diff --git a/lib/rbac/filterer.rb b/lib/rbac/filterer.rb
index b343e613eca..c7fa4537b80 100644
--- a/lib/rbac/filterer.rb
+++ b/lib/rbac/filterer.rb
@@ -13,6 +13,7 @@ class Filterer
       CloudVolume
       ConfigurationProfile
       ConfigurationScriptBase
+      ConfigurationScriptSource
       ConfiguredSystem
       Container
       ContainerBuild
diff --git a/spec/lib/rbac/filterer_spec.rb b/spec/lib/rbac/filterer_spec.rb
index 2a24c870532..d568bad42a4 100644
--- a/spec/lib/rbac/filterer_spec.rb
+++ b/spec/lib/rbac/filterer_spec.rb
@@ -137,6 +137,17 @@ def combine_filtered_ids(user_filtered_ids, belongsto_filtered_ids, managed_filt
         tagged_group.save!
       end
 
+      context 'searching for instances of ConfigurationScriptSource' do
+        let!(:configuration_script_source) { FactoryGirl.create_list(:embedded_ansible_configuration_script_source, 2).first }
+
+        it 'lists only tagged ConfigurationScriptSources' do
+          configuration_script_source.tag_with('/managed/environment/prod', :ns => '*')
+
+          results = described_class.search(:class => ManageIQ::Providers::EmbeddedAutomationManager::ConfigurationScriptSource, :user => user).first
+          expect(results).to match_array [configuration_script_source]
+        end
+      end
+
       context 'searching for instances of AuthKeyPair' do
         let!(:auth_key_pair_cloud) { FactoryGirl.create_list(:auth_key_pair_cloud, 2).first }