Index: src/applications/drydock/controller/DrydockLeaseViewController.php
===================================================================
--- src/applications/drydock/controller/DrydockLeaseViewController.php
+++ src/applications/drydock/controller/DrydockLeaseViewController.php
@@ -32,6 +32,7 @@
     $pager->setOffset($request->getInt('offset'));
 
     $logs = id(new DrydockLogQuery())
+      ->setViewer($user)
       ->withLeaseIDs(array($lease->getID()))
       ->executeWithOffsetPager($pager);
 
Index: src/applications/drydock/controller/DrydockLogController.php
===================================================================
--- src/applications/drydock/controller/DrydockLogController.php
+++ src/applications/drydock/controller/DrydockLogController.php
@@ -8,7 +8,8 @@
 
     $nav = $this->buildSideNav('log');
 
-    $query = new DrydockLogQuery();
+    $query = id(new DrydockLogQuery())
+      ->setViewer($user);
 
     $resource_ids = $request->getStrList('resource');
     if ($resource_ids) {
Index: src/applications/drydock/controller/DrydockResourceViewController.php
===================================================================
--- src/applications/drydock/controller/DrydockResourceViewController.php
+++ src/applications/drydock/controller/DrydockResourceViewController.php
@@ -41,6 +41,7 @@
     $pager->setOffset($request->getInt('offset'));
 
     $logs = id(new DrydockLogQuery())
+      ->setViewer($user)
       ->withResourceIDs(array($resource->getID()))
       ->executeWithOffsetPager($pager);
 
Index: src/applications/drydock/management/DrydockManagementLeaseWorkflow.php
===================================================================
--- src/applications/drydock/management/DrydockManagementLeaseWorkflow.php
+++ src/applications/drydock/management/DrydockManagementLeaseWorkflow.php
@@ -59,9 +59,8 @@
       }
 
       $logs = id(new DrydockLogQuery())
+        ->setViewer(PhabricatorUser::getOmnipotentUser())
         ->withLeaseIDs(array($lease->getID()))
-        ->withAfterID($cursor)
-        ->setOrder(DrydockLogQuery::ORDER_ID)
         ->execute();
 
       if ($logs) {
Index: src/applications/drydock/query/DrydockLogQuery.php
===================================================================
--- src/applications/drydock/query/DrydockLogQuery.php
+++ src/applications/drydock/query/DrydockLogQuery.php
@@ -1,14 +1,9 @@
 <?php
 
-final class DrydockLogQuery extends PhabricatorOffsetPagedQuery {
-
-  const ORDER_EPOCH   = 'order-epoch';
-  const ORDER_ID      = 'order-id';
+final class DrydockLogQuery extends PhabricatorCursorPagedPolicyAwareQuery {
 
   private $resourceIDs;
   private $leaseIDs;
-  private $afterID;
-  private $order = self::ORDER_EPOCH;
 
   public function withResourceIDs(array $ids) {
     $this->resourceIDs = $ids;
@@ -20,17 +15,7 @@
     return $this;
   }
 
-  public function setOrder($order) {
-    $this->order = $order;
-    return $this;
-  }
-
-  public function withAfterID($id) {
-    $this->afterID = $id;
-    return $this;
-  }
-
-  public function execute() {
+  public function loadPage() {
     $table = new DrydockLog();
     $conn_r = $table->establishConnection('r');
 
@@ -45,6 +30,26 @@
     return $table->loadAllFromArray($data);
   }
 
+  public function willFilterPage(array $logs) {
+    $resource_ids = mpull($logs, 'getResourceID');
+    $resources = id(new DrydockResourceQuery())
+      ->setParentQuery($this)
+      ->setViewer($this->getViewer())
+      ->withIDs($resource_ids)
+      ->execute();
+
+    foreach ($logs as $key => $log) {
+      $resource = idx($resources, $log->getResourceID());
+      if (!$resource) {
+        unset($logs[$key]);
+        continue;
+      }
+      $log->attachResource($resource);
+    }
+
+    return $logs;
+  }
+
   private function buildWhereClause(AphrontDatabaseConnection $conn_r) {
     $where = array();
 
@@ -62,25 +67,13 @@
         $this->leaseIDs);
     }
 
-    if ($this->afterID) {
-      $where[] = qsprintf(
-        $conn_r,
-        'id > %d',
-        $this->afterID);
-    }
+    $where[] = $this->buildPagingClause($conn_r);
 
     return $this->formatWhereClause($where);
   }
 
-  private function buildOrderClause(AphrontDatabaseConnection $conn_r) {
-    switch ($this->order) {
-      case self::ORDER_EPOCH:
-        return 'ORDER BY log.epoch DESC, log.id DESC';
-      case self::ORDER_ID:
-        return 'ORDER BY id ASC';
-      default:
-        throw new Exception("Unknown order '{$this->order}'!");
-    }
+  public function getQueryApplicationClass() {
+    return 'PhabricatorApplicationDrydock';
   }
 
 }
Index: src/applications/drydock/storage/DrydockLog.php
===================================================================
--- src/applications/drydock/storage/DrydockLog.php
+++ src/applications/drydock/storage/DrydockLog.php
@@ -1,16 +1,50 @@
 <?php
 
-final class DrydockLog extends DrydockDAO {
+final class DrydockLog extends DrydockDAO
+  implements PhabricatorPolicyInterface {
 
   protected $resourceID;
   protected $leaseID;
   protected $epoch;
   protected $message;
 
+  private $resource = self::ATTACHABLE;
+
   public function getConfiguration() {
     return array(
       self::CONFIG_TIMESTAMPS => false,
     ) + parent::getConfiguration();
   }
 
+  public function attachResource(DrydockResource $resource) {
+    $this->resource = $resource;
+    return $this;
+  }
+
+  public function getResource() {
+    return $this->assertAttached($this->resource);
+  }
+
+
+/* -(  PhabricatorPolicyInterface  )----------------------------------------- */
+
+
+  public function getCapabilities() {
+    return array(
+      PhabricatorPolicyCapability::CAN_VIEW,
+    );
+  }
+
+  public function getPolicy($capability) {
+    return $this->getResource()->getPolicy($capability);
+  }
+
+  public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
+    return $this->getResource()->hasAutomaticCapability($capability, $viewer);
+  }
+
+  public function describeAutomaticCapability($capability) {
+    return pht('Logs inherit the policy of their resources.');
+  }
+
 }