
+          <li><%= link_to t(".nav.invitations.new"), admin_invitations_path %></li>
+          <% if policy(UserInviteRequest).index? %>
+            <li><%= link_to t(".nav.invitations.requests"), user_invite_requests_path %></li>
+          <% end %>
+          <% if policy(InviteRequest).can_manage? %>
+            <li><%= link_to t(".nav.invitations.queue"), manage_invite_requests_path %></li>
+          <% end %>
+        </ul>
+      </li>
+    <% end %>
     <li class="dropdown">
       <%= link_to t(".nav.posts.admin_posts"), admin_posts_path %>
       <ul class="menu">
diff --git a/app/views/admin/admin_invitations/index.html.erb b/app/views/admin/admin_invitations/index.html.erb
index 9b9ab6df22e..c0e5037c383 100644
--- a/app/views/admin/admin_invitations/index.html.erb
+++ b/app/views/admin/admin_invitations/index.html.erb
@@ -33,17 +33,19 @@
   <% end %>
 <% end %>
 
-<%= form_tag url_for(controller: "admin/admin_invitations", action: :create), class: "invitation simple post", autocomplete: "off" do %>
-  <fieldset class="simple">
-    <h3 class="heading"><%= t(".send_to_email.heading") %></h3>
-    <p>
-      <%= t(".send_to_email.description") %>
-      <%= text_field_tag "invitation[invitee_email]",
-            (@invitation.try(:invitee_email) || ""),
-            title: t(".send_to_email.invite_by_email_title") %>
-      <span class="submit actions"><%= submit_tag t(".send_to_email.invite_user") %></span>
-    </p>
-  </fieldset>
+<% if policy(Invitation).create? %>
+  <%= form_tag url_for(controller: "admin/admin_invitations", action: :create), class: "invitation simple post", autocomplete: "off" do %>
+    <fieldset class="simple">
+      <h3 class="heading"><%= t(".send_to_email.heading") %></h3>
+      <p>
+        <%= t(".send_to_email.description") %>
+        <%= text_field_tag "invitation[invitee_email]",
+              (@invitation.try(:invitee_email) || ""),
+              title: t(".send_to_email.invite_by_email_title") %>
+        <span class="submit actions"><%= submit_tag t(".send_to_email.invite_user") %></span>
+      </p>
+    </fieldset>
+  <% end %>
 <% end %>
 
 <% if policy(Invitation).invite_from_queue? %>
diff --git a/config/i18n-tasks.yml b/config/i18n-tasks.yml
index ebef5870dd1..075ab027ea3 100644
--- a/config/i18n-tasks.yml
+++ b/config/i18n-tasks.yml
@@ -127,10 +127,6 @@ ignore_missing:
   - comments.set_page_subtitle.page_title
   ## All of the following keys are using default values defined in the respective .rb files
   ## TODO: Move the default values to the .yml files
-  # File: app/controllers/admin/admin_invitations_controller.rb
-  - invites_created # should be admin.admin_invitations.grant_invites_to_users.invites_created
-  - no_email # should be admin.admin_invitations.create.no_email
-  - sent # should be admin.admin_invitations.create.sent
   # File: app/controllers/challenge_assignments_controller.rb
   - challenge_assignments.assignments_not_sent
   - challenge_assignments.assignments_sent
@@ -163,8 +159,6 @@ ignore_missing:
   - skins.approval_queue
   - skins.approved_skins
   - skins.rejected_skins
-  # File: app/views/comments/show.html.erb
-  - comments.show.comment_on
   # File: app/views/external_authors/_external_author_name.html.erb
   - external_authors.external_author_name.label_external_author_name
   # File: app/views/external_authors/edit.html.erb
diff --git a/config/locales/controllers/en.yml b/config/locales/controllers/en.yml
index 81045b7d7a9..dfc70764d1b 100644
--- a/config/locales/controllers/en.yml
+++ b/config/locales/controllers/en.yml
@@ -6,8 +6,13 @@ en:
       not_admin_denied: Please log in as admin
       page_access_denied: Sorry, only an authorized admin can access the page you were trying to reach.
     admin_invitations:
+      create:
+        no_email: Please enter an email address.
+        sent: An invitation was sent to %{email_address}
       find:
         user_not_found: No results were found. Try another search.
+      grant_invites_to_users:
+        invites_created: Invitations successfully created.
       invite_from_queue:
         success:
           one: "%{count} person from the invite queue is being invited."
diff --git a/features/admins/admin_invitations.feature b/features/admins/admin_invitations.feature
index 55c141bbbbb..5a7e157760f 100644
--- a/features/admins/admin_invitations.feature
+++ b/features/admins/admin_invitations.feature
@@ -254,8 +254,13 @@ Feature: Admin Actions to Manage Invitations
       And I should not see "Create an Account!"
       And I should not see "Joining the Archive currently requires an invitation; however, we are not accepting new invitation requests at this time."
 
-  Scenario: An admin can send an invitation to a user via email
+  Scenario: An admin without a role has no Invitations entry in the admin header
     Given I am logged in as an admin
+    Then I should not see "Invite New Users"
+      And I should not see "Invitations"
+
+  Scenario: An admin can send an invitation to a user via email
+    Given I am logged in as a "tag_wrangling" admin
       And all emails have been delivered
     When I follow "Invite New Users"
       And I fill in "invitation[invitee_email]" with "fred@bedrock.com"
@@ -264,7 +269,7 @@ Feature: Admin Actions to Manage Invitations
       And 1 email should be delivered
 
   Scenario: An admin can't create an invite with invalid email
-    Given I am logged in as an admin
+    Given I am logged in as a "tag_wrangling" admin
       And all emails have been delivered
     When I follow "Invite New Users"
       And I fill in "invitation[invitee_email]" with "abcdefgh"
@@ -273,7 +278,7 @@ Feature: Admin Actions to Manage Invitations
       And 0 emails should be delivered
 
   Scenario: An admin can't create an invite without an email address.
-    Given I am logged in as an admin
+    Given I am logged in as a "tag_wrangling" admin
       And all emails have been delivered
     When I follow "Invite New Users"
       And I press "Invite user"
diff --git a/spec/controllers/admin/admin_invitations_controller_spec.rb b/spec/controllers/admin/admin_invitations_controller_spec.rb
index bb87ccf69ca..4c3b3df00de 100644
--- a/spec/controllers/admin/admin_invitations_controller_spec.rb
+++ b/spec/controllers/admin/admin_invitations_controller_spec.rb
@@ -6,40 +6,41 @@
   include LoginMacros
   include RedirectExpectationHelper
 
+  index_roles = %w[superadmin open_doors policy_and_abuse support tag_wrangling].freeze
+
   describe "GET #index" do
-    let(:admin) { create(:admin) }
+    subject { get :index }
+    let(:success) do
+      expect(response).to have_http_status(:success)
+      expect(response).to render_template("index")
+    end
+
+    it_behaves_like "an action only authorized admins can access", authorized_roles: index_roles
 
     it "denies non-admins access to index" do
       fake_login
-      get :index
-      it_redirects_to_with_notice(root_path, "I'm sorry, only an admin can look at that area")
-    end
+      subject
 
-    it "allows admins to access index" do
-      fake_login_admin(admin)
-      get :index
-      expect(response).to have_http_status(:success)
+      it_redirects_to_with_notice(root_path, "I'm sorry, only an admin can look at that area")
     end
   end
 
+  create_roles = %w[superadmin policy_and_abuse support tag_wrangling].freeze
+
   describe "POST #create" do
-    let(:admin) { create(:admin) }
+    subject { post :create, params: { invitation: { invitee_email: "test_email@example.com" } } }
+    let(:success) do
+      it_redirects_to_with_notice(admin_invitations_path, "An invitation was sent to test_email@example.com")
+    end
+
+    it_behaves_like "an action only authorized admins can access", authorized_roles: create_roles
 
     it "does not allow non-admins to create invites" do
-      email = "test_email@example.com"
       fake_login
-      post :create, params: { invitation: { invitee_email: email } }
+      subject
 
       it_redirects_to_with_notice(root_path, "I'm sorry, only an admin can look at that area")
     end
-
-    it "allows admins to create invites" do
-      email = "test_email@example.com"
-      fake_login_admin(admin)
-      post :create, params: { invitation: { invitee_email: email } }
-
-      it_redirects_to_with_notice(admin_invitations_path, "An invitation was sent to #{email}")
-    end
   end
 
   invite_from_queue_roles = %w[superadmin policy_and_abuse].freeze