diff --git a/app/assets/javascripts/controllers/catalog/catalog_item_form_controller.js b/app/assets/javascripts/controllers/catalog/catalog_item_form_controller.js
index 8d336603c74..7cc1d41dd56 100644
--- a/app/assets/javascripts/controllers/catalog/catalog_item_form_controller.js
+++ b/app/assets/javascripts/controllers/catalog/catalog_item_form_controller.js
@@ -22,6 +22,7 @@ ManageIQ.angular.app.controller('catalogItemFormController', ['$scope', 'catalog
       provisioning_key: '',
       provisioning_value: '',
       provisioning_variables: {},
+      provisioning_become_enabled: false,
       provisioning_editMode: false,
       retirement_repository_id: '',
       retirement_playbook_id: '',
@@ -33,6 +34,7 @@ ManageIQ.angular.app.controller('catalogItemFormController', ['$scope', 'catalog
       retirement_value: '',
       retirement_variables: {},
       retirement_editMode: false,
+      retirement_become_enabled: false,
     };
     getRemoveResourcesTypes();
     vm.provisioning_cloud_type = '';
@@ -112,6 +114,7 @@ ManageIQ.angular.app.controller('catalogItemFormController', ['$scope', 'catalog
     vm.catalogItemModel.provisioning_dialog_name = configData.provision.new_dialog_name;
     vm.catalogItemModel.provisioning_key = '';
     vm.catalogItemModel.provisioning_value = '';
+    vm.catalogItemModel.provisioning_become_enabled = configData.provision.become_enabled
     setExtraVars('provisioning_variables', configData.provision.extra_vars);
 
     if (typeof configData.retirement.repository_id !== 'undefined') {
@@ -121,6 +124,7 @@ ManageIQ.angular.app.controller('catalogItemFormController', ['$scope', 'catalog
       vm.catalogItemModel.retirement_remove_resources = configData.retirement.remove_resources;
       vm.catalogItemModel.retirement_machine_credential_id = configData.retirement.credential_id;
     }
+    vm.catalogItemModel.retirement_become_enabled = configData.retirement.become_enabled
     vm.catalogItemModel.retirement_network_credential_id = configData.retirement.network_credential_id;
     vm.catalogItemModel.retirement_cloud_credential_id = setIfDefined(configData.retirement.cloud_credential_id);
     vm.catalogItemModel.retirement_inventory = configData.retirement.hosts;
@@ -205,7 +209,7 @@ ManageIQ.angular.app.controller('catalogItemFormController', ['$scope', 'catalog
         }
       }
     }
-
+    catalog_item['config_info']['provision']['become_enabled'] = configData.provisioning_become_enabled;
     if (configData.provisioning_network_credential_id !== '')
       catalog_item['config_info']['provision']['network_credential_id'] = configData.provisioning_network_credential_id;
 
@@ -229,6 +233,9 @@ ManageIQ.angular.app.controller('catalogItemFormController', ['$scope', 'catalog
       retirement['playbook_id'] = configData.retirement_playbook_id;
       retirement['credential_id'] = configData.retirement_machine_credential_id;
     }
+    if (vm.catalogItemModel.retirement_playbook_id !== undefined && configData.retirement_playbook_id !== '') {
+      catalog_item['config_info']['retirement']['become_enabled'] = configData.retirement_become_enabled;
+    }
     if (configData.retirement_network_credential_id !== '')
       catalog_item['config_info']['retirement']['network_credential_id'] = configData.retirement_network_credential_id;
 
@@ -425,6 +432,12 @@ ManageIQ.angular.app.controller('catalogItemFormController', ['$scope', 'catalog
     return vm.catalogItemModel.retirement_repository_id !== '';
   }
 
+  vm.retirement_playbook_selected = function(prefix) {
+    if (prefix === "provisioning")
+      return true;
+    return vm.catalogItemModel.retirement_playbook_id !== '';
+  }
+
   vm.removeKeyValue = function(prefix, key) {
     delete vm.catalogItemModel[prefix + "_variables"][key];
     $scope.checkFormPristine();
diff --git a/app/controllers/catalog_controller.rb b/app/controllers/catalog_controller.rb
index bd2f4c74e4f..60ccb9726c0 100644
--- a/app/controllers/catalog_controller.rb
+++ b/app/controllers/catalog_controller.rb
@@ -1801,6 +1801,7 @@ def fetch_playbook_details
     playbook_details[:provisioning][:network_credential] = fetch_name_from_object(ManageIQ::Providers::EmbeddedAnsible::AutomationManager::NetworkCredential, provision[:network_credential_id]) if provision[:network_credential_id]
     playbook_details[:provisioning][:cloud_credential] = fetch_name_from_object(ManageIQ::Providers::EmbeddedAnsible::AutomationManager::CloudCredential, provision[:cloud_credential_id]) if provision[:cloud_credential_id]
     fetch_dialog(playbook_details, provision[:dialog_id], :provisioning)
+    playbook_details[:provisioning][:become_enabled] = provision[:become_enabled] == true ? _('Yes') : _('No')
 
     if @record.config_info[:retirement]
       retirement = @record.config_info[:retirement]
@@ -1813,6 +1814,7 @@ def fetch_playbook_details
         playbook_details[:retirement][:network_credential] = fetch_name_from_object(ManageIQ::Providers::EmbeddedAnsible::AutomationManager::NetworkCredential, retirement[:network_credential_id]) if retirement[:network_credential_id]
         playbook_details[:retirement][:cloud_credential] = fetch_name_from_object(ManageIQ::Providers::EmbeddedAnsible::AutomationManager::CloudCredential, retirement[:cloud_credential_id]) if retirement[:cloud_credential_id]
       end
+      playbook_details[:retirement][:become_enabled] = retirement[:become_enabled] == true ? _('Yes') : _('No')
     end
     playbook_details
   end
diff --git a/app/views/catalog/_sandt_tree_show.html.haml b/app/views/catalog/_sandt_tree_show.html.haml
index 79696e9aa11..14209ddec83 100644
--- a/app/views/catalog/_sandt_tree_show.html.haml
+++ b/app/views/catalog/_sandt_tree_show.html.haml
@@ -228,6 +228,11 @@
                 = _('Hosts')
               .col-md-9
                 = h(@record.config_info[:provision][:hosts])
+            .form-group
+              %label.col-md-3.control-label
+                = _('Escalate Privilege')
+              .col-md-9
+                = h(provisioning[:become_enabled])
         .col-md-12.col-lg-6
           .form-horizontal.static
             .form-group
@@ -297,6 +302,11 @@
                   = _('Hosts')
                 .col-md-9
                   = h(@record.config_info[:retirement][:hosts])
+              .form-group
+                %label.col-md-3.control-label
+                  = _('Escalate Privilege')
+                .col-md-9
+                  = h(retirement[:become_enabled])
               .form-group
                 %label.col-md-3.control-label
                   = _('Remove Resources')
diff --git a/app/views/layouts/angular/_ansible_form_options_angular.html.haml b/app/views/layouts/angular/_ansible_form_options_angular.html.haml
index 7bb325f4542..1785a870e5d 100644
--- a/app/views/layouts/angular/_ansible_form_options_angular.html.haml
+++ b/app/views/layouts/angular/_ansible_form_options_angular.html.haml
@@ -107,7 +107,18 @@
                             "checkchange" => true}
           %span.help-block{"ng-show" => "angularForm.#{prefix}_inventory.$error.miqrequired"}
             = _("Required")
-
+    #escalate_privilege{"ng-if" => "vm.retirement_playbook_selected('#{prefix}')"}
+      .form-group
+        %label.col-md-3.control-label
+          = _("Escalate Privilege")
+        .col-md-9
+          %input#become_enabled{"bs-switch"       => "",
+                                "type"            => "checkbox",
+                                "name"            => "#{prefix}_become_enabled",
+                                "ng-model"        => "#{ng_model}.#{prefix}_become_enabled",
+                                "switch-on-text"  => _("Yes"),
+                                "switch-off-text" => _("No"),
+                                "checkchange"     => ""}
     - if prefix == "retirement"
       .form-group
         %label.col-md-3.control-label{"for" => "catalog_id"}
diff --git a/spec/controllers/catalog_controller_spec.rb b/spec/controllers/catalog_controller_spec.rb
index 72ffac36356..31f386f76e5 100644
--- a/spec/controllers/catalog_controller_spec.rb
+++ b/spec/controllers/catalog_controller_spec.rb
@@ -787,13 +787,15 @@
           :playbook           => playbook.name,
           :machine_credential => auth.name,
           :dialog             => "Some Label",
-          :dialog_id          => dialog.id
+          :dialog_id          => dialog.id,
+          :become_enabled     => "No"
         },
         :retirement   => {
           :remove_resources   => nil,
           :repository         => repository.name,
           :playbook           => playbook.name,
-          :machine_credential => auth.name
+          :machine_credential => auth.name,
+          :become_enabled     => "No"
         }
       }
       expect(playbook_details).to eq(st_details)
@@ -829,13 +831,15 @@
         :provisioning => {
           :repository         => nil,
           :playbook           => playbook.name,
-          :machine_credential => auth.name
+          :machine_credential => auth.name,
+          :become_enabled     => "No"
         },
         :retirement   => {
           :remove_resources   => nil,
           :repository         => repository.name,
           :playbook           => nil,
-          :machine_credential => auth.name
+          :machine_credential => auth.name,
+          :become_enabled     => "No"
         }
       }
       expect(playbook_details).to eq(st_details)
diff --git a/spec/javascripts/controllers/catalog/catalog_item_form_controller_spec.js b/spec/javascripts/controllers/catalog/catalog_item_form_controller_spec.js
index e33675a0b46..3aa8ecf4ef4 100644
--- a/spec/javascripts/controllers/catalog/catalog_item_form_controller_spec.js
+++ b/spec/javascripts/controllers/catalog/catalog_item_form_controller_spec.js
@@ -33,6 +33,7 @@ describe('catalogItemFormController', function() {
             'var1': {'default': 'default_val1'},
             'var2': {'default': 'default_val2'}
           },
+          become_enabled: undefined,
           network_credential_id: undefined
         },
         retirement: {