diff --git a/resources/sql/autopatches/20151207.editengine.1.sql b/resources/sql/autopatches/20151207.editengine.1.sql
new file mode 100644
index 0000000000..5111ec99ed
--- /dev/null
+++ b/resources/sql/autopatches/20151207.editengine.1.sql
@@ -0,0 +1,11 @@
+ALTER TABLE {$NAMESPACE}_search.search_editengineconfiguration
+  DROP editPolicy;
+
+ALTER TABLE {$NAMESPACE}_search.search_editengineconfiguration
+  ADD isEdit BOOL NOT NULL;
+
+ALTER TABLE {$NAMESPACE}_search.search_editengineconfiguration
+  ADD createOrder INT UNSIGNED NOT NULL;
+
+ALTER TABLE {$NAMESPACE}_search.search_editengineconfiguration
+  ADD editOrder INT UNSIGNED NOT NULL;
diff --git a/src/applications/base/PhabricatorApplication.php b/src/applications/base/PhabricatorApplication.php
index c1cda07710..0a6a2b4cb5 100644
--- a/src/applications/base/PhabricatorApplication.php
+++ b/src/applications/base/PhabricatorApplication.php
@@ -1,638 +1,638 @@
 <?php
 
 /**
  * @task  info  Application Information
  * @task  ui    UI Integration
  * @task  uri   URI Routing
  * @task  mail  Email integration
  * @task  fact  Fact Integration
  * @task  meta  Application Management
  */
 abstract class PhabricatorApplication
   extends Phobject
   implements PhabricatorPolicyInterface {
 
   const MAX_STATUS_ITEMS      = 100;
 
   const GROUP_CORE            = 'core';
   const GROUP_UTILITIES       = 'util';
   const GROUP_ADMIN           = 'admin';
   const GROUP_DEVELOPER       = 'developer';
 
   final public static function getApplicationGroups() {
     return array(
       self::GROUP_CORE          => pht('Core Applications'),
       self::GROUP_UTILITIES     => pht('Utilities'),
       self::GROUP_ADMIN         => pht('Administration'),
       self::GROUP_DEVELOPER     => pht('Developer Tools'),
     );
   }
 
 
 /* -(  Application Information  )-------------------------------------------- */
 
   abstract public function getName();
 
   public function getShortDescription() {
     return pht('%s Application', $this->getName());
   }
 
   final public function isInstalled() {
     if (!$this->canUninstall()) {
       return true;
     }
 
     $prototypes = PhabricatorEnv::getEnvConfig('phabricator.show-prototypes');
     if (!$prototypes && $this->isPrototype()) {
       return false;
     }
 
     $uninstalled = PhabricatorEnv::getEnvConfig(
       'phabricator.uninstalled-applications');
 
     return empty($uninstalled[get_class($this)]);
   }
 
 
   public function isPrototype() {
     return false;
   }
 
 
   /**
    * Return `true` if this application should never appear in application lists
    * in the UI. Primarily intended for unit test applications or other
    * pseudo-applications.
    *
    * Few applications should be unlisted. For most applications, use
    * @{method:isLaunchable} to hide them from main launch views instead.
    *
    * @return bool True to remove application from UI lists.
    */
   public function isUnlisted() {
     return false;
   }
 
 
   /**
    * Return `true` if this application is a normal application with a base
    * URI and a web interface.
    *
    * Launchable applications can be pinned to the home page, and show up in the
    * "Launcher" view of the Applications application. Making an application
    * unlauncahble prevents pinning and hides it from this view.
    *
    * Usually, an application should be marked unlaunchable if:
    *
    *   - it is available on every page anyway (like search); or
    *   - it does not have a web interface (like subscriptions); or
    *   - it is still pre-release and being intentionally buried.
    *
    * To hide applications more completely, use @{method:isUnlisted}.
    *
    * @return bool True if the application is launchable.
    */
   public function isLaunchable() {
     return true;
   }
 
 
   /**
    * Return `true` if this application should be pinned by default.
    *
    * Users who have not yet set preferences see a default list of applications.
    *
    * @param PhabricatorUser User viewing the pinned application list.
    * @return bool True if this application should be pinned by default.
    */
   public function isPinnedByDefault(PhabricatorUser $viewer) {
     return false;
   }
 
 
   /**
    * Returns true if an application is first-party (developed by Phacility)
    * and false otherwise.
    *
    * @return bool True if this application is developed by Phacility.
    */
   final public function isFirstParty() {
     $where = id(new ReflectionClass($this))->getFileName();
     $root = phutil_get_library_root('phabricator');
 
     if (!Filesystem::isDescendant($where, $root)) {
       return false;
     }
 
     if (Filesystem::isDescendant($where, $root.'/extensions')) {
       return false;
     }
 
     return true;
   }
 
   public function canUninstall() {
     return true;
   }
 
   final public function getPHID() {
     return 'PHID-APPS-'.get_class($this);
   }
 
   public function getTypeaheadURI() {
     return $this->isLaunchable() ? $this->getBaseURI() : null;
   }
 
   public function getBaseURI() {
     return null;
   }
 
   final public function getApplicationURI($path = '') {
     return $this->getBaseURI().ltrim($path, '/');
   }
 
   public function getIconURI() {
     return null;
   }
 
   public function getFontIcon() {
     return 'fa-puzzle-piece';
   }
 
   public function getApplicationOrder() {
     return PHP_INT_MAX;
   }
 
   public function getApplicationGroup() {
     return self::GROUP_CORE;
   }
 
   public function getTitleGlyph() {
     return null;
   }
 
   final public function getHelpMenuItems(PhabricatorUser $viewer) {
     $items = array();
 
     $articles = $this->getHelpDocumentationArticles($viewer);
     if ($articles) {
       $items[] = id(new PHUIListItemView())
         ->setType(PHUIListItemView::TYPE_LABEL)
         ->setName(pht('%s Documentation', $this->getName()));
       foreach ($articles as $article) {
         $item = id(new PHUIListItemView())
           ->setName($article['name'])
           ->setIcon('fa-book')
           ->setHref($article['href']);
 
         $items[] = $item;
       }
     }
 
     $command_specs = $this->getMailCommandObjects();
     if ($command_specs) {
       $items[] = id(new PHUIListItemView())
         ->setType(PHUIListItemView::TYPE_LABEL)
         ->setName(pht('Email Help'));
       foreach ($command_specs as $key => $spec) {
         $object = $spec['object'];
 
         $class = get_class($this);
         $href = '/applications/mailcommands/'.$class.'/'.$key.'/';
 
         $item = id(new PHUIListItemView())
           ->setName($spec['name'])
           ->setIcon('fa-envelope-o')
           ->setHref($href);
         $items[] = $item;
       }
     }
 
     return $items;
   }
 
   public function getHelpDocumentationArticles(PhabricatorUser $viewer) {
     return array();
   }
 
   public function getOverview() {
     return null;
   }
 
   public function getEventListeners() {
     return array();
   }
 
   public function getRemarkupRules() {
     return array();
   }
 
   public function getQuicksandURIPatternBlacklist() {
     return array();
   }
 
   public function getMailCommandObjects() {
     return array();
   }
 
 
 /* -(  URI Routing  )-------------------------------------------------------- */
 
 
   public function getRoutes() {
     return array();
   }
 
   public function getResourceRoutes() {
     return array();
   }
 
 
 /* -(  Email Integration  )-------------------------------------------------- */
 
 
   public function supportsEmailIntegration() {
     return false;
   }
 
   final protected function getInboundEmailSupportLink() {
     return PhabricatorEnv::getDocLink('Configuring Inbound Email');
   }
 
   public function getAppEmailBlurb() {
     throw new PhutilMethodNotImplementedException();
   }
 
 
 /* -(  Fact Integration  )--------------------------------------------------- */
 
 
   public function getFactObjectsForAnalysis() {
     return array();
   }
 
 
 /* -(  UI Integration  )----------------------------------------------------- */
 
 
   /**
    * Render status elements (like "3 Waiting Reviews") for application list
    * views. These provide a way to alert users to new or pending action items
    * in applications.
    *
    * @param PhabricatorUser Viewing user.
    * @return list<PhabricatorApplicationStatusView> Application status elements.
    * @task ui
    */
   public function loadStatus(PhabricatorUser $user) {
     return array();
   }
 
 
   /**
    * You can provide an optional piece of flavor text for the application. This
    * is currently rendered in application launch views if the application has no
    * status elements.
    *
    * @return string|null Flavor text.
    * @task ui
    */
   public function getFlavorText() {
     return null;
   }
 
 
   /**
    * Build items for the main menu.
    *
    * @param  PhabricatorUser    The viewing user.
    * @param  AphrontController  The current controller. May be null for special
    *                            pages like 404, exception handlers, etc.
    * @return list<PHUIListItemView> List of menu items.
    * @task ui
    */
   public function buildMainMenuItems(
     PhabricatorUser $user,
     PhabricatorController $controller = null) {
     return array();
   }
 
 
   /**
    * Build extra items for the main menu. Generally, this is used to render
    * static dropdowns.
    *
    * @param  PhabricatorUser    The viewing user.
    * @param  AphrontController  The current controller. May be null for special
    *                            pages like 404, exception handlers, etc.
    * @return view               List of menu items.
    * @task ui
    */
   public function buildMainMenuExtraNodes(
     PhabricatorUser $viewer,
     PhabricatorController $controller = null) {
     return array();
   }
 
 
   /**
    * Build items for the "quick create" menu.
    *
    * @param   PhabricatorUser         The viewing user.
    * @return  list<PHUIListItemView>  List of menu items.
    */
   public function getQuickCreateItems(PhabricatorUser $viewer) {
     return array();
   }
 
 
 /* -(  Application Management  )--------------------------------------------- */
 
 
   final public static function getByClass($class_name) {
     $selected = null;
     $applications = self::getAllApplications();
 
     foreach ($applications as $application) {
       if (get_class($application) == $class_name) {
         $selected = $application;
         break;
       }
     }
 
     if (!$selected) {
       throw new Exception(pht("No application '%s'!", $class_name));
     }
 
     return $selected;
   }
 
   final public static function getAllApplications() {
     static $applications;
 
     if ($applications === null) {
       $apps = id(new PhutilClassMapQuery())
         ->setAncestorClass(__CLASS__)
         ->setSortMethod('getApplicationOrder')
         ->execute();
 
       // Reorder the applications into "application order". Notably, this
       // ensures their event handlers register in application order.
       $apps = mgroup($apps, 'getApplicationGroup');
 
       $group_order = array_keys(self::getApplicationGroups());
       $apps = array_select_keys($apps, $group_order) + $apps;
 
       $apps = array_mergev($apps);
 
       $applications = $apps;
     }
 
     return $applications;
   }
 
   final public static function getAllInstalledApplications() {
     $all_applications = self::getAllApplications();
     $apps = array();
     foreach ($all_applications as $app) {
       if (!$app->isInstalled()) {
         continue;
       }
 
       $apps[] = $app;
     }
 
     return $apps;
   }
 
 
   /**
    * Determine if an application is installed, by application class name.
    *
    * To check if an application is installed //and// available to a particular
    * viewer, user @{method:isClassInstalledForViewer}.
    *
    * @param string  Application class name.
    * @return bool   True if the class is installed.
    * @task meta
    */
   final public static function isClassInstalled($class) {
     return self::getByClass($class)->isInstalled();
   }
 
 
   /**
    * Determine if an application is installed and available to a viewer, by
    * application class name.
    *
    * To check if an application is installed at all, use
    * @{method:isClassInstalled}.
    *
    * @param string Application class name.
    * @param PhabricatorUser Viewing user.
    * @return bool True if the class is installed for the viewer.
    * @task meta
    */
   final public static function isClassInstalledForViewer(
     $class,
     PhabricatorUser $viewer) {
 
     if ($viewer->isOmnipotent()) {
       return true;
     }
 
     $cache = PhabricatorCaches::getRequestCache();
     $viewer_phid = $viewer->getPHID();
     $key = 'app.'.$class.'.installed.'.$viewer_phid;
 
     $result = $cache->getKey($key);
     if ($result === null) {
       if (!self::isClassInstalled($class)) {
         $result = false;
       } else {
         $result = PhabricatorPolicyFilter::hasCapability(
           $viewer,
           self::getByClass($class),
           PhabricatorPolicyCapability::CAN_VIEW);
       }
 
       $cache->setKey($key, $result);
     }
 
     return $result;
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array_merge(
       array(
         PhabricatorPolicyCapability::CAN_VIEW,
         PhabricatorPolicyCapability::CAN_EDIT,
       ),
       array_keys($this->getCustomCapabilities()));
   }
 
   public function getPolicy($capability) {
     $default = $this->getCustomPolicySetting($capability);
     if ($default) {
       return $default;
     }
 
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return PhabricatorPolicies::getMostOpenPolicy();
       case PhabricatorPolicyCapability::CAN_EDIT:
         return PhabricatorPolicies::POLICY_ADMIN;
       default:
         $spec = $this->getCustomCapabilitySpecification($capability);
         return idx($spec, 'default', PhabricatorPolicies::POLICY_USER);
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return false;
   }
 
   public function describeAutomaticCapability($capability) {
     return null;
   }
 
 
 /* -(  Policies  )----------------------------------------------------------- */
 
   protected function getCustomCapabilities() {
     return array();
   }
 
   final private function getCustomPolicySetting($capability) {
     if (!$this->isCapabilityEditable($capability)) {
       return null;
     }
 
     $policy_locked = PhabricatorEnv::getEnvConfig('policy.locked');
     if (isset($policy_locked[$capability])) {
       return $policy_locked[$capability];
     }
 
     $config = PhabricatorEnv::getEnvConfig('phabricator.application-settings');
 
     $app = idx($config, $this->getPHID());
     if (!$app) {
       return null;
     }
 
     $policy = idx($app, 'policy');
     if (!$policy) {
       return null;
     }
 
     return idx($policy, $capability);
   }
 
 
   final private function getCustomCapabilitySpecification($capability) {
     $custom = $this->getCustomCapabilities();
     if (!isset($custom[$capability])) {
       throw new Exception(pht("Unknown capability '%s'!", $capability));
     }
     return $custom[$capability];
   }
 
   final public function getCapabilityLabel($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return pht('Can Use Application');
       case PhabricatorPolicyCapability::CAN_EDIT:
         return pht('Can Configure Application');
     }
 
     $capobj = PhabricatorPolicyCapability::getCapabilityByKey($capability);
     if ($capobj) {
       return $capobj->getCapabilityName();
     }
 
     return null;
   }
 
   final public function isCapabilityEditable($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return $this->canUninstall();
       case PhabricatorPolicyCapability::CAN_EDIT:
         return false;
       default:
         $spec = $this->getCustomCapabilitySpecification($capability);
         return idx($spec, 'edit', true);
     }
   }
 
   final public function getCapabilityCaption($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         if (!$this->canUninstall()) {
           return pht(
             'This application is required for Phabricator to operate, so all '.
             'users must have access to it.');
         } else {
           return null;
         }
       case PhabricatorPolicyCapability::CAN_EDIT:
         return null;
       default:
         $spec = $this->getCustomCapabilitySpecification($capability);
         return idx($spec, 'caption');
     }
   }
 
   final public function getCapabilityTemplatePHIDType($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
       case PhabricatorPolicyCapability::CAN_EDIT:
         return null;
     }
 
     $spec = $this->getCustomCapabilitySpecification($capability);
     return idx($spec, 'template');
   }
 
   final public function getDefaultObjectTypePolicyMap() {
     $map = array();
 
     foreach ($this->getCustomCapabilities() as $capability => $spec) {
       if (empty($spec['template'])) {
         continue;
       }
       if (empty($spec['capability'])) {
         continue;
       }
       $default = $this->getPolicy($capability);
       $map[$spec['template']][$spec['capability']] = $default;
     }
 
     return $map;
   }
 
   public function getApplicationSearchDocumentTypes() {
     return array();
   }
 
   protected function getEditRoutePattern($base = null) {
     return $base.'(?:'.
       '(?P<id>[0-9]\d*)/)?'.
       '(?:'.
         '(?:'.
-          '(?P<editAction>parameters|nodefault|comment)'.
+          '(?P<editAction>parameters|nodefault|nocreate|nomanage|comment)'.
           '|'.
           '(?:form/(?P<formKey>[^/]+))'.
         ')'.
       '/)?';
   }
 
   protected function getQueryRoutePattern($base = null) {
     return $base.'(?:query/(?P<queryKey>[^/]+)/)?';
   }
 
 }
diff --git a/src/applications/transactions/controller/PhabricatorEditEngineConfigurationViewController.php b/src/applications/transactions/controller/PhabricatorEditEngineConfigurationViewController.php
index a1e37f96c3..2248e7d359 100644
--- a/src/applications/transactions/controller/PhabricatorEditEngineConfigurationViewController.php
+++ b/src/applications/transactions/controller/PhabricatorEditEngineConfigurationViewController.php
@@ -1,225 +1,225 @@
 <?php
 
 final class PhabricatorEditEngineConfigurationViewController
   extends PhabricatorEditEngineController {
 
   public function shouldAllowPublic() {
     return true;
   }
 
   public function handleRequest(AphrontRequest $request) {
     $viewer = $this->getViewer();
 
-    $config = $this->loadConfigForEdit();
+    $config = $this->loadConfigForView();
     if (!$config) {
       return id(new Aphront404Response());
     }
 
     $is_concrete = (bool)$config->getID();
 
     $actions = $this->buildActionView($config);
 
     $properties = $this->buildPropertyView($config)
       ->setActionList($actions);
 
     $header = id(new PHUIHeaderView())
       ->setUser($viewer)
       ->setPolicyObject($config)
       ->setHeader(pht('Edit Form: %s', $config->getDisplayName()));
 
     $box = id(new PHUIObjectBoxView())
       ->setHeader($header)
       ->addPropertyList($properties);
 
     $field_list = $this->buildFieldList($config);
 
     $crumbs = $this->buildApplicationCrumbs();
 
     if ($is_concrete) {
       $crumbs->addTextCrumb(pht('Form %d', $config->getID()));
     } else {
       $crumbs->addTextCrumb(pht('Builtin'));
     }
 
     if ($is_concrete) {
       $timeline = $this->buildTransactionTimeline(
         $config,
         new PhabricatorEditEngineConfigurationTransactionQuery());
 
       $timeline->setShouldTerminate(true);
     } else {
       $timeline = null;
     }
 
     return $this->newPage()
       ->setCrumbs($crumbs)
       ->appendChild(
         array(
           $box,
           $field_list,
           $timeline,
         ));
   }
 
   private function buildActionView(
     PhabricatorEditEngineConfiguration $config) {
     $viewer = $this->getViewer();
     $engine = $config->getEngine();
     $engine_key = $engine->getEngineKey();
 
     $can_edit = PhabricatorPolicyFilter::hasCapability(
       $viewer,
       $config,
       PhabricatorPolicyCapability::CAN_EDIT);
 
     $view = id(new PhabricatorActionListView())
       ->setUser($viewer);
 
     $form_key = $config->getIdentifier();
 
     $base_uri = "/transactions/editengine/{$engine_key}";
 
     $is_concrete = (bool)$config->getID();
     if (!$is_concrete) {
       $save_uri = "{$base_uri}/save/{$form_key}/";
 
       $view->addAction(
         id(new PhabricatorActionView())
           ->setName(pht('Make Editable'))
           ->setIcon('fa-pencil')
           ->setDisabled(!$can_edit)
           ->setWorkflow(true)
           ->setHref($save_uri));
 
       $can_edit = false;
     } else {
       $edit_uri = "{$base_uri}/edit/{$form_key}/";
       $view->addAction(
         id(new PhabricatorActionView())
           ->setName(pht('Edit Form Configuration'))
           ->setIcon('fa-pencil')
           ->setDisabled(!$can_edit)
           ->setWorkflow(!$can_edit)
           ->setHref($edit_uri));
     }
 
     $use_uri = $engine->getEditURI(null, "form/{$form_key}/");
 
     $view->addAction(
       id(new PhabricatorActionView())
         ->setName(pht('Use Form'))
         ->setIcon('fa-th-list')
         ->setHref($use_uri));
 
     $defaults_uri = "{$base_uri}/defaults/{$form_key}/";
 
     $view->addAction(
       id(new PhabricatorActionView())
         ->setName(pht('Change Default Values'))
         ->setIcon('fa-paint-brush')
         ->setHref($defaults_uri)
         ->setWorkflow(!$can_edit)
         ->setDisabled(!$can_edit));
 
     $reorder_uri = "{$base_uri}/reorder/{$form_key}/";
 
     $view->addAction(
       id(new PhabricatorActionView())
         ->setName(pht('Change Field Order'))
         ->setIcon('fa-sort-alpha-asc')
         ->setHref($reorder_uri)
         ->setWorkflow(true)
         ->setDisabled(!$can_edit));
 
     $lock_uri = "{$base_uri}/lock/{$form_key}/";
 
     $view->addAction(
       id(new PhabricatorActionView())
         ->setName(pht('Lock / Hide Fields'))
         ->setIcon('fa-lock')
         ->setHref($lock_uri)
         ->setWorkflow(true)
         ->setDisabled(!$can_edit));
 
     $disable_uri = "{$base_uri}/disable/{$form_key}/";
 
     if ($config->getIsDisabled()) {
       $disable_name = pht('Enable Form');
       $disable_icon = 'fa-check';
     } else {
       $disable_name = pht('Disable Form');
       $disable_icon = 'fa-ban';
     }
 
     $view->addAction(
       id(new PhabricatorActionView())
         ->setName($disable_name)
         ->setIcon($disable_icon)
         ->setHref($disable_uri)
         ->setWorkflow(true)
         ->setDisabled(!$can_edit));
 
     $defaultcreate_uri = "{$base_uri}/defaultcreate/{$form_key}/";
 
     if ($config->getIsDefault()) {
       $defaultcreate_name = pht('Remove from "Create" Menu');
       $defaultcreate_icon = 'fa-minus';
     } else {
       $defaultcreate_name = pht('Add to "Create" Menu');
       $defaultcreate_icon = 'fa-plus';
     }
 
     $view->addAction(
       id(new PhabricatorActionView())
         ->setName($defaultcreate_name)
         ->setIcon($defaultcreate_icon)
         ->setHref($defaultcreate_uri)
         ->setWorkflow(true)
         ->setDisabled(!$can_edit));
 
     return $view;
   }
 
   private function buildPropertyView(
     PhabricatorEditEngineConfiguration $config) {
     $viewer = $this->getViewer();
 
     $properties = id(new PHUIPropertyListView())
       ->setUser($viewer)
       ->setObject($config);
 
     return $properties;
   }
 
   private function buildFieldList(PhabricatorEditEngineConfiguration $config) {
     $viewer = $this->getViewer();
     $engine = $config->getEngine();
 
     $fields = $engine->getFieldsForConfig($config);
 
     $form = id(new AphrontFormView())
        ->setUser($viewer)
        ->setAction(null);
 
     foreach ($fields as $field) {
       $field->setIsPreview(true);
 
       $field->appendToForm($form);
     }
 
     $info = id(new PHUIInfoView())
       ->setSeverity(PHUIInfoView::SEVERITY_NOTICE)
       ->setErrors(
         array(
           pht('This is a preview of the current form configuration.'),
         ));
 
     $box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Form Preview'))
       ->setInfoView($info)
       ->setForm($form);
 
     return $box;
   }
 
 }
diff --git a/src/applications/transactions/controller/PhabricatorEditEngineController.php b/src/applications/transactions/controller/PhabricatorEditEngineController.php
index b7a7d39483..e7306c7866 100644
--- a/src/applications/transactions/controller/PhabricatorEditEngineController.php
+++ b/src/applications/transactions/controller/PhabricatorEditEngineController.php
@@ -1,72 +1,86 @@
 <?php
 
 abstract class PhabricatorEditEngineController
   extends PhabricatorApplicationTransactionController {
 
   private $engineKey;
 
   public function setEngineKey($engine_key) {
     $this->engineKey = $engine_key;
     return $this;
   }
 
   public function getEngineKey() {
     return $this->engineKey;
   }
 
   protected function buildApplicationCrumbs() {
     $crumbs = parent::buildApplicationCrumbs();
 
     $crumbs->addTextCrumb(pht('Edit Engines'), '/transactions/editengine/');
 
     $engine_key = $this->getEngineKey();
     if ($engine_key !== null) {
       $engine = PhabricatorEditEngine::getByKey(
         $this->getViewer(),
         $engine_key);
       if ($engine) {
         $crumbs->addTextCrumb(
           $engine->getEngineName(),
           "/transactions/editengine/{$engine_key}/");
       }
     }
 
     return $crumbs;
   }
 
   protected function loadConfigForEdit() {
+    return $this->loadConfig($need_edit = true);
+  }
+
+  protected function loadConfigForView() {
+    return $this->loadConfig($need_edit = false);
+  }
+
+  private function loadConfig($need_edit) {
     $request = $this->getRequest();
     $viewer = $this->getViewer();
 
     $engine_key = $request->getURIData('engineKey');
     $this->setEngineKey($engine_key);
 
     $key = $request->getURIData('key');
 
+    if ($need_edit) {
+      $capabilities = array(
+        PhabricatorPolicyCapability::CAN_VIEW,
+        PhabricatorPolicyCapability::CAN_EDIT,
+      );
+    } else {
+      $capabilities = array(
+        PhabricatorPolicyCapability::CAN_VIEW,
+      );
+    }
+
     $config = id(new PhabricatorEditEngineConfigurationQuery())
       ->setViewer($viewer)
       ->withEngineKeys(array($engine_key))
       ->withIdentifiers(array($key))
-      ->requireCapabilities(
-        array(
-          PhabricatorPolicyCapability::CAN_VIEW,
-          PhabricatorPolicyCapability::CAN_EDIT,
-        ))
+      ->requireCapabilities($capabilities)
       ->executeOne();
-
     if ($config) {
       $engine = $config->getEngine();
 
       // TODO: When we're editing the meta-engine, we need to set the engine
       // itself as its own target. This is hacky and it would be nice to find
       // a cleaner approach later.
       if ($engine instanceof PhabricatorEditEngineConfigurationEditEngine) {
         $engine->setTargetEngine($engine);
       }
     }
 
     return $config;
   }
 
 
 }
diff --git a/src/applications/transactions/editengine/PhabricatorEditEngine.php b/src/applications/transactions/editengine/PhabricatorEditEngine.php
index ff8407c1d3..a5f6cd4cc1 100644
--- a/src/applications/transactions/editengine/PhabricatorEditEngine.php
+++ b/src/applications/transactions/editengine/PhabricatorEditEngine.php
@@ -1,1509 +1,1615 @@
 <?php
 
 
 /**
  * @task fields Managing Fields
  * @task text Display Text
  * @task config Edit Engine Configuration
  * @task uri Managing URIs
  * @task load Creating and Loading Objects
  * @task web Responding to Web Requests
  * @task edit Responding to Edit Requests
  * @task http Responding to HTTP Parameter Requests
  * @task conduit Responding to Conduit Requests
  */
 abstract class PhabricatorEditEngine
   extends Phobject
   implements PhabricatorPolicyInterface {
 
   const EDITENGINECONFIG_DEFAULT = 'default';
 
   private $viewer;
   private $controller;
   private $isCreate;
   private $editEngineConfiguration;
 
   final public function setViewer(PhabricatorUser $viewer) {
     $this->viewer = $viewer;
     return $this;
   }
 
   final public function getViewer() {
     return $this->viewer;
   }
 
   final public function setController(PhabricatorController $controller) {
     $this->controller = $controller;
     $this->setViewer($controller->getViewer());
     return $this;
   }
 
   final public function getController() {
     return $this->controller;
   }
 
   final public function getEngineKey() {
     return $this->getPhobjectClassConstant('ENGINECONST', 64);
   }
 
   final public function getApplication() {
     $app_class = $this->getEngineApplicationClass();
     return PhabricatorApplication::getByClass($app_class);
   }
 
 
 /* -(  Managing Fields  )---------------------------------------------------- */
 
 
   abstract public function getEngineApplicationClass();
   abstract protected function buildCustomEditFields($object);
 
   public function getFieldsForConfig(
     PhabricatorEditEngineConfiguration $config) {
 
     $object = $this->newEditableObject();
 
     $this->editEngineConfiguration = $config;
 
     // This is mostly making sure that we fill in default values.
     $this->setIsCreate(true);
 
     return $this->buildEditFields($object);
   }
 
   final protected function buildEditFields($object) {
     $viewer = $this->getViewer();
 
     $fields = $this->buildCustomEditFields($object);
 
     $extensions = PhabricatorEditEngineExtension::getAllEnabledExtensions();
     foreach ($extensions as $extension) {
       $extension->setViewer($viewer);
 
       if (!$extension->supportsObject($this, $object)) {
         continue;
       }
 
       $extension_fields = $extension->buildCustomEditFields($this, $object);
 
       // TODO: Validate this in more detail with a more tailored error.
       assert_instances_of($extension_fields, 'PhabricatorEditField');
 
       foreach ($extension_fields as $field) {
         $fields[] = $field;
       }
     }
 
     $config = $this->getEditEngineConfiguration();
     $fields = $config->applyConfigurationToFields($this, $object, $fields);
 
     foreach ($fields as $field) {
       $field
         ->setViewer($viewer)
         ->setObject($object);
     }
 
     return $fields;
   }
 
 
 /* -(  Display Text  )------------------------------------------------------- */
 
 
   /**
    * @task text
    */
   abstract public function getEngineName();
 
 
   /**
    * @task text
    */
   abstract protected function getObjectCreateTitleText($object);
 
   /**
    * @task text
    */
   protected function getFormHeaderText($object) {
     $config = $this->getEditEngineConfiguration();
     return $config->getName();
   }
 
   /**
    * @task text
    */
   abstract protected function getObjectEditTitleText($object);
 
 
   /**
    * @task text
    */
   abstract protected function getObjectCreateShortText();
 
 
   /**
    * @task text
    */
   abstract protected function getObjectEditShortText($object);
 
 
   /**
    * @task text
    */
   protected function getObjectCreateButtonText($object) {
     return $this->getObjectCreateTitleText($object);
   }
 
 
   /**
    * @task text
    */
   protected function getObjectEditButtonText($object) {
     return pht('Save Changes');
   }
 
 
   /**
    * @task text
    */
   protected function getCommentViewHeaderText($object) {
     return pht('Add Comment');
   }
 
 
   /**
    * @task text
    */
   protected function getCommentViewButtonText($object) {
     return pht('Add Comment');
   }
 
 
   /**
    * @task text
    */
   protected function getQuickCreateMenuHeaderText() {
     return $this->getObjectCreateShortText();
   }
 
 
 /* -(  Edit Engine Configuration  )------------------------------------------ */
 
 
   protected function supportsEditEngineConfiguration() {
     return true;
   }
 
   final protected function getEditEngineConfiguration() {
     return $this->editEngineConfiguration;
   }
 
 
   /**
    * Load the default configuration, ignoring customization in the database
    * (which means we implicitly ignore policies).
    *
    * This is used from places like Conduit, where the fields available in the
    * API should not be affected by configuration changes.
    *
    * @return PhabricatorEditEngineConfiguration Default configuration, ignoring
    *   customization.
    */
   private function loadDefaultEditEngineConfiguration() {
     return $this->loadEditEngineConfigurationWithOptions(
       self::EDITENGINECONFIG_DEFAULT,
       true);
   }
 
 
   /**
    * Load a named configuration, respecting database customization and policies.
    *
    * @param string Configuration key, or null to load the default.
    * @return PhabricatorEditEngineConfiguration Default configuration,
    *   respecting customization.
    */
   private function loadEditEngineConfiguration($key) {
     if (!strlen($key)) {
       $key = self::EDITENGINECONFIG_DEFAULT;
     }
 
     return $this->loadEditEngineConfigurationWithOptions(
       $key,
       false);
   }
 
   private function loadEditEngineConfigurationWithOptions(
     $key,
     $ignore_database) {
     $viewer = $this->getViewer();
 
     $config = id(new PhabricatorEditEngineConfigurationQuery())
       ->setViewer($viewer)
       ->withEngineKeys(array($this->getEngineKey()))
       ->withIdentifiers(array($key))
       ->withIgnoreDatabaseConfigurations($ignore_database)
       ->executeOne();
     if (!$config) {
       return null;
     }
 
     $this->editEngineConfiguration = $config;
 
     return $config;
   }
 
   final public function getBuiltinEngineConfigurations() {
     $configurations = $this->newBuiltinEngineConfigurations();
 
     if (!$configurations) {
       throw new Exception(
         pht(
           'EditEngine ("%s") returned no builtin engine configurations, but '.
           'an edit engine must have at least one configuration.',
           get_class($this)));
     }
 
     assert_instances_of($configurations, 'PhabricatorEditEngineConfiguration');
 
     $has_default = false;
     foreach ($configurations as $config) {
       if ($config->getBuiltinKey() == self::EDITENGINECONFIG_DEFAULT) {
         $has_default = true;
       }
     }
 
     if (!$has_default) {
       $first = head($configurations);
       if (!$first->getBuiltinKey()) {
         $first
           ->setBuiltinKey(self::EDITENGINECONFIG_DEFAULT)
           ->setIsDefault(true);
 
         if (!strlen($first->getName())) {
           $first->setName($this->getObjectCreateShortText());
         }
     } else {
         throw new Exception(
           pht(
             'EditEngine ("%s") returned builtin engine configurations, '.
             'but none are marked as default and the first configuration has '.
             'a different builtin key already. Mark a builtin as default or '.
             'omit the key from the first configuration',
             get_class($this)));
       }
     }
 
     $builtins = array();
     foreach ($configurations as $key => $config) {
       $builtin_key = $config->getBuiltinKey();
 
       if ($builtin_key === null) {
         throw new Exception(
           pht(
             'EditEngine ("%s") returned builtin engine configurations, '.
             'but one (with key "%s") is missing a builtin key. Provide a '.
             'builtin key for each configuration (you can omit it from the '.
             'first configuration in the list to automatically assign the '.
             'default key).',
             get_class($this),
             $key));
       }
 
       if (isset($builtins[$builtin_key])) {
         throw new Exception(
           pht(
             'EditEngine ("%s") returned builtin engine configurations, '.
             'but at least two specify the same builtin key ("%s"). Engines '.
             'must have unique builtin keys.',
             get_class($this),
             $builtin_key));
       }
 
       $builtins[$builtin_key] = $config;
     }
 
 
     return $builtins;
   }
 
   protected function newBuiltinEngineConfigurations() {
     return array(
       $this->newConfiguration(),
     );
   }
 
   final protected function newConfiguration() {
     return PhabricatorEditEngineConfiguration::initializeNewConfiguration(
       $this->getViewer(),
       $this);
   }
 
 
 /* -(  Managing URIs  )------------------------------------------------------ */
 
 
   /**
    * @task uri
    */
   abstract protected function getObjectViewURI($object);
 
 
   /**
    * @task uri
    */
   protected function getObjectCreateCancelURI($object) {
     return $this->getApplication()->getApplicationURI();
   }
 
 
   /**
    * @task uri
    */
   protected function getEditorURI() {
     return $this->getApplication()->getApplicationURI('edit/');
   }
 
 
   /**
    * @task uri
    */
   protected function getObjectEditCancelURI($object) {
     return $this->getObjectViewURI($object);
   }
 
 
   /**
    * @task uri
    */
   public function getEditURI($object = null, $path = null) {
     $parts = array();
 
     $parts[] = $this->getEditorURI();
 
     if ($object && $object->getID()) {
       $parts[] = $object->getID().'/';
     }
 
     if ($path !== null) {
       $parts[] = $path;
     }
 
     return implode('', $parts);
   }
 
 
 /* -(  Creating and Loading Objects  )--------------------------------------- */
 
 
   /**
    * Initialize a new object for creation.
    *
    * @return object Newly initialized object.
    * @task load
    */
   abstract protected function newEditableObject();
 
 
   /**
    * Build an empty query for objects.
    *
    * @return PhabricatorPolicyAwareQuery Query.
    * @task load
    */
   abstract protected function newObjectQuery();
 
 
   /**
    * Test if this workflow is creating a new object or editing an existing one.
    *
    * @return bool True if a new object is being created.
    * @task load
    */
   final public function getIsCreate() {
     return $this->isCreate;
   }
 
 
   /**
    * Flag this workflow as a create or edit.
    *
    * @param bool True if this is a create workflow.
    * @return this
    * @task load
    */
   private function setIsCreate($is_create) {
     $this->isCreate = $is_create;
     return $this;
   }
 
 
   /**
    * Try to load an object by ID, PHID, or monogram. This is done primarily
    * to make Conduit a little easier to use.
    *
    * @param wild ID, PHID, or monogram.
    * @param list<const> List of required capability constants, or omit for
    *   defaults.
    * @return object Corresponding editable object.
    * @task load
    */
   private function newObjectFromIdentifier(
     $identifier,
     array $capabilities = array()) {
     if (is_int($identifier) || ctype_digit($identifier)) {
       $object = $this->newObjectFromID($identifier, $capabilities);
 
       if (!$object) {
         throw new Exception(
           pht(
             'No object exists with ID "%s".',
             $identifier));
       }
 
       return $object;
     }
 
     $type_unknown = PhabricatorPHIDConstants::PHID_TYPE_UNKNOWN;
     if (phid_get_type($identifier) != $type_unknown) {
       $object = $this->newObjectFromPHID($identifier, $capabilities);
 
       if (!$object) {
         throw new Exception(
           pht(
             'No object exists with PHID "%s".',
             $identifier));
       }
 
       return $object;
     }
 
     $target = id(new PhabricatorObjectQuery())
       ->setViewer($this->getViewer())
       ->withNames(array($identifier))
       ->executeOne();
     if (!$target) {
       throw new Exception(
         pht(
           'Monogram "%s" does not identify a valid object.',
           $identifier));
     }
 
     $expect = $this->newEditableObject();
     $expect_class = get_class($expect);
     $target_class = get_class($target);
     if ($expect_class !== $target_class) {
       throw new Exception(
         pht(
           'Monogram "%s" identifies an object of the wrong type. Loaded '.
           'object has class "%s", but this editor operates on objects of '.
           'type "%s".',
           $identifier,
           $target_class,
           $expect_class));
     }
 
     // Load the object by PHID using this engine's standard query. This makes
     // sure it's really valid, goes through standard policy check logic, and
     // picks up any `need...()` clauses we want it to load with.
 
     $object = $this->newObjectFromPHID($target->getPHID(), $capabilities);
     if (!$object) {
       throw new Exception(
         pht(
           'Failed to reload object identified by monogram "%s" when '.
           'querying by PHID.',
           $identifier));
     }
 
     return $object;
   }
 
   /**
    * Load an object by ID.
    *
    * @param int Object ID.
    * @param list<const> List of required capability constants, or omit for
    *   defaults.
    * @return object|null Object, or null if no such object exists.
    * @task load
    */
   private function newObjectFromID($id, array $capabilities = array()) {
     $query = $this->newObjectQuery()
       ->withIDs(array($id));
 
     return $this->newObjectFromQuery($query, $capabilities);
   }
 
 
   /**
    * Load an object by PHID.
    *
    * @param phid Object PHID.
    * @param list<const> List of required capability constants, or omit for
    *   defaults.
    * @return object|null Object, or null if no such object exists.
    * @task load
    */
   private function newObjectFromPHID($phid, array $capabilities = array()) {
     $query = $this->newObjectQuery()
       ->withPHIDs(array($phid));
 
     return $this->newObjectFromQuery($query, $capabilities);
   }
 
 
   /**
    * Load an object given a configured query.
    *
    * @param PhabricatorPolicyAwareQuery Configured query.
    * @param list<const> List of required capabilitiy constants, or omit for
    *  defaults.
    * @return object|null Object, or null if no such object exists.
    * @task load
    */
   private function newObjectFromQuery(
     PhabricatorPolicyAwareQuery $query,
     array $capabilities = array()) {
 
     $viewer = $this->getViewer();
 
     if (!$capabilities) {
       $capabilities = array(
         PhabricatorPolicyCapability::CAN_VIEW,
         PhabricatorPolicyCapability::CAN_EDIT,
       );
     }
 
     $object = $query
       ->setViewer($viewer)
       ->requireCapabilities($capabilities)
       ->executeOne();
     if (!$object) {
       return null;
     }
 
     return $object;
   }
 
 
   /**
    * Verify that an object is appropriate for editing.
    *
    * @param wild Loaded value.
    * @return void
    * @task load
    */
   private function validateObject($object) {
     if (!$object || !is_object($object)) {
       throw new Exception(
         pht(
           'EditEngine "%s" created or loaded an invalid object: object must '.
           'actually be an object, but is of some other type ("%s").',
           get_class($this),
           gettype($object)));
     }
 
     if (!($object instanceof PhabricatorApplicationTransactionInterface)) {
       throw new Exception(
         pht(
           'EditEngine "%s" created or loaded an invalid object: object (of '.
           'class "%s") must implement "%s", but does not.',
           get_class($this),
           get_class($object),
           'PhabricatorApplicationTransactionInterface'));
     }
   }
 
 
 /* -(  Responding to Web Requests  )----------------------------------------- */
 
 
   final public function buildResponse() {
     $viewer = $this->getViewer();
     $controller = $this->getController();
     $request = $controller->getRequest();
 
     $action = $request->getURIData('editAction');
 
     $capabilities = array();
     $use_default = false;
+    $require_create = true;
     switch ($action) {
       case 'comment':
         $capabilities = array(
           PhabricatorPolicyCapability::CAN_VIEW,
         );
         $use_default = true;
         break;
       case 'parameters':
         $use_default = true;
         break;
+      case 'nodefault':
+      case 'nocreate':
+      case 'nomanage':
+        $require_create = false;
+        break;
       default:
         break;
     }
 
     if ($use_default) {
       $config = $this->loadDefaultEditEngineConfiguration();
     } else {
       $form_key = $request->getURIData('formKey');
       $config = $this->loadEditEngineConfiguration($form_key);
     }
 
     if (!$config) {
       return new Aphront404Response();
     }
 
     $id = $request->getURIData('id');
     if ($id) {
       $this->setIsCreate(false);
       $object = $this->newObjectFromID($id, $capabilities);
       if (!$object) {
         return new Aphront404Response();
       }
     } else {
+      // Make sure the viewer has permission to create new objects of
+      // this type if we're going to create a new object.
+      if ($require_create) {
+        $this->requireCreateCapability();
+      }
+
       $this->setIsCreate(true);
       $object = $this->newEditableObject();
     }
 
     $this->validateObject($object);
 
     switch ($action) {
       case 'parameters':
         return $this->buildParametersResponse($object);
       case 'nodefault':
         return $this->buildNoDefaultResponse($object);
+      case 'nocreate':
+        return $this->buildNoCreateResponse($object);
+      case 'nomanage':
+        return $this->buildNoManageResponse($object);
       case 'comment':
         return $this->buildCommentResponse($object);
       default:
         return $this->buildEditResponse($object);
     }
   }
 
   private function buildCrumbs($object, $final = false) {
     $controller = $this->getcontroller();
 
     $crumbs = $controller->buildApplicationCrumbsForEditEngine();
     if ($this->getIsCreate()) {
       $create_text = $this->getObjectCreateShortText();
       if ($final) {
         $crumbs->addTextCrumb($create_text);
       } else {
         $edit_uri = $this->getEditURI($object);
         $crumbs->addTextCrumb($create_text, $edit_uri);
       }
     } else {
       $crumbs->addTextCrumb(
         $this->getObjectEditShortText($object),
         $this->getObjectViewURI($object));
 
       $edit_text = pht('Edit');
       if ($final) {
         $crumbs->addTextCrumb($edit_text);
       } else {
         $edit_uri = $this->getEditURI($object);
         $crumbs->addTextCrumb($edit_text, $edit_uri);
       }
     }
 
     return $crumbs;
   }
 
   private function buildEditResponse($object) {
     $viewer = $this->getViewer();
     $controller = $this->getController();
     $request = $controller->getRequest();
 
     $fields = $this->buildEditFields($object);
     $template = $object->getApplicationTransactionTemplate();
 
     $validation_exception = null;
     if ($request->isFormPost()) {
       foreach ($fields as $field) {
         $field->setIsSubmittedForm(true);
 
         if ($field->getIsLocked() || $field->getIsHidden()) {
           continue;
         }
 
         $field->readValueFromSubmit($request);
       }
 
       $xactions = array();
       foreach ($fields as $field) {
         $types = $field->getWebEditTypes();
         foreach ($types as $type) {
           $type_xactions = $type->generateTransactions(
             clone $template,
             array(
               'value' => $field->getValueForTransaction(),
             ));
 
           if (!$type_xactions) {
             continue;
           }
 
           foreach ($type_xactions as $type_xaction) {
             $xactions[] = $type_xaction;
           }
         }
       }
 
       $editor = $object->getApplicationTransactionEditor()
         ->setActor($viewer)
         ->setContentSourceFromRequest($request)
         ->setContinueOnNoEffect(true);
 
       try {
 
         $editor->applyTransactions($object, $xactions);
 
-        return id(new AphrontRedirectResponse())
-          ->setURI($this->getObjectViewURI($object));
+        return $this->newEditResponse($request, $object, $xactions);
       } catch (PhabricatorApplicationTransactionValidationException $ex) {
         $validation_exception = $ex;
 
         foreach ($fields as $field) {
           $xaction_type = $field->getTransactionType();
           if ($xaction_type === null) {
             continue;
           }
 
           $message = $ex->getShortMessage($xaction_type);
           if ($message === null) {
             continue;
           }
 
           $field->setControlError($message);
         }
       }
     } else {
       if ($this->getIsCreate()) {
         $template = $request->getStr('template');
 
         if (strlen($template)) {
           $template_object = $this->newObjectFromIdentifier(
             $template,
             array(
               PhabricatorPolicyCapability::CAN_VIEW,
             ));
           if (!$template_object) {
             return new Aphront404Response();
           }
         } else {
           $template_object = null;
         }
 
         if ($template_object) {
           $copy_fields = $this->buildEditFields($template_object);
           $copy_fields = mpull($copy_fields, null, 'getKey');
           foreach ($copy_fields as $copy_key => $copy_field) {
             if (!$copy_field->getIsCopyable()) {
               unset($copy_fields[$copy_key]);
             }
           }
         } else {
           $copy_fields = array();
         }
 
         foreach ($fields as $field) {
           if ($field->getIsLocked() || $field->getIsHidden()) {
             continue;
           }
 
           $field_key = $field->getKey();
           if (isset($copy_fields[$field_key])) {
             $field->readValueFromField($copy_fields[$field_key]);
           }
 
           $field->readValueFromRequest($request);
         }
       }
     }
 
     $action_button = $this->buildEditFormActionButton($object);
 
     if ($this->getIsCreate()) {
       $header_text = $this->getFormHeaderText($object);
     } else {
       $header_text = $this->getObjectEditTitleText($object);
     }
 
     $header = id(new PHUIHeaderView())
       ->setHeader($header_text)
       ->addActionLink($action_button);
 
     $crumbs = $this->buildCrumbs($object, $final = true);
     $form = $this->buildEditForm($object, $fields);
 
     $box = id(new PHUIObjectBoxView())
       ->setUser($viewer)
       ->setHeader($header)
       ->setValidationException($validation_exception)
       ->appendChild($form);
 
     return $controller->newPage()
       ->setTitle($header_text)
       ->setCrumbs($crumbs)
       ->appendChild($box);
   }
 
+  protected function newEditResponse(
+    AphrontRequest $request,
+    $object,
+    array $xactions) {
+    return id(new AphrontRedirectResponse())
+      ->setURI($this->getObjectViewURI($object));
+  }
+
   private function buildEditForm($object, array $fields) {
     $viewer = $this->getViewer();
 
     $form = id(new AphrontFormView())
       ->setUser($viewer);
 
     foreach ($fields as $field) {
       $field->appendToForm($form);
     }
 
     if ($this->getIsCreate()) {
       $cancel_uri = $this->getObjectCreateCancelURI($object);
       $submit_button = $this->getObjectCreateButtonText($object);
     } else {
       $cancel_uri = $this->getObjectEditCancelURI($object);
       $submit_button = $this->getObjectEditButtonText($object);
     }
 
     $form->appendControl(
       id(new AphrontFormSubmitControl())
         ->addCancelButton($cancel_uri)
         ->setValue($submit_button));
 
     return $form;
   }
 
   private function buildEditFormActionButton($object) {
     $viewer = $this->getViewer();
 
     $action_view = id(new PhabricatorActionListView())
       ->setUser($viewer);
 
     foreach ($this->buildEditFormActions($object) as $action) {
       $action_view->addAction($action);
     }
 
     $action_button = id(new PHUIButtonView())
       ->setTag('a')
       ->setText(pht('Actions'))
       ->setHref('#')
       ->setIconFont('fa-bars')
       ->setDropdownMenu($action_view);
 
     return $action_button;
   }
 
   private function buildEditFormActions($object) {
     $actions = array();
 
+    $actions[] = id(new PhabricatorActionView())
+      ->setName(pht('Show HTTP Parameters'))
+      ->setIcon('fa-crosshairs')
+      ->setHref($this->getEditURI($object, 'parameters/'));
+
     if ($this->supportsEditEngineConfiguration()) {
       $engine_key = $this->getEngineKey();
       $config = $this->getEditEngineConfiguration();
 
+      $can_manage = PhabricatorPolicyFilter::hasCapability(
+        $this->getViewer(),
+        $config,
+        PhabricatorPolicyCapability::CAN_EDIT);
+
+      if ($can_manage) {
+        $manage_uri = $config->getURI();
+      } else {
+        $manage_uri = $this->getEditURI(null, 'nomanage/');
+      }
+
+      $view_uri = "/transactions/editengine/{$engine_key}/";
+
       $actions[] = id(new PhabricatorActionView())
-        ->setName(pht('Manage Form Configurations'))
+        ->setName(pht('View Form Configurations'))
         ->setIcon('fa-list-ul')
-        ->setHref("/transactions/editengine/{$engine_key}/");
+        ->setHref($view_uri);
+
       $actions[] = id(new PhabricatorActionView())
         ->setName(pht('Edit Form Configuration'))
         ->setIcon('fa-pencil')
-        ->setHref($config->getURI());
+        ->setHref($manage_uri)
+        ->setDisabled(!$can_manage)
+        ->setWorkflow(!$can_manage);
     }
 
-    $actions[] = id(new PhabricatorActionView())
-      ->setName(pht('Show HTTP Parameters'))
-      ->setIcon('fa-crosshairs')
-      ->setHref($this->getEditURI($object, 'parameters/'));
 
     return $actions;
   }
 
   final public function addActionToCrumbs(PHUICrumbsView $crumbs) {
     $viewer = $this->getViewer();
 
-    $configs = $this->loadUsableConfigurationsForCreate();
+    $can_create = $this->hasCreateCapability();
+    if ($can_create) {
+      $configs = $this->loadUsableConfigurationsForCreate();
+    } else {
+      $configs = array();
+    }
 
     $dropdown = null;
     $disabled = false;
     $workflow = false;
 
     $menu_icon = 'fa-plus-square';
 
     if (!$configs) {
       if ($viewer->isLoggedIn()) {
         $disabled = true;
       } else {
         // If the viewer isn't logged in, assume they'll get hit with a login
         // dialog and are likely able to create objects after they log in.
         $disabled = false;
       }
       $workflow = true;
-      $create_uri = $this->getEditURI(null, 'nodefault/');
+
+      if ($can_create) {
+        $create_uri = $this->getEditURI(null, 'nodefault/');
+      } else {
+        $create_uri = $this->getEditURI(null, 'nocreate/');
+      }
     } else {
       $config = head($configs);
       $form_key = $config->getIdentifier();
       $create_uri = $this->getEditURI(null, "form/{$form_key}/");
 
       if (count($configs) > 1) {
         $configs = msort($configs, 'getDisplayName');
 
         $menu_icon = 'fa-caret-square-o-down';
 
         $dropdown = id(new PhabricatorActionListView())
           ->setUser($viewer);
 
         foreach ($configs as $config) {
           $form_key = $config->getIdentifier();
           $config_uri = $this->getEditURI(null, "form/{$form_key}/");
 
           $item_icon = 'fa-plus';
 
           $dropdown->addAction(
             id(new PhabricatorActionView())
               ->setName($config->getDisplayName())
               ->setIcon($item_icon)
               ->setHref($config_uri));
         }
       }
     }
 
     $action = id(new PHUIListItemView())
       ->setName($this->getObjectCreateShortText())
       ->setHref($create_uri)
       ->setIcon($menu_icon)
       ->setWorkflow($workflow)
       ->setDisabled($disabled);
 
     if ($dropdown) {
       $action->setDropdownMenu($dropdown);
     }
 
     $crumbs->addAction($action);
   }
 
   final public function buildEditEngineCommentView($object) {
     $config = $this->loadDefaultEditEngineConfiguration();
 
     $viewer = $this->getViewer();
     $object_phid = $object->getPHID();
 
     $header_text = $this->getCommentViewHeaderText($object);
     $button_text = $this->getCommentViewButtonText($object);
 
     $comment_uri = $this->getEditURI($object, 'comment/');
 
     $view = id(new PhabricatorApplicationTransactionCommentView())
       ->setUser($viewer)
       ->setObjectPHID($object_phid)
       ->setHeaderText($header_text)
       ->setAction($comment_uri)
       ->setSubmitButtonName($button_text);
 
     $draft = PhabricatorVersionedDraft::loadDraft(
       $object_phid,
       $viewer->getPHID());
     if ($draft) {
       $view->setVersionedDraft($draft);
     }
 
     $view->setCurrentVersion($this->loadDraftVersion($object));
 
     $fields = $this->buildEditFields($object);
 
     $all_types = array();
     foreach ($fields as $field) {
       // TODO: Load draft stuff.
       $types = $field->getCommentEditTypes();
       foreach ($types as $type) {
         $all_types[] = $type;
       }
     }
 
     $view->setEditTypes($all_types);
 
     return $view;
   }
 
   protected function loadDraftVersion($object) {
     $viewer = $this->getViewer();
 
     if (!$viewer->isLoggedIn()) {
       return null;
     }
 
     $template = $object->getApplicationTransactionTemplate();
     $conn_r = $template->establishConnection('r');
 
     // Find the most recent transaction the user has written. We'll use this
     // as a version number to make sure that out-of-date drafts get discarded.
     $result = queryfx_one(
       $conn_r,
       'SELECT id AS version FROM %T
         WHERE objectPHID = %s AND authorPHID = %s
         ORDER BY id DESC LIMIT 1',
       $template->getTableName(),
       $object->getPHID(),
       $viewer->getPHID());
 
     if ($result) {
       return (int)$result['version'];
     } else {
       return null;
     }
   }
 
 
 /* -(  Responding to HTTP Parameter Requests  )------------------------------ */
 
 
   /**
    * Respond to a request for documentation on HTTP parameters.
    *
    * @param object Editable object.
    * @return AphrontResponse Response object.
    * @task http
    */
   private function buildParametersResponse($object) {
     $controller = $this->getController();
     $viewer = $this->getViewer();
     $request = $controller->getRequest();
     $fields = $this->buildEditFields($object);
 
     $crumbs = $this->buildCrumbs($object);
     $crumbs->addTextCrumb(pht('HTTP Parameters'));
     $crumbs->setBorder(true);
 
     $header_text = pht(
       'HTTP Parameters: %s',
       $this->getObjectCreateShortText());
 
     $header = id(new PHUIHeaderView())
       ->setHeader($header_text);
 
     $help_view = id(new PhabricatorApplicationEditHTTPParameterHelpView())
       ->setUser($viewer)
       ->setFields($fields);
 
     $document = id(new PHUIDocumentViewPro())
       ->setUser($viewer)
       ->setHeader($header)
       ->appendChild($help_view);
 
     return $controller->newPage()
       ->setTitle(pht('HTTP Parameters'))
       ->setCrumbs($crumbs)
       ->appendChild($document);
   }
 
 
   private function buildNoDefaultResponse($object) {
     $cancel_uri = $this->getObjectCreateCancelURI($object);
 
     return $this->getController()
       ->newDialog()
       ->setTitle(pht('No Default Create Forms'))
       ->appendParagraph(
         pht(
           'This application is not configured with any visible, enabled '.
           'forms for creating objects.'))
       ->addCancelButton($cancel_uri);
   }
 
+  private function buildNoCreateResponse($object) {
+    $cancel_uri = $this->getObjectCreateCancelURI($object);
+
+    return $this->getController()
+      ->newDialog()
+      ->setTitle(pht('No Create Permission'))
+      ->appendParagraph(
+        pht(
+          'You do not have permission to create these objects.'))
+      ->addCancelButton($cancel_uri);
+  }
+
+  private function buildNoManageResponse($object) {
+    $cancel_uri = $this->getObjectCreateCancelURI($object);
+
+    return $this->getController()
+      ->newDialog()
+      ->setTitle(pht('No Manage Permission'))
+      ->appendParagraph(
+        pht(
+          'You do not have permission to configure forms for this '.
+          'application.'))
+      ->addCancelButton($cancel_uri);
+  }
+
   private function buildCommentResponse($object) {
     $viewer = $this->getViewer();
 
     if ($this->getIsCreate()) {
       return new Aphront404Response();
     }
 
     $controller = $this->getController();
     $request = $controller->getRequest();
 
     if (!$request->isFormPost()) {
       return new Aphront400Response();
     }
 
     $config = $this->loadDefaultEditEngineConfiguration();
     $fields = $this->buildEditFields($object);
 
     $is_preview = $request->isPreviewRequest();
     $view_uri = $this->getObjectViewURI($object);
 
     $template = $object->getApplicationTransactionTemplate();
     $comment_template = $template->getApplicationTransactionCommentObject();
 
     $comment_text = $request->getStr('comment');
 
     $actions = $request->getStr('editengine.actions');
     if ($actions) {
       $actions = phutil_json_decode($actions);
     }
 
     if ($is_preview) {
       $version_key = PhabricatorVersionedDraft::KEY_VERSION;
       $request_version = $request->getInt($version_key);
       $current_version = $this->loadDraftVersion($object);
       if ($request_version >= $current_version) {
         $draft = PhabricatorVersionedDraft::loadOrCreateDraft(
           $object->getPHID(),
           $viewer->getPHID(),
           $current_version);
 
         // TODO: This is just a proof of concept.
         $draft
           ->setProperty('temporary.comment', $comment_text)
           ->setProperty('actions', $actions)
           ->save();
       }
     }
 
     $xactions = array();
 
     if ($actions) {
       $type_map = array();
       foreach ($fields as $field) {
         $types = $field->getCommentEditTypes();
         foreach ($types as $type) {
           $type_map[$type->getEditType()] = array(
             'type' => $type,
             'field' => $field,
           );
         }
       }
 
       foreach ($actions as $action) {
         $type = idx($action, 'type');
         if (!$type) {
           continue;
         }
 
         $spec = idx($type_map, $type);
         if (!$spec) {
           continue;
         }
 
         $edit_type = $spec['type'];
         $field = $spec['field'];
 
         $field->readValueFromComment($action);
 
         $type_xactions = $edit_type->generateTransactions(
           $template,
           array(
             'value' => $field->getValueForTransaction(),
           ));
         foreach ($type_xactions as $type_xaction) {
           $xactions[] = $type_xaction;
         }
       }
     }
 
     if (strlen($comment_text) || !$xactions) {
       $xactions[] = id(clone $template)
         ->setTransactionType(PhabricatorTransactions::TYPE_COMMENT)
         ->attachComment(
           id(clone $comment_template)
             ->setContent($comment_text));
     }
 
     $editor = $object->getApplicationTransactionEditor()
       ->setActor($viewer)
       ->setContinueOnNoEffect($request->isContinueRequest())
       ->setContentSourceFromRequest($request)
       ->setIsPreview($is_preview);
 
     try {
       $xactions = $editor->applyTransactions($object, $xactions);
     } catch (PhabricatorApplicationTransactionNoEffectException $ex) {
       return id(new PhabricatorApplicationTransactionNoEffectResponse())
         ->setCancelURI($view_uri)
         ->setException($ex);
     }
 
     if (!$is_preview) {
       PhabricatorVersionedDraft::purgeDrafts(
         $object->getPHID(),
         $viewer->getPHID(),
         $this->loadDraftVersion($object));
     }
 
     if ($request->isAjax() && $is_preview) {
       return id(new PhabricatorApplicationTransactionResponse())
         ->setViewer($viewer)
         ->setTransactions($xactions)
         ->setIsPreview($is_preview);
     } else {
       return id(new AphrontRedirectResponse())
         ->setURI($view_uri);
     }
   }
 
 
 /* -(  Conduit  )------------------------------------------------------------ */
 
 
   /**
    * Respond to a Conduit edit request.
    *
    * This method accepts a list of transactions to apply to an object, and
    * either edits an existing object or creates a new one.
    *
    * @task conduit
    */
   final public function buildConduitResponse(ConduitAPIRequest $request) {
     $viewer = $this->getViewer();
 
     $config = $this->loadDefaultEditEngineConfiguration();
     if (!$config) {
       throw new Exception(
         pht(
           'Unable to load configuration for this EditEngine ("%s").',
           get_class($this)));
     }
 
     $identifier = $request->getValue('objectIdentifier');
     if ($identifier) {
       $this->setIsCreate(false);
       $object = $this->newObjectFromIdentifier($identifier);
     } else {
+      $this->requireCreateCapability();
+
       $this->setIsCreate(true);
       $object = $this->newEditableObject();
     }
 
     $this->validateObject($object);
 
     $fields = $this->buildEditFields($object);
 
     $types = $this->getConduitEditTypesFromFields($fields);
     $template = $object->getApplicationTransactionTemplate();
 
     $xactions = $this->getConduitTransactions($request, $types, $template);
 
     $editor = $object->getApplicationTransactionEditor()
       ->setActor($viewer)
       ->setContentSourceFromConduitRequest($request)
       ->setContinueOnNoEffect(true);
 
     $xactions = $editor->applyTransactions($object, $xactions);
 
     $xactions_struct = array();
     foreach ($xactions as $xaction) {
       $xactions_struct[] = array(
         'phid' => $xaction->getPHID(),
       );
     }
 
     return array(
       'object' => array(
         'id' => $object->getID(),
         'phid' => $object->getPHID(),
       ),
       'transactions' => $xactions_struct,
     );
   }
 
 
   /**
    * Generate transactions which can be applied from edit actions in a Conduit
    * request.
    *
    * @param ConduitAPIRequest The request.
    * @param list<PhabricatorEditType> Supported edit types.
    * @param PhabricatorApplicationTransaction Template transaction.
    * @return list<PhabricatorApplicationTransaction> Generated transactions.
    * @task conduit
    */
   private function getConduitTransactions(
     ConduitAPIRequest $request,
     array $types,
     PhabricatorApplicationTransaction $template) {
 
     $transactions_key = 'transactions';
 
     $xactions = $request->getValue($transactions_key);
     if (!is_array($xactions)) {
       throw new Exception(
         pht(
           'Parameter "%s" is not a list of transactions.',
           $transactions_key));
     }
 
     foreach ($xactions as $key => $xaction) {
       if (!is_array($xaction)) {
         throw new Exception(
           pht(
             'Parameter "%s" must contain a list of transaction descriptions, '.
             'but item with key "%s" is not a dictionary.',
             $transactions_key,
             $key));
       }
 
       if (!array_key_exists('type', $xaction)) {
         throw new Exception(
           pht(
             'Parameter "%s" must contain a list of transaction descriptions, '.
             'but item with key "%s" is missing a "type" field. Each '.
             'transaction must have a type field.',
             $transactions_key,
             $key));
       }
 
       $type = $xaction['type'];
       if (empty($types[$type])) {
         throw new Exception(
           pht(
             'Transaction with key "%s" has invalid type "%s". This type is '.
             'not recognized. Valid types are: %s.',
             $key,
             $type,
             implode(', ', array_keys($types))));
       }
     }
 
     $results = array();
     foreach ($xactions as $xaction) {
       $type = $types[$xaction['type']];
 
       $type_xactions = $type->generateTransactions(
         clone $template,
         $xaction);
 
       foreach ($type_xactions as $type_xaction) {
         $results[] = $type_xaction;
       }
     }
 
     return $results;
   }
 
 
   /**
    * @return map<string, PhabricatorEditType>
    * @task conduit
    */
   private function getConduitEditTypesFromFields(array $fields) {
     $types = array();
     foreach ($fields as $field) {
       $field_types = $field->getConduitEditTypes();
 
       if ($field_types === null) {
         continue;
       }
 
       foreach ($field_types as $field_type) {
         $field_type->setField($field);
         $types[$field_type->getEditType()] = $field_type;
       }
     }
     return $types;
   }
 
   public function getConduitEditTypes() {
     $config = $this->loadDefaultEditEngineConfiguration();
     if (!$config) {
       return array();
     }
 
     $object = $this->newEditableObject();
     $fields = $this->buildEditFields($object);
     return $this->getConduitEditTypesFromFields($fields);
   }
 
   final public static function getAllEditEngines() {
     return id(new PhutilClassMapQuery())
       ->setAncestorClass(__CLASS__)
       ->setUniqueMethod('getEngineKey')
       ->execute();
   }
 
   final public static function getByKey(PhabricatorUser $viewer, $key) {
     return id(new PhabricatorEditEngineQuery())
       ->setViewer($viewer)
       ->withEngineKeys(array($key))
       ->executeOne();
   }
 
   public function getIcon() {
     $application = $this->getApplication();
     return $application->getFontIcon();
   }
 
   public function loadQuickCreateItems() {
-    $configs = $this->loadUsableConfigurationsForCreate();
-
     $items = array();
 
+    if (!$this->hasCreateCapability()) {
+      return $items;
+    }
+
+    $configs = $this->loadUsableConfigurationsForCreate();
+
     if (!$configs) {
       // No items to add.
     } else if (count($configs) == 1) {
       $config = head($configs);
       $items[] = $this->newQuickCreateItem($config);
     } else {
       $group_name = $this->getQuickCreateMenuHeaderText();
 
       $items[] = id(new PHUIListItemView())
         ->setType(PHUIListItemView::TYPE_LABEL)
         ->setName($group_name);
 
       foreach ($configs as $config) {
         $items[] = $this->newQuickCreateItem($config);
       }
     }
 
     return $items;
   }
 
   private function loadUsableConfigurationsForCreate() {
     $viewer = $this->getViewer();
 
-    return id(new PhabricatorEditEngineConfigurationQuery())
+    $configs = id(new PhabricatorEditEngineConfigurationQuery())
       ->setViewer($viewer)
       ->withEngineKeys(array($this->getEngineKey()))
       ->withIsDefault(true)
       ->withIsDisabled(false)
       ->execute();
+
+    $configs = msort($configs, 'getCreateSortKey');
+
+    return $configs;
   }
 
   private function newQuickCreateItem(
     PhabricatorEditEngineConfiguration $config) {
 
     $item_name = $config->getName();
     $item_icon = $config->getIcon();
     $form_key = $config->getIdentifier();
     $item_uri = $this->getEditURI(null, "form/{$form_key}/");
 
     return id(new PHUIListItemView())
       ->setName($item_name)
       ->setIcon($item_icon)
       ->setHref($item_uri);
   }
 
+  protected function getCreateNewObjectPolicy() {
+    return PhabricatorPolicies::POLICY_USER;
+  }
+
+  private function requireCreateCapability() {
+    PhabricatorPolicyFilter::requireCapability(
+      $this->getViewer(),
+      $this,
+      PhabricatorPolicyCapability::CAN_EDIT);
+  }
+
+  private function hasCreateCapability() {
+    return PhabricatorPolicyFilter::hasCapability(
+      $this->getViewer(),
+      $this,
+      PhabricatorPolicyCapability::CAN_EDIT);
+  }
+
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getPHID() {
     return get_class($this);
   }
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
+      PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return PhabricatorPolicies::getMostOpenPolicy();
+      case PhabricatorPolicyCapability::CAN_EDIT:
+        return $this->getCreateNewObjectPolicy();
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return false;
   }
 
   public function describeAutomaticCapability($capability) {
     return null;
   }
 }
diff --git a/src/applications/transactions/editor/PhabricatorEditEngineConfigurationEditEngine.php b/src/applications/transactions/editor/PhabricatorEditEngineConfigurationEditEngine.php
index 2c340e8649..de667ace4e 100644
--- a/src/applications/transactions/editor/PhabricatorEditEngineConfigurationEditEngine.php
+++ b/src/applications/transactions/editor/PhabricatorEditEngineConfigurationEditEngine.php
@@ -1,93 +1,99 @@
 <?php
 
 final class PhabricatorEditEngineConfigurationEditEngine
   extends PhabricatorEditEngine {
 
   const ENGINECONST = 'transactions.editengine.config';
 
   private $targetEngine;
 
   public function setTargetEngine(PhabricatorEditEngine $target_engine) {
     $this->targetEngine = $target_engine;
     return $this;
   }
 
   public function getTargetEngine() {
     if (!$this->targetEngine) {
       throw new PhutilInvalidStateException('setTargetEngine');
     }
     return $this->targetEngine;
   }
 
+  protected function getCreateNewObjectPolicy() {
+    return $this->getTargetEngine()
+      ->getApplication()
+      ->getPolicy(PhabricatorPolicyCapability::CAN_EDIT);
+  }
+
   public function getEngineName() {
     return pht('Edit Configurations');
   }
 
   public function getEngineApplicationClass() {
     return 'PhabricatorTransactionsApplication';
   }
 
   protected function newEditableObject() {
     return PhabricatorEditEngineConfiguration::initializeNewConfiguration(
       $this->getViewer(),
       $this->getTargetEngine());
   }
 
   protected function newObjectQuery() {
     return id(new PhabricatorEditEngineConfigurationQuery());
   }
 
   protected function getObjectCreateTitleText($object) {
     return pht('Create New Form');
   }
 
   protected function getObjectEditTitleText($object) {
     return pht('Edit Form %d: %s', $object->getID(), $object->getDisplayName());
   }
 
   protected function getObjectEditShortText($object) {
     return pht('Form %d', $object->getID());
   }
 
   protected function getObjectCreateShortText() {
     return pht('Create Form');
   }
 
   protected function getObjectViewURI($object) {
     $id = $object->getID();
     return $this->getURI("view/{$id}/");
   }
 
   protected function getEditorURI() {
     return $this->getURI('edit/');
   }
 
   protected function getObjectCreateCancelURI($object) {
     return $this->getURI();
   }
 
   private function getURI($path = null) {
     $engine_key = $this->getTargetEngine()->getEngineKey();
     return "/transactions/editengine/{$engine_key}/{$path}";
   }
 
   protected function buildCustomEditFields($object) {
     return array(
       id(new PhabricatorTextEditField())
         ->setKey('name')
         ->setLabel(pht('Name'))
         ->setDescription(pht('Name of the form.'))
         ->setTransactionType(
           PhabricatorEditEngineConfigurationTransaction::TYPE_NAME)
         ->setValue($object->getName()),
       id(new PhabricatorRemarkupEditField())
         ->setKey('preamble')
         ->setLabel(pht('Preamble'))
         ->setDescription(pht('Optional instructions, shown above the form.'))
         ->setTransactionType(
           PhabricatorEditEngineConfigurationTransaction::TYPE_PREAMBLE)
         ->setValue($object->getPreamble()),
     );
   }
 
 }
diff --git a/src/applications/transactions/editor/PhabricatorEditEngineConfigurationEditor.php b/src/applications/transactions/editor/PhabricatorEditEngineConfigurationEditor.php
index 8b3f446c90..0b9edd7b63 100644
--- a/src/applications/transactions/editor/PhabricatorEditEngineConfigurationEditor.php
+++ b/src/applications/transactions/editor/PhabricatorEditEngineConfigurationEditor.php
@@ -1,151 +1,150 @@
 <?php
 
 final class PhabricatorEditEngineConfigurationEditor
   extends PhabricatorApplicationTransactionEditor {
 
   public function getEditorApplicationClass() {
     return 'PhabricatorTransactionsApplication';
   }
 
   public function getEditorObjectsDescription() {
     return pht('Edit Configurations');
   }
 
   public function getTransactionTypes() {
     $types = parent::getTransactionTypes();
 
     $types[] = PhabricatorTransactions::TYPE_VIEW_POLICY;
-    $types[] = PhabricatorTransactions::TYPE_EDIT_POLICY;
 
     $types[] = PhabricatorEditEngineConfigurationTransaction::TYPE_NAME;
     $types[] = PhabricatorEditEngineConfigurationTransaction::TYPE_PREAMBLE;
     $types[] = PhabricatorEditEngineConfigurationTransaction::TYPE_ORDER;
     $types[] = PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULT;
     $types[] = PhabricatorEditEngineConfigurationTransaction::TYPE_LOCKS;
     $types[] =
       PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULTCREATE;
     $types[] = PhabricatorEditEngineConfigurationTransaction::TYPE_DISABLE;
 
 
     return $types;
   }
 
   protected function validateTransaction(
     PhabricatorLiskDAO $object,
     $type,
     array $xactions) {
 
     $errors = parent::validateTransaction($object, $type, $xactions);
     switch ($type) {
       case PhabricatorEditEngineConfigurationTransaction::TYPE_NAME:
         $missing = $this->validateIsEmptyTextField(
           $object->getName(),
           $xactions);
 
         if ($missing) {
           $error = new PhabricatorApplicationTransactionValidationError(
             $type,
             pht('Required'),
             pht('Form name is required.'),
             nonempty(last($xactions), null));
 
           $error->setIsMissingFieldError(true);
           $errors[] = $error;
         }
         break;
     }
 
     return $errors;
   }
 
   protected function getCustomTransactionOldValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorEditEngineConfigurationTransaction::TYPE_NAME:
         return $object->getName();
       case PhabricatorEditEngineConfigurationTransaction::TYPE_PREAMBLE;
         return $object->getPreamble();
       case PhabricatorEditEngineConfigurationTransaction::TYPE_ORDER:
         return $object->getFieldOrder();
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULT:
         $field_key = $xaction->getMetadataValue('field.key');
         return $object->getFieldDefault($field_key);
       case PhabricatorEditEngineConfigurationTransaction::TYPE_LOCKS:
         return $object->getFieldLocks();
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULTCREATE:
         return (int)$object->getIsDefault();
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DISABLE:
         return (int)$object->getIsDisabled();
     }
   }
 
   protected function getCustomTransactionNewValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorEditEngineConfigurationTransaction::TYPE_NAME:
       case PhabricatorEditEngineConfigurationTransaction::TYPE_PREAMBLE;
       case PhabricatorEditEngineConfigurationTransaction::TYPE_ORDER:
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULT:
       case PhabricatorEditEngineConfigurationTransaction::TYPE_LOCKS:
         return $xaction->getNewValue();
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULTCREATE:
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DISABLE:
         return (int)$xaction->getNewValue();
     }
   }
 
   protected function applyCustomInternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorEditEngineConfigurationTransaction::TYPE_NAME:
         $object->setName($xaction->getNewValue());
         return;
       case PhabricatorEditEngineConfigurationTransaction::TYPE_PREAMBLE;
         $object->setPreamble($xaction->getNewValue());
         return;
       case PhabricatorEditEngineConfigurationTransaction::TYPE_ORDER:
         $object->setFieldOrder($xaction->getNewValue());
         return;
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULT:
         $field_key = $xaction->getMetadataValue('field.key');
         $object->setFieldDefault($field_key, $xaction->getNewValue());
         return;
       case PhabricatorEditEngineConfigurationTransaction::TYPE_LOCKS:
         $object->setFieldLocks($xaction->getNewValue());
         return;
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULTCREATE:
         $object->setIsDefault($xaction->getNewValue());
         return;
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DISABLE:
         $object->setIsDisabled($xaction->getNewValue());
         return;
     }
 
     return parent::applyCustomInternalTransaction($object, $xaction);
   }
 
   protected function applyCustomExternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorEditEngineConfigurationTransaction::TYPE_NAME:
       case PhabricatorEditEngineConfigurationTransaction::TYPE_PREAMBLE;
       case PhabricatorEditEngineConfigurationTransaction::TYPE_ORDER;
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULT:
       case PhabricatorEditEngineConfigurationTransaction::TYPE_LOCKS:
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DEFAULTCREATE:
       case PhabricatorEditEngineConfigurationTransaction::TYPE_DISABLE:
         return;
     }
 
     return parent::applyCustomExternalTransaction($object, $xaction);
   }
 
 }
diff --git a/src/applications/transactions/storage/PhabricatorEditEngineConfiguration.php b/src/applications/transactions/storage/PhabricatorEditEngineConfiguration.php
index 5d80d95c5e..a2793d626f 100644
--- a/src/applications/transactions/storage/PhabricatorEditEngineConfiguration.php
+++ b/src/applications/transactions/storage/PhabricatorEditEngineConfiguration.php
@@ -1,270 +1,311 @@
 <?php
 
 final class PhabricatorEditEngineConfiguration
   extends PhabricatorSearchDAO
   implements
     PhabricatorApplicationTransactionInterface,
     PhabricatorPolicyInterface {
 
   protected $engineKey;
   protected $builtinKey;
   protected $name;
   protected $viewPolicy;
-  protected $editPolicy;
   protected $properties = array();
   protected $isDisabled = 0;
   protected $isDefault = 0;
+  protected $isEdit = 0;
+  protected $createOrder = 0;
+  protected $editOrder = 0;
 
   private $engine = self::ATTACHABLE;
 
   const LOCK_VISIBLE = 'visible';
   const LOCK_LOCKED = 'locked';
   const LOCK_HIDDEN = 'hidden';
 
   public function getTableName() {
     return 'search_editengineconfiguration';
   }
 
   public static function initializeNewConfiguration(
     PhabricatorUser $actor,
     PhabricatorEditEngine $engine) {
 
-    // TODO: This should probably be controlled by a new default capability.
-    $edit_policy = PhabricatorPolicies::POLICY_ADMIN;
-
     return id(new PhabricatorEditEngineConfiguration())
       ->setEngineKey($engine->getEngineKey())
       ->attachEngine($engine)
-      ->setViewPolicy(PhabricatorPolicies::getMostOpenPolicy())
-      ->setEditPolicy($edit_policy);
+      ->setViewPolicy(PhabricatorPolicies::getMostOpenPolicy());
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorEditEngineConfigurationPHIDType::TYPECONST);
   }
 
+  public function getCreateSortKey() {
+    return $this->getSortKey($this->createOrder);
+  }
+
+  public function getEditSortKey() {
+    return $this->getSortKey($this->editOrder);
+  }
+
+  private function getSortKey($order) {
+    // Put objects at the bottom by default if they haven't previously been
+    // reordered. When they're explicitly reordered, the smallest sort key we
+    // assign is 1, so if the object has a value of 0 it means it hasn't been
+    // ordered yet.
+    if ($order != 0) {
+      $group = 'A';
+    } else {
+      $group = 'B';
+    }
+
+    return sprintf(
+      "%s%012d%s\0%012d",
+      $group,
+      $order,
+      $this->getName(),
+      $this->getID());
+  }
+
   protected function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_SERIALIZATION => array(
         'properties' => self::SERIALIZATION_JSON,
       ),
       self::CONFIG_COLUMN_SCHEMA => array(
         'engineKey' => 'text64',
         'builtinKey' => 'text64?',
         'name' => 'text255',
         'isDisabled' => 'bool',
         'isDefault' => 'bool',
+        'isEdit' => 'bool',
+        'createOrder' => 'uint32',
+        'editOrder' => 'uint32',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_engine' => array(
           'columns' => array('engineKey', 'builtinKey'),
           'unique' => true,
         ),
         'key_default' => array(
           'columns' => array('engineKey', 'isDefault', 'isDisabled'),
         ),
+        'key_edit' => array(
+          'columns' => array('engineKey', 'isEdit', 'isDisabled'),
+        ),
       ),
     ) + parent::getConfiguration();
   }
 
   public function getProperty($key, $default = null) {
     return idx($this->properties, $key, $default);
   }
 
   public function setProperty($key, $value) {
     $this->properties[$key] = $value;
     return $this;
   }
 
   public function attachEngine(PhabricatorEditEngine $engine) {
     $this->engine = $engine;
     return $this;
   }
 
   public function getEngine() {
     return $this->assertAttached($this->engine);
   }
 
   public function applyConfigurationToFields(
     PhabricatorEditEngine $engine,
     $object,
     array $fields) {
     $fields = mpull($fields, null, 'getKey');
 
     $is_new = !$object->getID();
 
     $values = $this->getProperty('defaults', array());
     foreach ($fields as $key => $field) {
       if ($is_new) {
         if (array_key_exists($key, $values)) {
           $field->readDefaultValueFromConfiguration($values[$key]);
         }
       }
     }
 
     $locks = $this->getFieldLocks();
     foreach ($fields as $field) {
       $key = $field->getKey();
       switch (idx($locks, $key)) {
         case self::LOCK_LOCKED:
           $field->setIsHidden(false);
           $field->setIsLocked(true);
           break;
         case self::LOCK_HIDDEN:
           $field->setIsHidden(true);
           $field->setIsLocked(false);
           break;
         case self::LOCK_VISIBLE:
           $field->setIsHidden(false);
           $field->setIsLocked(false);
           break;
         default:
           // If we don't have an explicit value, don't make any adjustments.
           break;
       }
     }
 
     $fields = $this->reorderFields($fields);
 
     $preamble = $this->getPreamble();
     if (strlen($preamble)) {
       $fields = array(
         'config.preamble' => id(new PhabricatorInstructionsEditField())
           ->setKey('config.preamble')
           ->setIsReorderable(false)
           ->setIsDefaultable(false)
           ->setIsLockable(false)
           ->setValue($preamble),
       ) + $fields;
     }
 
     return $fields;
   }
 
   private function reorderFields(array $fields) {
     $keys = $this->getFieldOrder();
     $fields = array_select_keys($fields, $keys) + $fields;
     return $fields;
   }
 
   public function getURI() {
     $engine_key = $this->getEngineKey();
     $key = $this->getIdentifier();
 
     return "/transactions/editengine/{$engine_key}/view/{$key}/";
   }
 
   public function getIdentifier() {
     $key = $this->getID();
     if (!$key) {
       $key = $this->getBuiltinKey();
     }
     return $key;
   }
 
   public function getDisplayName() {
     $name = $this->getName();
     if (strlen($name)) {
       return $name;
     }
 
     $builtin = $this->getBuiltinKey();
     if ($builtin !== null) {
       return pht('Builtin Form "%s"', $builtin);
     }
 
     return pht('Untitled Form');
   }
 
   public function getPreamble() {
     return $this->getProperty('preamble');
   }
 
   public function setPreamble($preamble) {
     return $this->setProperty('preamble', $preamble);
   }
 
   public function setFieldOrder(array $field_order) {
     return $this->setProperty('order', $field_order);
   }
 
   public function getFieldOrder() {
     return $this->getProperty('order', array());
   }
 
   public function setFieldLocks(array $field_locks) {
     return $this->setProperty('locks', $field_locks);
   }
 
   public function getFieldLocks() {
     return $this->getProperty('locks', array());
   }
 
   public function getFieldDefault($key) {
     $defaults = $this->getProperty('defaults', array());
     return idx($defaults, $key);
   }
 
   public function setFieldDefault($key, $value) {
     $defaults = $this->getProperty('defaults', array());
     $defaults[$key] = $value;
     return $this->setProperty('defaults', $defaults);
   }
 
   public function getIcon() {
     return $this->getEngine()->getIcon();
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return $this->getViewPolicy();
       case PhabricatorPolicyCapability::CAN_EDIT:
-        return $this->getEditPolicy();
+        return $this->getEngine()
+          ->getApplication()
+          ->getPolicy($capability);
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
+    switch ($capability) {
+      case PhabricatorPolicyCapability::CAN_VIEW:
+        return PhabricatorPolicyFilter::hasCapability(
+          $viewer,
+          $this->getEngine()->getApplication(),
+          PhabricatorPolicyCapability::CAN_EDIT);
+    }
+
     return false;
   }
 
   public function describeAutomaticCapability($capability) {
     return null;
   }
 
 
 /* -(  PhabricatorApplicationTransactionInterface  )------------------------- */
 
 
   public function getApplicationTransactionEditor() {
     return new PhabricatorEditEngineConfigurationEditor();
   }
 
   public function getApplicationTransactionObject() {
     return $this;
   }
 
   public function getApplicationTransactionTemplate() {
     return new PhabricatorEditEngineConfigurationTransaction();
   }
 
   public function willRenderTimeline(
     PhabricatorApplicationTransactionView $timeline,
     AphrontRequest $request) {
     return $timeline;
   }
 
 }