diff --git a/_local/.armadactl.yaml b/_local/.armadactl.yaml
index f9dd46366fe..5f564b62d13 100644
--- a/_local/.armadactl.yaml
+++ b/_local/.armadactl.yaml
@@ -30,7 +30,7 @@ contexts:
 
   # Context with OIDC Client Credentials authentication
   # For service accounts (requires confidential client with secret)
-  auth-client-creds:
+  auth-client-creds-executor:
     armadaUrl: localhost:50051
     openIdClientCredentialsAuth:
       providerUrl: "http://localhost:8180/realms/armada"
@@ -38,6 +38,42 @@ contexts:
       clientSecret: "executor-secret"
       scopes: ["openid", "profile", "email"]
 
+  auth-client-creds-user:
+    armadaUrl: localhost:50051
+    openIdClientCredentialsAuth:
+      providerUrl: "http://localhost:8180/realms/armada"
+      clientId: "armada-user"
+      clientSecret: "user-secret"
+      scopes: ["openid", "profile", "email"]
+
+  auth-client-creds-admin:
+    armadaUrl: localhost:50051
+    openIdClientCredentialsAuth:
+      providerUrl: "http://localhost:8180/realms/armada"
+      clientId: "armada-admin"
+      clientSecret: "admin-secret"
+      scopes: ["openid", "profile", "email"]
+
+  # Contexts for the rbac integration test suite, against the containerized full.yaml stack
+  # (server-auth on :50061, keycloak reachable from the host via the /etc/hosts alias that
+  # `mage dev:full` adds -- see magefiles/dev.go's ensureEtcHostsEntry). Same Keycloak realm/
+  # clients as auth-client-creds-admin/-user above; only the network path differs.
+  rbac-admin:
+    armadaUrl: localhost:50061
+    openIdClientCredentialsAuth:
+      providerUrl: "http://keycloak:8180/realms/armada"
+      clientId: "armada-admin"
+      clientSecret: "admin-secret"
+      scopes: ["openid", "profile", "email"]
+
+  rbac-user:
+    armadaUrl: localhost:50061
+    openIdClientCredentialsAuth:
+      providerUrl: "http://keycloak:8180/realms/armada"
+      clientId: "armada-user"
+      clientSecret: "user-secret"
+      scopes: ["openid", "profile", "email"]
+
   # Context with OIDC Password Flow authentication
   auth-password:
     armadaUrl: localhost:50051
diff --git a/_local/compose/full.yaml b/_local/compose/full.yaml
index 6a0e5b4d9a9..ed631006d35 100644
--- a/_local/compose/full.yaml
+++ b/_local/compose/full.yaml
@@ -138,6 +138,47 @@ services:
       ARMADA_POSTGRES_CONNECTION_HOST: postgres
     command: ./lookout --migrateDatabase --config /config/config.yaml
 
+  # =========================================================
+  # OIDC provider, for the rbac test suite only
+  # =========================================================
+  keycloak:
+    container_name: keycloak
+    image: ${KEYCLOAK_IMAGE:-quay.io/keycloak/keycloak:25.0}
+    environment:
+      KEYCLOAK_ADMIN: admin
+      KEYCLOAK_ADMIN_PASSWORD: admin
+      KC_HTTP_PORT: 8180
+      KC_HEALTH_ENABLED: "true"
+      # Pins the OIDC issuer to one literal hostname regardless of whether the caller is another
+      # container (reaching it via the "keycloak" service name) or the host (reaching it via the
+      # "keycloak" /etc/hosts alias that `mage dev:full` adds, pointing at 127.0.0.1). go-oidc
+      # requires the discovery document's issuer to exactly match the URL used to fetch it, and
+      # token verification then requires the token's iss claim to match that same issuer, so both
+      # paths must agree on one hostname string.
+      KC_HOSTNAME: keycloak
+    ports:
+      - "8180:8180"
+    command: start-dev --import-realm
+    volumes:
+      - ../keycloak/import:/opt/keycloak/data/import:ro
+    networks: [kind]
+    restart: unless-stopped
+    # server-auth dials Keycloak's discovery endpoint at its own startup and, unlike the
+    # dependency services above, doesn't retry/restart on failure -- so server-auth's
+    # depends_on below needs service_healthy, not just service_started, to not lose the race
+    # against Keycloak's realm import. No curl/wget in this image, so the check uses bash's
+    # /dev/tcp against the KC_HEALTH_ENABLED management endpoint (port 9000) instead.
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "bash -c 'exec 3<>/dev/tcp/127.0.0.1/9000 && printf \"GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n\" >&3 && cat <&3' | grep -q '\"status\": \"UP\"'",
+        ]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 20s
+
   # =========================================================
   # Armada components
   # =========================================================
@@ -198,6 +239,33 @@ services:
       ARMADA_SCHEDULERAPICONNECTION_ARMADAURL: scheduler:50052
     command: ./server --config /config/config.yaml
 
+  # Second API server instance, backed by the same scheduler/pulsar/redis/postgres as `server`,
+  # but with OIDC auth enabled (config-auth.yaml). Used only by the rbac test suite, so every
+  # other suite's unauthenticated connection to `server` is unaffected.
+  server-auth:
+    <<: *component
+    container_name: server-auth
+    image: ${ARMADA_IMAGE:-gresearch/armada-bundle}:${ARMADA_IMAGE_TAG:-latest}
+    ports:
+      - "50061:50051"
+      - "8091:8081"
+    depends_on:
+      lookout-migration: {condition: service_completed_successfully}
+      pulsar: {condition: service_healthy}
+      redis: {condition: service_healthy}
+      keycloak: {condition: service_healthy}
+    volumes:
+      - ../server/config-auth.yaml:/config/config.yaml:ro
+    environment:
+      ARMADA_EVENTSAPIREDIS_ADDRS: redis:6379
+      ARMADA_REDIS_ADDRS: redis:6379
+      ARMADA_POSTGRES_CONNECTION_HOST: postgres
+      ARMADA_QUERYAPI_POSTGRES_CONNECTION_HOST: postgres
+      ARMADA_PULSAR_URL: pulsar://pulsar:6650
+      ARMADA_SCHEDULERAPICONNECTION_ARMADAURL: scheduler:50052
+      ARMADA_AUTH_OPENIDAUTH_PROVIDERURL: http://keycloak:8180/realms/armada
+    command: ./server --config /config/config.yaml
+
   executor:
     <<: *component
     container_name: executor
diff --git a/_local/keycloak/import/armada-realm.json b/_local/keycloak/import/armada-realm.json
index 0a4d731e80b..382316d81a5 100644
--- a/_local/keycloak/import/armada-realm.json
+++ b/_local/keycloak/import/armada-realm.json
@@ -102,6 +102,72 @@
         "offline_access",
         "microprofile-jwt"
       ]
+    },
+    {
+      "clientId": "armada-user",
+      "name": "Armada User Service",
+      "description": "Service account for Armada Users",
+      "enabled": true,
+      "publicClient": false,
+      "standardFlowEnabled": false,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": true,
+      "authorizationServicesEnabled": false,
+      "protocol": "openid-connect",
+      "bearerOnly": false,
+      "consentRequired": false,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "user-secret",
+      "redirectUris": [],
+      "webOrigins": [],
+      "notBefore": 0,
+      "attributes": {
+        "use.refresh.tokens": "false",
+        "client_credentials.use_refresh_token": "false"
+      },
+      "fullScopeAllowed": true,
+      "nodeReRegistrationTimeout": -1,
+      "defaultClientScopes": ["web-origins", "profile", "roles", "email"],
+      "optionalClientScopes": [
+        "address",
+        "phone",
+        "offline_access",
+        "microprofile-jwt"
+      ]
+    },
+    {
+      "clientId": "armada-admin",
+      "name": "Armada Admin Service",
+      "description": "Service account for Armada Admins",
+      "enabled": true,
+      "publicClient": false,
+      "standardFlowEnabled": false,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": true,
+      "authorizationServicesEnabled": false,
+      "protocol": "openid-connect",
+      "bearerOnly": false,
+      "consentRequired": false,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "admin-secret",
+      "redirectUris": [],
+      "webOrigins": [],
+      "notBefore": 0,
+      "attributes": {
+        "use.refresh.tokens": "false",
+        "client_credentials.use_refresh_token": "false"
+      },
+      "fullScopeAllowed": true,
+      "nodeReRegistrationTimeout": -1,
+      "defaultClientScopes": ["web-origins", "profile", "roles", "email"],
+      "optionalClientScopes": [
+        "address",
+        "phone",
+        "offline_access",
+        "microprofile-jwt"
+      ]
     }
   ],
   "clientScopes": [
@@ -239,6 +305,40 @@
       "realmRoles": ["default-roles-armada"],
       "groups": ["/admins"]
     },
+    {
+      "username": "executor",
+      "enabled": true,
+      "email": "executor@example.com",
+      "firstName": "Executor",
+      "lastName": "User",
+      "emailVerified": true,
+      "credentials": [
+        {
+          "type": "password",
+          "value": "executor",
+          "temporary": false
+        }
+      ],
+      "realmRoles": ["default-roles-armada"],
+      "groups": ["/executors"]
+    },
+    {
+      "username": "user",
+      "enabled": true,
+      "email": "user@example.com",
+      "firstName": "User",
+      "lastName": "User",
+      "emailVerified": true,
+      "credentials": [
+        {
+          "type": "password",
+          "value": "user",
+          "temporary": false
+        }
+      ],
+      "realmRoles": ["default-roles-armada"],
+      "groups": ["/users"]
+    },
     {
       "username": "service-account-armada-executor",
       "enabled": true,
@@ -247,6 +347,26 @@
       "lastName": "Executor",
       "emailVerified": true,
       "serviceAccountClientId": "armada-executor",
+      "groups": ["/executors"]
+    },
+    {
+      "username": "service-account-armada-user",
+      "enabled": true,
+      "email": "user@armada.local",
+      "firstName": "Service Account",
+      "lastName": "User",
+      "emailVerified": true,
+      "serviceAccountClientId": "armada-user",
+      "groups": ["/users"]
+    },
+    {
+      "username": "service-account-armada-admin",
+      "enabled": true,
+      "email": "admin-service@armada.local",
+      "firstName": "Service Account",
+      "lastName": "Admin",
+      "emailVerified": true,
+      "serviceAccountClientId": "armada-admin",
       "groups": ["/admins"]
     }
   ],
diff --git a/_local/queues/e2e-test-queue.yaml b/_local/queues/e2e-test-queue.yaml
new file mode 100644
index 00000000000..dcefbff0a42
--- /dev/null
+++ b/_local/queues/e2e-test-queue.yaml
@@ -0,0 +1,4 @@
+apiVersion: armadaproject.io/v1beta1
+kind: Queue
+name: e2e-test-queue
+priorityFactor: 1.0
diff --git a/_local/rbac-queues/rbac-fixture-plain.yaml b/_local/rbac-queues/rbac-fixture-plain.yaml
new file mode 100644
index 00000000000..9066f24f274
--- /dev/null
+++ b/_local/rbac-queues/rbac-fixture-plain.yaml
@@ -0,0 +1,4 @@
+apiVersion: armadaproject.io/v1beta1
+kind: Queue
+name: rbac-fixture-plain
+priorityFactor: 1.0
diff --git a/_local/rbac-queues/rbac-fixture-restricted.yaml b/_local/rbac-queues/rbac-fixture-restricted.yaml
new file mode 100644
index 00000000000..dffc1e00938
--- /dev/null
+++ b/_local/rbac-queues/rbac-fixture-restricted.yaml
@@ -0,0 +1,10 @@
+apiVersion: armadaproject.io/v1beta1
+kind: Queue
+name: rbac-fixture-restricted
+priorityFactor: 1.0
+permissions:
+  - subjects:
+      - name: users
+        kind: Group
+    verbs:
+      - submit
diff --git a/_local/server/config-auth.yaml b/_local/server/config-auth.yaml
index a22f162a5ce..418e1964ac9 100644
--- a/_local/server/config-auth.yaml
+++ b/_local/server/config-auth.yaml
@@ -34,9 +34,13 @@ auth:
     delete_retry_policy: ["admins"]
     delete_queue: ["admins"]
     cancel_any_jobs: ["admins"]
+    preempt_any_jobs: ["admins"]
     reprioritize_any_jobs: ["admins"]
     watch_all_events: ["admins"]
     execute_jobs: ["admins", "executors"]
+    cordon_queue: ["admins"]
+    cordon_nodes: ["admins"]
+    update_executor_settings: ["admins"]
 eventsApiRedis:
   addrs:
     - localhost:6379
diff --git a/internal/testsuite/app.go b/internal/testsuite/app.go
index 3e8c6c59677..39a7d52e283 100644
--- a/internal/testsuite/app.go
+++ b/internal/testsuite/app.go
@@ -317,9 +317,23 @@ func (a *App) RunTests(ctx context.Context, testSpecs []*api.TestSpec) (*TestSui
 	wg.Add(len(testSpecs))
 	for i, testSpec := range testSpecs {
 		i := i
+		apiConnectionDetails := a.Params.ApiConnectionDetails
+		if testSpec.AuthContext != "" {
+			resolved, err := client.ResolveNamedContext(testSpec.AuthContext)
+			if err != nil {
+				report := NewTestCaseReport(testSpec)
+				report.Finish = report.Start
+				report.FailureReason = fmt.Sprintf("failed to resolve authContext %q: %s", testSpec.AuthContext, err)
+				report.Out = &bytes.Buffer{}
+				rv.TestCaseReports[i] = report
+				wg.Done()
+				continue
+			}
+			apiConnectionDetails = resolved
+		}
 		testRunner := TestRunner{
 			Out:                  a.Out,
-			apiConnectionDetails: a.Params.ApiConnectionDetails,
+			apiConnectionDetails: apiConnectionDetails,
 			testSpec:             testSpec,
 			eventLogger:          eventLogger,
 		}
diff --git a/internal/testsuite/eventwatcher/eventwatcher.go b/internal/testsuite/eventwatcher/eventwatcher.go
index cbbc73ac568..35a66ba8366 100644
--- a/internal/testsuite/eventwatcher/eventwatcher.go
+++ b/internal/testsuite/eventwatcher/eventwatcher.go
@@ -88,7 +88,9 @@ func (srv *EventWatcher) Run(ctx context.Context) error {
 		if err == nil || errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
 			return err
 		}
-		if status.Code(err) == codes.Canceled {
+		if status.Code(err) == codes.Canceled || status.Code(err) == codes.PermissionDenied {
+			// Permission denials are permanent for the lifetime of a test (the caller's
+			// identity doesn't change mid-run), so retrying would only waste the backoff budget.
 			return err
 		}
 
diff --git a/internal/testsuite/testrunner.go b/internal/testsuite/testrunner.go
index f0fd7982f96..804a6e86e1a 100644
--- a/internal/testsuite/testrunner.go
+++ b/internal/testsuite/testrunner.go
@@ -11,6 +11,8 @@ import (
 	"github.com/pkg/errors"
 	"golang.org/x/exp/maps"
 	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/clientcmd"
@@ -26,6 +28,26 @@ import (
 	"github.com/armadaproject/armada/pkg/client"
 )
 
+// checkExpectedError reconciles a call's outcome against testSpec.ExpectErrorCode.
+// A nil err is always passed through unchanged: at most one call site is "the action under
+// test" for any given negative RBAC test, and every other site along the way (queue setup,
+// submit, teardown, ...) is a precondition that's expected to genuinely succeed. Run() uses
+// expectedErrorObserved to separately verify that the expected denial happened somewhere by
+// the end of the test, rather than baking that check into every call site.
+// If ExpectErrorCode is unset, err is returned unchanged (today's behavior: any error fails
+// the test). If set and err is non-nil: a matching status code is the expected, benign outcome
+// (returns nil); a non-matching code is a real failure (wrapped and returned).
+func checkExpectedError(testSpec *api.TestSpec, err error) error {
+	if err == nil || testSpec.GetExpectErrorCode() == 0 {
+		return err
+	}
+	wantCode := codes.Code(testSpec.GetExpectErrorCode())
+	if status.Code(err) != wantCode {
+		return errors.Wrapf(err, "expected call to fail with code %s", wantCode)
+	}
+	return nil
+}
+
 type TestRunner struct {
 	Out                  io.Writer
 	apiConnectionDetails *client.ApiConnectionDetails
@@ -70,6 +92,20 @@ func (srv *TestRunner) Run(ctx context.Context) (err error) {
 		}
 	}()
 
+	// expectedErrorObserved is set by whichever call site actually produces the
+	// ExpectErrorCode denial this test is checking for (at most one of setup/update/submit/
+	// teardown/action ever will, per test). Registered before the report defer above so it
+	// runs first (defers are LIFO) and can still correct err before the report captures it.
+	var expectedErrorObserved bool
+	defer func() {
+		if err == nil && srv.testSpec.GetExpectErrorCode() != 0 && !expectedErrorObserved {
+			err = errors.Errorf(
+				"expected a call to fail with code %s, but the test completed successfully",
+				codes.Code(srv.testSpec.GetExpectErrorCode()),
+			)
+		}
+	}()
+
 	// Optional timeout
 	var cancel context.CancelFunc
 	timeout := protoutil.ToStdDuration(srv.testSpec.Timeout)
@@ -81,22 +117,43 @@ func (srv *TestRunner) Run(ctx context.Context) (err error) {
 	defer cancel()
 
 	// Create and (optionally) update the queue(s) under test.
-	queueNames, err := queue.RunSetup(ctx, srv.testSpec, srv.apiConnectionDetails, out)
-	if err != nil {
+	queueNames, setupErr := queue.RunSetup(ctx, srv.testSpec, srv.apiConnectionDetails, out)
+	if err = checkExpectedError(srv.testSpec, setupErr); err != nil {
 		return err
 	}
-	if err = queue.RunUpdate(ctx, queueNames, srv.testSpec, srv.apiConnectionDetails, out); err != nil {
+	if setupErr != nil {
+		// The expected failure already occurred (e.g. create_queue denied); nothing was
+		// created, so there's nothing left to do or tear down.
+		expectedErrorObserved = true
+		return nil
+	}
+	updateErr := queue.RunUpdate(ctx, queueNames, srv.testSpec, srv.apiConnectionDetails, out)
+	if err = checkExpectedError(srv.testSpec, updateErr); err != nil {
 		return err
 	}
+	if updateErr != nil {
+		// The expected failure already occurred (e.g. update_queue denied against a queue this
+		// test doesn't own); skip teardown since this test didn't create the queue it targeted.
+		expectedErrorObserved = true
+		return nil
+	}
 
 	// (deferred): always delete the queue(s) once the test finishes.
 	defer func() {
-		if teardownErr := queue.RunTeardown(queueNames, srv.testSpec, srv.apiConnectionDetails, out); teardownErr != nil {
-			fmt.Fprintf(out, "warning: queue teardown failed: %s\n", teardownErr)
+		teardownErr := queue.RunTeardown(queueNames, srv.testSpec, srv.apiConnectionDetails, out)
+		if teardownErr == nil {
+			return
+		}
+		if checkedErr := checkExpectedError(srv.testSpec, teardownErr); checkedErr != nil {
+			fmt.Fprintf(out, "warning: queue teardown failed: %s\n", checkedErr)
 			if err == nil {
-				err = teardownErr
+				err = checkedErr
 			}
+			return
 		}
+		// teardownErr matched ExpectErrorCode (e.g. delete_queue denied) -- the expected
+		// denial for this test.
+		expectedErrorObserved = true
 	}()
 
 	// Pure queue tests submit no jobs, so skip the job-submission block below and
@@ -110,9 +167,16 @@ func (srv *TestRunner) Run(ctx context.Context) (err error) {
 
 	// Submit jobs. All jobs must be submitted before proceeding since we need the job ids.
 	sbmtr := submitter.NewSubmitterFromTestSpec(srv.apiConnectionDetails, srv.testSpec, out)
-	if err = sbmtr.Run(ctx); err != nil {
+	submitErr := sbmtr.Run(ctx)
+	if err = checkExpectedError(srv.testSpec, submitErr); err != nil {
 		return err
 	}
+	if submitErr != nil {
+		// The expected failure already occurred (e.g. submit denied); no jobs exist to watch,
+		// act on, or assert against.
+		expectedErrorObserved = true
+		return nil
+	}
 	jobIds := sbmtr.JobIds()
 	jobIdMap := make(map[string]bool)
 	for _, jobId := range jobIds {
@@ -205,16 +269,38 @@ func (srv *TestRunner) Run(ctx context.Context) (err error) {
 	// Watch for ingress events and try to download from any ingresses found.
 	g.Go(func() error { return eventwatcher.GetFromIngresses(ctx, ingressCh) })
 
+	if srv.testSpec.GetExpectErrorCode() != 0 {
+		// Negative RBAC tests targeting the action/watch goroutines (cancel, preempt,
+		// reprioritize, GetJobSetEvents) deliberately leave ExpectedEvents empty, since
+		// what's under test is whether the RPC was denied, not what events followed it -- a
+		// short ExpectedEvents list (e.g. just "submitted") would let AssertEvents return
+		// success before the denied action even runs, racing the very thing we're testing.
+		// An empty ExpectedEvents list instead blocks AssertEvents until ctx is cancelled,
+		// which happens automatically once the denied RPC returns and the errgroup cancels
+		// its shared ctx -- or once this test's own timeout elapses if the RPC was (wrongly)
+		// allowed through. So AssertEvents's own result is meaningless here; reconcile the
+		// aggregated error from every goroutine in the group against ExpectErrorCode instead.
+		eventwatcher.AssertEvents(ctx, assertCh, maps.Clone(jobIdMap), srv.testSpec.ExpectedEvents) //nolint:errcheck
+		cancel()
+		groupErr := g.Wait()
+		if checkedErr := checkExpectedError(srv.testSpec, groupErr); checkedErr != nil {
+			return checkedErr
+		}
+		if groupErr != nil {
+			expectedErrorObserved = true
+		}
+		return nil
+	}
+
 	// Assert that we get the right events for each job.
 	// Returns once we've received all events or when ctx is cancelled.
-	if err = eventwatcher.AssertEvents(ctx, assertCh, maps.Clone(jobIdMap), srv.testSpec.ExpectedEvents); err != nil {
+	if assertErr := eventwatcher.AssertEvents(ctx, assertCh, maps.Clone(jobIdMap), srv.testSpec.ExpectedEvents); assertErr != nil {
 		cancel()
 		groupErr := g.Wait()
 		if groupErr != nil {
-			return errors.Errorf("%s: %s", err, groupErr)
-		} else {
-			return err
+			return errors.Errorf("%s: %s", assertErr, groupErr)
 		}
+		return assertErr
 	}
 
 	// Assert queue state now that the jobs have finished. (used for GetActiveQueues)
diff --git a/magefiles/ci.go b/magefiles/ci.go
index c4d980ec785..fff93f2944c 100644
--- a/magefiles/ci.go
+++ b/magefiles/ci.go
@@ -14,13 +14,34 @@ import (
 )
 
 func createQueue() error {
-	out, err := runArmadaCtl("create", "queue", "e2e-test-queue")
-	// check if err text contains "already exists" and ignore if it does
-	if err != nil && !strings.Contains(out, "already exists") {
-		fmt.Println(out)
+	return createQueuesFromDir("", "_local/queues")
+}
+
+// createRbacFixtureQueues bootstraps the queues the rbac test suite's "without permission" cases
+// target, using the rbac-admin context (server-auth, on the containerized full.yaml stack) since
+// armada-user itself lacks create_queue. rbac-fixture-restricted grants the Keycloak "users"
+// group submit-only, so armada-user's negative tests (cancel/reprioritize/watch without
+// permission) can submit a job and prove those specific actions -- not queue ownership -- are
+// what's denied.
+func createRbacFixtureQueues() error {
+	return createQueuesFromDir("rbac-admin", "_local/rbac-queues")
+}
+
+// createQueuesFromDir runs armadactl to create every queue fixture (*.yaml) in dir against the
+// given armadactl context, tolerating "already exists" so repeated CI runs against a stack that
+// wasn't torn down don't fail.
+func createQueuesFromDir(context string, dir string) error {
+	files, err := filepath.Glob(filepath.Join(dir, "*.yaml"))
+	if err != nil {
 		return err
 	}
-
+	for _, file := range files {
+		out, err := runArmadaCtlContext(context, "create", "-f", file)
+		if err != nil && !strings.Contains(out, "already exists") {
+			fmt.Println(out)
+			return err
+		}
+	}
 	return nil
 }
 
@@ -38,7 +59,7 @@ func TestSuite() error {
 	timeTakenTestSuite := time.Now()
 
 	suites := []string{
-		"basic", "categorization", "preemption", "reprioritization", "queue",
+		"basic", "categorization", "preemption", "reprioritization", "queue", "rbac",
 		"testsuite/testcases/node/node_cancel_by_name_1x5.yaml",
 		"testsuite/testcases/node/node_preempt_by_name_1x5.yaml",
 	}
@@ -81,6 +102,7 @@ func CheckForArmadaRunning() error {
 	// TODO Make a good check to confirm the system is ready, such as seeing armadactl get executors return a value
 	mg.Deps(CheckSchedulerReady)
 	mg.Deps(createQueue)
+	mg.Deps(createRbacFixtureQueues)
 
 	// Set high to take compile time into account
 	timeout := time.After(2 * time.Minute)
@@ -142,9 +164,19 @@ func CheckDockerContainerRunning(containerName string, expectedLogRegex string)
 }
 
 func runArmadaCtl(args ...string) (string, error) {
+	return runArmadaCtlContext("", args...)
+}
+
+// runArmadaCtlContext is runArmadaCtl with an explicit armadactl context override (e.g.
+// "rbac-admin"), needed to bootstrap the rbac suite's fixture queues against server-auth rather
+// than the default unauthenticated "server" connection every other suite uses.
+func runArmadaCtlContext(context string, args ...string) (string, error) {
 	armadaCtlArgs := []string{
 		"--config", "_local/.armadactl.yaml",
 	}
+	if context != "" {
+		armadaCtlArgs = append(armadaCtlArgs, "--context", context)
+	}
 	armadaCtlArgs = append(armadaCtlArgs, args...)
 	outBytes, err := exec.Command(findOrBuildArmadaCtl(), armadaCtlArgs...).CombinedOutput()
 	out := string(outBytes)
diff --git a/magefiles/dev.go b/magefiles/dev.go
index d7291a4ca97..f4609b430a8 100644
--- a/magefiles/dev.go
+++ b/magefiles/dev.go
@@ -161,9 +161,43 @@ func (Dev) Down() error {
 // ordered ahead of the components, so no separate init step is needed.
 func (Dev) Full() error {
 	mg.Deps(mg.F(goreleaserMinimalRelease, "bundle", "lookout-bundle"), Kind)
+	if err := ensureEtcHostsEntry("keycloak", "127.0.0.1"); err != nil {
+		return err
+	}
+	// keycloak has its own compose healthcheck, so --wait already blocks until it (and every
+	// other service, including server-auth which depends on it) is ready.
 	return sh.RunV("docker", "compose", "-f", fullComposeFile, "up", "-d", "--wait")
 }
 
+// ensureEtcHostsEntry makes the literal hostname host resolve to ip from the host machine, by
+// appending an /etc/hosts entry if one isn't already present. full.yaml's keycloak service pins
+// KC_HOSTNAME=keycloak so its OIDC issuer is one fixed string regardless of caller; other
+// containers reach it as "keycloak" via Docker's own DNS, so the host (where armadactl and the
+// test runner run) needs the same literal hostname to resolve, to satisfy go-oidc's requirement
+// that the issuer used for discovery and a token's iss claim match exactly.
+func ensureEtcHostsEntry(host, ip string) error {
+	data, err := os.ReadFile("/etc/hosts")
+	if err != nil {
+		return fmt.Errorf("reading /etc/hosts: %w", err)
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) >= 2 && fields[0] == ip {
+			for _, name := range fields[1:] {
+				if name == host {
+					return nil
+				}
+			}
+		}
+	}
+	fmt.Printf("Adding %q entry to /etc/hosts (sudo required)...\n", ip+" "+host)
+	cmd := exec.Command("sudo", "tee", "-a", "/etc/hosts")
+	cmd.Stdin = strings.NewReader("\n" + ip + " " + host + "\n")
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+
 // FullDown stops the containerized full stack and tears down the Kind cluster.
 func (Dev) FullDown() error {
 	if err := sh.RunV("docker", "compose", "-f", fullComposeFile, "down", "-v"); err != nil {
diff --git a/pkg/api/testspec.pb.go b/pkg/api/testspec.pb.go
index 9036ffff006..209e9e2731f 100644
--- a/pkg/api/testspec.pb.go
+++ b/pkg/api/testspec.pb.go
@@ -139,6 +139,13 @@ type TestSpec struct {
 	TriggerEvent string `protobuf:"bytes,20,opt,name=trigger_event,json=triggerEvent,proto3" json:"triggerEvent,omitempty"`
 	// Optional queue lifecycle phases.
 	QueueConfig *QueueConfig `protobuf:"bytes,21,opt,name=queue_config,json=queueConfig,proto3" json:"queueConfig,omitempty"`
+	// Named armadactl context (see client.ApiConnectionDetails) to authenticate this test's
+	// API calls with. If empty, falls back to the connection details the suite was invoked with.
+	AuthContext string `protobuf:"bytes,22,opt,name=auth_context,json=authContext,proto3" json:"authContext,omitempty"`
+	// If non-zero, the test expects job submission/cancellation/reprioritization or queue
+	// create/update/delete to fail with this gRPC status code (see google.golang.org/grpc/codes)
+	// rather than succeed. Mutually exclusive with expecting expected_events to be observed.
+	ExpectErrorCode int32 `protobuf:"varint,23,opt,name=expect_error_code,json=expectErrorCode,proto3" json:"expectErrorCode,omitempty"`
 }
 
 func (m *TestSpec) Reset()         { *m = TestSpec{} }
@@ -321,6 +328,20 @@ func (m *TestSpec) GetQueueConfig() *QueueConfig {
 	return nil
 }
 
+func (m *TestSpec) GetAuthContext() string {
+	if m != nil {
+		return m.AuthContext
+	}
+	return ""
+}
+
+func (m *TestSpec) GetExpectErrorCode() int32 {
+	if m != nil {
+		return m.ExpectErrorCode
+	}
+	return 0
+}
+
 type NodeCancelConfig struct {
 	Request *NodeCancelRequest `protobuf:"bytes,1,opt,name=request,proto3" json:"request,omitempty"`
 	// value of the armadaproject.io/node-pool label used to resolve the target node at runtime
@@ -657,84 +678,87 @@ func init() {
 func init() { proto.RegisterFile("pkg/api/testspec.proto", fileDescriptor_38d601305b414287) }
 
 var fileDescriptor_38d601305b414287 = []byte{
-	// 1222 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xdc, 0x56, 0x4f, 0x6f, 0x1b, 0x45,
-	0x14, 0xcf, 0x26, 0x6d, 0xe2, 0x3c, 0xc7, 0xf6, 0x66, 0x9c, 0x3f, 0xdb, 0x16, 0x6c, 0xcb, 0x07,
-	0x08, 0x52, 0x65, 0xa3, 0x82, 0x10, 0x50, 0x10, 0xd8, 0xa9, 0x0b, 0xae, 0x9a, 0xc4, 0xd8, 0x91,
-	0x28, 0x45, 0x68, 0xb5, 0xb6, 0x5f, 0xb7, 0x1b, 0xbc, 0x3b, 0xdb, 0xdd, 0x71, 0x4a, 0xfb, 0x15,
-	0xb8, 0x20, 0x8e, 0x88, 0x4f, 0xc0, 0x27, 0x41, 0xe2, 0x52, 0x71, 0xe2, 0x64, 0xa1, 0xe6, 0xb6,
-	0x9f, 0x02, 0xed, 0x9b, 0xd9, 0x78, 0xec, 0x1c, 0xb8, 0x71, 0xe0, 0xb8, 0xbf, 0xdf, 0x7b, 0xbf,
-	0x79, 0x33, 0xbf, 0x37, 0xf3, 0x16, 0xf6, 0xc2, 0xef, 0xdd, 0xa6, 0x13, 0x7a, 0x4d, 0x81, 0xb1,
-	0x88, 0x43, 0x1c, 0x35, 0xc2, 0x88, 0x0b, 0xce, 0xd6, 0x9c, 0xd0, 0xbb, 0x59, 0x71, 0x39, 0x77,
-	0x27, 0xd8, 0x24, 0x68, 0x38, 0x7d, 0xd2, 0x1c, 0x4f, 0x23, 0x47, 0x78, 0x3c, 0x90, 0x41, 0x37,
-	0x77, 0xb2, 0xe4, 0x78, 0x3a, 0xf4, 0x3d, 0xa1, 0xd0, 0x72, 0x86, 0xe2, 0x39, 0x06, 0x19, 0xc8,
-	0x32, 0x30, 0xe0, 0x63, 0x94, 0x58, 0xfd, 0x8f, 0x2d, 0xc8, 0x9d, 0x62, 0x2c, 0x06, 0x21, 0x8e,
-	0x58, 0x0b, 0xae, 0x9d, 0xf1, 0x61, 0x6c, 0x19, 0xb5, 0xb5, 0x83, 0xfc, 0x9d, 0x1b, 0x0d, 0x27,
-	0xf4, 0x1a, 0x0f, 0xf8, 0x70, 0x40, 0xca, 0x7d, 0x7c, 0x36, 0xc5, 0x58, 0x74, 0x05, 0xfa, 0x6d,
-	0x96, 0xcc, 0xaa, 0xc5, 0x34, 0xf4, 0x36, 0xf7, 0x3d, 0x81, 0x7e, 0x28, 0x5e, 0xf4, 0x29, 0x95,
-	0x3d, 0x82, 0x12, 0xfe, 0x10, 0xe2, 0x48, 0xe0, 0xd8, 0xa6, 0xb5, 0x63, 0x6b, 0x95, 0xd4, 0xb6,
-	0x49, 0xad, 0x93, 0x42, 0x47, 0x18, 0xc7, 0x8e, 0x8b, 0xed, 0x37, 0x92, 0x59, 0xd5, 0xca, 0xa2,
-	0x89, 0xd1, 0xf5, 0x8a, 0x8b, 0x0c, 0x7b, 0x07, 0xae, 0x3f, 0x9b, 0xe2, 0x14, 0xad, 0xb5, 0x9a,
-	0x71, 0xb0, 0xd9, 0x2e, 0x27, 0xb3, 0x6a, 0x89, 0x00, 0x2d, 0x47, 0x46, 0xb0, 0xf7, 0x01, 0xce,
-	0xf8, 0xd0, 0x8e, 0x51, 0xd8, 0xde, 0xd8, 0xba, 0x46, 0xf1, 0x7b, 0xc9, 0xac, 0xca, 0xce, 0xf8,
-	0x70, 0x80, 0xa2, 0x3b, 0xd6, 0x52, 0x72, 0x19, 0xc6, 0x3e, 0x82, 0x7c, 0x30, 0xf5, 0xed, 0xa1,
-	0x23, 0x46, 0x4f, 0x31, 0xb6, 0xae, 0xd7, 0x8c, 0x83, 0x42, 0xdb, 0x4a, 0x66, 0xd5, 0x9d, 0x60,
-	0xea, 0xb7, 0x25, 0xaa, 0x25, 0xc2, 0x1c, 0x65, 0x1f, 0x00, 0x50, 0x9a, 0x1d, 0x7b, 0x2f, 0xd1,
-	0x5a, 0xa7, 0xcc, 0xfd, 0x64, 0x56, 0x2d, 0x13, 0x3a, 0xf0, 0x5e, 0xea, 0x45, 0x6e, 0x5e, 0x82,
-	0xec, 0x08, 0x72, 0x5e, 0x20, 0x30, 0x3a, 0x77, 0x26, 0xd6, 0x46, 0xcd, 0xa0, 0x43, 0x97, 0x7e,
-	0x37, 0x32, 0xbf, 0x1b, 0xf7, 0x94, 0xdf, 0x72, 0x07, 0x59, 0xb8, 0xbe, 0x83, 0x0c, 0x63, 0x0f,
-	0x60, 0x43, 0x78, 0x3e, 0xf2, 0xa9, 0xb0, 0x72, 0xff, 0xa6, 0xb6, 0x9b, 0xcc, 0xaa, 0xdb, 0x2a,
-	0x5a, 0x13, 0xcb, 0x04, 0xd8, 0x7d, 0x58, 0x77, 0x46, 0x69, 0xa4, 0xb5, 0x59, 0x33, 0x0e, 0x8a,
-	0x77, 0x2c, 0xf2, 0x2f, 0x6b, 0x95, 0x46, 0x8b, 0xb8, 0xd3, 0x17, 0x21, 0xb6, 0x77, 0x92, 0x59,
-	0xd5, 0x94, 0xb1, 0x9a, 0x90, 0xca, 0x66, 0x6f, 0xc1, 0xb5, 0xc0, 0xf1, 0xd1, 0x02, 0x72, 0x81,
-	0x1a, 0x27, 0xfd, 0xd6, 0x1b, 0x27, 0xfd, 0x66, 0xf7, 0xc1, 0x8c, 0x9c, 0x60, 0xcc, 0x7d, 0x7b,
-	0x34, 0xf1, 0x30, 0x20, 0xe7, 0xf2, 0x35, 0xe3, 0x20, 0x27, 0xdb, 0x44, 0x72, 0x87, 0x44, 0x2d,
-	0xf8, 0x57, 0x5c, 0x64, 0xd8, 0xbb, 0x90, 0x73, 0x51, 0xd8, 0x13, 0xee, 0xc6, 0xd6, 0x16, 0xe5,
-	0xd3, 0x4e, 0x5d, 0x14, 0x0f, 0xb9, 0xab, 0xfb, 0xb7, 0xa1, 0x20, 0x76, 0x17, 0xf2, 0x18, 0x9c,
-	0x7b, 0x11, 0x0f, 0x7c, 0x0c, 0x84, 0x55, 0xa0, 0x42, 0x6f, 0x24, 0xb3, 0xea, 0xae, 0x06, 0x6b,
-	0x89, 0x7a, 0x34, 0xbb, 0x0d, 0xeb, 0xc2, 0x89, 0x5c, 0x14, 0x56, 0x91, 0xf2, 0xe8, 0x30, 0x24,
-	0xa2, 0x1f, 0x86, 0x44, 0xd8, 0x27, 0xb0, 0x15, 0xe0, 0x73, 0x3b, 0x8c, 0x3c, 0x1e, 0x79, 0xe2,
-	0x85, 0x55, 0xaa, 0x19, 0x07, 0x86, 0x5c, 0x2b, 0xc0, 0xe7, 0x3d, 0x05, 0xeb, 0x6b, 0x69, 0x30,
-	0x6b, 0x43, 0x31, 0x8c, 0x30, 0x25, 0xec, 0x08, 0x9d, 0x98, 0x07, 0x96, 0x49, 0x6b, 0xde, 0x4a,
-	0x66, 0xd5, 0x7d, 0xc5, 0xf4, 0x89, 0xd0, 0x14, 0x0a, 0x0b, 0x04, 0xeb, 0xc3, 0x66, 0x8c, 0x13,
-	0x94, 0xce, 0x6e, 0x93, 0xb3, 0xb7, 0x16, 0x9d, 0x1d, 0x64, 0x34, 0x99, 0x4b, 0x5d, 0x7c, 0x99,
-	0xa1, 0x77, 0xf1, 0x25, 0xc8, 0xbe, 0x86, 0xe2, 0xc8, 0x09, 0x46, 0x38, 0xb1, 0x79, 0x60, 0xa7,
-	0x6f, 0x8b, 0xc5, 0xa8, 0xfb, 0x76, 0x49, 0xf8, 0x98, 0x8f, 0xf1, 0x90, 0xe8, 0x43, 0x1e, 0x3c,
-	0xf1, 0xdc, 0xf6, 0xcd, 0x64, 0x56, 0xdd, 0x93, 0x09, 0x27, 0x41, 0xca, 0x6a, 0xaa, 0x5b, 0x3a,
-	0xce, 0xbe, 0x85, 0x52, 0xb6, 0xe1, 0x4c, 0xb9, 0x4c, 0xca, 0x7b, 0x97, 0xca, 0x3d, 0xc9, 0x2b,
-	0x69, 0xfd, 0x24, 0xae, 0x68, 0x17, 0x16, 0x08, 0xf6, 0x19, 0x14, 0x44, 0xe4, 0xb9, 0x2e, 0x46,
-	0xf2, 0xa1, 0xb2, 0x76, 0xe8, 0x30, 0xa9, 0x3a, 0x45, 0xd0, 0xcb, 0xa3, 0x57, 0xa7, 0xe3, 0xec,
-	0x18, 0xb6, 0xe8, 0xb9, 0xb1, 0x47, 0xb4, 0xb8, 0xb5, 0x4b, 0xa5, 0x99, 0x54, 0xda, 0x57, 0x29,
-	0xa1, 0x8a, 0x22, 0x7b, 0x9f, 0xcd, 0x01, 0xdd, 0x5e, 0x0d, 0xae, 0x7f, 0x07, 0x30, 0xbf, 0x55,
-	0xac, 0x04, 0xf9, 0xd6, 0xe1, 0x69, 0xf7, 0xe4, 0xd8, 0x3e, 0x3e, 0x39, 0xee, 0x98, 0x2b, 0x6c,
-	0x1b, 0x0a, 0x0a, 0x38, 0x6c, 0x1d, 0x1f, 0x76, 0x1e, 0x9a, 0x06, 0x63, 0x50, 0x54, 0x50, 0xaf,
-	0xdf, 0xe9, 0x1c, 0xf5, 0x4e, 0xcd, 0x55, 0xb6, 0x0f, 0x65, 0x85, 0xf5, 0x3b, 0xbd, 0x7e, 0xf7,
-	0xa4, 0xdf, 0x3d, 0xed, 0x3e, 0xee, 0x98, 0x6b, 0xf5, 0x21, 0x14, 0x16, 0xac, 0x65, 0x26, 0x6c,
-	0x0d, 0x3a, 0x0f, 0x3b, 0xd9, 0x22, 0xe6, 0x0a, 0x2b, 0x43, 0x69, 0x8e, 0xb4, 0xbf, 0xb1, 0xbb,
-	0xf7, 0x4c, 0x83, 0xed, 0x80, 0xb9, 0x00, 0x0e, 0x3a, 0xe9, 0x32, 0xcb, 0x68, 0xf7, 0xde, 0xc0,
-	0x5c, 0xab, 0xff, 0x62, 0x80, 0xb9, 0xec, 0x37, 0xfb, 0x02, 0x36, 0x22, 0x39, 0x3b, 0x2c, 0x63,
-	0xc9, 0x3d, 0x19, 0xa7, 0x26, 0x8b, 0xbc, 0xa8, 0x2a, 0x54, 0xbf, 0xa8, 0x0a, 0x62, 0x9f, 0x42,
-	0x21, 0xed, 0x01, 0x3b, 0xe4, 0x7c, 0x62, 0x0b, 0xc7, 0xb5, 0x56, 0xe7, 0x57, 0x35, 0x25, 0x7a,
-	0x9c, 0x4f, 0x4e, 0x9d, 0x85, 0xf3, 0xd5, 0xe0, 0xfa, 0xaf, 0x06, 0x6c, 0x5f, 0x69, 0x19, 0xf6,
-	0xe5, 0x72, 0x75, 0xfb, 0xcb, 0xbd, 0xf5, 0x1f, 0x95, 0xf7, 0xa7, 0x01, 0x79, 0xad, 0x6d, 0xd8,
-	0xc7, 0x70, 0x3d, 0x46, 0x31, 0x0d, 0x55, 0x59, 0xa5, 0x79, 0x5f, 0x0d, 0x52, 0x58, 0x0e, 0x40,
-	0x8a, 0xd0, 0x07, 0x20, 0x01, 0xec, 0x08, 0xc0, 0x89, 0x63, 0x8c, 0x52, 0xaf, 0xb3, 0x01, 0x5c,
-	0x9e, 0x0b, 0xb4, 0x32, 0x4e, 0x8e, 0xb7, 0x79, 0xa8, 0x3e, 0xde, 0xe6, 0x28, 0xfb, 0x10, 0xd6,
-	0xa7, 0xe1, 0xd8, 0x11, 0x48, 0xb3, 0x34, 0x7f, 0x07, 0xe6, 0x52, 0xf2, 0xc1, 0x93, 0xac, 0xfe,
-	0xe0, 0x49, 0xa4, 0xfe, 0xf3, 0x2a, 0xc0, 0xbc, 0xe6, 0xff, 0xc1, 0x88, 0x6d, 0x03, 0xc8, 0x4b,
-	0x9f, 0xfe, 0xa7, 0xa9, 0x29, 0xab, 0x1f, 0x07, 0x95, 0x44, 0x11, 0xe9, 0x63, 0xaa, 0x97, 0x74,
-	0x09, 0xd6, 0x7f, 0x5c, 0x85, 0xe2, 0xa2, 0x0f, 0xec, 0x73, 0x28, 0xa6, 0xf3, 0xf2, 0x1c, 0x6d,
-	0x2f, 0xa0, 0x06, 0x22, 0xd7, 0xd5, 0x6b, 0x24, 0x99, 0x6e, 0x90, 0x76, 0x8a, 0xfe, 0x1a, 0xe9,
-	0x38, 0xeb, 0xc2, 0xb6, 0x13, 0x86, 0xe8, 0x44, 0x71, 0x2a, 0x11, 0x8b, 0x08, 0x1d, 0x9f, 0x3a,
-	0x30, 0xd7, 0x7e, 0x33, 0x99, 0x55, 0x6f, 0x28, 0xb2, 0x1b, 0x0c, 0x88, 0xd2, 0x74, 0x4a, 0x4b,
-	0x14, 0xbb, 0x0b, 0x1b, 0xbe, 0x72, 0x68, 0xed, 0xca, 0x06, 0xe9, 0x16, 0xf8, 0x57, 0xac, 0xca,
-	0x32, 0x58, 0x13, 0x36, 0xc6, 0x38, 0x41, 0x81, 0xf2, 0xc7, 0x4b, 0x8d, 0x5f, 0x05, 0xe9, 0x09,
-	0x0a, 0x6a, 0x3f, 0xfa, 0xfd, 0x75, 0xc5, 0x78, 0xf5, 0xba, 0x62, 0xfc, 0xfd, 0xba, 0x62, 0xfc,
-	0x74, 0x51, 0x59, 0x79, 0x75, 0x51, 0x59, 0xf9, 0xeb, 0xa2, 0xb2, 0xf2, 0xf8, 0x6d, 0xd7, 0x13,
-	0x4f, 0xa7, 0xc3, 0xc6, 0x88, 0xfb, 0x4d, 0x27, 0xf2, 0x9d, 0xb1, 0x13, 0x46, 0xfc, 0x0c, 0x47,
-	0x42, 0x7d, 0x35, 0xd5, 0xff, 0xec, 0x6f, 0xab, 0x3b, 0x2d, 0x02, 0x7a, 0x92, 0x6e, 0x74, 0x79,
-	0xa3, 0x15, 0x7a, 0xc3, 0x75, 0x32, 0xf8, 0xbd, 0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0x11, 0x15,
-	0xa1, 0xb8, 0x60, 0x0b, 0x00, 0x00,
+	// 1274 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xdc, 0x96, 0xcf, 0x6e, 0x1b, 0xd5,
+	0x17, 0xc7, 0x33, 0x49, 0x93, 0x38, 0xc7, 0xb1, 0x3d, 0xb9, 0xce, 0x9f, 0x69, 0xfb, 0xfb, 0xd9,
+	0x96, 0x17, 0x60, 0xa4, 0xca, 0x46, 0x05, 0x21, 0xa0, 0x20, 0xb0, 0x5d, 0x17, 0x5c, 0x35, 0x89,
+	0xb1, 0x23, 0x51, 0x8a, 0xd0, 0x68, 0x6c, 0x9f, 0x4e, 0x27, 0x78, 0xe6, 0x4e, 0x67, 0xae, 0xd3,
+	0x3f, 0xaf, 0xc0, 0x06, 0xb1, 0x44, 0x3c, 0x01, 0x4f, 0xc2, 0xb2, 0x42, 0x2c, 0x58, 0x59, 0xa8,
+	0xdd, 0xf9, 0x29, 0xd0, 0x9c, 0x7b, 0x27, 0xbe, 0x76, 0x16, 0xec, 0x58, 0xb0, 0xf4, 0xe7, 0x7b,
+	0xce, 0x99, 0x33, 0xf7, 0x7b, 0x7c, 0xee, 0xc0, 0x61, 0xf8, 0xbd, 0xdb, 0x70, 0x42, 0xaf, 0x21,
+	0x30, 0x16, 0x71, 0x88, 0xa3, 0x7a, 0x18, 0x71, 0xc1, 0xd9, 0x86, 0x13, 0x7a, 0x37, 0x4a, 0x2e,
+	0xe7, 0xee, 0x04, 0x1b, 0x84, 0x86, 0xd3, 0xc7, 0x8d, 0xf1, 0x34, 0x72, 0x84, 0xc7, 0x03, 0x19,
+	0x74, 0x63, 0x3f, 0x4d, 0x8e, 0xa7, 0x43, 0xdf, 0x13, 0x8a, 0x16, 0x53, 0x8a, 0x17, 0x18, 0xa4,
+	0x90, 0xa5, 0x30, 0xe0, 0x63, 0x94, 0xac, 0xfa, 0x47, 0x0e, 0x32, 0x67, 0x18, 0x8b, 0x41, 0x88,
+	0x23, 0xd6, 0x84, 0x6b, 0xe7, 0x7c, 0x18, 0x5b, 0x46, 0x65, 0xa3, 0x96, 0xbd, 0x7d, 0xbd, 0xee,
+	0x84, 0x5e, 0xfd, 0x3e, 0x1f, 0x0e, 0xa8, 0x72, 0x1f, 0x9f, 0x4e, 0x31, 0x16, 0x5d, 0x81, 0x7e,
+	0x8b, 0xcd, 0x67, 0xe5, 0x7c, 0x12, 0x7a, 0x8b, 0xfb, 0x9e, 0x40, 0x3f, 0x14, 0x2f, 0xfa, 0x94,
+	0xca, 0x1e, 0x42, 0x01, 0x9f, 0x87, 0x38, 0x12, 0x38, 0xb6, 0xe9, 0xd9, 0xb1, 0xb5, 0x4e, 0xd5,
+	0xf6, 0xa8, 0x5a, 0x27, 0x41, 0xc7, 0x18, 0xc7, 0x8e, 0x8b, 0xad, 0xff, 0xcd, 0x67, 0x65, 0x2b,
+	0x8d, 0x26, 0x45, 0xaf, 0x97, 0x5f, 0x56, 0xd8, 0x3b, 0xb0, 0xf9, 0x74, 0x8a, 0x53, 0xb4, 0x36,
+	0x2a, 0x46, 0x6d, 0xa7, 0x55, 0x9c, 0xcf, 0xca, 0x05, 0x02, 0x5a, 0x8e, 0x8c, 0x60, 0xef, 0x03,
+	0x9c, 0xf3, 0xa1, 0x1d, 0xa3, 0xb0, 0xbd, 0xb1, 0x75, 0x8d, 0xe2, 0x0f, 0xe7, 0xb3, 0x32, 0x3b,
+	0xe7, 0xc3, 0x01, 0x8a, 0xee, 0x58, 0x4b, 0xc9, 0xa4, 0x8c, 0x7d, 0x04, 0xd9, 0x60, 0xea, 0xdb,
+	0x43, 0x47, 0x8c, 0x9e, 0x60, 0x6c, 0x6d, 0x56, 0x8c, 0x5a, 0xae, 0x65, 0xcd, 0x67, 0xe5, 0xfd,
+	0x60, 0xea, 0xb7, 0x24, 0xd5, 0x12, 0x61, 0x41, 0xd9, 0x07, 0x00, 0x94, 0x66, 0xc7, 0xde, 0x4b,
+	0xb4, 0xb6, 0x28, 0xf3, 0x68, 0x3e, 0x2b, 0x17, 0x89, 0x0e, 0xbc, 0x97, 0x7a, 0x93, 0x3b, 0x97,
+	0x90, 0x1d, 0x43, 0xc6, 0x0b, 0x04, 0x46, 0x17, 0xce, 0xc4, 0xda, 0xae, 0x18, 0x74, 0xe8, 0xd2,
+	0xef, 0x7a, 0xea, 0x77, 0xfd, 0xae, 0xf2, 0x5b, 0xbe, 0x41, 0x1a, 0xae, 0xbf, 0x41, 0xca, 0xd8,
+	0x7d, 0xd8, 0x16, 0x9e, 0x8f, 0x7c, 0x2a, 0xac, 0xcc, 0x3f, 0x55, 0x3b, 0x98, 0xcf, 0xca, 0x7b,
+	0x2a, 0x5a, 0x2b, 0x96, 0x16, 0x60, 0xf7, 0x60, 0xcb, 0x19, 0x25, 0x91, 0xd6, 0x4e, 0xc5, 0xa8,
+	0xe5, 0x6f, 0x5b, 0xe4, 0x5f, 0x3a, 0x2a, 0xf5, 0x26, 0x69, 0x67, 0x2f, 0x42, 0x6c, 0xed, 0xcf,
+	0x67, 0x65, 0x53, 0xc6, 0x6a, 0x85, 0x54, 0x36, 0x7b, 0x0b, 0xae, 0x05, 0x8e, 0x8f, 0x16, 0x90,
+	0x0b, 0x34, 0x38, 0xc9, 0x6f, 0x7d, 0x70, 0x92, 0xdf, 0xec, 0x1e, 0x98, 0x91, 0x13, 0x8c, 0xb9,
+	0x6f, 0x8f, 0x26, 0x1e, 0x06, 0xe4, 0x5c, 0xb6, 0x62, 0xd4, 0x32, 0x72, 0x4c, 0xa4, 0xd6, 0x26,
+	0x69, 0xc9, 0xbf, 0xfc, 0xb2, 0xc2, 0xde, 0x85, 0x8c, 0x8b, 0xc2, 0x9e, 0x70, 0x37, 0xb6, 0x76,
+	0x29, 0x9f, 0xde, 0xd4, 0x45, 0xf1, 0x80, 0xbb, 0xba, 0x7f, 0xdb, 0x0a, 0xb1, 0x3b, 0x90, 0xc5,
+	0xe0, 0xc2, 0x8b, 0x78, 0xe0, 0x63, 0x20, 0xac, 0x1c, 0x35, 0x7a, 0x7d, 0x3e, 0x2b, 0x1f, 0x68,
+	0x58, 0x4b, 0xd4, 0xa3, 0xd9, 0x2d, 0xd8, 0x12, 0x4e, 0xe4, 0xa2, 0xb0, 0xf2, 0x94, 0x47, 0x87,
+	0x21, 0x89, 0x7e, 0x18, 0x92, 0xb0, 0x4f, 0x60, 0x37, 0xc0, 0x67, 0x76, 0x18, 0x79, 0x3c, 0xf2,
+	0xc4, 0x0b, 0xab, 0x50, 0x31, 0x6a, 0x86, 0x7c, 0x56, 0x80, 0xcf, 0x7a, 0x0a, 0xeb, 0xcf, 0xd2,
+	0x30, 0x6b, 0x41, 0x3e, 0x8c, 0x30, 0x11, 0xec, 0x08, 0x9d, 0x98, 0x07, 0x96, 0x49, 0xcf, 0xbc,
+	0x39, 0x9f, 0x95, 0x8f, 0x94, 0xd2, 0x27, 0x41, 0xab, 0x90, 0x5b, 0x12, 0x58, 0x1f, 0x76, 0x62,
+	0x9c, 0xa0, 0x74, 0x76, 0x8f, 0x9c, 0xbd, 0xb9, 0xec, 0xec, 0x20, 0x95, 0xc9, 0x5c, 0x9a, 0xe2,
+	0xcb, 0x0c, 0x7d, 0x8a, 0x2f, 0x21, 0xfb, 0x1a, 0xf2, 0x23, 0x27, 0x18, 0xe1, 0xc4, 0xe6, 0x81,
+	0x9d, 0xec, 0x16, 0x8b, 0xd1, 0xf4, 0x1d, 0x50, 0xe1, 0x13, 0x3e, 0xc6, 0x36, 0xc9, 0x6d, 0x1e,
+	0x3c, 0xf6, 0xdc, 0xd6, 0x8d, 0xf9, 0xac, 0x7c, 0x28, 0x13, 0x4e, 0x83, 0x44, 0xd5, 0xaa, 0xee,
+	0xea, 0x9c, 0x7d, 0x0b, 0x85, 0xf4, 0x85, 0xd3, 0xca, 0x45, 0xaa, 0x7c, 0x78, 0x59, 0xb9, 0x27,
+	0x75, 0x55, 0x5a, 0x3f, 0x89, 0x2b, 0xb5, 0x73, 0x4b, 0x02, 0xfb, 0x0c, 0x72, 0x22, 0xf2, 0x5c,
+	0x17, 0x23, 0xb9, 0xa8, 0xac, 0x7d, 0x3a, 0x4c, 0xea, 0x4e, 0x09, 0xb4, 0x79, 0xf4, 0xee, 0x74,
+	0xce, 0x4e, 0x60, 0x97, 0xd6, 0x8d, 0x3d, 0xa2, 0x87, 0x5b, 0x07, 0xd4, 0x9a, 0x49, 0xad, 0x7d,
+	0x95, 0x08, 0xaa, 0x29, 0xb2, 0xf7, 0xe9, 0x02, 0xe8, 0xf6, 0x6a, 0x38, 0x19, 0x0e, 0x67, 0x2a,
+	0x9e, 0x24, 0xe5, 0x04, 0x3e, 0x17, 0xd6, 0xe1, 0x62, 0x10, 0x13, 0xde, 0x96, 0x58, 0xcf, 0xd6,
+	0x30, 0xeb, 0xc2, 0x9e, 0x5c, 0x98, 0x36, 0x46, 0x11, 0x8f, 0xec, 0x51, 0x72, 0x5a, 0x47, 0x15,
+	0xa3, 0xb6, 0xd9, 0xfa, 0xff, 0x7c, 0x56, 0xbe, 0x2e, 0xc5, 0x4e, 0xa2, 0xb5, 0x97, 0xcf, 0xa5,
+	0xb0, 0x22, 0x55, 0xbf, 0x03, 0x58, 0xfc, 0xbd, 0x59, 0x01, 0xb2, 0xcd, 0xf6, 0x59, 0xf7, 0xf4,
+	0xc4, 0x3e, 0x39, 0x3d, 0xe9, 0x98, 0x6b, 0x6c, 0x0f, 0x72, 0x0a, 0xb4, 0x9b, 0x27, 0xed, 0xce,
+	0x03, 0xd3, 0x60, 0x0c, 0xf2, 0x0a, 0xf5, 0xfa, 0x9d, 0xce, 0x71, 0xef, 0xcc, 0x5c, 0x67, 0x47,
+	0x50, 0x54, 0xac, 0xdf, 0xe9, 0xf5, 0xbb, 0xa7, 0xfd, 0xee, 0x59, 0xf7, 0x51, 0xc7, 0xdc, 0xa8,
+	0x0e, 0x21, 0xb7, 0x34, 0x63, 0xcc, 0x84, 0xdd, 0x41, 0xe7, 0x41, 0x27, 0x7d, 0x88, 0xb9, 0xc6,
+	0x8a, 0x50, 0x58, 0x90, 0xd6, 0x37, 0x76, 0xf7, 0xae, 0x69, 0xb0, 0x7d, 0x30, 0x97, 0xe0, 0xa0,
+	0x93, 0x3c, 0x66, 0x95, 0x76, 0xef, 0x0e, 0xcc, 0x8d, 0xea, 0xcf, 0x06, 0x98, 0xab, 0x83, 0xc7,
+	0xbe, 0x80, 0xed, 0x48, 0x5e, 0x62, 0x96, 0xb1, 0x32, 0x46, 0x32, 0x4e, 0x5d, 0x71, 0x72, 0x63,
+	0xa8, 0x50, 0x7d, 0x63, 0x28, 0xc4, 0x3e, 0x85, 0x5c, 0x32, 0x8c, 0x76, 0xc8, 0xf9, 0xc4, 0x16,
+	0x8e, 0x6b, 0xad, 0x2f, 0xac, 0x4a, 0x84, 0x1e, 0xe7, 0x93, 0x33, 0x67, 0xc9, 0x68, 0x0d, 0x57,
+	0x7f, 0x31, 0x60, 0xef, 0xca, 0xec, 0xb2, 0x2f, 0x57, 0xbb, 0x3b, 0x5a, 0x1d, 0xf2, 0x7f, 0xa9,
+	0xbd, 0xdf, 0x0d, 0xc8, 0x6a, 0xf3, 0xcb, 0x3e, 0x86, 0xcd, 0x18, 0xc5, 0x34, 0x54, 0x6d, 0x15,
+	0x16, 0x03, 0x3e, 0x48, 0xb0, 0xbc, 0x89, 0x29, 0x42, 0xbf, 0x89, 0x09, 0xb0, 0x63, 0x00, 0x27,
+	0x8e, 0x31, 0x4a, 0xbc, 0x4e, 0xbf, 0x04, 0x8a, 0x8b, 0x02, 0xcd, 0x54, 0x93, 0xf7, 0xec, 0x22,
+	0x54, 0xbf, 0x67, 0x17, 0x94, 0x7d, 0x08, 0x5b, 0xd3, 0x70, 0xec, 0x08, 0xa4, 0x4b, 0x3d, 0x7b,
+	0x1b, 0x16, 0xa5, 0xe4, 0xe6, 0x95, 0xaa, 0xbe, 0x79, 0x25, 0xa9, 0xfe, 0xb4, 0x0e, 0xb0, 0xe8,
+	0xf9, 0x3f, 0x70, 0xd7, 0xb7, 0x00, 0xe4, 0xf6, 0x49, 0x3e, 0x18, 0xd5, 0x75, 0xaf, 0x1f, 0x07,
+	0xb5, 0x44, 0x11, 0xc9, 0x56, 0xd7, 0x5b, 0xba, 0x84, 0xd5, 0x1f, 0xd6, 0x21, 0xbf, 0xec, 0x03,
+	0xfb, 0x1c, 0xf2, 0xc9, 0xc5, 0x7d, 0x81, 0xb6, 0x17, 0xd0, 0x00, 0x91, 0xeb, 0x6a, 0x2d, 0x4a,
+	0xa5, 0x1b, 0x24, 0x93, 0xa2, 0xaf, 0x45, 0x9d, 0x27, 0x8b, 0xc8, 0x09, 0x43, 0x74, 0xa2, 0x38,
+	0x29, 0x11, 0x8b, 0x08, 0x1d, 0x9f, 0x26, 0x30, 0x23, 0x17, 0x91, 0x12, 0xbb, 0xc1, 0x80, 0x24,
+	0x7d, 0x11, 0xad, 0x48, 0xec, 0x0e, 0x6c, 0xfb, 0xca, 0xa1, 0x8d, 0x2b, 0x2f, 0x48, 0xff, 0x02,
+	0xff, 0x8a, 0x55, 0x69, 0x06, 0x6b, 0xc0, 0xf6, 0x18, 0x27, 0x28, 0x50, 0x7e, 0x01, 0xaa, 0xef,
+	0x00, 0x85, 0xf4, 0x04, 0x85, 0x5a, 0x0f, 0x7f, 0x7b, 0x5d, 0x32, 0x5e, 0xbd, 0x2e, 0x19, 0x7f,
+	0xbd, 0x2e, 0x19, 0x3f, 0xbe, 0x29, 0xad, 0xbd, 0x7a, 0x53, 0x5a, 0xfb, 0xf3, 0x4d, 0x69, 0xed,
+	0xd1, 0xdb, 0xae, 0x27, 0x9e, 0x4c, 0x87, 0xf5, 0x11, 0xf7, 0x1b, 0x4e, 0xe4, 0x3b, 0x63, 0x27,
+	0x8c, 0xf8, 0x39, 0x8e, 0x84, 0xfa, 0xd5, 0x50, 0x1f, 0xd6, 0xbf, 0xae, 0xef, 0x37, 0x09, 0xf4,
+	0xa4, 0x5c, 0xef, 0xf2, 0x7a, 0x33, 0xf4, 0x86, 0x5b, 0x64, 0xf0, 0x7b, 0x7f, 0x07, 0x00, 0x00,
+	0xff, 0xff, 0x32, 0x83, 0xc3, 0xa5, 0xe9, 0x0b, 0x00, 0x00,
 }
 
 func (m *TestSpec) Marshal() (dAtA []byte, err error) {
@@ -757,6 +781,22 @@ func (m *TestSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.ExpectErrorCode != 0 {
+		i = encodeVarintTestspec(dAtA, i, uint64(m.ExpectErrorCode))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xb8
+	}
+	if len(m.AuthContext) > 0 {
+		i -= len(m.AuthContext)
+		copy(dAtA[i:], m.AuthContext)
+		i = encodeVarintTestspec(dAtA, i, uint64(len(m.AuthContext)))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xb2
+	}
 	if m.QueueConfig != nil {
 		{
 			size, err := m.QueueConfig.MarshalToSizedBuffer(dAtA[:i])
@@ -1317,6 +1357,13 @@ func (m *TestSpec) Size() (n int) {
 		l = m.QueueConfig.Size()
 		n += 2 + l + sovTestspec(uint64(l))
 	}
+	l = len(m.AuthContext)
+	if l > 0 {
+		n += 2 + l + sovTestspec(uint64(l))
+	}
+	if m.ExpectErrorCode != 0 {
+		n += 2 + sovTestspec(uint64(m.ExpectErrorCode))
+	}
 	return n
 }
 
@@ -2057,6 +2104,57 @@ func (m *TestSpec) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 22:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AuthContext", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTestspec
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTestspec
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTestspec
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AuthContext = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 23:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExpectErrorCode", wireType)
+			}
+			m.ExpectErrorCode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowTestspec
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ExpectErrorCode |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipTestspec(dAtA[iNdEx:])
diff --git a/pkg/api/testspec.proto b/pkg/api/testspec.proto
index 241888c7836..ec8be7d9229 100644
--- a/pkg/api/testspec.proto
+++ b/pkg/api/testspec.proto
@@ -73,6 +73,13 @@ message TestSpec {
     string trigger_event = 20;
     // Optional queue lifecycle phases.
     QueueConfig queue_config = 21;
+    // Named armadactl context (see client.ApiConnectionDetails) to authenticate this test's
+    // API calls with. If empty, falls back to the connection details the suite was invoked with.
+    string auth_context = 22;
+    // If non-zero, the test expects job submission/cancellation/reprioritization or queue
+    // create/update/delete to fail with this gRPC status code (see google.golang.org/grpc/codes)
+    // rather than succeed. Mutually exclusive with expecting expected_events to be observed.
+    int32 expect_error_code = 23;
 }
 
 message NodeCancelConfig {
diff --git a/pkg/client/command_line.go b/pkg/client/command_line.go
index c142480bc14..dde013fd963 100644
--- a/pkg/client/command_line.go
+++ b/pkg/client/command_line.go
@@ -183,6 +183,22 @@ func ExtractConfigurationContexts() []string {
 	return contexts
 }
 
+// ResolveNamedContext resolves a named context (as defined under "contexts" in the config loaded
+// into viper) directly into ApiConnectionDetails, without going through the "currentContext" /
+// "armadaUrl" command-line flags. Hence, this function must be called after loading config into
+// viper, e.g., by calling LoadCommandlineArgsFromConfigFile.
+func ResolveNamedContext(contextName string) (*ApiConnectionDetails, error) {
+	subTree := viper.Sub(fmt.Sprintf("contexts.%s", contextName))
+	if subTree == nil {
+		return nil, fmt.Errorf("context %s not found under contexts within the Armada config", contextName)
+	}
+	apiConnectionDetails := &ApiConnectionDetails{}
+	if err := subTree.Unmarshal(apiConnectionDetails); err != nil {
+		return nil, err
+	}
+	return apiConnectionDetails, nil
+}
+
 // ExtractCommandlineArmadaApiConnectionDetails extracts Armada server connection details from the
 // config loaded into viper. Hence, this function must be called after loading config into viper,
 // e.g., by calling LoadCommandlineArgsFromConfigFile.
@@ -191,11 +207,10 @@ func ExtractCommandlineArmadaApiConnectionDetails() (*ApiConnectionDetails, erro
 	var err error
 
 	if context := viper.GetString("currentContext"); context != "" {
-		subTree := viper.Sub(fmt.Sprintf("contexts.%s", context))
-		if subTree == nil {
-			return nil, fmt.Errorf("context %s not found under contexts within the Armada config", context)
+		apiConnectionDetails, err = ResolveNamedContext(context)
+		if err != nil {
+			return nil, err
 		}
-		err = subTree.Unmarshal(apiConnectionDetails)
 		if viper.GetString("armadaUrl") != defaultArmadaConnectionUrl {
 			apiConnectionDetails.ArmadaUrl = viper.GetString("armadaUrl")
 		}
diff --git a/testsuite/testcases/rbac/rbac_cancel_with_global_permission.yaml b/testsuite/testcases/rbac/rbac_cancel_with_global_permission.yaml
new file mode 100644
index 00000000000..1a7eb6aafc1
--- /dev/null
+++ b/testsuite/testcases/rbac/rbac_cancel_with_global_permission.yaml
@@ -0,0 +1,40 @@
+# RBAC: a principal with the global cancel_any_jobs permission (armada-admin) can cancel jobs
+# in a queue it doesn't own.
+queue: rbac-cancel-with-perm
+authContext: rbac-admin
+numBatches: 1
+batchSize: 1
+jobs:
+  - priority: 0
+    namespace: personal-anonymous
+    podSpec:
+      terminationGracePeriodSeconds: 0
+      restartPolicy: Never
+      containers:
+        - name: cancel-by-id
+          imagePullPolicy: IfNotPresent
+          image: alpine:3.20.0
+          args:
+            - "sleep"
+            - "100s"
+          resources:
+            limits:
+              memory: 25Mi
+              cpu: 100m
+            requests:
+              memory: 25Mi
+              cpu: 100m
+---
+action: ACTION_CANCEL
+selection: SELECTION_BY_ID
+timeout: "100s"
+expectedEvents:
+  - submitted:
+  - cancelled:
+queueConfig:
+  setup:
+    # An explicit non-admin owner stops CreateQueue's auto-add-owner default (which would
+    # otherwise make armada-admin the queue owner and let ownership -- not cancel_any_jobs --
+    # explain a successful cancel).
+    queueSpec:
+      userOwners: ["nobody"]
diff --git a/testsuite/testcases/rbac/rbac_cancel_without_permission.yaml b/testsuite/testcases/rbac/rbac_cancel_without_permission.yaml
new file mode 100644
index 00000000000..f9b8ae350ba
--- /dev/null
+++ b/testsuite/testcases/rbac/rbac_cancel_without_permission.yaml
@@ -0,0 +1,35 @@
+# RBAC: a principal without cancel_any_jobs and without a queue-level cancel grant (armada-user)
+# cannot cancel a job, even one it submitted itself. Targets the shared rbac-fixture-restricted
+# queue (bootstrapped by CI under the admin identity, granting the /users group submit-only),
+# so submission succeeds via the queue-level grant but the subsequent cancel is denied.
+# ExpectedEvents is deliberately empty -- see testrunner.go's Run() for why a short list would
+# race the denied action.
+queue: rbac-fixture-restricted
+authContext: rbac-user
+numBatches: 1
+batchSize: 1
+jobs:
+  - priority: 0
+    namespace: personal-anonymous
+    podSpec:
+      terminationGracePeriodSeconds: 0
+      restartPolicy: Never
+      containers:
+        - name: cancel-by-id
+          imagePullPolicy: IfNotPresent
+          image: alpine:3.20.0
+          args:
+            - "sleep"
+            - "100s"
+          resources:
+            limits:
+              memory: 25Mi
+              cpu: 100m
+            requests:
+              memory: 25Mi
+              cpu: 100m
+---
+action: ACTION_CANCEL
+selection: SELECTION_BY_ID
+timeout: "30s"
+expectErrorCode: 7 # PERMISSION_DENIED
diff --git a/testsuite/testcases/rbac/rbac_get_jobset_events_with_permission.yaml b/testsuite/testcases/rbac/rbac_get_jobset_events_with_permission.yaml
new file mode 100644
index 00000000000..a693680c17a
--- /dev/null
+++ b/testsuite/testcases/rbac/rbac_get_jobset_events_with_permission.yaml
@@ -0,0 +1,37 @@
+# RBAC: a principal with the global watch_all_events permission (armada-admin) can watch a job
+# set's events via GetJobSetEvents in a queue it doesn't own.
+queue: rbac-watch-with-perm
+authContext: rbac-admin
+numBatches: 1
+batchSize: 1
+jobs:
+  - priority: 0
+    namespace: personal-anonymous
+    podSpec:
+      terminationGracePeriodSeconds: 0
+      restartPolicy: Never
+      containers:
+        - name: sleep
+          imagePullPolicy: IfNotPresent
+          image: alpine:3.20.0
+          args:
+            - "ls"
+          resources:
+            limits:
+              memory: 25Mi
+              cpu: 100m
+            requests:
+              memory: 25Mi
+              cpu: 100m
+---
+timeout: "100s"
+expectedEvents:
+  - submitted:
+  - succeeded:
+queueConfig:
+  setup:
+    # An explicit non-admin owner stops CreateQueue's auto-add-owner default (which would
+    # otherwise make armada-admin the queue owner and let ownership -- not watch_all_events --
+    # explain successfully watching events).
+    queueSpec:
+      userOwners: ["nobody"]
diff --git a/testsuite/testcases/rbac/rbac_get_jobset_events_without_permission.yaml b/testsuite/testcases/rbac/rbac_get_jobset_events_without_permission.yaml
new file mode 100644
index 00000000000..725a8853f87
--- /dev/null
+++ b/testsuite/testcases/rbac/rbac_get_jobset_events_without_permission.yaml
@@ -0,0 +1,34 @@
+# RBAC: a principal without watch_all_events and without a queue-level watch grant (armada-user)
+# cannot watch job-set events via GetJobSetEvents, even for a job it submitted itself. Targets
+# the shared rbac-fixture-restricted queue (bootstrapped by CI under the admin identity, granting
+# the /users group submit-only), so submission succeeds via the queue-level grant but the
+# GetJobSetEvents stream that Run() opens to watch for events is denied.
+# ExpectedEvents is deliberately empty -- see testrunner.go's Run() for why a short list would
+# race the denied watch (eventwatcher.EventWatcher.Run returns PermissionDenied immediately,
+# without retrying, cancelling the errgroup's shared ctx).
+queue: rbac-fixture-restricted
+authContext: rbac-user
+numBatches: 1
+batchSize: 1
+jobs:
+  - priority: 0
+    namespace: personal-anonymous
+    podSpec:
+      terminationGracePeriodSeconds: 0
+      restartPolicy: Never
+      containers:
+        - name: sleep
+          imagePullPolicy: IfNotPresent
+          image: alpine:3.20.0
+          args:
+            - "ls"
+          resources:
+            limits:
+              memory: 25Mi
+              cpu: 100m
+            requests:
+              memory: 25Mi
+              cpu: 100m
+---
+timeout: "30s"
+expectErrorCode: 7 # PERMISSION_DENIED
diff --git a/testsuite/testcases/rbac/rbac_reprioritize_with_global_permission.yaml b/testsuite/testcases/rbac/rbac_reprioritize_with_global_permission.yaml
new file mode 100644
index 00000000000..7e1fb72e6f5
--- /dev/null
+++ b/testsuite/testcases/rbac/rbac_reprioritize_with_global_permission.yaml
@@ -0,0 +1,41 @@
+# RBAC: a principal with the global reprioritize_any_jobs permission (armada-admin) can
+# reprioritize jobs in a queue it doesn't own.
+queue: rbac-reprioritize-with-perm
+authContext: rbac-admin
+numBatches: 1
+batchSize: 1
+jobs:
+  - priority: 0
+    namespace: personal-anonymous
+    podSpec:
+      terminationGracePeriodSeconds: 0
+      restartPolicy: Never
+      containers:
+        - name: reprioritize-by-id
+          imagePullPolicy: IfNotPresent
+          image: alpine:3.20.0
+          args:
+            - "sleep"
+            - "100s"
+          resources:
+            limits:
+              memory: 25Mi
+              cpu: 100m
+            requests:
+              memory: 25Mi
+              cpu: 100m
+---
+action: ACTION_REPRIORITIZE
+selection: SELECTION_BY_ID
+newPriority: 100
+timeout: "100s"
+expectedEvents:
+  - submitted:
+  - reprioritized:
+queueConfig:
+  setup:
+    # An explicit non-admin owner stops CreateQueue's auto-add-owner default (which would
+    # otherwise make armada-admin the queue owner and let ownership -- not
+    # reprioritize_any_jobs -- explain a successful reprioritize).
+    queueSpec:
+      userOwners: ["nobody"]
diff --git a/testsuite/testcases/rbac/rbac_reprioritize_without_permission.yaml b/testsuite/testcases/rbac/rbac_reprioritize_without_permission.yaml
new file mode 100644
index 00000000000..1df91223524
--- /dev/null
+++ b/testsuite/testcases/rbac/rbac_reprioritize_without_permission.yaml
@@ -0,0 +1,37 @@
+# RBAC: a principal without reprioritize_any_jobs and without a queue-level reprioritize grant
+# (armada-user) cannot reprioritize a job, even one it submitted itself. Targets the shared
+# rbac-fixture-restricted queue (bootstrapped by CI under the admin identity, granting the
+# /users group submit-only), so submission succeeds via the queue-level grant but the
+# subsequent reprioritize is denied.
+# ExpectedEvents is deliberately empty -- see testrunner.go's Run() for why a short list would
+# race the denied action.
+queue: rbac-fixture-restricted
+authContext: rbac-user
+numBatches: 1
+batchSize: 1
+jobs:
+  - priority: 0
+    namespace: personal-anonymous
+    podSpec:
+      terminationGracePeriodSeconds: 0
+      restartPolicy: Never
+      containers:
+        - name: reprioritize-by-id
+          imagePullPolicy: IfNotPresent
+          image: alpine:3.20.0
+          args:
+            - "sleep"
+            - "100s"
+          resources:
+            limits:
+              memory: 25Mi
+              cpu: 100m
+            requests:
+              memory: 25Mi
+              cpu: 100m
+---
+action: ACTION_REPRIORITIZE
+selection: SELECTION_BY_ID
+newPriority: 100
+timeout: "30s"
+expectErrorCode: 7 # PERMISSION_DENIED
diff --git a/testsuite/testcases/rbac/rbac_submit_with_global_permission.yaml b/testsuite/testcases/rbac/rbac_submit_with_global_permission.yaml
new file mode 100644
index 00000000000..6655973c179
--- /dev/null
+++ b/testsuite/testcases/rbac/rbac_submit_with_global_permission.yaml
@@ -0,0 +1,37 @@
+# RBAC: a principal with the global submit_any_jobs permission (armada-admin) can submit to a
+# queue it doesn't own.
+queue: rbac-submit-with-perm
+authContext: rbac-admin
+numBatches: 1
+batchSize: 1
+jobs:
+  - priority: 0
+    namespace: personal-anonymous
+    podSpec:
+      terminationGracePeriodSeconds: 0
+      restartPolicy: Never
+      containers:
+        - name: sleep
+          imagePullPolicy: IfNotPresent
+          image: alpine:3.20.0
+          args:
+            - "ls"
+          resources:
+            limits:
+              memory: 25Mi
+              cpu: 100m
+            requests:
+              memory: 25Mi
+              cpu: 100m
+---
+timeout: "100s"
+expectedEvents:
+  - submitted:
+  - succeeded:
+queueConfig:
+  setup:
+    # An explicit non-admin owner stops CreateQueue's auto-add-owner default (which would
+    # otherwise make armada-admin the queue owner and let ownership -- not submit_any_jobs --
+    # explain a successful submit).
+    queueSpec:
+      userOwners: ["nobody"]
diff --git a/testsuite/testcases/rbac/rbac_submit_without_permission.yaml b/testsuite/testcases/rbac/rbac_submit_without_permission.yaml
new file mode 100644
index 00000000000..cb656818c0e
--- /dev/null
+++ b/testsuite/testcases/rbac/rbac_submit_without_permission.yaml
@@ -0,0 +1,29 @@
+# RBAC: a principal without submit_any_jobs (armada-user) and without a queue-level submit
+# grant cannot submit jobs. Targets the shared rbac-fixture-plain queue (bootstrapped by CI
+# under the admin identity; this test must not create or delete it -- no queueConfig).
+queue: rbac-fixture-plain
+authContext: rbac-user
+numBatches: 1
+batchSize: 1
+jobs:
+  - priority: 0
+    namespace: personal-anonymous
+    podSpec:
+      terminationGracePeriodSeconds: 0
+      restartPolicy: Never
+      containers:
+        - name: sleep
+          imagePullPolicy: IfNotPresent
+          image: alpine:3.20.0
+          args:
+            - "ls"
+          resources:
+            limits:
+              memory: 25Mi
+              cpu: 100m
+            requests:
+              memory: 25Mi
+              cpu: 100m
+---
+timeout: "30s"
+expectErrorCode: 7 # PERMISSION_DENIED