diff --git a/.forge/features/hacker-management/spec.md b/.forge/features/hacker-management/spec.md
index 9ffb34c5a..c795d345d 100644
--- a/.forge/features/hacker-management/spec.md
+++ b/.forge/features/hacker-management/spec.md
@@ -18,8 +18,11 @@ the readiness signal that slice computed finally means something.
 
 ## Users / actors
 
-- **Officers** — the only actors here. They read the roster, change statuses,
-  blacklist, and un-blacklist.
+- **Hacker readers** — users granted Read Hackers can browse, search, filter,
+  and open applications, including their event attendance. They cannot edit.
+- **Hacker editors** — users granted Edit Hackers can also correct applications,
+  adjust points, change statuses singly or in bulk, and delete applications.
+- **Officers** — retain full access, including blacklist information and controls.
 - **Applicants** — never see this screen. They experience it only as the mail a
   transition sends. They are the reason the guards exist.
 
@@ -27,6 +30,15 @@ Not actors in this slice: applicants applying (the hack sites own that, and the
 SDK carrying it is two slices out), and anyone checking in (moved to the event
 slice).
 
+### Delegated access (approved 2026-09-06)
+
+Read Hackers and Edit Hackers must work without officer access. Editors also
+have read access. The Hackers navigation and direct links use the same policy.
+Readers see application details and filters without selection or write controls.
+Blacklist information, filtering, and changes remain officer-only. Editors cannot
+delete a blacklisted application to clear that restriction; they must ask an
+officer. Configuration and event check-in permissions remain separate.
+
 ## User-visible interface
 
 **`/admin/hackathon/[id]/hackers`** — the roster for one hackathon, reached from
diff --git a/.forge/features/hacker-management/srd.md b/.forge/features/hacker-management/srd.md
index dd32f2145..ed71bd50c 100644
--- a/.forge/features/hacker-management/srd.md
+++ b/.forge/features/hacker-management/srd.md
@@ -29,23 +29,32 @@ From `docs/agentic-development/forge-engineering-principles.md`:
 
 ## Access policy
 
-Every procedure is `permProcedure` asserting officer, matching the
-configuration router it sits beside.
-
-- **Unauthenticated / non-officer:** no access; the route redirects.
-- **Officer:** full read and write.
-
-Two notes that are not obvious:
-
-- **`READ_HACKERS` exists and is deliberately not accepted.** A read-only tier
-  would be defensible for the roster, but the roster carries applicant PII
-  (email, school, phone via the hacker record) and every write on this screen is
-  officer-only anyway. Splitting the tier is a decision for whoever needs it,
-  not a guess to make now.
-- **The blacklist flag must never leave the officer tier.** It is a judgement
-  about a person recorded where they cannot see it. No procedure reachable by a
-  member or by an applicant may return it, and the SDK slice must not expose it
-  when it starts serving hacker data to external sites.
+Delegated hacker access was approved on 2026-09-06 and supersedes the original
+officer-only policy. Existing permission bits are reused; no migration is needed.
+
+- `READ_HACKERS` or `EDIT_HACKERS`: roster options, filters, counts, selection
+  survival, application details, and the existing hacker event-attendance read.
+- `EDIT_HACKERS`: profile corrections, point adjustments, single/bulk status
+  changes (including preview), and application deletion.
+- `IS_OFFICER`: overrides the above and is still required for blacklist access
+  and hackathon configuration. Do not broaden the platform configuration guard.
+- No hacker capability: no navigation, page access, or API access.
+
+The API redacts blacklist fields to null for non-officers, rejects blacklist
+filters (including false), and replaces blacklist skip reasons/errors with a
+request for officer review. Existing transition safeguards still apply. Deleting
+a blacklisted application requires an officer, checked under the attendee lock.
+Officer responses retain their existing shape and values.
+
+Blade must gate its admin layout, navigation, and page consistently. It passes
+read/edit/officer capabilities to the roster and detail controls. Read-only
+users cannot select rows or see mutations. The event-attendance read uses hacker
+read access; general event administration and check-in keep their existing gates.
+
+Validation covers the actual routers, role unions/revocation, read-only UI, and
+blacklist redaction/filtering. Rollout is a normal application deployment;
+rollback is reverting the code. No persisted data, permission indices, email
+delivery mechanics, or dependencies change.
 
 ## Architecture / data flow
 
diff --git a/.forge/features/hacker-management/status.md b/.forge/features/hacker-management/status.md
index c86afd9f2..dc9031ccd 100644
--- a/.forge/features/hacker-management/status.md
+++ b/.forge/features/hacker-management/status.md
@@ -3,7 +3,43 @@
 Phase: **implemented** — whole bundle approved 2026-08-03 and built. Awaiting
 `forge-review` and the owner's UI pass.
 
-## Context
+## Delegated hacker permissions — 2026-09-06
+
+Phase: PR open; awaiting CI and review. Branch: `codex/blade-hacker-permissions`.
+
+- Issue: [#538](https://github.com/KnightHacks/forge/issues/538).
+- PR: [#539](https://github.com/KnightHacks/forge/pull/539).
+- Rebased onto `main` before publishing to exclude the unrelated navigation
+  changes in PR #537. The permission fix applied without conflicts; validation
+  passed again on this standalone branch (194 API tests, 34 Blade tests, and
+  seven browser tests).
+
+- Owner approved making Read Hackers functional without officer status, with
+  Edit Hackers controlling writes and blacklist/configuration remaining officer-only.
+- Scope: Blade hacker navigation/page/controls, hacker API guards and responses,
+  and the hacker detail's event-attendance read. No schema or dependency changes.
+- Regression proof: the new API matrix failed 31 cases before implementation.
+  The completed API checks pass 194 tests across hacker access, real database
+  guards, hackathon configuration access, event access, and role permissions.
+- Blade: 34 targeted tests pass. All seven hacker-management browser tests pass,
+  including readers at 1440px and 320px, the legacy link, filtering/search,
+  details and attendance, editor controls, unauthorized redirects, and existing
+  officer flows. Roster/detail screenshots were inspected at both widths.
+- Database and browser checks used disposable local databases, dropped afterward.
+  Status-mail tests enqueue only in the disposable database; no delivery worker runs.
+- `pnpm format`, `pnpm lint`, `pnpm typecheck`, and
+  `pnpm analyze:react:changed` pass. Lint retains the repository's existing
+  warnings. The root typecheck covers shared API consumers.
+- No schema, permission-bit layout, dependency, or persistent environment changes.
+  `pnpm build` was attempted before publishing and failed while collecting page
+  data: Guild lacks `JUDGING_ACCESS_SECRET` and `NEXT_PUBLIC_BLADE_URL`; the 2026
+  app lacks `KHIX_HACKER_PORTAL_CLIENT_ID` and `KHIX_HACKER_PORTAL_ORIGIN`.
+  `pnpm --filter=@forge/blade build` also failed collecting `/judge/end` due to
+  missing `JUDGING_ACCESS_SECRET` and `NEXT_PUBLIC_BLADE_URL`.
+  No environment values were changed to bypass this. Deployment is not performed.
+- Screenshot files are excluded from the repository at the owner's request.
+
+## Original context
 
 The slice after hackathon configuration. That slice made per-status mail
 officer-editable; nothing sends it, and `isConfigured` is computed and read by
diff --git a/.forge/features/hacker-management/test-cases.md b/.forge/features/hacker-management/test-cases.md
index 6518cdb68..9be30bf95 100644
--- a/.forge/features/hacker-management/test-cases.md
+++ b/.forge/features/hacker-management/test-cases.md
@@ -273,13 +273,27 @@ Expected: the total is unchanged by all of them.
 
 ### TC-NEG-001: Access (AC — SRD access policy)
 
-Setup: unauthenticated; a logged-in non-officer; an officer.
+Setup: unauthenticated; no hacker permissions; Read Hackers only; Edit Hackers
+only; both hacker permissions; an officer.
 
 Action: call every procedure in the router.
 
-Expected: the first two are refused for every procedure; the officer succeeds.
-Asserted against the router's actual procedure list so a procedure added later
-without a guard fails this test rather than slipping through.
+Expected: the first two are refused for every procedure. Readers pass every read
+and cannot mutate, including bulk preview. Editors pass reads and writes except
+blacklist management. Officers pass all guards. Assert against the router's actual
+procedure list so new procedures need an access decision. Permissions granted
+through separate roles combine; revoking them takes effect on the next request.
+
+Blade: a reader can reach `/admin/hackers` and the legacy per-hackathon link,
+switch hackathons, search/filter, and open details including event attendance.
+There are no selection, status, edit, points adjustment, delete, or blacklist
+controls. Editors see ordinary write controls; only officers see configuration
+and blacklist controls. A signed-in user without hacker access is redirected.
+
+For readers and editors, roster/detail responses redact blacklist values to null.
+Blacklist filters, including `false`, fail before roster/count/selection reads.
+Bulk responses never name the blacklist to editors. Status changes still reject
+ineligible applicants, and an editor cannot delete a blacklisted application.
 
 ### TC-NEG-002: A blacklisted applicant cannot be accepted (AC-014)
 
diff --git a/apps/blade/src/app/_components/admin/hackathon/hackers/bulk-confirm-dialog.tsx b/apps/blade/src/app/_components/admin/hackathon/hackers/bulk-confirm-dialog.tsx
index 135a90964..18505acb1 100644
--- a/apps/blade/src/app/_components/admin/hackathon/hackers/bulk-confirm-dialog.tsx
+++ b/apps/blade/src/app/_components/admin/hackathon/hackers/bulk-confirm-dialog.tsx
@@ -30,7 +30,8 @@ type SendingStatus = keyof typeof HACKER_STATUS_LABELS;
  * `undefined`, which React renders as nothing. A blank explanation on the one
  * list whose job is saying who was *not* mailed is worse than an ugly one.
  */
-export function skipLabel(reason: string) {
+export function skipLabel(reason: string | null) {
+  if (reason === null) return "Requires officer review";
   // `hasOwn`, not `in`: `in` walks the prototype, so `"toString"` would pass the
   // guard and return a function, which React refuses to render — an error
   // boundary in place of the fallback this helper exists to provide.
diff --git a/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-detail-dialog.tsx b/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-detail-dialog.tsx
index 51f66cf30..ac703d738 100644
--- a/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-detail-dialog.tsx
+++ b/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-detail-dialog.tsx
@@ -144,6 +144,8 @@ function HackerDetailSkeleton() {
  * explain themselves.
  */
 export function HackerDetailDialog({
+  canEdit,
+  isOfficer,
   attendeeId,
   blocked,
   blockedReason,
@@ -151,6 +153,8 @@ export function HackerDetailDialog({
   onOpenChange,
   onSaved,
 }: {
+  canEdit: boolean;
+  isOfficer: boolean;
   attendeeId: string | null;
   blocked: boolean;
   blockedReason: string | null;
@@ -301,16 +305,17 @@ export function HackerDetailDialog({
                     </span>
                   </DialogDescription>
                 </div>
-                {/* A real control, not a ghost link buried in the subtitle. */}
-                <Button
-                  className="min-h-11 shrink-0 gap-2"
-                  disabled={busy || blocked}
-                  onClick={() => setEditing((current) => !current)}
-                  variant={editing ? "secondary" : "outline"}
-                >
-                  <Pencil className="size-4" aria-hidden="true" />
-                  {editing ? "Stop editing" : "Edit"}
-                </Button>
+                {canEdit ? (
+                  <Button
+                    className="min-h-11 shrink-0 gap-2"
+                    disabled={busy || blocked}
+                    onClick={() => setEditing((current) => !current)}
+                    variant={editing ? "secondary" : "outline"}
+                  >
+                    <Pencil className="size-4" aria-hidden="true" />
+                    {editing ? "Stop editing" : "Edit"}
+                  </Button>
+                ) : null}
               </div>
 
               {/* The summary row the member panel leads with: the numbers an
@@ -405,7 +410,7 @@ export function HackerDetailDialog({
               school, major and the MLH consent answers are the applicant's own
               answers, not an officer's to rewrite.
             */}
-            {editing ? (
+            {canEdit && editing ? (
               <div className="px-4 py-4 sm:px-6">
                 <HackerEditForm
                   busy={busy}
@@ -426,19 +431,21 @@ export function HackerDetailDialog({
                 on the screen and the reason an officer opened it — reading the
                 application is what they do to decide, not the task itself.
               */}
-                <DetailSection
-                  className="lg:col-span-2"
-                  description={
-                    blocked
-                      ? (blockedReason ?? "Actions are unavailable.")
-                      : "Each status sends its configured email immediately. It cannot be recalled."
-                  }
-                  icon={Send}
-                  title="Status and actions"
-                >
-                  <div className="flex flex-wrap gap-2 px-3 py-3 sm:px-4">
-                    {(Object.keys(HACKER_STATUS_LABELS) as SendingStatus[]).map(
-                      (status) => (
+                {canEdit ? (
+                  <DetailSection
+                    className="lg:col-span-2"
+                    description={
+                      blocked
+                        ? (blockedReason ?? "Actions are unavailable.")
+                        : "Each status sends its configured email immediately. It cannot be recalled."
+                    }
+                    icon={Send}
+                    title="Status and actions"
+                  >
+                    <div className="flex flex-wrap gap-2 px-3 py-3 sm:px-4">
+                      {(
+                        Object.keys(HACKER_STATUS_LABELS) as SendingStatus[]
+                      ).map((status) => (
                         <Button
                           className="min-h-11 text-sm"
                           disabled={
@@ -446,7 +453,7 @@ export function HackerDetailDialog({
                             blocked ||
                             hacker.status === status ||
                             // Blacklisted: capacity reject only.
-                            (hacker.blacklisted && status !== "denied")
+                            (hacker.blacklisted === true && status !== "denied")
                           }
                           key={status}
                           onClick={() =>
@@ -462,84 +469,90 @@ export function HackerDetailDialog({
                         >
                           {HACKER_STATUS_LABELS[status]}
                         </Button>
-                      ),
-                    )}
-                  </div>
-                  <div className="border-t border-border/70 px-3 py-3 sm:px-4">
-                    {hacker.blacklisted ? (
-                      <Button
-                        className="min-h-11 gap-2"
-                        disabled={busy || blocked}
-                        onClick={() =>
-                          setBlacklist.mutate({
-                            attendeeId: hacker.attendeeId,
-                            blacklisted: false,
-                          })
-                        }
-                        variant="secondary"
-                      >
-                        {setBlacklist.isPending ? (
-                          <Loader2
-                            className="size-4 animate-spin"
-                            aria-hidden="true"
-                          />
-                        ) : null}
-                        Remove blacklist
-                      </Button>
-                    ) : blacklisting ? (
-                      <div className="grid gap-2">
-                        <Label htmlFor="detail-blacklist-reason">
-                          Why should this applicant not be accepted?
-                        </Label>
-                        <Textarea
-                          id="detail-blacklist-reason"
-                          maxLength={500}
-                          onChange={(event) => setReason(event.target.value)}
-                          value={reason}
-                        />
-                        <p className="text-sm text-muted-foreground">
-                          Does not change their status and sends nothing.
-                          Visible only here — a year from now it is the only
-                          thing that explains the flag.
-                        </p>
-                        <div className="flex flex-wrap justify-end gap-2">
-                          <Button
-                            className="min-h-11"
-                            disabled={busy}
-                            onClick={() => setBlacklisting(false)}
-                            variant="ghost"
-                          >
-                            Cancel
-                          </Button>
+                      ))}
+                    </div>
+                    {isOfficer ? (
+                      <div className="border-t border-border/70 px-3 py-3 sm:px-4">
+                        {hacker.blacklisted ? (
                           <Button
                             className="min-h-11 gap-2"
-                            disabled={busy || blocked || reason.trim() === ""}
+                            disabled={busy || blocked}
                             onClick={() =>
                               setBlacklist.mutate({
                                 attendeeId: hacker.attendeeId,
-                                blacklisted: true,
-                                reason,
+                                blacklisted: false,
                               })
                             }
-                            variant="destructive"
+                            variant="secondary"
+                          >
+                            {setBlacklist.isPending ? (
+                              <Loader2
+                                className="size-4 animate-spin"
+                                aria-hidden="true"
+                              />
+                            ) : null}
+                            Remove blacklist
+                          </Button>
+                        ) : blacklisting ? (
+                          <div className="grid gap-2">
+                            <Label htmlFor="detail-blacklist-reason">
+                              Why should this applicant not be accepted?
+                            </Label>
+                            <Textarea
+                              id="detail-blacklist-reason"
+                              maxLength={500}
+                              onChange={(event) =>
+                                setReason(event.target.value)
+                              }
+                              value={reason}
+                            />
+                            <p className="text-sm text-muted-foreground">
+                              Does not change their status and sends nothing.
+                              Visible only here — a year from now it is the only
+                              thing that explains the flag.
+                            </p>
+                            <div className="flex flex-wrap justify-end gap-2">
+                              <Button
+                                className="min-h-11"
+                                disabled={busy}
+                                onClick={() => setBlacklisting(false)}
+                                variant="ghost"
+                              >
+                                Cancel
+                              </Button>
+                              <Button
+                                className="min-h-11 gap-2"
+                                disabled={
+                                  busy || blocked || reason.trim() === ""
+                                }
+                                onClick={() =>
+                                  setBlacklist.mutate({
+                                    attendeeId: hacker.attendeeId,
+                                    blacklisted: true,
+                                    reason,
+                                  })
+                                }
+                                variant="destructive"
+                              >
+                                Blacklist applicant
+                              </Button>
+                            </div>
+                          </div>
+                        ) : (
+                          <Button
+                            className="min-h-11 gap-2"
+                            disabled={busy || blocked}
+                            onClick={() => setBlacklisting(true)}
+                            variant="outline"
                           >
+                            <Ban className="size-4" aria-hidden="true" />
                             Blacklist applicant
                           </Button>
-                        </div>
+                        )}
                       </div>
-                    ) : (
-                      <Button
-                        className="min-h-11 gap-2"
-                        disabled={busy || blocked}
-                        onClick={() => setBlacklisting(true)}
-                        variant="outline"
-                      >
-                        <Ban className="size-4" aria-hidden="true" />
-                        Blacklist applicant
-                      </Button>
-                    )}
-                  </div>
-                </DetailSection>
+                    ) : null}
+                  </DetailSection>
+                ) : null}
 
                 <DetailSection
                   description="Who they are, and how to reach them."
@@ -596,90 +609,92 @@ export function HackerDetailDialog({
                 </DetailSection>
 
                 <DetailSection
-                  description="Awarded by hand. Every change is logged under the officer who made it."
+                  description="Every adjustment is logged under the person who made it."
                   icon={Sparkles}
                   title="Points"
                 >
                   <DetailRow label="Total" value={hacker.points} />
-                  <div className="px-3 py-3 sm:px-4">
-                    {/*
+                  {canEdit ? (
+                    <div className="px-3 py-3 sm:px-4">
+                      {/*
                     Behind a control rather than always on screen: this panel is
                     read far more often than it is used to award, and a live
                     number box in a permanent row invites a mis-click on a value
                     an officer never meant to change.
                   */}
-                    {awarding ? (
-                      <div className="grid gap-2">
-                        <div className="grid gap-2 sm:grid-cols-[7rem_1fr]">
-                          <Input
-                            aria-label="Points to add or subtract"
-                            className="h-11"
-                            disabled={busy || blocked}
-                            inputMode="numeric"
-                            onChange={(event) =>
-                              setPointDelta(event.target.value)
-                            }
-                            placeholder="+10"
-                            type="number"
-                            value={pointDelta}
-                          />
-                          <Input
-                            aria-label="Reason for the adjustment"
-                            className="h-11"
-                            disabled={busy || blocked}
-                            maxLength={300}
-                            onChange={(event) =>
-                              setPointReason(event.target.value)
-                            }
-                            placeholder="Why? e.g. won the hardware challenge"
-                            value={pointReason}
-                          />
-                        </div>
-                        <p className="text-sm text-muted-foreground">
-                          A change, not a new total, so two officers awarding at
-                          once add up.
-                        </p>
-                        <div className="flex flex-wrap justify-end gap-2">
-                          <Button
-                            className="min-h-11"
-                            disabled={busy}
-                            onClick={() => setAwarding(false)}
-                            variant="ghost"
-                          >
-                            Cancel
-                          </Button>
-                          <Button
-                            className="min-h-11"
-                            disabled={
-                              busy ||
-                              blocked ||
-                              pointDelta.trim() === "" ||
-                              Number(pointDelta) === 0 ||
-                              pointReason.trim() === ""
-                            }
-                            onClick={() =>
-                              awardPoints.mutate({
-                                attendeeId: hacker.attendeeId,
-                                delta: Number(pointDelta),
-                                reason: pointReason,
-                              })
-                            }
-                          >
-                            Apply
-                          </Button>
+                      {awarding ? (
+                        <div className="grid gap-2">
+                          <div className="grid gap-2 sm:grid-cols-[7rem_1fr]">
+                            <Input
+                              aria-label="Points to add or subtract"
+                              className="h-11"
+                              disabled={busy || blocked}
+                              inputMode="numeric"
+                              onChange={(event) =>
+                                setPointDelta(event.target.value)
+                              }
+                              placeholder="+10"
+                              type="number"
+                              value={pointDelta}
+                            />
+                            <Input
+                              aria-label="Reason for the adjustment"
+                              className="h-11"
+                              disabled={busy || blocked}
+                              maxLength={300}
+                              onChange={(event) =>
+                                setPointReason(event.target.value)
+                              }
+                              placeholder="Why? e.g. won the hardware challenge"
+                              value={pointReason}
+                            />
+                          </div>
+                          <p className="text-sm text-muted-foreground">
+                            A change, not a new total, so two officers awarding
+                            at once add up.
+                          </p>
+                          <div className="flex flex-wrap justify-end gap-2">
+                            <Button
+                              className="min-h-11"
+                              disabled={busy}
+                              onClick={() => setAwarding(false)}
+                              variant="ghost"
+                            >
+                              Cancel
+                            </Button>
+                            <Button
+                              className="min-h-11"
+                              disabled={
+                                busy ||
+                                blocked ||
+                                pointDelta.trim() === "" ||
+                                Number(pointDelta) === 0 ||
+                                pointReason.trim() === ""
+                              }
+                              onClick={() =>
+                                awardPoints.mutate({
+                                  attendeeId: hacker.attendeeId,
+                                  delta: Number(pointDelta),
+                                  reason: pointReason,
+                                })
+                              }
+                            >
+                              Apply
+                            </Button>
+                          </div>
                         </div>
-                      </div>
-                    ) : (
-                      <Button
-                        className="min-h-11"
-                        disabled={busy || blocked}
-                        onClick={() => setAwarding(true)}
-                        variant="secondary"
-                      >
-                        Adjust points
-                      </Button>
-                    )}
-                  </div>
+                      ) : (
+                        <Button
+                          className="min-h-11"
+                          disabled={busy || blocked}
+                          onClick={() => setAwarding(true)}
+                          variant="secondary"
+                        >
+                          Adjust points
+                        </Button>
+                      )}
+                    </div>
+                  ) : null}
                 </DetailSection>
 
                 <DetailSection
@@ -763,29 +778,31 @@ export function HackerDetailDialog({
                   </DetailSection>
                 ) : null}
 
-                <DetailSection
-                  className="border-destructive/30 lg:col-span-2"
-                  description="Remove this hackathon application so the participant can submit it again."
-                  icon={Trash2}
-                  title="Delete application"
-                >
-                  <div className="flex flex-col gap-3 px-3 py-3 sm:flex-row sm:items-center sm:justify-between sm:px-4">
-                    <p className="text-sm leading-5 text-muted-foreground">
-                      Their Blade account and reusable profile remain. Status,
-                      points, agreements, and check-ins for this hackathon are
-                      removed permanently.
-                    </p>
-                    <DeleteApplicationDialog
-                      attendeeId={hacker.attendeeId}
-                      blocked={blocked}
-                      name={hacker.name}
-                      onDeleted={() => {
-                        onOpenChange(false);
-                        onSaved();
-                      }}
-                    />
-                  </div>
-                </DetailSection>
+                {canEdit ? (
+                  <DetailSection
+                    className="border-destructive/30 lg:col-span-2"
+                    description="Remove this hackathon application so the participant can submit it again."
+                    icon={Trash2}
+                    title="Delete application"
+                  >
+                    <div className="flex flex-col gap-3 px-3 py-3 sm:flex-row sm:items-center sm:justify-between sm:px-4">
+                      <p className="text-sm leading-5 text-muted-foreground">
+                        Their Blade account and reusable profile remain. Status,
+                        points, agreements, and check-ins for this hackathon are
+                        removed permanently.
+                      </p>
+                      <DeleteApplicationDialog
+                        attendeeId={hacker.attendeeId}
+                        blocked={blocked}
+                        name={hacker.name}
+                        onDeleted={() => {
+                          onOpenChange(false);
+                          onSaved();
+                        }}
+                      />
+                    </div>
+                  </DetailSection>
+                ) : null}
               </div>
             )}
           </>
diff --git a/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-filters.tsx b/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-filters.tsx
index 526646a31..869c06427 100644
--- a/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-filters.tsx
+++ b/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-filters.tsx
@@ -223,6 +223,7 @@ function MultiSelectFilter({
  * chips once applied.
  */
 export function HackerFilters({
+  canViewBlacklist,
   busy,
   filter,
   hackathonId,
@@ -233,6 +234,7 @@ export function HackerFilters({
   optionsError,
   optionsLoading,
 }: {
+  canViewBlacklist: boolean;
   filter: RosterFilter;
   hackathonId: string;
   hackathons: Options;
@@ -545,25 +547,27 @@ export function HackerFilters({
                 </div>
               </div>
 
-              <div className="grid gap-2">
-                <Label>Only show</Label>
-                <div className="flex flex-wrap gap-2">
-                  <Button
-                    aria-pressed={draft.blacklisted === true}
-                    className="min-h-11 text-sm"
-                    onClick={() =>
-                      setDraft({
-                        ...draft,
-                        blacklisted: draft.blacklisted ? undefined : true,
-                      })
-                    }
-                    size="sm"
-                    variant={draft.blacklisted ? "secondary" : "outline"}
-                  >
-                    Blacklisted
-                  </Button>
+              {canViewBlacklist ? (
+                <div className="grid gap-2">
+                  <Label>Only show</Label>
+                  <div className="flex flex-wrap gap-2">
+                    <Button
+                      aria-pressed={draft.blacklisted === true}
+                      className="min-h-11 text-sm"
+                      onClick={() =>
+                        setDraft({
+                          ...draft,
+                          blacklisted: draft.blacklisted ? undefined : true,
+                        })
+                      }
+                      size="sm"
+                      variant={draft.blacklisted ? "secondary" : "outline"}
+                    >
+                      Blacklisted
+                    </Button>
+                  </div>
                 </div>
-              </div>
+              ) : null}
             </div>
           )}
 
diff --git a/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-roster.tsx b/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-roster.tsx
index 3e5aeae47..f39ca159d 100644
--- a/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-roster.tsx
+++ b/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-roster.tsx
@@ -95,9 +95,13 @@ function PaneTab({
 }
 
 export function HackerRoster({
+  canEdit,
+  isOfficer,
   hackathons,
   selected,
 }: {
+  canEdit: boolean;
+  isOfficer: boolean;
   hackathons: Options;
   selected: Options[number] | null;
 }) {
@@ -220,13 +224,17 @@ export function HackerRoster({
           title="Hackers"
         />
         <p className="rounded-md border border-dashed p-6 text-center text-muted-foreground">
-          Create a hackathon before managing applicants.{" "}
-          <Link
-            className="underline underline-offset-4"
-            href="/admin/hackathon"
-          >
-            Hackathons
-          </Link>
+          {isOfficer
+            ? "Create a hackathon before managing applicants."
+            : "Ask an officer to create a hackathon before managing applicants."}{" "}
+          {isOfficer ? (
+            <Link
+              className="underline underline-offset-4"
+              href="/admin/hackathon"
+            >
+              Hackathons
+            </Link>
+          ) : null}
         </p>
       </main>
     );
@@ -267,7 +275,11 @@ export function HackerRoster({
   return (
     <main className={adminPageLayoutClassName}>
       <AdminPageHeader
-        description="Everyone who applied. Filter to the group you mean, click across the rows, and act on them together."
+        description={
+          canEdit
+            ? "Everyone who applied. Filter to the group you mean, click across the rows, and act on them together."
+            : "Everyone who applied. Search, filter, and open an application to read its details."
+        }
         eyebrow={ADMIN_PAGE_EYEBROWS.hackers}
         icon={Users}
         title="Hackers"
@@ -307,6 +319,7 @@ export function HackerRoster({
               />
             </div>
             <HackerFilters
+              canViewBlacklist={isOfficer}
               busy={filterBusy}
               options={filterOptions.data ?? EMPTY_FILTER_OPTIONS}
               optionsError={filterOptions.isError}
@@ -395,7 +408,7 @@ export function HackerRoster({
           ) : null}
         </CardHeader>
 
-        {selectedCount > 0 ? (
+        {canEdit && selectedCount > 0 ? (
           <div className="flex flex-wrap items-center gap-2 border-b border-border/70 bg-primary/5 px-3 py-3 sm:px-4 md:px-6">
             <Badge className="text-sm" variant="secondary">
               {selectedCount} selected
@@ -461,6 +474,7 @@ export function HackerRoster({
               )}
             >
               <HackerTable
+                canSelect={canEdit}
                 busy={resultsUpdating}
                 hackers={hackers}
                 onOpen={(hacker) => url.setHackerId(hacker.attendeeId)}
@@ -492,26 +506,31 @@ export function HackerRoster({
             ? ` · capped at ${SHOW_ALL_SIZE}; narrow the filter to reach the rest`
             : url.showAll
               ? ""
-              : ` · first ${PAGE_SIZE}, use Show all to select across the list`}
-          {" · "}click a row to open it, shift-click to select a range
+              : ` · first ${PAGE_SIZE}, use Show all to see the rest`}
+          {" · "}click a row to open it
+          {canEdit ? ", shift-click to select a range" : " · read-only"}
         </div>
       </Card>
 
-      <BulkConfirmDialog
-        attendeeIds={selectedIds}
-        hackathonId={selected.id}
-        onDone={() => {
-          setBulkStatus(null);
-          selection.clear();
-          void refresh();
-        }}
-        onOpenChange={(open) => {
-          if (!open) setBulkStatus(null);
-        }}
-        status={bulkStatus}
-      />
+      {canEdit ? (
+        <BulkConfirmDialog
+          attendeeIds={selectedIds}
+          hackathonId={selected.id}
+          onDone={() => {
+            setBulkStatus(null);
+            selection.clear();
+            void refresh();
+          }}
+          onOpenChange={(open) => {
+            if (!open) setBulkStatus(null);
+          }}
+          status={bulkStatus}
+        />
+      ) : null}
 
       <HackerDetailDialog
+        canEdit={canEdit}
+        isOfficer={isOfficer}
         attendeeId={url.hackerId}
         blocked={blocked}
         blockedReason={blockedReason}
diff --git a/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-table.tsx b/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-table.tsx
index 88b09e939..33309aa0f 100644
--- a/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-table.tsx
+++ b/apps/blade/src/app/_components/admin/hackathon/hackers/hacker-table.tsx
@@ -35,6 +35,7 @@ function statusLabel(status: string) {
 }
 
 export function HackerTable({
+  canSelect,
   busy,
   hackers,
   onOpen,
@@ -43,6 +44,7 @@ export function HackerTable({
   onToggleRange,
   selected,
 }: {
+  canSelect: boolean;
   /**
    * True while a filter change is being checked against the selection, and
    * while the officer is answering the prompt that check produced.
@@ -77,14 +79,16 @@ export function HackerTable({
     <Table>
       <TableHeader>
         <TableRow className="hover:bg-transparent">
-          <TableHead className="w-12 pl-4">
-            <Checkbox
-              aria-label="Select every applicant shown"
-              checked={headerChecked}
-              disabled={busy}
-              onCheckedChange={(next) => onSelectAllShown(next === true)}
-            />
-          </TableHead>
+          {canSelect ? (
+            <TableHead className="w-12 pl-4">
+              <Checkbox
+                aria-label="Select every applicant shown"
+                checked={headerChecked}
+                disabled={busy}
+                onCheckedChange={(next) => onSelectAllShown(next === true)}
+              />
+            </TableHead>
+          ) : null}
           <TableHead>Applicant</TableHead>
           <TableHead className="hidden md:table-cell">School</TableHead>
           <TableHead>Status</TableHead>
@@ -116,14 +120,14 @@ export function HackerTable({
               onKeyDown={(event) => {
                 if (event.key === "Enter") {
                   event.preventDefault();
-                  if (event.shiftKey) {
+                  if (canSelect && event.shiftKey) {
                     if (!busy) onToggleRange(hacker.attendeeId);
                   } else onOpen(hacker);
                   return;
                 }
                 if (event.key === " ") {
                   event.preventDefault();
-                  if (!busy) onToggle(hacker.attendeeId);
+                  if (canSelect && !busy) onToggle(hacker.attendeeId);
                 }
               }}
               tabIndex={0}
@@ -132,7 +136,7 @@ export function HackerTable({
               // column, so both gestures are available — requiring a 20px
               // checkbox for every pick is what made multi-select feel broken.
               onClick={(event) => {
-                if (event.shiftKey) {
+                if (canSelect && event.shiftKey) {
                   if (!busy) onToggleRange(hacker.attendeeId);
                   return;
                 }
@@ -142,7 +146,7 @@ export function HackerTable({
               // painting a text selection across a shift-sweep — that is
               // decided on mousedown.
               onMouseDown={(event) => {
-                if (event.shiftKey) event.preventDefault();
+                if (canSelect && event.shiftKey) event.preventDefault();
               }}
             >
               {/*
@@ -150,37 +154,39 @@ export function HackerTable({
                 densest part of the screen and a mis-tap would open the detail
                 dialog instead of selecting.
               */}
-              <TableCell
-                className="pl-4"
-                onClick={(event) => {
-                  event.stopPropagation();
-                  if (busy) return;
-                  // Shift on the checkbox means the same thing it means on the
-                  // row. Previously it silently degraded to a single toggle,
-                  // with no signal that the gesture had done something else.
-                  if (event.shiftKey) onToggleRange(hacker.attendeeId);
-                  else onToggle(hacker.attendeeId);
-                }}
-              >
-                <Checkbox
-                  aria-label={`Select ${hacker.name}`}
-                  checked={isSelected}
-                  disabled={busy}
-                  // The cell owns the click; this is the visual affordance, so
-                  // it must not toggle a second time.
-                  onClick={(event) => event.preventDefault()}
-                  // Radix keeps focus on this button after a mouse click, and
-                  // the row's handler would then read Space as "open". Handling
-                  // it here keeps Space meaning "toggle" wherever focus landed.
-                  onKeyDown={(event) => {
-                    if (event.key !== " " && event.key !== "Enter") return;
-                    event.preventDefault();
+              {canSelect ? (
+                <TableCell
+                  className="pl-4"
+                  onClick={(event) => {
                     event.stopPropagation();
-                    if (!busy) onToggle(hacker.attendeeId);
+                    if (busy) return;
+                    // Shift on the checkbox means the same thing it means on the
+                    // row. Previously it silently degraded to a single toggle,
+                    // with no signal that the gesture had done something else.
+                    if (event.shiftKey) onToggleRange(hacker.attendeeId);
+                    else onToggle(hacker.attendeeId);
                   }}
-                  tabIndex={-1}
-                />
-              </TableCell>
+                >
+                  <Checkbox
+                    aria-label={`Select ${hacker.name}`}
+                    checked={isSelected}
+                    disabled={busy}
+                    // The cell owns the click; this is the visual affordance, so
+                    // it must not toggle a second time.
+                    onClick={(event) => event.preventDefault()}
+                    // Radix keeps focus on this button after a mouse click, and
+                    // the row's handler would then read Space as "open". Handling
+                    // it here keeps Space meaning "toggle" wherever focus landed.
+                    onKeyDown={(event) => {
+                      if (event.key !== " " && event.key !== "Enter") return;
+                      event.preventDefault();
+                      event.stopPropagation();
+                      if (!busy) onToggle(hacker.attendeeId);
+                    }}
+                    tabIndex={-1}
+                  />
+                </TableCell>
+              ) : null}
               <TableCell className="min-w-0">
                 <div className="flex flex-wrap items-center gap-2">
                   {/* Underlined, because the whole row opens the applicant and
diff --git a/apps/blade/src/app/admin/hackers/page.tsx b/apps/blade/src/app/admin/hackers/page.tsx
index 184bf1d75..e1564ddc9 100644
--- a/apps/blade/src/app/admin/hackers/page.tsx
+++ b/apps/blade/src/app/admin/hackers/page.tsx
@@ -4,7 +4,7 @@ import { notFound, redirect } from "next/navigation";
 import { MEMBER_DASHBOARD_PATH } from "@forge/validators";
 
 import { HackerRoster } from "~/app/_components/admin/hackathon/hackers/hacker-roster";
-import { canAccessHackathonAdmin } from "~/lib/admin-access";
+import { canAccessHackerAdmin, canEditHackerAdmin } from "~/lib/admin-access";
 import { auth } from "~/server/auth";
 import { api } from "~/trpc/server";
 
@@ -31,7 +31,7 @@ export default async function AdminHackersPage({
   if (!session) redirect("/");
 
   const permissions = await api.roles.getPermissions();
-  if (!canAccessHackathonAdmin(permissions)) redirect(MEMBER_DASHBOARD_PATH);
+  if (!canAccessHackerAdmin(permissions)) redirect(MEMBER_DASHBOARD_PATH);
 
   const { hackathons } = await api.hacker.listHackathonOptions();
   const params = await searchParams;
@@ -52,6 +52,8 @@ export default async function AdminHackersPage({
 
   return (
     <HackerRoster
+      canEdit={canEditHackerAdmin(permissions)}
+      isOfficer={permissions.IS_OFFICER === true}
       key={selected?.id ?? "no-hackathon"}
       hackathons={hackathons}
       selected={selected ?? null}
diff --git a/apps/blade/src/app/admin/layout.tsx b/apps/blade/src/app/admin/layout.tsx
index 5dd11e6c4..03dcabfa8 100644
--- a/apps/blade/src/app/admin/layout.tsx
+++ b/apps/blade/src/app/admin/layout.tsx
@@ -16,6 +16,7 @@ import {
   canAccessHackathonAdmin,
   canAccessHackathonCheckIn,
   canAccessHackathonEvents,
+  canAccessHackerAdmin,
   canAccessIssues,
   canAccessMemberAdmin,
   canAccessProjectAdmin,
@@ -43,6 +44,7 @@ export default async function AdminLayout({
     !canAccessEmailPortal(effectivePermissions) &&
     !canAccessEventCheckIn(effectivePermissions) &&
     !canAccessFormAdmin(effectivePermissions) &&
+    !canAccessHackerAdmin(effectivePermissions) &&
     !canAccessHackathonAdmin(effectivePermissions) &&
     !canAccessHackathonCheckIn(effectivePermissions) &&
     !canAccessHackathonEvents(effectivePermissions) &&
diff --git a/apps/blade/src/lib/admin-access.ts b/apps/blade/src/lib/admin-access.ts
index 336ed115e..332d081e6 100644
--- a/apps/blade/src/lib/admin-access.ts
+++ b/apps/blade/src/lib/admin-access.ts
@@ -140,6 +140,18 @@ export function canAccessHackathonAdmin(permissions: EffectivePermissions) {
   return permissions.IS_OFFICER === true;
 }
 
+export function canAccessHackerAdmin(permissions: EffectivePermissions) {
+  return (
+    permissions.IS_OFFICER === true ||
+    permissions.READ_HACKERS === true ||
+    permissions.EDIT_HACKERS === true
+  );
+}
+
+export function canEditHackerAdmin(permissions: EffectivePermissions) {
+  return permissions.IS_OFFICER === true || permissions.EDIT_HACKERS === true;
+}
+
 export function canAccessEmailPortal(permissions: EffectivePermissions) {
   return permissions.IS_OFFICER === true || permissions.EMAIL_PORTAL === true;
 }
@@ -157,8 +169,7 @@ export function getAdminNavigationAccess(permissions: EffectivePermissions) {
     hackathon: canAccessHackathonAdmin(permissions),
     hackathonCheckIn: canAccessHackathonCheckIn(permissions),
     hackathonEvents: canAccessHackathonEvents(permissions),
-    // Same tier: both screens are officer-only and one links to the other.
-    hackers: canAccessHackathonAdmin(permissions),
+    hackers: canAccessHackerAdmin(permissions),
     issues: canAccessIssues(permissions),
     logs: canAccessAdminLogs(permissions),
     members: canAccessMemberAdmin(permissions),
diff --git a/apps/blade/src/tests/admin/admin-access.test.ts b/apps/blade/src/tests/admin/admin-access.test.ts
index a67b1c3f4..6fbaa0634 100644
--- a/apps/blade/src/tests/admin/admin-access.test.ts
+++ b/apps/blade/src/tests/admin/admin-access.test.ts
@@ -5,7 +5,11 @@ import { PERMISSIONS } from "@forge/consts";
 import {
   canAccessCompanyAdmin,
   canAccessDiscordArchive,
+  canAccessHackathonAdmin,
+  canAccessHackerAdmin,
   canEditCompanyAdmin,
+  canEditHackerAdmin,
+  getAdminNavigationAccess,
 } from "~/lib/admin-access";
 
 type EffectivePermissions = Parameters<typeof canAccessCompanyAdmin>[0];
@@ -19,6 +23,25 @@ function permissions(
 }
 
 describe("dedicated admin access", () => {
+  it.each(["READ_HACKERS", "EDIT_HACKERS"] as const)(
+    "grants hacker access through %s without configuration access",
+    (permission) => {
+      const granted = permissions(permission);
+      expect(canAccessHackerAdmin(granted)).toBe(true);
+      expect(getAdminNavigationAccess(granted).hackers).toBe(true);
+      expect(canAccessHackathonAdmin(granted)).toBe(false);
+      expect(canEditHackerAdmin(granted)).toBe(permission === "EDIT_HACKERS");
+    },
+  );
+
+  it("keeps unrelated permissions out and preserves the officer override", () => {
+    expect(canAccessHackerAdmin(permissions("READ_HACK_DATA"))).toBe(false);
+    expect(canAccessHackerAdmin(permissions("READ_MEMBERS"))).toBe(false);
+    expect(canAccessHackerAdmin(permissions())).toBe(false);
+    expect(canAccessHackerAdmin(permissions("IS_OFFICER"))).toBe(true);
+    expect(canEditHackerAdmin(permissions("IS_OFFICER"))).toBe(true);
+  });
+
   it("separates company access from member access", () => {
     expect(canAccessCompanyAdmin(permissions("READ_MEMBERS"))).toBe(false);
     expect(canAccessCompanyAdmin(permissions("EDIT_MEMBERS"))).toBe(false);
diff --git a/apps/blade/src/tests/e2e/hacker-management.spec.ts b/apps/blade/src/tests/e2e/hacker-management.spec.ts
index d85d0a223..b2c8f0c62 100644
--- a/apps/blade/src/tests/e2e/hacker-management.spec.ts
+++ b/apps/blade/src/tests/e2e/hacker-management.spec.ts
@@ -168,10 +168,133 @@ test.describe("Hacker management critical flow", () => {
     ]);
   });
 
+  test.beforeEach(async () => {
+    await db
+      .update(Roles)
+      .set({ permissions: permissionBitstring("IS_OFFICER") })
+      .where(eq(Roles.id, ADMIN_ROLE_ID));
+  });
+
   test.afterAll(async () => {
     await cleanupFixtures();
   });
 
+  for (const width of [1440, 320]) {
+    test(`READ_HACKERS works without officer at ${width}px`, async ({
+      page,
+    }, testInfo) => {
+      await db
+        .update(Roles)
+        .set({ permissions: permissionBitstring("READ_HACKERS") })
+        .where(eq(Roles.id, ADMIN_ROLE_ID));
+      await page.setViewportSize({ width, height: 1000 });
+      // The legacy link must reach the same permission-aware standalone roster.
+      await page.goto(
+        `/api/e2e/signin?userId=${ADMIN_ID}&callbackURL=${encodeURIComponent(`/admin/hackathon/${HACKATHON_ID}/hackers`)}`,
+      );
+      await expect(page).toHaveURL(
+        new RegExp(`/admin/hackers\\?hackathon=${HACKATHON_ID}`),
+      );
+      await expect(page.getByText("Edge alpha")).toBeVisible();
+      expect(
+        await page.locator('a[href="/admin/hackers"]').count(),
+      ).toBeGreaterThan(0);
+      await expect(page.locator('a[href="/admin/hackathon"]')).toHaveCount(0);
+      await expect(page.getByRole("checkbox", { name: /Select/ })).toHaveCount(
+        0,
+      );
+      await page
+        .getByRole("button", { name: /^Accepted/ })
+        .first()
+        .click();
+      await expect(
+        page.getByText("No applicants match these filters."),
+      ).toBeVisible();
+      await page
+        .getByRole("button", { name: /^Applied/ })
+        .first()
+        .click();
+      await expect(page.getByText("Edge alpha")).toBeVisible();
+      await page
+        .getByRole("textbox", { name: "Search applicants" })
+        .fill("alpha");
+      await expect(page.getByText("Edge beta")).toHaveCount(0);
+      await expect(page.getByText("Edge alpha")).toBeVisible();
+      await page.screenshot({
+        path: testInfo.outputPath("reader-roster.png"),
+        fullPage: true,
+      });
+      await page.getByText("Edge alpha").click();
+      const dialog = page.getByRole("dialog");
+      await expect(
+        dialog.getByRole("heading", { name: "Edge alpha" }),
+      ).toBeVisible();
+      await expect(
+        dialog.getByText("e2e-alpha@example.test", { exact: true }),
+      ).toBeVisible();
+      await expect(
+        dialog.getByText("No attendance recorded for this hackathon."),
+      ).toBeVisible();
+      await expect(
+        dialog.getByRole("button", {
+          name: /^(Edit|Adjust points|Accepted|Delete application|Blacklist applicant|Remove blacklist)$/,
+        }),
+      ).toHaveCount(0);
+      await page.screenshot({
+        path: testInfo.outputPath("reader-detail.png"),
+        fullPage: true,
+      });
+      expect(
+        await page.evaluate(
+          () => document.documentElement.scrollWidth <= window.innerWidth,
+        ),
+      ).toBe(true);
+    });
+  }
+
+  test("EDIT_HACKERS exposes editing without blacklist or configuration controls", async ({
+    page,
+  }) => {
+    await db
+      .update(Roles)
+      .set({ permissions: permissionBitstring("EDIT_HACKERS") })
+      .where(eq(Roles.id, ADMIN_ROLE_ID));
+    await page.goto(
+      `/api/e2e/signin?userId=${ADMIN_ID}&callbackURL=${encodeURIComponent(`/admin/hackers?hackathon=${HACKATHON_ID}`)}`,
+    );
+    await expect(
+      page.getByRole("checkbox", { name: "Select Edge alpha" }),
+    ).toBeVisible();
+    await page.getByText("Edge alpha").click();
+    const dialog = page.getByRole("dialog");
+    await expect(
+      dialog.getByRole("button", { name: "Edit", exact: true }),
+    ).toBeEnabled();
+    await expect(
+      dialog.getByRole("button", { name: "Adjust points" }),
+    ).toBeEnabled();
+    await expect(
+      dialog.getByRole("button", { name: "Accepted", exact: true }),
+    ).toBeEnabled();
+    await expect(dialog.getByRole("button", { name: /Blacklist/ })).toHaveCount(
+      0,
+    );
+  });
+
+  test("no hacker capability redirects a direct roster link", async ({
+    page,
+  }) => {
+    await db
+      .update(Roles)
+      .set({ permissions: permissionBitstring() })
+      .where(eq(Roles.id, ADMIN_ROLE_ID));
+    await page.goto(
+      `/api/e2e/signin?userId=${ADMIN_ID}&callbackURL=${encodeURIComponent(`/admin/hackers?hackathon=${HACKATHON_ID}`)}`,
+    );
+    await expect(page).toHaveURL(/\/form\/member-signup/);
+    await expect(page.getByText("Edge alpha")).toHaveCount(0);
+  });
+
   test("TC-001/TC-015 lists applicants and builds an amendable selection", async ({
     page,
   }) => {
diff --git a/packages/api/src/routers/hackathon-event.ts b/packages/api/src/routers/hackathon-event.ts
index 7eadcbf16..477b9eb61 100644
--- a/packages/api/src/routers/hackathon-event.ts
+++ b/packages/api/src/routers/hackathon-event.ts
@@ -90,6 +90,7 @@ import {
   deliverHackathonRoleGrants,
   loadHackathonRoleGrantHealth,
 } from "../utils/hackathon-events/roles";
+import { requireHackerRead } from "../utils/hacker/access";
 import { assertCanManagePlatformConfig } from "../utils/platform-config/access";
 import { resolveRoleDiscordGateway } from "../utils/roles/discord-gateway";
 
@@ -2265,11 +2266,11 @@ export const hackathonEventRouter = {
       };
     }),
 
-  /** Existing hacker-management detail panel; still officer-only. */
+  /** Attendance read embedded in the permission-gated hacker detail panel. */
   listHackerEventAttendance: permProcedure
     .input(hackerAttendanceInput)
     .query(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerRead(ctx);
       const attendee = await db.query.HackerAttendee.findFirst({
         columns: { id: true },
         where: and(
diff --git a/packages/api/src/routers/hacker.ts b/packages/api/src/routers/hacker.ts
index 0e4ae2f95..4573c5dd0 100644
--- a/packages/api/src/routers/hacker.ts
+++ b/packages/api/src/routers/hacker.ts
@@ -46,6 +46,12 @@ import {
   createAdminAuditEvent,
 } from "../utils/audit/service";
 import { getDiscordEngagement } from "../utils/discord/engagement";
+import {
+  redactHackerBlacklist,
+  redactHackerSkipReasons,
+  requireHackerEdit,
+  requireHackerRead,
+} from "../utils/hacker/access";
 import {
   prepareStatusMail,
   withheldByDevelopmentGate,
@@ -56,8 +62,8 @@ import { assertCanManagePlatformConfig } from "../utils/platform-config/access";
 /**
  * The columns the roster reads.
  *
- * `blacklistReason` is included because the roster is the one screen allowed to
- * show it. Nothing here may be lifted into a member-facing or SDK procedure —
+ * Blacklist fields are redacted for non-officers before returning these rows.
+ * Nothing here may be lifted into a member-facing or SDK procedure —
  * the flag is a judgement about a person recorded where they cannot see it.
  */
 const ROSTER_COLUMNS = {
@@ -372,7 +378,7 @@ interface BulkSkip {
 
 export const hackerRouter = createTRPCRouter({
   /**
-   * Officer-only. The hackathons the roster's picker offers.
+   * Hacker read access. The hackathons the roster's picker offers.
    *
    * Ordered by how close the start date is to now, so the default selection is
    * the hackathon an officer is most likely working on — the one about to
@@ -381,7 +387,7 @@ export const hackerRouter = createTRPCRouter({
    * them read-only rather than hiding them.
    */
   listHackathonOptions: permProcedure.query(async ({ ctx }) => {
-    assertCanManagePlatformConfig(ctx.session.permissions);
+    requireHackerRead(ctx);
 
     const rows = await db
       .select({
@@ -420,7 +426,7 @@ export const hackerRouter = createTRPCRouter({
   }),
 
   /**
-   * Officer-only. The distinct values the filters offer, for this hackathon.
+   * Hacker read access. The distinct values the filters offer, for this hackathon.
    *
    * Read from the applicants who actually exist rather than from the full
    * school enum — offering five thousand universities when eleven appear in
@@ -429,7 +435,7 @@ export const hackerRouter = createTRPCRouter({
   filterOptions: permProcedure
     .input(hackerFilterOptionsSchema)
     .query(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerRead(ctx);
 
       // DISTINCT at the database. Without it this moved every attendee row —
       // 1448 on the largest hackathon today — to build a list of about a dozen
@@ -468,7 +474,7 @@ export const hackerRouter = createTRPCRouter({
     }),
 
   /**
-   * Officer-only. One applicant in full.
+   * Hacker read access. One applicant in full.
    *
    * A hacker record is a superset of a member's — everything a member has,
    * plus what MLH requires and what the hackathon needs — so the detail panel
@@ -479,7 +485,7 @@ export const hackerRouter = createTRPCRouter({
   get: permProcedure
     .input(z.object({ attendeeId: z.string().uuid() }))
     .query(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerRead(ctx);
 
       const [row] = await db
         .select({
@@ -546,19 +552,18 @@ export const hackerRouter = createTRPCRouter({
         : null;
 
       return {
-        ...row,
+        ...redactHackerBlacklist(row, ctx),
         discord,
-        blacklisted: row.blacklistedAt !== null,
         deliveryFailed: row.sendStatus === "failed",
         name: `${row.firstName} ${row.lastName}`.trim(),
       };
     }),
 
-  /** Officer-only. One page of the roster, or the whole filtered set. */
+  /** Hacker read access. One page of the roster, or the whole filtered set. */
   listForHackathon: permProcedure
     .input(hackerRosterListSchema)
     .query(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerRead(ctx, input.filter);
       await requireHackathon(input.hackathonId);
 
       // One extra row, to know whether another page exists without a second
@@ -576,8 +581,7 @@ export const hackerRouter = createTRPCRouter({
       const page = rows.slice(0, input.limit);
       return {
         hackers: page.map((row) => ({
-          ...row,
-          blacklisted: row.blacklistedAt !== null,
+          ...redactHackerBlacklist(row, ctx),
           deliveryFailed: row.sendStatus === "failed",
           name: `${row.firstName} ${row.lastName}`.trim(),
         })),
@@ -587,11 +591,11 @@ export const hackerRouter = createTRPCRouter({
       };
     }),
 
-  /** Officer-only. One grouped query, not one per status. */
+  /** Hacker read access. One grouped query, not one per status. */
   statusCounts: permProcedure
     .input(hackerRosterCountsSchema)
     .query(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerRead(ctx, input.filter);
       await requireHackathon(input.hackathonId);
 
       // `status` is stripped: this query groups *by* status, so applying it as
@@ -619,7 +623,7 @@ export const hackerRouter = createTRPCRouter({
     }),
 
   /**
-   * Officer-only. Which of a set of selected applicants survive a prospective
+   * Hacker read access. Which of a set of selected applicants survive a prospective
    * filter.
    *
    * Answered here rather than in the browser because the client only knows the
@@ -629,7 +633,7 @@ export const hackerRouter = createTRPCRouter({
   selectionSurvival: permProcedure
     .input(hackerSelectionSurvivalSchema)
     .query(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerRead(ctx, input.filter);
 
       const rows = await rosterQuery().where(
         and(
@@ -645,11 +649,11 @@ export const hackerRouter = createTRPCRouter({
       };
     }),
 
-  /** Officer-only. Moves one applicant and queues the mail for the new status. */
+  /** Hacker edit access. Moves one applicant and queues the mail for the new status. */
   setStatus: permProcedure
     .input(hackerSetStatusSchema)
     .mutation(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerEdit(ctx);
       const auditActor = await captureAdminAuditActor(ctx.session.user);
 
       // Everything read here, before the transaction opens. A pooled read
@@ -699,8 +703,9 @@ export const hackerRouter = createTRPCRouter({
         if (attendee.blacklistedAt && input.status !== "denied") {
           throw new TRPCError({
             code: "PRECONDITION_FAILED",
-            message:
-              "This applicant is blacklisted. Remove the blacklist first, or reject them for capacity.",
+            message: ctx.session.permissions.IS_OFFICER
+              ? "This applicant is blacklisted. Remove the blacklist first, or reject them for capacity."
+              : "This status change requires officer review.",
           });
         }
 
@@ -789,7 +794,7 @@ export const hackerRouter = createTRPCRouter({
     }),
 
   /**
-   * Officer-only. Who a bulk action would move and who it would skip.
+   * Hacker edit access. Who a bulk action would move and who it would skip.
    *
    * Writes nothing. Mirrors the email portal's preview step, which is the
    * interaction officers already know for "you are about to mail a lot of
@@ -798,7 +803,7 @@ export const hackerRouter = createTRPCRouter({
   previewBulk: permProcedure
     .input(hackerBulkPreviewSchema)
     .mutation(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerEdit(ctx);
       const hackathon = await requireHackathon(input.hackathonId);
       assertHackathonNotEnded(hackathon);
       await assertHackathonReady(db, input.hackathonId);
@@ -823,13 +828,13 @@ export const hackerRouter = createTRPCRouter({
           email: row.email,
           name: row.name,
         })),
-        skipped,
+        skipped: redactHackerSkipReasons(skipped, ctx),
         status: input.status,
       };
     }),
 
   /**
-   * Officer-only. Applies the bulk action.
+   * Hacker edit access. Applies the bulk action.
    *
    * Takes the same selection the preview took, not a stored preview id. The
    * SRD proposed a `previewVersion` handle; carrying one would mean persisting
@@ -847,7 +852,7 @@ export const hackerRouter = createTRPCRouter({
   confirmBulk: permProcedure
     .input(hackerBulkPreviewSchema)
     .mutation(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerEdit(ctx);
       const hackathon = await requireHackathon(input.hackathonId);
       const auditActor = await captureAdminAuditActor(ctx.session.user);
 
@@ -863,7 +868,12 @@ export const hackerRouter = createTRPCRouter({
         const { sending, skipped } = await resolveBulkTargets(tx, input, true);
 
         if (sending.length === 0) {
-          return { movedCount: 0, sendId: null, skipped, withheldCount: 0 };
+          return {
+            movedCount: 0,
+            sendId: null,
+            skipped: redactHackerSkipReasons(skipped, ctx),
+            withheldCount: 0,
+          };
         }
 
         const sendId = await writeStatusMail(
@@ -925,7 +935,7 @@ export const hackerRouter = createTRPCRouter({
         return {
           movedCount: sending.length,
           sendId,
-          skipped,
+          skipped: redactHackerSkipReasons(skipped, ctx),
           // Surfaced so the officer is told when a development run mails fewer
           // people than it moved, instead of reporting a clean success and
           // sending nothing.
@@ -949,7 +959,7 @@ export const hackerRouter = createTRPCRouter({
   awardPoints: permProcedure
     .input(hackerAwardPointsSchema)
     .mutation(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerEdit(ctx);
       const auditActor = await captureAdminAuditActor(ctx.session.user);
 
       return db.transaction(async (tx) => {
@@ -1021,7 +1031,7 @@ export const hackerRouter = createTRPCRouter({
   updateProfile: permProcedure
     .input(hackerUpdateProfileSchema)
     .mutation(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerEdit(ctx);
       const auditActor = await captureAdminAuditActor(ctx.session.user);
       const { attendeeId, ...patch } = input;
 
@@ -1167,12 +1177,13 @@ export const hackerRouter = createTRPCRouter({
   deleteApplication: permProcedure
     .input(hackerDeleteApplicationSchema)
     .mutation(async ({ ctx, input }) => {
-      assertCanManagePlatformConfig(ctx.session.permissions);
+      requireHackerEdit(ctx);
       const auditActor = await captureAdminAuditActor(ctx.session.user);
 
       return db.transaction(async (tx) => {
         const [application] = await tx
           .select({
+            blacklistedAt: HackerAttendee.blacklistedAt,
             firstName: Hacker.firstName,
             hackerId: HackerAttendee.hackerId,
             hackathonId: HackerAttendee.hackathonId,
@@ -1192,6 +1203,14 @@ export const hackerRouter = createTRPCRouter({
           });
         }
 
+        // Deleting the application would also clear its officer-only blacklist.
+        if (application.blacklistedAt && !ctx.session.permissions.IS_OFFICER) {
+          throw new TRPCError({
+            code: "FORBIDDEN",
+            message: "Deleting this application requires officer review.",
+          });
+        }
+
         const clearedCommands = await tx
           .delete(HackerParticipantCommand)
           .where(
diff --git a/packages/api/src/tests/hacker/access.test.ts b/packages/api/src/tests/hacker/access.test.ts
index 7890c83ad..32ef0e12d 100644
--- a/packages/api/src/tests/hacker/access.test.ts
+++ b/packages/api/src/tests/hacker/access.test.ts
@@ -1,6 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { Session } from "@forge/auth/server";
+import type { PERMISSIONS } from "@forge/consts";
 
 import { permissionBitstring } from "../support/permissions";
 
@@ -177,57 +178,89 @@ describe("hacker management access policy", () => {
     );
   });
 
-  describe("TC-NEG-001: signed in without IS_OFFICER", () => {
-    it.each(PROCEDURES)(
-      "%s rejects a READ_HACKERS holder",
-      async (_name, call) => {
-        // Deliberately the permission a reader would assume grants the roster.
-        // The SRD says it does not — the roster carries applicant PII and every
-        // write here is officer-only — so this pins a decision, not an accident.
-        mocks.permissionRows = [
-          {
-            permissions: permissionBitstring("READ_HACKERS", "READ_HACK_DATA"),
-          },
-        ];
+  const reads = new Set([
+    "listHackathonOptions",
+    "get",
+    "filterOptions",
+    "listForHackathon",
+    "statusCounts",
+    "selectionSurvival",
+  ]);
+  const actors: { label: string; keys: PERMISSIONS.PermissionKey[] }[] = [
+    { label: "no permissions", keys: [] },
+    { label: "analytics only", keys: ["READ_HACK_DATA"] },
+    { label: "reader", keys: ["READ_HACKERS"] },
+    { label: "editor", keys: ["EDIT_HACKERS"] },
+    { label: "reader and editor", keys: ["READ_HACKERS", "EDIT_HACKERS"] },
+    { label: "officer", keys: ["IS_OFFICER"] },
+  ];
 
+  describe.each(actors)("$label", ({ keys }) => {
+    it.each(PROCEDURES)("%s uses its hacker capability", async (name, call) => {
+      // Separate granting roles must union exactly as a single role would.
+      mocks.permissionRows = keys.map((key) => ({
+        permissions: permissionBitstring(key),
+      }));
+      const allowed =
+        keys.includes("IS_OFFICER") ||
+        (name !== "setBlacklist" &&
+          (keys.includes("EDIT_HACKERS") ||
+            (reads.has(name) && keys.includes("READ_HACKERS"))));
+      if (!allowed) {
         await expect(call(createCaller())).rejects.toMatchObject({
           code: "FORBIDDEN",
         });
-        // One select: the permission lookup. Nothing read the roster.
         expect(mocks.db.select).toHaveBeenCalledTimes(1);
-      },
-    );
+        return;
+      }
+      // The DB harness deliberately stops authorized calls after the guard.
+      let refused = false;
+      try {
+        await call(createCaller());
+      } catch (error) {
+        refused =
+          typeof error === "object" &&
+          error !== null &&
+          "code" in error &&
+          error.code === "FORBIDDEN";
+      }
+      expect(refused).toBe(false);
+    });
   });
 
-  describe("positive control", () => {
-    it.each(PROCEDURES)(
-      "%s admits an officer past the permission guard",
-      async (_name, call) => {
-        mocks.permissionRows = [
-          { permissions: permissionBitstring("IS_OFFICER") },
-        ];
-
-        // Admitted means "not refused for permission" — which is either a
-        // resolution, or a failure from the throwing mocks further in. Written
-        // as an explicit catch rather than `rejects.not.toMatchObject`, because
-        // that form fails outright on a procedure whose mocked reads happen to
-        // succeed, and it would then be reporting a harness detail as an access
-        // failure.
-        //
-        // Without this control a guard that refused everyone would pass every
-        // negative case above.
-        let refused = false;
-        try {
-          await call(createCaller());
-        } catch (error) {
-          refused =
-            typeof error === "object" &&
-            error !== null &&
-            "code" in error &&
-            (error as { code?: unknown }).code === "FORBIDDEN";
-        }
-        expect(refused).toBe(false);
-      },
-    );
+  it.each([true, false])(
+    "rejects blacklist=%s before any roster, count, or selection read",
+    async (blacklisted) => {
+      mocks.permissionRows = [
+        { permissions: permissionBitstring("READ_HACKERS", "EDIT_HACKERS") },
+      ];
+      const caller = createCaller();
+      const input = { hackathonId: HACKATHON_ID, filter: { blacklisted } };
+      await expect(caller.listForHackathon(input)).rejects.toMatchObject({
+        code: "FORBIDDEN",
+      });
+      await expect(caller.statusCounts(input)).rejects.toMatchObject({
+        code: "FORBIDDEN",
+      });
+      await expect(
+        caller.selectionSurvival({ ...input, attendeeIds: [ATTENDEE_ID] }),
+      ).rejects.toMatchObject({ code: "FORBIDDEN" });
+      expect(mocks.db.select).toHaveBeenCalledTimes(3);
+    },
+  );
+
+  it("reloads permissions when a role grant is revoked", async () => {
+    const caller = createCaller();
+    mocks.permissionRows = [
+      { permissions: permissionBitstring("READ_HACKERS") },
+    ];
+    // A second select proves the permission guard reached the roster query.
+    await caller.listHackathonOptions().catch(() => undefined);
+    expect(mocks.db.select).toHaveBeenCalledTimes(2);
+    mocks.permissionRows = [];
+    await expect(caller.listHackathonOptions()).rejects.toMatchObject({
+      code: "FORBIDDEN",
+    });
+    expect(mocks.db.select).toHaveBeenCalledTimes(3);
   });
 });
diff --git a/packages/api/src/tests/integration/hacker-guards.test.ts b/packages/api/src/tests/integration/hacker-guards.test.ts
index 07227976d..e3a84744a 100644
--- a/packages/api/src/tests/integration/hacker-guards.test.ts
+++ b/packages/api/src/tests/integration/hacker-guards.test.ts
@@ -66,9 +66,14 @@ describe.skipIf(!canRunDatabaseTests())("hacker management guards", () => {
   async function officerCaller() {
     const trpc = await import("../../trpc");
     const { hackerRouter } = await import("../../routers/hacker");
+    const { hackathonEventRouter } =
+      await import("../../routers/hackathon-event");
 
     return trpc.createCallerFactory(
-      trpc.createTRPCRouter({ hacker: hackerRouter }),
+      trpc.createTRPCRouter({
+        hacker: hackerRouter,
+        hackathonEvent: hackathonEventRouter,
+      }),
     )({
       headers: new Headers(),
       session: {
@@ -254,6 +259,10 @@ describe.skipIf(!canRunDatabaseTests())("hacker management guards", () => {
   // for the wrong reason, because the blacklist guard throws the identical
   // PRECONDITION_FAILED code.
   afterEach(async () => {
+    await client
+      .update(auth.Roles)
+      .set({ permissions: permissionBitstring("IS_OFFICER") })
+      .where(eq(auth.Roles.id, OFFICER_ROLE));
     await client
       .update(knightHacks.Hacker)
       .set({ isFirstTime: false })
@@ -321,6 +330,139 @@ describe.skipIf(!canRunDatabaseTests())("hacker management guards", () => {
     await client.delete(knightHacks.EmailSend);
   });
 
+  describe("delegated hacker permissions", () => {
+    it.each(["READ_HACKERS", "EDIT_HACKERS"] as const)(
+      "%s reads real applicants and attendance without the blacklist",
+      async (permission) => {
+        await client
+          .update(auth.Roles)
+          .set({ permissions: permissionBitstring(permission) })
+          .where(eq(auth.Roles.id, OFFICER_ROLE));
+        const options = await caller.hacker.listHackathonOptions();
+        expect(options.hackathons.map((row) => row.id)).toContain(
+          READY_HACKATHON,
+        );
+        const roster = await caller.hacker.listForHackathon({
+          hackathonId: READY_HACKATHON,
+        });
+        expect(roster.hackers).toHaveLength(3);
+        for (const row of roster.hackers) {
+          expect(row).toMatchObject({
+            blacklisted: null,
+            blacklistedAt: null,
+            blacklistReason: null,
+          });
+        }
+        const detail = await caller.hacker.get({
+          attendeeId: BLACKLISTED_ATTENDEE,
+        });
+        expect(detail).toMatchObject({
+          firstName: "Test",
+          email: "hacker-blocked@example.test",
+          blacklisted: null,
+          blacklistedAt: null,
+          blacklistReason: null,
+        });
+        await expect(
+          caller.hacker.statusCounts({ hackathonId: READY_HACKATHON }),
+        ).resolves.toMatchObject({ total: 3 });
+        const filters = await caller.hacker.filterOptions({
+          hackathonId: READY_HACKATHON,
+        });
+        expect(filters.schools).toContain("University of Central Florida");
+        await expect(
+          caller.hackathonEvent.listHackerEventAttendance({
+            attendeeId: PLAIN_ATTENDEE,
+            hackathonId: READY_HACKATHON,
+          }),
+        ).resolves.toMatchObject({ rows: [] });
+      },
+    );
+
+    it("keeps blacklist details available to officers", async () => {
+      await expect(
+        caller.hacker.get({ attendeeId: BLACKLISTED_ATTENDEE }),
+      ).resolves.toMatchObject({
+        blacklisted: true,
+        blacklistReason: "Repeated code of conduct violations.",
+      });
+    });
+
+    it("lets an editor update an application and queue its status mail", async () => {
+      await client
+        .update(auth.Roles)
+        .set({ permissions: permissionBitstring("EDIT_HACKERS") })
+        .where(eq(auth.Roles.id, OFFICER_ROLE));
+      await expect(
+        caller.hacker.updateProfile({
+          attendeeId: PLAIN_ATTENDEE,
+          email: "updated-hacker@example.test",
+        }),
+      ).resolves.toMatchObject({ updated: true });
+      await expect(
+        caller.hacker.setStatus({
+          attendeeId: PLAIN_ATTENDEE,
+          status: "accepted",
+        }),
+      ).resolves.toMatchObject({ status: "accepted" });
+      const row = await client.query.HackerAttendee.findFirst({
+        where: eq(knightHacks.HackerAttendee.id, PLAIN_ATTENDEE),
+      });
+      expect(row?.status).toBe("accepted");
+      expect(row?.lastStatusSendId).not.toBeNull();
+    });
+
+    it("preserves blacklist safeguards without disclosing them to editors", async () => {
+      await client
+        .update(auth.Roles)
+        .set({ permissions: permissionBitstring("EDIT_HACKERS") })
+        .where(eq(auth.Roles.id, OFFICER_ROLE));
+      await expect(
+        caller.hacker.setStatus({
+          attendeeId: BLACKLISTED_ATTENDEE,
+          status: "accepted",
+        }),
+      ).rejects.toMatchObject({
+        code: "PRECONDITION_FAILED",
+        message: "This status change requires officer review.",
+      });
+      await expect(
+        caller.hacker.deleteApplication({
+          attendeeId: BLACKLISTED_ATTENDEE,
+          confirmed: true,
+        }),
+      ).rejects.toMatchObject({
+        code: "FORBIDDEN",
+        message: "Deleting this application requires officer review.",
+      });
+      for (const operation of ["previewBulk", "confirmBulk"] as const) {
+        // Both the all-skipped and mixed-result response paths must redact.
+        for (const attendeeIds of [
+          [BLACKLISTED_ATTENDEE],
+          [BLACKLISTED_ATTENDEE, PLAIN_ATTENDEE],
+        ]) {
+          const result = await caller.hacker[operation]({
+            attendeeIds,
+            hackathonId: READY_HACKATHON,
+            status: "accepted",
+          });
+          expect(result.skipped).toEqual([
+            {
+              attendeeId: BLACKLISTED_ATTENDEE,
+              name: "Test blocked",
+              reason: null,
+            },
+          ]);
+        }
+      }
+      const blocked = await client.query.HackerAttendee.findFirst({
+        where: eq(knightHacks.HackerAttendee.id, BLACKLISTED_ATTENDEE),
+      });
+      expect(blocked?.blacklistedAt).not.toBeNull();
+      expect(blocked?.status).toBe("pending");
+    });
+  });
+
   afterAll(async () => {
     // Pool first, then drop. Dropping a database with live connections makes
     // Postgres terminate them, and vitest reports the resulting FATAL as an
diff --git a/packages/api/src/utils/hacker/access.ts b/packages/api/src/utils/hacker/access.ts
new file mode 100644
index 000000000..f9e2864cd
--- /dev/null
+++ b/packages/api/src/utils/hacker/access.ts
@@ -0,0 +1,49 @@
+import { TRPCError } from "@trpc/server";
+
+import type { HackerRosterFilter, SkipReason } from "@forge/validators";
+import { permissions } from "@forge/utils";
+
+type PermissionContext = Parameters<typeof permissions.controlPerms.or>[1];
+
+export function requireHackerRead(
+  ctx: PermissionContext,
+  filter?: HackerRosterFilter,
+) {
+  permissions.controlPerms.or(["READ_HACKERS", "EDIT_HACKERS"], ctx);
+  // Filtering either true or false would reveal the private blacklist.
+  if (
+    filter?.blacklisted !== undefined &&
+    !ctx.session.permissions.IS_OFFICER
+  ) {
+    throw new TRPCError({ code: "FORBIDDEN" });
+  }
+}
+
+export function requireHackerEdit(ctx: PermissionContext) {
+  return permissions.controlPerms.or(["EDIT_HACKERS"], ctx);
+}
+
+export function redactHackerBlacklist<
+  T extends { blacklistReason: string | null; blacklistedAt: Date | null },
+>(row: T, ctx: PermissionContext) {
+  const isOfficer = ctx.session.permissions.IS_OFFICER;
+  return {
+    ...row,
+    blacklistReason: isOfficer ? row.blacklistReason : null,
+    blacklistedAt: isOfficer ? row.blacklistedAt : null,
+    blacklisted: isOfficer ? row.blacklistedAt !== null : null,
+  };
+}
+
+export function redactHackerSkipReasons<T extends { reason: SkipReason }>(
+  rows: T[],
+  ctx: PermissionContext,
+) {
+  return rows.map((row) => ({
+    ...row,
+    reason:
+      row.reason === "blacklisted" && !ctx.session.permissions.IS_OFFICER
+        ? null
+        : row.reason,
+  }));
+}