diff --git a/app_mgr/__init__.py b/app_mgr/__init__.py
index e69de29..f47b747 100644
--- a/app_mgr/__init__.py
+++ b/app_mgr/__init__.py
@@ -0,0 +1 @@
+default_app_config = 'app_mgr.apps.AppMgrConfig'
diff --git a/app_mgr/admin.py b/app_mgr/admin.py
index 9fc9ecb..f09e67d 100644
--- a/app_mgr/admin.py
+++ b/app_mgr/admin.py
@@ -23,7 +23,7 @@
 
 class MembershipAdmin(admin.ModelAdmin):
     search_fields = ['join_date']
-    list_display = ['user', 'org', 'join_date']
+    list_display = ['user', 'org', 'is_admin', 'join_date']
 
 class ApplicationInline(GenericTabularInline):
     model = Application
@@ -33,6 +33,7 @@
 class ApplicationAdmin(GuardedModelAdmin):
     inlines = [ApplicationInline]
     search_fields = ['name']
+    list_display = ['id', 'name', 'isPublic']
 
 class AppVersionAdmin(admin.ModelAdmin):
     model = AppVersion
diff --git a/app_mgr/apps.py b/app_mgr/apps.py
new file mode 100644
index 0000000..fba4f88
--- /dev/null
+++ b/app_mgr/apps.py
@@ -0,0 +1,9 @@
+from django.apps import AppConfig
+
+class AppMgrConfig(AppConfig):
+    name = 'app_mgr'
+    verbose_name = "Application Manager"
+
+    def ready(self):
+        print 'Loading', self.verbose_name
+        import app_mgr.signals.handlers
diff --git a/app_mgr/migrations/0002_membership_is_admin.py b/app_mgr/migrations/0002_membership_is_admin.py
new file mode 100644
index 0000000..b4b9139
--- /dev/null
+++ b/app_mgr/migrations/0002_membership_is_admin.py
@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.9.7 on 2016-06-28 04:39
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('app_mgr', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='membership',
+            name='is_admin',
+            field=models.BooleanField(default=False),
+        ),
+    ]
diff --git a/app_mgr/migrations/0003_auto_20160629_0112.py b/app_mgr/migrations/0003_auto_20160629_0112.py
new file mode 100644
index 0000000..cbe8910
--- /dev/null
+++ b/app_mgr/migrations/0003_auto_20160629_0112.py
@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.9.7 on 2016-06-29 05:12
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('auth', '0007_alter_validators_add_error_messages'),
+        ('app_mgr', '0002_membership_is_admin'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='organization',
+            name='admin_group',
+            field=models.OneToOneField(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='admins_of', to='auth.Group'),
+        ),
+        migrations.AddField(
+            model_name='organization',
+            name='member_group',
+            field=models.OneToOneField(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='members_of', to='auth.Group'),
+        ),
+    ]
diff --git a/app_mgr/migrations/0004_auto_20160629_0252.py b/app_mgr/migrations/0004_auto_20160629_0252.py
new file mode 100644
index 0000000..00c719b
--- /dev/null
+++ b/app_mgr/migrations/0004_auto_20160629_0252.py
@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.9.7 on 2016-06-29 06:52
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('app_mgr', '0003_auto_20160629_0112'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='organization',
+            name='admin_group',
+            field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='admins_of', to='auth.Group'),
+        ),
+        migrations.AlterField(
+            model_name='organization',
+            name='member_group',
+            field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='members_of', to='auth.Group'),
+        ),
+    ]
diff --git a/app_mgr/models.py b/app_mgr/models.py
index 93fd37f..ca7d735 100644
--- a/app_mgr/models.py
+++ b/app_mgr/models.py
@@ -6,21 +6,12 @@
 from django.contrib.contenttypes.fields import GenericForeignKey
 
 from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Group
 
 from custom_user.models import AbstractEmailUser
 
 from guardian.mixins import GuardianUserMixin
 
-from django.db.models.signals import post_save
-from django.dispatch import receiver
-from rest_framework.authtoken.models import Token
-
-# Define signals here
-@receiver(post_save, sender=settings.AUTH_USER_MODEL)
-def create_auth_token(sender, instance=None, created=False, **kwargs):
-    if created:
-        Token.objects.create(user=instance)
-
 # Create your models here.
 class UserProfile(AbstractEmailUser, GuardianUserMixin):
 
@@ -39,6 +30,11 @@
 
     members = models.ManyToManyField(UserProfile, through='Membership')
 
+    member_group = models.OneToOneField(Group, null=True, blank=True,
+                                        related_name='members_of')
+    admin_group = models.OneToOneField(Group, null=True, blank=True,
+                                       related_name='admins_of')
+
     class Meta:
         permissions = (
             ("view_organization", "view organization information"),
@@ -51,6 +47,7 @@
     user = models.ForeignKey(UserProfile,  null=True, blank=False)
     org  = models.ForeignKey(Organization, null=True, blank=False)
     join_date = models.DateTimeField()
+    is_admin = models.BooleanField(default=False)
     
 class Application(models.Model):
     name = models.CharField(max_length=255)
diff --git a/app_mgr/permissions.py b/app_mgr/permissions.py
index daf8d9d..334a662 100644
--- a/app_mgr/permissions.py
+++ b/app_mgr/permissions.py
@@ -3,6 +3,7 @@
 from guardian.shortcuts import get_perms, get_perms_for_model, get_users_with_perms
 
 SAFE_METHODS = ('GET', 'HEAD', 'OPTIONS')
+
 class ViewControlObjectPermissions(DjangoObjectPermissions):
     """ same as base object level permissions, plus read permission """
     perms_map = {
@@ -15,6 +16,18 @@
         'DELETE': ['%(app_label)s.delete_%(model_name)s'],
     }
 
+class ApplicationObjectPermissions(DjangoObjectPermissions):
+    """ same as base object level permissions, plus read permission """
+    perms_map = {
+        'GET': ['%(app_label)s.view_%(model_name)s'],
+        'OPTIONS': [],
+        'HEAD': [],
+        'POST': ['%(app_label)s.add_%(model_name)s'],
+        'PUT': ['%(app_label)s.change_%(model_name)s'],
+        'PATCH': ['%(app_label)s.change_%(model_name)s'],
+        'DELETE': ['%(app_label)s.delete_%(model_name)s'],
+    }
+
     def has_object_permission(self, request, view, obj):
         if hasattr(view, 'get_queryset'):
             queryset = view.get_queryset()
@@ -31,6 +44,9 @@
 
         perms = self.get_required_object_permissions(request.method, model_cls)
 
+        if obj.isPublic and request.method == 'GET':
+            perms = []
+
         #print "-----------"
         #print request.method, perms
         #print obj.id, obj
@@ -42,7 +58,7 @@
         #print get_perms(request.user, obj)
         #print get_perms_for_model(model_cls)
         #print get_users_with_perms(obj)
-        #print "-----------"
+        #print "~~~~~~~~~~~"
 
         if not user.has_perms(perms, obj):
             # If the user does not have permissions we need to determine if
diff --git a/app_mgr/serializers.py b/app_mgr/serializers.py
index e551137..a8f4a74 100644
--- a/app_mgr/serializers.py
+++ b/app_mgr/serializers.py
@@ -9,7 +9,7 @@
     org = serializers.PrimaryKeyRelatedField(queryset=Organization.objects.all())
     class Meta:
         model = Membership
-        fields = ('org', 'user', 'join_date')
+        fields = ('org', 'user', 'is_admin', 'join_date')
 
 class UserProfileSerializer(serializers.ModelSerializer):
     memberships = MembershipSerializer(source='membership_set', many=True)
diff --git a/app_mgr/signals/__init__.py b/app_mgr/signals/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/app_mgr/signals/__init__.py
diff --git a/app_mgr/signals/handlers.py b/app_mgr/signals/handlers.py
new file mode 100644
index 0000000..06fb660
--- /dev/null
+++ b/app_mgr/signals/handlers.py
@@ -0,0 +1,116 @@
+from django.contrib.auth.models import Group
+
+from django.conf import settings
+
+from django.contrib.contenttypes.models import ContentType
+
+from django.apps import apps
+
+from guardian.shortcuts import assign_perm, get_user_perms, get_users_with_perms, remove_perm, get_perms_for_model
+
+from django.db.models.signals import pre_save, post_save, pre_delete
+from django.dispatch import receiver
+from rest_framework.authtoken.models import Token
+
+# Define signals here
+
+### UserProfile Signals
+@receiver(post_save, sender=settings.AUTH_USER_MODEL)
+def set_user_perms(sender, instance=None, created=False, **kwargs):
+    perms = get_perms_for_model(apps.get_model('app_mgr', 'UserProfile'))
+    for perm in perms:
+        assign_perm(perm.codename, instance, instance)
+
+@receiver(post_save, sender=settings.AUTH_USER_MODEL)
+def create_auth_token(sender, instance=None, created=False, **kwargs):
+    if created:
+        Token.objects.create(user=instance)
+
+### Organization Signals
+@receiver(pre_delete, sender='app_mgr.Organization')
+def delete_org_groups(sender, instance=None, **kwargs):
+    if instance.member_group != None:
+        instance.member_group.delete()
+    if instance.admin_group != None:
+        instance.admin_group.delete()
+
+@receiver(pre_save, sender='app_mgr.Organization')
+def create_org_groups(sender, instance=None, created=False, **kwargs):
+    if instance.member_group == None:
+        g_name = '%s members' % (instance.name)
+        instance.member_group = Group.objects.create(name=g_name)
+    if instance.admin_group == None:
+        g_name = '%s admins' % (instance.name)
+        instance.admin_group = Group.objects.create(name=g_name)
+
+@receiver(post_save, sender='app_mgr.Organization')
+def set_org_perms(sender, instance=None, created=False, **kwargs):
+    perms = get_perms_for_model(apps.get_model('app_mgr', 'Organization'))
+    
+    if not created:
+        old_members = get_users_with_perms(instance)
+        for member in old_members:
+            instance.member_group.user_set.remove(member)
+            instance.admin_group.user_set.remove(member)
+            for perm in perms:
+                remove_perm(perm.codename, member, instance)
+    
+    new_members = instance.members.all()
+
+    for member in (m for m in new_members if m.is_admin):
+        instance.admin_group.user_set.add(member)
+        instance.member_group.user_set.add(member)
+        for perm in perms:
+            assign_perm(perm.codename, member.user, instance)
+
+    for member in (m for m in new_members if not m.is_admin):
+        instance.member_group.user_set.add(member)
+        assign_perm('view_organization', member.user, instance)
+
+### Membership Signals
+@receiver(post_save, sender='app_mgr.Membership')
+def set_member_perms(sender, instance=None, created=False, **kwargs):
+    perms = get_perms_for_model(apps.get_model('app_mgr', 'Organization'))
+
+    was_admin  = len(get_user_perms(instance.user, instance.org)) > 1
+
+    if instance.is_admin and not was_admin:
+        instance.org.admin_group.user_set.add(instance.user)
+        for perm in perms:
+            assign_perm(perm.codename, instance.user, instance.org)
+
+    if not instance.is_admin and was_admin:
+        instance.org.admin_group.user_set.remove(instance.user)
+        for perm in perms:
+            remove_perm(perm.codename, instance.user, instance.org)
+
+    instance.org.member_group.user_set.add(instance.user)
+    assign_perm('view_organization', instance.user, instance.org)
+
+@receiver(pre_delete, sender='app_mgr.Membership')
+def rm_org_perms(sender, instance=None, **kwargs):
+    perms = get_perms_for_model(apps.get_model('app_mgr', 'Organization'))
+
+    instance.org.admin_group.user_set.remove(instance.user)
+    instance.org.member_group.user_set.remove(instance.user)
+    for perm in perms:
+        remove_perm(perm.codename, instance.user, instance.org)
+
+### Application Signals
+@receiver(post_save, sender='app_mgr.Application')
+def set_app_perms(sender, instance=None, created=False, **kwargs):
+    perms = get_perms_for_model(apps.get_model('app_mgr', 'Application'))
+
+    if not created:
+        old_members = get_users_with_perms(instance)
+        for member in old_members:
+            for perm in perms:
+                remove_perm(perm.codename, member, instance)
+
+    if instance.content_type.name == u'user profile':
+        for perm in perms:
+            assign_perm(perm.codename, instance.content_object, instance)
+    
+    if instance.content_type.name == u'organization':
+        for perm in perms:
+            assign_perm(perm.codename, instance.content_object.member_group, instance)
diff --git a/app_mgr/urls.py b/app_mgr/urls.py
index 496992d..827f2e3 100644
--- a/app_mgr/urls.py
+++ b/app_mgr/urls.py
@@ -33,7 +33,7 @@
     url(r'^apps/$', views.ApplicationListView.as_view(), name='app-list'),
 
     url(r'^user/(?P<pk>[\d]+)/$', views.UserProfileInstanceView.as_view(), name='user-instance'),
-    url(r'^user/(?P<pk>current)/$', views.UserProfileInstanceView.as_view(), name='user-instance'),
-    url(r'^org/(?P<pk>[\d]+)/$', views.OrganizationInstanceView.as_view(), name='user-instance'),
-    url(r'^app/(?P<pk>[\d]+)/$', views.ApplicationInstanceView.as_view(), name='user-instance'),
+    url(r'^user/(?P<pk>current)/$', views.UserProfileInstanceView.as_view(), name='user-current'),
+    url(r'^org/(?P<pk>[\d]+)/$', views.OrganizationInstanceView.as_view(), name='org-instance'),
+    url(r'^app/(?P<pk>[\d]+)/$', views.ApplicationInstanceView.as_view(), name='app-instance'),
 ]
diff --git a/app_mgr/views.py b/app_mgr/views.py
index 86b6a72..2d4ae9a 100644
--- a/app_mgr/views.py
+++ b/app_mgr/views.py
@@ -9,6 +9,7 @@
 from django.conf import settings
 
 from django.db import IntegrityError
+from django.db.models import Q
 
 from django.views.generic.base import RedirectView
 
@@ -19,9 +20,10 @@
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 
-from guardian.shortcuts import assign_perm
+from guardian.shortcuts import assign_perm, get_objects_for_user
 
 from app_mgr.permissions import ViewControlObjectPermissions
+from app_mgr.permissions import ApplicationObjectPermissions
 from app_mgr.models import UserProfile, Organization, Application, AppVersion
 from app_mgr.serializers import UserProfileSerializer, OrganizationSerializer, ApplicationSerializer
 
@@ -42,20 +44,46 @@
     queryset = UserProfile.objects.all()
     serializer_class = UserProfileSerializer
 
+    def get_queryset(self):
+        # only used for list
+        return get_objects_for_user(self.request.user, "view_userprofile", 
+                                    UserProfile.objects.all())
+
 class OrganizationListView(generics.ListCreateAPIView):
     """
     Returns a list of all organizations.
     """
+    authentication_classes = (TokenAuthentication,)
+    permission_classes = (IsAuthenticated,)
+
     queryset = Organization.objects.all()
     serializer_class = OrganizationSerializer
 
+    def get_queryset(self):
+        # only used for list
+        return get_objects_for_user(self.request.user, "view_organization", 
+                                    Organization.objects.all())
+
 class ApplicationListView(generics.ListCreateAPIView):
     """
     Returns a list of all applications.
     """
+    authentication_classes = (TokenAuthentication,)
+    permission_classes = (IsAuthenticated,)
+
     queryset = Application.objects.all()
     serializer_class = ApplicationSerializer
 
+    def get_queryset(self):
+        # only used for list
+        owned = get_objects_for_user(self.request.user, "view_application", 
+                                     Application.objects.all())
+        public = Application.objects.filter(isPublic=True)
+
+        viewable = list(set(list(owned) + list(public)))
+       
+        return viewable
+
 # SINGLE RETRIEVE/UPDATE/DESTROY
 class UserProfileInstanceView(generics.RetrieveUpdateDestroyAPIView):
     """
@@ -92,6 +120,10 @@
     """
     Returns a single org.
     """
+    authentication_classes = (TokenAuthentication,)
+    permission_classes = (ViewControlObjectPermissions,)
+    _ignore_model_permissions = True
+
     queryset = Organization.objects.all()
     serializer_class = OrganizationSerializer
 
@@ -99,6 +131,10 @@
     """
     Returns a single app.
     """
+    authentication_classes = (TokenAuthentication,)
+    permission_classes = (ApplicationObjectPermissions,)
+    _ignore_model_permissions = True
+
     queryset = Application.objects.all()
     serializer_class = ApplicationSerializer