diff --git a/spec/policies/admin_portal_policy_spec.rb b/spec/policies/admin_portal_policy_spec.rb
new file mode 100644
index 000000000..788b1161e
--- /dev/null
+++ b/spec/policies/admin_portal_policy_spec.rb
@@ -0,0 +1,24 @@
+RSpec.describe AdminPortalPolicy do
+  subject { described_class.new(user, :admin_portal) }
+
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#index?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.index?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.index?).to be false
+      end
+    end
+  end
+end
diff --git a/spec/policies/application_policy_spec.rb b/spec/policies/application_policy_spec.rb
new file mode 100644
index 000000000..3dba8ed56
--- /dev/null
+++ b/spec/policies/application_policy_spec.rb
@@ -0,0 +1,55 @@
+RSpec.describe ApplicationPolicy do
+  subject { described_class.new(user, record) }
+
+  let(:record) { double('record') }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#index?' do
+    let(:user) { admin }
+
+    it 'denies access by default' do
+      expect(subject.index?).to be false
+    end
+  end
+
+  describe '#create?' do
+    let(:user) { admin }
+
+    it 'denies access by default' do
+      expect(subject.create?).to be false
+    end
+  end
+
+  describe '#new?' do
+    let(:user) { admin }
+
+    it 'delegates to create?' do
+      expect(subject.new?).to eq(subject.create?)
+    end
+  end
+
+  describe '#update?' do
+    let(:user) { admin }
+
+    it 'denies access by default' do
+      expect(subject.update?).to be false
+    end
+  end
+
+  describe '#edit?' do
+    let(:user) { admin }
+
+    it 'delegates to update?' do
+      expect(subject.edit?).to eq(subject.update?)
+    end
+  end
+
+  describe '#destroy?' do
+    let(:user) { admin }
+
+    it 'denies access by default' do
+      expect(subject.destroy?).to be false
+    end
+  end
+end
diff --git a/spec/policies/chapter_policy_spec.rb b/spec/policies/chapter_policy_spec.rb
new file mode 100644
index 000000000..8fa80b07e
--- /dev/null
+++ b/spec/policies/chapter_policy_spec.rb
@@ -0,0 +1,115 @@
+RSpec.describe ChapterPolicy do
+  subject { described_class.new(user, chapter) }
+
+  let(:chapter) { Fabricate(:chapter) }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#index?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.index?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.index?).to be false
+      end
+    end
+  end
+
+  describe '#create?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.create?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.create?).to be false
+      end
+    end
+  end
+
+  describe '#show?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.show?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.show?).to be false
+      end
+    end
+  end
+
+  describe '#edit?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.edit?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.edit?).to be false
+      end
+    end
+  end
+
+  describe '#update?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.update?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.update?).to be false
+      end
+    end
+  end
+
+  describe '#members?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.members?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.members?).to be false
+      end
+    end
+  end
+end
diff --git a/spec/policies/contact_policy_spec.rb b/spec/policies/contact_policy_spec.rb
new file mode 100644
index 000000000..73fda7420
--- /dev/null
+++ b/spec/policies/contact_policy_spec.rb
@@ -0,0 +1,25 @@
+RSpec.describe ContactPolicy do
+  subject { described_class.new(user, contact) }
+
+  let(:contact) { Fabricate(:contact) }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#index?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.index?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.index?).to be false
+      end
+    end
+  end
+end
diff --git a/spec/policies/event_policy_spec.rb b/spec/policies/event_policy_spec.rb
new file mode 100644
index 000000000..30f3e13bb
--- /dev/null
+++ b/spec/policies/event_policy_spec.rb
@@ -0,0 +1,43 @@
+RSpec.describe EventPolicy do
+  subject { described_class.new(user, event) }
+
+  let(:event) { Fabricate(:event) }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#invite?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.invite?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.invite?).to be false
+      end
+    end
+  end
+
+  describe '#show?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.show?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.show?).to be false
+      end
+    end
+  end
+end
diff --git a/spec/policies/group_policy_spec.rb b/spec/policies/group_policy_spec.rb
new file mode 100644
index 000000000..e00ed2e6d
--- /dev/null
+++ b/spec/policies/group_policy_spec.rb
@@ -0,0 +1,43 @@
+RSpec.describe GroupPolicy do
+  subject { described_class.new(user, group) }
+
+  let(:group) { Fabricate(:group) }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#create?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.create?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.create?).to be false
+      end
+    end
+  end
+
+  describe '#show?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.show?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.show?).to be false
+      end
+    end
+  end
+end
diff --git a/spec/policies/member_note_policy_spec.rb b/spec/policies/member_note_policy_spec.rb
new file mode 100644
index 000000000..c4c185a98
--- /dev/null
+++ b/spec/policies/member_note_policy_spec.rb
@@ -0,0 +1,25 @@
+RSpec.describe MemberNotePolicy do
+  subject { described_class.new(user, member_note) }
+
+  let(:member_note) { Fabricate(:member_note) }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#create?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.create?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.create?).to be false
+      end
+    end
+  end
+end
diff --git a/spec/policies/organiser_policy_spec.rb b/spec/policies/organiser_policy_spec.rb
new file mode 100644
index 000000000..837fd8623
--- /dev/null
+++ b/spec/policies/organiser_policy_spec.rb
@@ -0,0 +1,61 @@
+RSpec.describe OrganiserPolicy do
+  subject { described_class.new(user, organiser) }
+
+  let(:organiser) { Fabricate(:member) }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#index?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.index?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.index?).to be false
+      end
+    end
+  end
+
+  describe '#create?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.create?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.create?).to be false
+      end
+    end
+  end
+
+  describe '#destroy?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.destroy?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.destroy?).to be false
+      end
+    end
+  end
+end
diff --git a/spec/policies/sponsor_policy_spec.rb b/spec/policies/sponsor_policy_spec.rb
new file mode 100644
index 000000000..f4a761324
--- /dev/null
+++ b/spec/policies/sponsor_policy_spec.rb
@@ -0,0 +1,97 @@
+RSpec.describe SponsorPolicy do
+  subject { described_class.new(user, sponsor) }
+
+  let(:sponsor) { Fabricate(:sponsor) }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#index?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.index?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.index?).to be false
+      end
+    end
+  end
+
+  describe '#create?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.create?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.create?).to be false
+      end
+    end
+  end
+
+  describe '#show?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.show?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.show?).to be false
+      end
+    end
+  end
+
+  describe '#edit?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.edit?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.edit?).to be false
+      end
+    end
+  end
+
+  describe '#update?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.update?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.update?).to be false
+      end
+    end
+  end
+end
diff --git a/spec/policies/testimonial_policy_spec.rb b/spec/policies/testimonial_policy_spec.rb
new file mode 100644
index 000000000..3cb1160b2
--- /dev/null
+++ b/spec/policies/testimonial_policy_spec.rb
@@ -0,0 +1,25 @@
+RSpec.describe TestimonialPolicy do
+  subject { described_class.new(user, testimonial) }
+
+  let(:testimonial) { Fabricate(:testimonial) }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#index?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.index?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.index?).to be false
+      end
+    end
+  end
+end
diff --git a/spec/policies/workshop_policy_spec.rb b/spec/policies/workshop_policy_spec.rb
new file mode 100644
index 000000000..a73c37129
--- /dev/null
+++ b/spec/policies/workshop_policy_spec.rb
@@ -0,0 +1,115 @@
+RSpec.describe WorkshopPolicy do
+  subject { described_class.new(user, workshop) }
+
+  let(:workshop) { Fabricate(:workshop) }
+  let(:admin) { Fabricate(:member).tap { |m| m.add_role(:admin) } }
+  let(:regular_member) { Fabricate(:member) }
+
+  describe '#new?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.new?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.new?).to be false
+      end
+    end
+  end
+
+  describe '#create?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.create?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.create?).to be false
+      end
+    end
+  end
+
+  describe '#show?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.show?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.show?).to be false
+      end
+    end
+  end
+
+  describe '#invite?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.invite?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.invite?).to be false
+      end
+    end
+  end
+
+  describe '#update?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.update?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.update?).to be false
+      end
+    end
+  end
+
+  describe '#destroy?' do
+    context 'when user is admin' do
+      let(:user) { admin }
+
+      it 'permits access' do
+        expect(subject.destroy?).to be true
+      end
+    end
+
+    context 'when user is regular member' do
+      let(:user) { regular_member }
+
+      it 'denies access' do
+        expect(subject.destroy?).to be false
+      end
+    end
+  end
+end