diff --git a/src/Tgstation.Server.Api/Models/Administration.cs b/src/Tgstation.Server.Api/Models/Administration.cs
new file mode 100644
index 0000000000..668ba0dd0a
--- /dev/null
+++ b/src/Tgstation.Server.Api/Models/Administration.cs
@@ -0,0 +1,27 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+namespace Tgstation.Server.Api.Models
+{
+	/// <summary>
+	/// Metadata about an installation
+	/// </summary>
+	public sealed class Administration
+	{
+		/// <summary>
+		/// Use the specified Windows/UNIX authentication to authorize users. Setting this to <see langword="null"/> enables full administrative anonymous access
+		/// </summary>
+		public string SystemAuthenticationGroup { get; set; }
+
+		/// <summary>
+		/// Automatically send unhandled exception data to a public collection service. This will be limited to system information, path data, and game code compilation information.
+		/// </summary>
+		public bool EnableTelemetry { get; set; }
+
+		/// <summary>
+		/// Users in the <see cref="SystemAuthenticationGroup"/>. Not modifiable
+		/// </summary>
+		public IReadOnlyList<User> Users { get; set; }
+	}
+}
diff --git a/src/Tgstation.Server.Api/Models/DreamDaemon.cs b/src/Tgstation.Server.Api/Models/DreamDaemon.cs
index 4394923f37..974bf1d83e 100644
--- a/src/Tgstation.Server.Api/Models/DreamDaemon.cs
+++ b/src/Tgstation.Server.Api/Models/DreamDaemon.cs
@@ -10,61 +10,61 @@ namespace Tgstation.Server.Api.Models
 		/// <summary>
 		/// The pull requests merged on the live game version. Not modifiable
 		/// </summary>
-		IReadOnlyDictionary<int, string> PullRequests { get; set; }
+		public IReadOnlyDictionary<int, string> PullRequests { get; set; }
 
 		/// <summary>
 		/// The git sha the live game version was compiled at. Not modifiable
 		/// </summary>
-		string Sha { get; set; }
+		public string Sha { get; set; }
 
 		/// <summary>
 		/// The git sha of the origin branch the live game version was compiled at. Not modifiable
 		/// </summary>
-		string OriginSha { get; set; }
-		
+		public string OriginSha { get; set; }
+
 		/// <summary>
 		/// If <see cref="DreamDaemon"/> starts when it's <see cref="Instance"/> starts
 		/// </summary>
-		bool? AutoStart { get; set; }
+		public bool? AutoStart { get; set; }
 
 		/// <summary>
 		/// The current status of <see cref="DreamDaemon"/>
 		/// </summary>
-		DreamDaemonStatus? Status { get; set; }
+		public DreamDaemonStatus? Status { get; set; }
 
 		/// <summary>
 		/// If the BYOND web client can be used to connect to the game server
 		/// </summary>
-		bool? AllowWebClient { get; set; }
+		public bool? AllowWebClient { get; set; }
 
 		/// <summary>
 		/// If the server is undergoing a soft reset. This may be automatically set by changes to other fields
 		/// </summary>
-		bool? SoftRestart { get; set; }
+		public bool? SoftRestart { get; set; }
 
 		/// <summary>
 		/// If the server is undergoing a soft shutdown
 		/// </summary>
-		bool? SoftShutdown { get; set; }
+		public bool? SoftShutdown { get; set; }
 
 		/// <summary>
 		/// The <see cref="DreamDaemonSecurity"/> level of <see cref="DreamDaemon"/>
 		/// </summary>
-		DreamDaemonSecurity? SecurirtyLevel { get; set; }
+		public DreamDaemonSecurity? SecurirtyLevel { get; set; }
 
 		/// <summary>
 		/// The first port <see cref="DreamDaemon"/> uses. This should be the publically advertised port
 		/// </summary>
-		ushort? PrimaryPort { get; set; }
+		public ushort? PrimaryPort { get; set; }
 
 		/// <summary>
 		/// The second port <see cref="DreamDaemon"/> uses
 		/// </summary>
-		ushort? SecondaryPort { get; set; }
+		public ushort? SecondaryPort { get; set; }
 
 		/// <summary>
 		/// The port the running <see cref="DreamDaemon"/> instance is set to. Not modifiable
 		/// </summary>
-		bool CurrentPort { get; set; }
+		public bool CurrentPort { get; set; }
 	}
 }
diff --git a/src/Tgstation.Server.Api/Models/User.cs b/src/Tgstation.Server.Api/Models/User.cs
new file mode 100644
index 0000000000..82699749a9
--- /dev/null
+++ b/src/Tgstation.Server.Api/Models/User.cs
@@ -0,0 +1,38 @@
+using System.Collections.Generic;
+using Tgstation.Server.Api.Rights;
+
+namespace Tgstation.Server.Api.Models
+{
+	/// <summary>
+	/// Represents a server <see cref="User"/>
+	/// </summary>
+	public sealed class User
+	{
+		/// <summary>
+		/// The system identifier for the <see cref="User"/>. On Windows, this is the user's SecurityIdentifier. On UNIX, this is their UID
+		/// </summary>
+		public string SystemIdentifier { get; set; }
+
+		/// <summary>
+		/// The name of the <see cref="User"/>
+		/// </summary>
+		public string Name { get; set; }
+
+		/// <summary>
+		/// The <see cref="Rights.AdministrationRights"/> for the <see cref="User"/>
+		/// </summary>
+		public AdministrationRights AdministrationRights { get; set; }
+
+		/// <summary>
+		/// The <see cref="Rights.InstanceManagerRights"/> for the <see cref="User"/>
+		/// </summary>
+		public InstanceManagerRights InstanceManagerRights { get; set; }
+
+		/// <summary>
+		/// <see cref="List{T}"/> of <see cref="Instance.Id"/>s the <see cref="User"/> can view
+		/// </summary>
+#pragma warning disable CA2227 // Collection properties should be read only
+		public List<long> ViewableInstanceIds { get; set; }
+#pragma warning restore CA2227 // Collection properties should be read only
+	}
+}
\ No newline at end of file
diff --git a/src/Tgstation.Server.Api/Rights/AdministrationRights.cs b/src/Tgstation.Server.Api/Rights/AdministrationRights.cs
new file mode 100644
index 0000000000..da7cb3d559
--- /dev/null
+++ b/src/Tgstation.Server.Api/Rights/AdministrationRights.cs
@@ -0,0 +1,28 @@
+using System;
+
+namespace Tgstation.Server.Api.Rights
+{
+	/// <summary>
+	/// Rights for <see cref="Models.Administration"/>
+	/// </summary>
+	[Flags]
+	public enum AdministrationRights
+	{
+		/// <summary>
+		/// User has no rights
+		/// </summary>
+		None = 0,
+		/// <summary>
+		/// User can change <see cref="Models.Administration.SystemAuthenticationGroup"/>
+		/// </summary>
+		ChangeAuthenticationGroup = 1,
+		/// <summary>
+		/// User can change <see cref="Models.Administration.EnableTelemetry"/>
+		/// </summary>
+		ChangeTelemetry = 2,
+		/// <summary>
+		/// User can edit themself and other <see cref="Models.User"/>s
+		/// </summary>
+		EditUsers = 4,
+	}
+}
diff --git a/src/Tgstation.Server.Api/Rights/DreamDaemonRights.cs b/src/Tgstation.Server.Api/Rights/DreamDaemonRights.cs
new file mode 100644
index 0000000000..51591eb334
--- /dev/null
+++ b/src/Tgstation.Server.Api/Rights/DreamDaemonRights.cs
@@ -0,0 +1,60 @@
+using System;
+
+namespace Tgstation.Server.Api.Rights
+{
+	/// <summary>
+	/// Rights for <see cref="Models.DreamDaemon"/>
+	/// </summary>
+	[Flags]
+	public enum DreamDaemonRights
+	{
+		/// <summary>
+		/// User has no rights
+		/// </summary>
+		None = 0,
+		/// <summary>
+		/// User can read <see cref="Models.DreamDaemon.PullRequests"/>, <see cref="Models.DreamDaemon.Sha"/>, and <see cref="Models.DreamDaemon.OriginSha"/>
+		/// </summary>
+		ReadRevision = 1,
+		/// <summary>
+		/// User can change both primary and secondary ports
+		/// </summary>
+		SetPorts = 2,
+		/// <summary>
+		/// User can change <see cref="Models.DreamDaemon.AutoStart"/>
+		/// </summary>
+		SetAutoStart = 4,
+		/// <summary>
+		/// User set <see cref="Models.DreamDaemon.SecurirtyLevel"/>
+		/// </summary>
+		SetSecurity = 8,
+		/// <summary>
+		/// User can read all ports, <see cref="Models.DreamDaemon.SoftRestart"/>, <see cref="Models.DreamDaemon.SoftShutdown"/>, <see cref="Models.DreamDaemon.Status"/>, <see cref="Models.DreamDaemon.AllowWebClient"/>, and <see cref="Models.DreamDaemon.AutoStart"/>
+		/// </summary>
+		ReadMetadata = 16,
+		/// <summary>
+		/// User can change <see cref="Models.DreamDaemon.AllowWebClient"/>
+		/// </summary>
+		SetWebClient = 32,
+		/// <summary>
+		/// User can enable <see cref="Models.DreamDaemon.SoftRestart"/>
+		/// </summary>
+		SoftRestart = 64,
+		/// <summary>
+		/// User can enable <see cref="Models.DreamDaemon.SoftShutdown"/>
+		/// </summary>
+		SoftShutdown = 128,
+		/// <summary>
+		/// User can immediately restart <see cref="Models.DreamDaemon"/>
+		/// </summary>
+		Restart = 256,
+		/// <summary>
+		/// User can immediately shutdown <see cref="Models.DreamDaemon"/>
+		/// </summary>
+		Shutdown = 512,
+		/// <summary>
+		/// User can start <see cref="Models.DreamDaemon"/> and disable <see cref="Models.DreamDaemon.SoftRestart"/> and <see cref="Models.DreamDaemon.SoftShutdown"/>
+		/// </summary>
+		Start = 1024
+	}
+}
diff --git a/src/Tgstation.Server.Client/Components/IDreamDaemonClient.cs b/src/Tgstation.Server.Client/Components/IDreamDaemonClient.cs
new file mode 100644
index 0000000000..fb4a0d38d3
--- /dev/null
+++ b/src/Tgstation.Server.Client/Components/IDreamDaemonClient.cs
@@ -0,0 +1,42 @@
+using System.Threading;
+using System.Threading.Tasks;
+using Tgstation.Server.Api.Models;
+using Tgstation.Server.Api.Rights;
+
+namespace Tgstation.Server.Client.Components
+{
+	/// <summary>
+	/// For managing <see cref="DreamDaemon"/>
+	/// </summary>
+	interface IDreamDaemonClient: IRightsClient<DreamDaemonRights>
+	{
+		/// <summary>
+		/// Get the <see cref="DreamDaemon"/> represented by the <see cref="IDreamDaemonClient"/>
+		/// </summary>
+		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation</param>
+		/// <returns>A <see cref="Task{TResult}"/> resulting in the <see cref="DreamDaemon"/> represented by the <see cref="IDreamDaemonClient"/></returns>
+		Task<DreamDaemon> Read(CancellationToken cancellationToken);
+
+		/// <summary>
+		/// Start <see cref="DreamDaemon"/>
+		/// </summary>
+		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation</param>
+		/// <returns>A <see cref="Task"/> representing the running operation</returns>
+		Task Start(CancellationToken cancellationToken);
+
+		/// <summary>
+		/// Stop <see cref="DreamDaemon"/>
+		/// </summary>
+		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation</param>
+		/// <returns>A <see cref="Task"/> representing the running operation</returns>
+		Task Stop(CancellationToken cancellationToken);
+
+		/// <summary>
+		/// Update <see cref="DreamDaemon"/>. This may trigger <see cref="DreamDaemon.SoftRestart"/>
+		/// </summary>
+		/// <param name="dreamDaemon">The <see cref="DreamDaemon"/> to update</param>
+		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation</param>
+		/// <returns>A <see cref="Task"/> representing the running operation</returns>
+		Task Update(DreamDaemon dreamDaemon, CancellationToken cancellationToken);
+	}
+}
diff --git a/src/Tgstation.Server.Client/Components/IInstanceClient.cs b/src/Tgstation.Server.Client/Components/IInstanceClient.cs
index 24338095c8..18d1252c65 100644
--- a/src/Tgstation.Server.Client/Components/IInstanceClient.cs
+++ b/src/Tgstation.Server.Client/Components/IInstanceClient.cs
@@ -6,7 +6,7 @@ using Tgstation.Server.Api.Rights;
 namespace Tgstation.Server.Client.Components
 {
 	/// <summary>
-	/// Client for <see cref="Instance"/>s
+	/// For managing a single <see cref="Instance"/>
 	/// </summary>
 	public interface IInstanceClient : IRightsClient<InstanceRights>
 	{
diff --git a/src/Tgstation.Server.Client/Components/IInstanceManagerClient.cs b/src/Tgstation.Server.Client/Components/IInstanceManagerClient.cs
index a5fbfc3584..4e87ed6d46 100644
--- a/src/Tgstation.Server.Client/Components/IInstanceManagerClient.cs
+++ b/src/Tgstation.Server.Client/Components/IInstanceManagerClient.cs
@@ -7,9 +7,9 @@ using Tgstation.Server.Api.Rights;
 namespace Tgstation.Server.Client.Components
 {
 	/// <summary>
-	/// Manager for <see cref="Instance"/>s
+	/// For managing <see cref="Instance"/>s
 	/// </summary>
-    public interface IInstanceManagerClient : IRightsClient<InstanceRights>
+	public interface IInstanceManagerClient : IRightsClient<InstanceRights>
 	{
 		/// <summary>
 		/// Get all <see cref="IInstanceClient"/>s for <see cref="Instance"/>s the user can view