diff --git a/classes/field_base.php b/classes/field_base.php
index 07d36f0..9773b86 100644
--- a/classes/field_base.php
+++ b/classes/field_base.php
@@ -337,6 +337,14 @@ protected function matches_internal($value) {
      * @param int $rulecount
      */
     public function add_form_field(MoodleQuickForm $mform, $values, $rulecount) {
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+
+        $selectattrs = ['class' => 'localprofile-value'];
+        if (!$canmanagerules) {
+            $selectattrs[] = 'disabled';
+        }
+
         $id = $this->get_form_id();
         $mform->addElement('hidden', "fieldid[$id]", $this->fieldid);
         $mform->setType("fieldid[$id]", PARAM_INT);
@@ -344,31 +352,32 @@ public function add_form_field(MoodleQuickForm $mform, $values, $rulecount) {
         $group = $this->add_form_field_internal($mform, $id);
         $valuelabel = html_writer::span(get_string('selectvalue', 'local_profilecohort'), 'localprofile-value');
         $group[] = $mform->createElement('static', "valuelabel[$id]", '', $valuelabel);
-        $group[] = $mform->createElement('select', "value[$id]", get_string('selectvalue', 'local_profilecohort'), $values,
-                                         ['class' => 'localprofile-value']);
+        $group[] = $mform->createElement('select', "value[$id]", get_string('selectvalue', 'local_profilecohort'), $values, $selectattrs);
         $mform->setDefault("value[$id]", $this->value);
 
         $prefix = '';
         if ($this->id) {
-            $group[] = $mform->createElement('static', '', '', '<br><span class="localprofile-rule-actions">');
-            if ($rulecount > 1) {
-                $moveopts = range(1, $rulecount);
-                $moveopts = array_combine($moveopts, $moveopts);
-                $group[] = $mform->createElement('static', "movelabel[$id]", '', get_string('moveto', 'local_profilecohort'));
-                $group[] = $mform->createElement('select', "moveto[$id]", get_string('moveto', 'local_profilecohort'), $moveopts,
-                                                 ['class' => 'moveto']);
-                $mform->setDefault("moveto[$id]", $this->formposition);
-                $group[] = $mform->createElement('static', '', '', '<br>');
-
-                $group[] = $mform->createElement('advcheckbox', "andnextrule[$id]", '',
-                                                 get_string('andnextrule', 'local_profilecohort'), ['class' => 'andnextrule']);
-                $mform->setDefault("andnextrule[$id]", $this->andnextrule);
-                $group[] = $mform->createElement('static', '', '', '<br>');
-            }
+            if ($canmanagerules) {
+                $group[] = $mform->createElement('static', '', '', '<br><span class="localprofile-rule-actions">');
+                if ($rulecount > 1) {
+                    $moveopts = range(1, $rulecount);
+                    $moveopts = array_combine($moveopts, $moveopts);
+                    $group[] = $mform->createElement('static', "movelabel[$id]", '', get_string('moveto', 'local_profilecohort'));
+                    $group[] = $mform->createElement('select', "moveto[$id]", get_string('moveto', 'local_profilecohort'), $moveopts,
+                                                    ['class' => 'moveto']);
+                    $mform->setDefault("moveto[$id]", $this->formposition);
+                    $group[] = $mform->createElement('static', '', '', '<br>');
+
+                    $group[] = $mform->createElement('advcheckbox', "andnextrule[$id]", '',
+                                                    get_string('andnextrule', 'local_profilecohort'), ['class' => 'andnextrule']);
+                    $mform->setDefault("andnextrule[$id]", $this->andnextrule);
+                    $group[] = $mform->createElement('static', '', '', '<br>');
+                }
 
-            $group[] = $mform->createElement('advcheckbox', "delete[$id]", '', get_string('delete', 'local_profilecohort'),
-                                             ['class' => 'deleterule']);
-            $group[] = $mform->createElement('static', '', '', '</span>');
+                $group[] = $mform->createElement('advcheckbox', "delete[$id]", '', get_string('delete', 'local_profilecohort'),
+                                                ['class' => 'deleterule']);
+                $group[] = $mform->createElement('static', '', '', '</span>');
+            }
 
             $prefix = '<span class="localprofile-number">'.$this->formposition.'</span>. ';
         }
diff --git a/classes/field_checkbox.php b/classes/field_checkbox.php
index e7283ec..7b30da4 100644
--- a/classes/field_checkbox.php
+++ b/classes/field_checkbox.php
@@ -54,8 +54,16 @@ protected function add_form_field_internal(MoodleQuickForm $mform, $id) {
             self::MATCH_NOTDEFINED => get_string('match_notdefined', 'local_profilecohort'),
         ];
 
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+        $selectattrs = [];
+
+        if (!$canmanagerules) {
+            $selectattrs[] = 'disabled';
+        }
+
         $label = $mform->createElement('static', "matchlabel[$id]", '', get_string('match_exact', 'local_profilecohort'));
-        $sel = $mform->createElement('select', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $opts);
+        $sel = $mform->createElement('select', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $opts, $selectattrs);
         $mform->setDefault("matchvalue[$id]", $matchvalue);
         return [$label, $sel];
     }
diff --git a/classes/field_menu.php b/classes/field_menu.php
index 5c54690..2d4558f 100644
--- a/classes/field_menu.php
+++ b/classes/field_menu.php
@@ -69,9 +69,17 @@ protected function add_form_field_internal(MoodleQuickForm $mform, $id) {
             $matchvalue = $this->matchtype;
         }
 
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+        $selectattrs = [];
+
+        if (!$canmanagerules) {
+            $selectattrs[] = 'disabled';
+        }
+
         $label = $mform->createElement('static', "matchlabel[$id]", '', get_string('match_exact', 'local_profilecohort'));
         $opts = [null => get_string('choosedots')] + $this->opts;
-        $sel = $mform->createElement('select', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $opts);
+        $sel = $mform->createElement('select', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $opts, $selectattrs);
         $mform->setType("matchvalue[$id]", PARAM_TEXT);
         $mform->setDefault("matchvalue[$id]", $matchvalue);
         return [$label, $sel];
diff --git a/classes/field_text.php b/classes/field_text.php
index a88e236..a042ef7 100644
--- a/classes/field_text.php
+++ b/classes/field_text.php
@@ -118,11 +118,20 @@ protected function add_form_field_internal(MoodleQuickForm $mform, $id) {
             $strmatchtype = 'match_'.str_replace('!', '', $matchtype);
             $matchopts[$matchtype] = get_string($strmatchtype, 'local_profilecohort');
         }
-        $type = $mform->createElement('select', "matchtype[$id]", get_string('matchtype', 'local_profilecohort'), $matchopts);
+
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+        $selectattrs = [];
+
+        if (!$canmanagerules) {
+            $selectattrs[] = 'disabled';
+        }
+
+        $type = $mform->createElement('select', "matchtype[$id]", get_string('matchtype', 'local_profilecohort'), $matchopts, $selectattrs);
         $mform->setType("matchtype[$id]", PARAM_TEXT);
         $mform->setDefault("matchtype[$id]", $this->matchtype);
 
-        $match = $mform->createElement('text', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'));
+        $match = $mform->createElement('text', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $selectattrs);
         $mform->setType("matchvalue[$id]", PARAM_TEXT);
         $mform->setDefault("matchvalue[$id]", $this->matchvalue);
         $mform->disabledIf("matchvalue[$id]", "matchtype[$id]", 'eq', self::MATCH_ISDEFINED);
diff --git a/classes/fields_form.php b/classes/fields_form.php
index c1b63b9..e7bef88 100644
--- a/classes/fields_form.php
+++ b/classes/fields_form.php
@@ -73,7 +73,13 @@ protected function definition() {
         foreach ($rules as $rule) {
             $rule->add_form_field($mform, $values, count($rules));
         }
-        $this->add_action_buttons();
+
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+
+        if ($canmanagerules) {
+            $this->add_action_buttons();
+        }
 
         $PAGE->requires->js_call_amd('local_profilecohort/reorder', 'init');
     }
diff --git a/classes/profilecohort.php b/classes/profilecohort.php
index a8b519a..cd4e8c8 100644
--- a/classes/profilecohort.php
+++ b/classes/profilecohort.php
@@ -71,6 +71,8 @@ public function output_form() {
         $out = '';
 
         if ($this->action == 'members') {
+            $context = \context_system::instance();
+            require_capability('local/profilecohort:seecohortmembers', $context);
             $out .= $this->output_members();
         } else {
             $out .= parent::output_form();
@@ -84,12 +86,20 @@ public function output_form() {
      * @return \tabobject[]
      */
     protected function extra_tabs() {
-        return [
-            new \tabobject('members', new \moodle_url($this->get_index_url(), ['action' => 'members']),
-                           get_string('members', 'local_profilecohort')),
-            new \tabobject('cohorts', new \moodle_url('/local/profilecohort/cohorts.php'),
-                           get_string('selectcohorts', 'local_profilecohort'))
-        ];
+        $tabs = [];
+        $context = \context_system::instance();
+
+        if (has_capability('local/profilecohort:seecohortmembers', $context)) {
+            $tabs[] = new \tabobject('members', new \moodle_url($this->get_index_url(), ['action' => 'members']),
+                                    get_string('members', 'local_profilecohort'));
+        }
+
+        if (has_capability('local/profilecohort:selectcohorts', $context)) {
+            $tabs[] = new \tabobject('cohorts', new \moodle_url('/local/profilecohort/cohorts.php'),
+                                    get_string('selectcohorts', 'local_profilecohort'));
+        }
+
+        return $tabs;
     }
 
     /**
diff --git a/classes/profilefields.php b/classes/profilefields.php
index 6737f55..b15f65b 100644
--- a/classes/profilefields.php
+++ b/classes/profilefields.php
@@ -105,6 +105,9 @@ public function process_form() {
 
         $addid = null;
         if ($this->action == 'add') {
+            $context = \context_system::instance();
+            require_capability('local/profilecohort:managerules', $context);
+
             // Add a new, empty, rule to the end of the list, if requested.
             if ($addid = optional_param('add', null, PARAM_INT)) {
                 $field = $DB->get_record('user_info_field', array('id' => $addid), 'id AS fieldid, name, datatype, param1',
@@ -247,10 +250,23 @@ protected function extra_tabs() {
      */
     protected function get_tabs() {
         $tabs = [];
-        $tabs[] = new \tabobject('view', new \moodle_url($this->get_index_url(), ['action' => 'view']),
-                                 get_string('viewrules', 'local_profilecohort'));
-        $tabs[] = new \tabobject('add', new \moodle_url($this->get_index_url(), ['action' => 'add']),
-                                 get_string('addrules', 'local_profilecohort'));
+        $context = \context_system::instance();
+
+        if (has_capability('local/profilecohort:viewrules', $context)) {
+            $title = get_string('viewrules', 'local_profilecohort');
+
+            if (has_capability('local/profilecohort:managerules', $context)) {
+                $title = get_string('vieweditrules', 'local_profilecohort');
+            }
+
+            $tabs[] = new \tabobject('view', new \moodle_url($this->get_index_url(), ['action' => 'view']), $title);
+        }
+
+        if (has_capability('local/profilecohort:managerules', $context)) {
+            $tabs[] = new \tabobject('add', new \moodle_url($this->get_index_url(), ['action' => 'add']),
+                                    get_string('addrules', 'local_profilecohort'));
+        }
+
         $tabs = array_merge($tabs, $this->extra_tabs());
 
         $tabtree = new \tabtree($tabs, $this->action);
diff --git a/cohorts.php b/cohorts.php
index 9583eca..4a7c942 100644
--- a/cohorts.php
+++ b/cohorts.php
@@ -27,6 +27,9 @@
 require(__DIR__ . '/../../config.php');
 require_once($CFG->libdir.'/adminlib.php');
 
+$context = \context_system::instance();
+require_capability('local/profilecohort:selectcohorts', $context);
+
 global $PAGE, $CFG, $OUTPUT;
 
 $url = new moodle_url('/local/profilecohort/cohorts.php');
diff --git a/db/access.php b/db/access.php
new file mode 100644
index 0000000..42042b4
--- /dev/null
+++ b/db/access.php
@@ -0,0 +1,67 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Local plugin "Profile field based cohort membership" - Plugin capabilities
+ *
+ * @package   local_profilecohort
+ * @copyright 2016 Davo Smith, Synergy Learning UK on behalf of Alexander Bias, Ulm University <alexander.bias@uni-ulm.de>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$capabilities = array(
+    'local/profilecohort:viewrules' => array(
+        'riskbitmask'  => RISK_PERSONAL,
+        'captype'      => 'read',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes'   => array(
+            'teacher'        => CAP_ALLOW,
+            'editingteacher' => CAP_ALLOW,
+            'manager'        => CAP_ALLOW
+        )
+    ),
+
+    'local/profilecohort:managerules' => array(
+        'riskbitmask'  => RISK_PERSONAL | RISK_DATALOSS,
+        'captype'      => 'write',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes'   => array(
+            'manager'  => CAP_ALLOW
+        )
+    ),
+
+    'local/profilecohort:seecohortmembers' => array(
+        'riskbitmask'  => RISK_PERSONAL,
+        'captype'      => 'read',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes'   => array(
+            'teacher'        => CAP_ALLOW,
+            'editingteacher' => CAP_ALLOW,
+            'manager'        => CAP_ALLOW
+        )
+    ),
+
+    'local/profilecohort:selectcohorts' => array(
+        'riskbitmask'  => RISK_PERSONAL | RISK_DATALOSS,
+        'captype'      => 'write',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes'   => array(
+            'manager'  => CAP_ALLOW
+        )
+    )
+);
diff --git a/lang/en/local_profilecohort.php b/lang/en/local_profilecohort.php
index 3f6fd35..656ea30 100644
--- a/lang/en/local_profilecohort.php
+++ b/lang/en/local_profilecohort.php
@@ -24,6 +24,11 @@
 
 defined('MOODLE_INTERNAL') || die();
 
+$string['profilecohort:viewrules'] = 'View cohort rules.';
+$string['profilecohort:managerules'] = 'Add, change and delete cohort rules.';
+$string['profilecohort:seecohortmembers'] = 'See the users who are currently members of the cohorts.';
+$string['profilecohort:selectcohorts'] = 'Select cohorts to be managed.';
+
 $string['addintro'] = 'On this tab, you can add a new rule mapping a custom user profile field\'s value to a cohort the user will be added to.';
 $string['addrule'] = 'Add rule for custom user profile field ...';
 $string['addrules'] = 'Add new rule';
@@ -58,4 +63,5 @@
 $string['viewintro'] = 'On this tab, you define the rules mapping custom user profile fields to the cohorts the user will be added to.<br>
 The defined rules are processed in the order that they are displayed. However, a user matching multiple rules will be added to all the relevant cohorts.<br>
 Please note: When rules are changed, a background task will be scheduled to update all affected users - there will be a short delay (a few minutes, depending on the configuration of your scheduled tasks in Moodle and the cronjob on the Moodle server) before all user memberships in the cohorts are updated. Nevertheless, any user who logs in before the background task is finished will be updated immediately.';
-$string['viewrules'] = 'View / edit rules';
+$string['viewrules'] = 'View rules';
+$string['vieweditrules'] = 'View / edit rules';
diff --git a/settings.php b/settings.php
index 1a04b49..5b6612a 100644
--- a/settings.php
+++ b/settings.php
@@ -24,8 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-if ($hassiteconfig) {
-    $settingspage = new admin_externalpage('local_profilecohort', new lang_string('pluginname', 'local_profilecohort'),
-                                           new moodle_url('/local/profilecohort/index.php'), 'moodle/site:config');
-    $ADMIN->add('accounts', $settingspage);
-}
+$settingspage = new admin_externalpage('local_profilecohort', new lang_string('pluginname', 'local_profilecohort'),
+                                        new moodle_url('/local/profilecohort/index.php'), 'local/profilecohort:viewrules');
+$ADMIN->add('accounts', $settingspage);