Index: src/__phutil_library_map__.php
===================================================================
--- src/__phutil_library_map__.php
+++ src/__phutil_library_map__.php
@@ -1050,6 +1050,7 @@
     'PasteEmbedView' => 'applications/paste/view/PasteEmbedView.php',
     'PasteMockMailReceiver' => 'applications/paste/mail/PasteMockMailReceiver.php',
     'PasteReplyHandler' => 'applications/paste/mail/PasteReplyHandler.php',
+    'PeopleCapabilityBrowseUserDirectory' => 'applications/people/capability/PeopleCapabilityBrowseUserDirectory.php',
     'Phabricator404Controller' => 'applications/base/controller/Phabricator404Controller.php',
     'PhabricatorAWSConfigOptions' => 'applications/config/option/PhabricatorAWSConfigOptions.php',
     'PhabricatorAccessControlTestCase' => 'applications/base/controller/__tests__/PhabricatorAccessControlTestCase.php',
@@ -3654,6 +3655,7 @@
     'PasteEmbedView' => 'AphrontView',
     'PasteMockMailReceiver' => 'PhabricatorObjectMailReceiver',
     'PasteReplyHandler' => 'PhabricatorMailReplyHandler',
+    'PeopleCapabilityBrowseUserDirectory' => 'PhabricatorPolicyCapability',
     'Phabricator404Controller' => 'PhabricatorController',
     'PhabricatorAWSConfigOptions' => 'PhabricatorApplicationConfigOptions',
     'PhabricatorAccessControlTestCase' => 'PhabricatorTestCase',
Index: src/applications/people/application/PhabricatorApplicationPeople.php
===================================================================
--- src/applications/people/application/PhabricatorApplicationPeople.php
+++ src/applications/people/application/PhabricatorApplicationPeople.php
@@ -62,6 +62,14 @@
     );
   }
 
+
+  protected function getCustomCapabilities() {
+    return array(
+      PeopleCapabilityBrowseUserDirectory::CAPABILITY => array(
+      ),
+    );
+  }
+
   public function loadStatus(PhabricatorUser $user) {
     if (!$user->getIsAdmin()) {
       return array();
Index: src/applications/people/capability/PeopleCapabilityBrowseUserDirectory.php
===================================================================
--- /dev/null
+++ src/applications/people/capability/PeopleCapabilityBrowseUserDirectory.php
@@ -0,0 +1,25 @@
+<?php
+
+final class PeopleCapabilityBrowseUserDirectory
+  extends PhabricatorPolicyCapability {
+
+  const CAPABILITY = 'people.browse';
+
+  public function getCapabilityKey() {
+    return self::CAPABILITY;
+  }
+
+  public function getCapabilityName() {
+    return pht('Can Browse User Directory');
+  }
+
+  public function shouldAllowPublicPolicySetting() {
+    return true;
+  }
+
+  public function describeCapabilityRejection() {
+    return pht(
+      'You do not have permission to browse the user directory.');
+  }
+
+}
Index: src/applications/people/controller/PhabricatorPeopleListController.php
===================================================================
--- src/applications/people/controller/PhabricatorPeopleListController.php
+++ src/applications/people/controller/PhabricatorPeopleListController.php
@@ -19,6 +19,11 @@
 
   public function processRequest() {
     $request = $this->getRequest();
+    $viewer = $request->getUser();
+
+    $this->requireApplicationCapability(
+      PeopleCapabilityBrowseUserDirectory::CAPABILITY);
+
     $controller = id(new PhabricatorApplicationSearchController($request))
       ->setQueryKey($this->key)
       ->setSearchEngine(new PhabricatorPeopleSearchEngine())