diff --git a/app/controllers/admin/base_controller.rb b/app/controllers/admin/base_controller.rb
index dcdc9afd7d1..50fd6d543c6 100644
--- a/app/controllers/admin/base_controller.rb
+++ b/app/controllers/admin/base_controller.rb
@@ -4,6 +4,7 @@ module Admin
   class BaseController < ApplicationController
     include Authorization
     include AccountableConcern
+    include Admin::PermissionsConcern
 
     content_security_policy do |p|
       policy = ContentSecurityPolicy.new
@@ -13,7 +14,6 @@ module Admin
 
     layout 'admin'
 
-    before_action :require_moderator_or_admin_permissions
     before_action :set_referrer_policy_header
 
     after_action :verify_authorized
@@ -27,10 +27,5 @@ module Admin
     def set_user
       @user = Account.find(params[:account_id]).user || raise(ActiveRecord::RecordNotFound)
     end
-
-    def require_moderator_or_admin_permissions
-      # not using #authorize here, so #verify_authorized still makes sure more fine-grained rules are enforced down the line
-      forbidden unless Admin::BasePolicy.new(current_account, :base).access?
-    end
   end
 end
diff --git a/app/controllers/api/v1/admin/account_actions_controller.rb b/app/controllers/api/v1/admin/account_actions_controller.rb
index 7249797a40b..fd2b91c125f 100644
--- a/app/controllers/api/v1/admin/account_actions_controller.rb
+++ b/app/controllers/api/v1/admin/account_actions_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::AccountActionsController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:write', :'admin:write:accounts' }
   before_action :set_account
diff --git a/app/controllers/api/v1/admin/accounts_controller.rb b/app/controllers/api/v1/admin/accounts_controller.rb
index ff6f41e01da..cc42db25352 100644
--- a/app/controllers/api/v1/admin/accounts_controller.rb
+++ b/app/controllers/api/v1/admin/accounts_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::AccountsController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/canonical_email_blocks_controller.rb b/app/controllers/api/v1/admin/canonical_email_blocks_controller.rb
index c144a9e0f93..12c2603087b 100644
--- a/app/controllers/api/v1/admin/canonical_email_blocks_controller.rb
+++ b/app/controllers/api/v1/admin/canonical_email_blocks_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::CanonicalEmailBlocksController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/dimensions_controller.rb b/app/controllers/api/v1/admin/dimensions_controller.rb
index 4a72ad08be7..1f8dc9f2aa1 100644
--- a/app/controllers/api/v1/admin/dimensions_controller.rb
+++ b/app/controllers/api/v1/admin/dimensions_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::DimensionsController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }
   before_action :set_dimensions
diff --git a/app/controllers/api/v1/admin/domain_allows_controller.rb b/app/controllers/api/v1/admin/domain_allows_controller.rb
index 24f68aa1bd8..e3f5ddb7ab8 100644
--- a/app/controllers/api/v1/admin/domain_allows_controller.rb
+++ b/app/controllers/api/v1/admin/domain_allows_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::DomainAllowsController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
   MAX_LIMIT = 500
diff --git a/app/controllers/api/v1/admin/domain_blocks_controller.rb b/app/controllers/api/v1/admin/domain_blocks_controller.rb
index b44ae2ae2a2..90dec85c15c 100644
--- a/app/controllers/api/v1/admin/domain_blocks_controller.rb
+++ b/app/controllers/api/v1/admin/domain_blocks_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::DomainBlocksController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
   MAX_LIMIT = 500
diff --git a/app/controllers/api/v1/admin/email_domain_blocks_controller.rb b/app/controllers/api/v1/admin/email_domain_blocks_controller.rb
index e7bd804e366..571d5f67252 100644
--- a/app/controllers/api/v1/admin/email_domain_blocks_controller.rb
+++ b/app/controllers/api/v1/admin/email_domain_blocks_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::EmailDomainBlocksController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/ip_blocks_controller.rb b/app/controllers/api/v1/admin/ip_blocks_controller.rb
index 8ef18e4ff05..93c2d4afb24 100644
--- a/app/controllers/api/v1/admin/ip_blocks_controller.rb
+++ b/app/controllers/api/v1/admin/ip_blocks_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::IpBlocksController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/measures_controller.rb b/app/controllers/api/v1/admin/measures_controller.rb
index e90e50f999b..8518cd5e414 100644
--- a/app/controllers/api/v1/admin/measures_controller.rb
+++ b/app/controllers/api/v1/admin/measures_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::MeasuresController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }
   before_action :set_measures
diff --git a/app/controllers/api/v1/admin/reports_controller.rb b/app/controllers/api/v1/admin/reports_controller.rb
index 765996eb3cf..1c72f844de4 100644
--- a/app/controllers/api/v1/admin/reports_controller.rb
+++ b/app/controllers/api/v1/admin/reports_controller.rb
@@ -3,6 +3,7 @@
 class Api::V1::Admin::ReportsController < Api::BaseController
   include Authorization
   include AccountableConcern
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/retention_controller.rb b/app/controllers/api/v1/admin/retention_controller.rb
index 41f1be7edbe..4acfbb6da93 100644
--- a/app/controllers/api/v1/admin/retention_controller.rb
+++ b/app/controllers/api/v1/admin/retention_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::RetentionController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }
   before_action :set_retention
diff --git a/app/controllers/api/v1/admin/tags_controller.rb b/app/controllers/api/v1/admin/tags_controller.rb
index dd272120e21..c57c771864b 100644
--- a/app/controllers/api/v1/admin/tags_controller.rb
+++ b/app/controllers/api/v1/admin/tags_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::TagsController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }, only: [:index, :show]
   before_action -> { authorize_if_got_token! :'admin:write' }, only: :update
diff --git a/app/controllers/api/v1/admin/trends/links/preview_card_providers_controller.rb b/app/controllers/api/v1/admin/trends/links/preview_card_providers_controller.rb
index 2b0f39b98f9..65e96924aa6 100644
--- a/app/controllers/api/v1/admin/trends/links/preview_card_providers_controller.rb
+++ b/app/controllers/api/v1/admin/trends/links/preview_card_providers_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::Trends::Links::PreviewCardProvidersController < Api::BaseController
   include Authorization
+  include Admin::PermissionsConcern
 
   LIMIT = 100
 
diff --git a/app/controllers/api/v1/admin/trends/links_controller.rb b/app/controllers/api/v1/admin/trends/links_controller.rb
index 7f4ca482882..13d7ae70c0c 100644
--- a/app/controllers/api/v1/admin/trends/links_controller.rb
+++ b/app/controllers/api/v1/admin/trends/links_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::Trends::LinksController < Api::V1::Trends::LinksController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }, only: :index
   before_action -> { authorize_if_got_token! :'admin:write' }, except: :index
diff --git a/app/controllers/api/v1/admin/trends/statuses_controller.rb b/app/controllers/api/v1/admin/trends/statuses_controller.rb
index 34b6580df15..dfb1d70a2aa 100644
--- a/app/controllers/api/v1/admin/trends/statuses_controller.rb
+++ b/app/controllers/api/v1/admin/trends/statuses_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::Trends::StatusesController < Api::V1::Trends::StatusesController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }, only: :index
   before_action -> { authorize_if_got_token! :'admin:write' }, except: :index
diff --git a/app/controllers/api/v1/admin/trends/tags_controller.rb b/app/controllers/api/v1/admin/trends/tags_controller.rb
index 2eeea95225c..d368ff8eaab 100644
--- a/app/controllers/api/v1/admin/trends/tags_controller.rb
+++ b/app/controllers/api/v1/admin/trends/tags_controller.rb
@@ -2,6 +2,7 @@
 
 class Api::V1::Admin::Trends::TagsController < Api::V1::Trends::TagsController
   include Authorization
+  include Admin::PermissionsConcern
 
   before_action -> { authorize_if_got_token! :'admin:read' }, only: :index
   before_action -> { authorize_if_got_token! :'admin:write' }, except: :index
diff --git a/app/controllers/concerns/admin/permissions_concern.rb b/app/controllers/concerns/admin/permissions_concern.rb
new file mode 100644
index 00000000000..a38156619e8
--- /dev/null
+++ b/app/controllers/concerns/admin/permissions_concern.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Admin::PermissionsConcern
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :require_moderator_or_admin_permissions
+  end
+
+  private
+
+  def require_moderator_or_admin_permissions
+    # not using #authorize here, so #verify_authorized still makes sure more fine-grained rules are enforced down the line
+    forbidden unless Admin::BasePolicy.new(current_account, :base).access?
+  end
+end
diff --git a/app/policies/application_policy.rb b/app/policies/application_policy.rb
index 163b81e9e65..4be443bcd78 100644
--- a/app/policies/application_policy.rb
+++ b/app/policies/application_policy.rb
@@ -19,6 +19,8 @@ class ApplicationPolicy
   end
 
   def role
+    return UserRole.nobody if current_user&.disabled?
+
     current_user&.role || UserRole.nobody
   end
 end
diff --git a/spec/policies/application_policy_spec.rb b/spec/policies/application_policy_spec.rb
new file mode 100644
index 00000000000..265be521771
--- /dev/null
+++ b/spec/policies/application_policy_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe ApplicationPolicy do
+  subject do
+    Class.new(described_class) do
+      def spec?
+        role.can?(:manage_users)
+      end
+    end
+  end
+
+  let(:admin)   { Fabricate(:admin_user).account }
+  let(:john)    { Fabricate(:account) }
+  let(:alice)   { Fabricate(:admin_user, disabled: true).account }
+
+  permissions :spec? do
+    context 'when staff' do
+      it 'permits' do
+        expect(subject).to permit(admin)
+      end
+    end
+
+    context 'when not staff' do
+      it 'denies' do
+        expect(subject).to_not permit(john)
+      end
+    end
+
+    context 'when staff but disabled' do
+      it 'denies' do
+        expect(subject).to_not permit(alice)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/admin/account_actions_spec.rb b/spec/requests/api/v1/admin/account_actions_spec.rb
index c1273f468dd..97549c8ed5a 100644
--- a/spec/requests/api/v1/admin/account_actions_spec.rb
+++ b/spec/requests/api/v1/admin/account_actions_spec.rb
@@ -51,6 +51,7 @@ RSpec.describe 'Account actions' do
 
       it_behaves_like 'forbidden for wrong scope', 'admin:read admin:read:accounts'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
       it_behaves_like 'a successful notification delivery'
       it_behaves_like 'a successful logged action', :disable, :user
 
@@ -67,6 +68,7 @@ RSpec.describe 'Account actions' do
 
       it_behaves_like 'forbidden for wrong scope', 'admin:read admin:read:accounts'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
       it_behaves_like 'a successful notification delivery'
       it_behaves_like 'a successful logged action', :sensitive, :account
 
@@ -83,6 +85,7 @@ RSpec.describe 'Account actions' do
 
       it_behaves_like 'forbidden for wrong scope', 'admin:read admin:read:accounts'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
       it_behaves_like 'a successful notification delivery'
       it_behaves_like 'a successful logged action', :silence, :account
 
@@ -99,6 +102,7 @@ RSpec.describe 'Account actions' do
 
       it_behaves_like 'forbidden for wrong scope', 'admin:read admin:read:accounts'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
       it_behaves_like 'a successful notification delivery'
       it_behaves_like 'a successful logged action', :suspend, :account
 
diff --git a/spec/requests/api/v1/admin/accounts_spec.rb b/spec/requests/api/v1/admin/accounts_spec.rb
index d94fcd31e40..0580e296799 100644
--- a/spec/requests/api/v1/admin/accounts_spec.rb
+++ b/spec/requests/api/v1/admin/accounts_spec.rb
@@ -30,6 +30,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'read read:accounts admin:write admin:write:accounts'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when requesting active local staff accounts' do
       let(:expected_results) { [admin_account] }
@@ -107,6 +108,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'read read:accounts admin:write admin:write:accounts'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the requested account successfully', :aggregate_failures do
       subject
@@ -144,6 +146,7 @@ RSpec.describe 'Accounts' do
 
       it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
 
       it 'approves the user successfully', :aggregate_failures do
         subject
@@ -202,6 +205,7 @@ RSpec.describe 'Accounts' do
 
       it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
 
       it 'removes the user successfully and logs action', :aggregate_failures do
         subject
@@ -255,6 +259,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'enables the user successfully', :aggregate_failures do
       subject
@@ -290,6 +295,7 @@ RSpec.describe 'Accounts' do
 
       it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
 
       it 'unsuspends the account successfully', :aggregate_failures do
         subject
@@ -335,6 +341,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'unsensitizes the account successfully', :aggregate_failures do
       subject
@@ -369,6 +376,7 @@ RSpec.describe 'Accounts' do
 
     it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'unsilences the account successfully', :aggregate_failures do
       subject
@@ -404,6 +412,7 @@ RSpec.describe 'Accounts' do
 
       it_behaves_like 'forbidden for wrong scope', 'write write:accounts read admin:read'
       it_behaves_like 'forbidden for wrong role', ''
+      it_behaves_like 'forbidden for disabled user'
 
       it 'deletes the account successfully', :aggregate_failures do
         allow(Admin::AccountDeletionWorker).to receive(:perform_async)
diff --git a/spec/requests/api/v1/admin/canonical_email_blocks_spec.rb b/spec/requests/api/v1/admin/canonical_email_blocks_spec.rb
index b3af0a923d9..513adb08911 100644
--- a/spec/requests/api/v1/admin/canonical_email_blocks_spec.rb
+++ b/spec/requests/api/v1/admin/canonical_email_blocks_spec.rb
@@ -15,6 +15,7 @@ RSpec.describe 'Canonical Email Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there is no canonical email block' do
       it 'returns an empty list' do
@@ -90,6 +91,7 @@ RSpec.describe 'Canonical Email Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when the requested canonical email block exists' do
       it 'returns the requested canonical email block data correctly', :aggregate_failures do
@@ -127,6 +129,7 @@ RSpec.describe 'Canonical Email Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when the required email param is not provided' do
       let(:params) { {} }
@@ -178,6 +181,7 @@ RSpec.describe 'Canonical Email Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the canonical_email_hash correctly', :aggregate_failures do
       subject
@@ -252,6 +256,7 @@ RSpec.describe 'Canonical Email Blocks' do
 
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'deletes the canonical email block', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/domain_allows_spec.rb b/spec/requests/api/v1/admin/domain_allows_spec.rb
index f3ae4076dbc..83b2ff4229d 100644
--- a/spec/requests/api/v1/admin/domain_allows_spec.rb
+++ b/spec/requests/api/v1/admin/domain_allows_spec.rb
@@ -15,6 +15,7 @@ RSpec.describe 'Domain Allows' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there is no allowed domains' do
       it 'returns an empty body' do
@@ -73,6 +74,7 @@ RSpec.describe 'Domain Allows' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the expected allowed domain name', :aggregate_failures do
       subject
@@ -104,6 +106,7 @@ RSpec.describe 'Domain Allows' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'with a valid domain name' do
       it 'returns the expected domain name', :aggregate_failures do
@@ -164,6 +167,7 @@ RSpec.describe 'Domain Allows' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'deletes the allowed domain', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/domain_blocks_spec.rb b/spec/requests/api/v1/admin/domain_blocks_spec.rb
index d532b0d25f9..67753ece899 100644
--- a/spec/requests/api/v1/admin/domain_blocks_spec.rb
+++ b/spec/requests/api/v1/admin/domain_blocks_spec.rb
@@ -15,6 +15,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there are no domain blocks' do
       it 'returns an empty list' do
@@ -89,6 +90,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the expected domain block content', :aggregate_failures do
       subject
@@ -131,6 +133,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'creates a domain block with the expected domain name and severity', :aggregate_failures do
       subject
@@ -239,6 +242,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the updated domain block', :aggregate_failures do
       subject
@@ -281,6 +285,7 @@ RSpec.describe 'Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'deletes the domain block', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/email_domain_blocks_spec.rb b/spec/requests/api/v1/admin/email_domain_blocks_spec.rb
index a75b5abde4f..d70d87f3140 100644
--- a/spec/requests/api/v1/admin/email_domain_blocks_spec.rb
+++ b/spec/requests/api/v1/admin/email_domain_blocks_spec.rb
@@ -15,6 +15,7 @@ RSpec.describe 'Email Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there is no email domain block' do
       it 'returns an empty list' do
@@ -90,6 +91,7 @@ RSpec.describe 'Email Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when email domain block exists' do
       it 'returns the correct blocked domain', :aggregate_failures do
@@ -123,6 +125,7 @@ RSpec.describe 'Email Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the correct blocked email domain', :aggregate_failures do
       subject
@@ -182,6 +185,7 @@ RSpec.describe 'Email Domain Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'read:statuses'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'deletes email domain block', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/ip_blocks_spec.rb b/spec/requests/api/v1/admin/ip_blocks_spec.rb
index a9d62752941..368768549bf 100644
--- a/spec/requests/api/v1/admin/ip_blocks_spec.rb
+++ b/spec/requests/api/v1/admin/ip_blocks_spec.rb
@@ -15,6 +15,7 @@ RSpec.describe 'IP Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'admin:write:ip_blocks'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there is no ip block' do
       it 'returns an empty body' do
@@ -83,6 +84,7 @@ RSpec.describe 'IP Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'admin:write:ip_blocks'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the correct ip block', :aggregate_failures do
       subject
@@ -119,6 +121,7 @@ RSpec.describe 'IP Blocks' do
     it_behaves_like 'forbidden for wrong scope', 'admin:read:ip_blocks'
     it_behaves_like 'forbidden for wrong role', ''
     it_behaves_like 'forbidden for wrong role', 'Moderator'
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the correct ip block', :aggregate_failures do
       subject
diff --git a/spec/requests/api/v1/admin/reports_spec.rb b/spec/requests/api/v1/admin/reports_spec.rb
index 432e7f47a2b..19dc4d6a5ba 100644
--- a/spec/requests/api/v1/admin/reports_spec.rb
+++ b/spec/requests/api/v1/admin/reports_spec.rb
@@ -14,6 +14,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there are no reports' do
       it 'returns an empty list' do
@@ -132,6 +133,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns the requested report content', :aggregate_failures do
       subject
@@ -199,6 +201,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'marks report as resolved', :aggregate_failures do
       expect { subject }
@@ -219,6 +222,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'marks report as unresolved', :aggregate_failures do
       expect { subject }
@@ -239,6 +243,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'assigns report to the requesting user', :aggregate_failures do
       expect { subject }
@@ -259,6 +264,7 @@ RSpec.describe 'Reports' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'unassigns report from assignee', :aggregate_failures do
       expect { subject }
diff --git a/spec/requests/api/v1/admin/tags_spec.rb b/spec/requests/api/v1/admin/tags_spec.rb
index c84536d1b57..13de29f22b4 100644
--- a/spec/requests/api/v1/admin/tags_spec.rb
+++ b/spec/requests/api/v1/admin/tags_spec.rb
@@ -17,6 +17,7 @@ RSpec.describe 'Tags' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     context 'when there are no tags' do
       it 'returns an empty list' do
@@ -74,6 +75,7 @@ RSpec.describe 'Tags' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success and expected tag content' do
       subject
@@ -111,6 +113,7 @@ RSpec.describe 'Tags' do
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong scope', 'admin:read'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success and updates tag' do
       subject
diff --git a/spec/requests/api/v1/admin/trends/links/links_spec.rb b/spec/requests/api/v1/admin/trends/links/links_spec.rb
index e49c9a0709a..f3019811ae5 100644
--- a/spec/requests/api/v1/admin/trends/links/links_spec.rb
+++ b/spec/requests/api/v1/admin/trends/links/links_spec.rb
@@ -28,6 +28,7 @@ RSpec.describe 'Links' do
 
     it_behaves_like 'forbidden for wrong scope', 'read write'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect { subject }
@@ -87,6 +88,7 @@ RSpec.describe 'Links' do
 
     it_behaves_like 'forbidden for wrong scope', 'read write'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect { subject }
diff --git a/spec/requests/api/v1/admin/trends/links/preview_card_providers_spec.rb b/spec/requests/api/v1/admin/trends/links/preview_card_providers_spec.rb
index 5fe6cac47f5..6606a0c0cad 100644
--- a/spec/requests/api/v1/admin/trends/links/preview_card_providers_spec.rb
+++ b/spec/requests/api/v1/admin/trends/links/preview_card_providers_spec.rb
@@ -25,6 +25,7 @@ RSpec.describe 'API V1 Admin Trends Links Preview Card Providers' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
@@ -40,6 +41,7 @@ RSpec.describe 'API V1 Admin Trends Links Preview Card Providers' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
diff --git a/spec/requests/api/v1/admin/trends/statuses_spec.rb b/spec/requests/api/v1/admin/trends/statuses_spec.rb
index 90a3d80a2a4..f92f4831a79 100644
--- a/spec/requests/api/v1/admin/trends/statuses_spec.rb
+++ b/spec/requests/api/v1/admin/trends/statuses_spec.rb
@@ -25,6 +25,7 @@ RSpec.describe 'API V1 Admin Trends Statuses' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
@@ -40,6 +41,7 @@ RSpec.describe 'API V1 Admin Trends Statuses' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
diff --git a/spec/requests/api/v1/admin/trends/tags_spec.rb b/spec/requests/api/v1/admin/trends/tags_spec.rb
index 750ee8975d3..c96319a9b88 100644
--- a/spec/requests/api/v1/admin/trends/tags_spec.rb
+++ b/spec/requests/api/v1/admin/trends/tags_spec.rb
@@ -25,6 +25,7 @@ RSpec.describe 'API V1 Admin Trends Tags' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
@@ -40,6 +41,7 @@ RSpec.describe 'API V1 Admin Trends Tags' do
 
     it_behaves_like 'forbidden for wrong scope', 'write:statuses'
     it_behaves_like 'forbidden for wrong role', ''
+    it_behaves_like 'forbidden for disabled user'
 
     it 'returns http success' do
       expect(response).to have_http_status(200)
diff --git a/spec/support/examples/api.rb b/spec/support/examples/api.rb
index 350166b10d5..33de6242a6f 100644
--- a/spec/support/examples/api.rb
+++ b/spec/support/examples/api.rb
@@ -22,3 +22,14 @@ RSpec.shared_examples 'forbidden for wrong role' do |wrong_role|
     expect(response).to have_http_status(403)
   end
 end
+
+RSpec.shared_examples 'forbidden for disabled user' do
+  let(:user) { Fabricate(:admin_user, disabled: true) }
+
+  it 'returns http forbidden' do
+    # Some examples have a subject which needs to be called to make a request
+    subject if request.nil?
+
+    expect(response).to have_http_status(403)
+  end
+end