diff --git a/spec/policies/application_policy_spec.rb b/spec/policies/application_policy_spec.rb
new file mode 100644
index 00000000..e1c88233
--- /dev/null
+++ b/spec/policies/application_policy_spec.rb
@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe ApplicationPolicy, type: :policy do
+  let(:record) { Object.new }
+
+  describe 'default action permissions' do
+    context 'with an Axis Mundi user' do
+      subject { described_class.new(create(:user, :with_axis_mundi_role), record) }
+
+      %i[index show create new update edit destroy].each do |action|
+        it { is_expected.to permit_action(action) }
+      end
+    end
+
+    context 'with a regular user' do
+      subject { described_class.new(create(:user), record) }
+
+      %i[index show create new update edit destroy].each do |action|
+        it { is_expected.not_to permit_action(action) }
+      end
+    end
+
+    context 'with a nil user' do
+      subject { described_class.new(nil, record) }
+
+      %i[index show create new update edit destroy].each do |action|
+        it { is_expected.not_to permit_action(action) }
+      end
+    end
+  end
+
+  describe 'Scope#resolve' do
+    let!(:visible_role) { create(:role, kind: 'Scoped Role A') }
+    let!(:hidden_role) { create(:role, kind: 'Scoped Role B') }
+
+    it 'returns all records for Axis Mundi users' do
+      user = create(:user, :with_axis_mundi_role)
+      roles = Role.all.to_a
+      scope = described_class::Scope.new(user, Role.all).resolve
+
+      expect(scope).to match_array(roles)
+    end
+
+    it 'returns no records for regular users' do
+      user = create(:user)
+      scope = described_class::Scope.new(user, Role.all).resolve
+
+      expect(scope).to be_empty
+    end
+
+    it 'returns no records for a nil user' do
+      scope = described_class::Scope.new(nil, Role.all).resolve
+
+      expect(scope).to be_empty
+    end
+  end
+end
diff --git a/yarn.lock b/yarn.lock
index 295a5039..ee0d8d27 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2321,9 +2321,9 @@ domexception@^4.0.0:
     webidl-conversions "^7.0.0"
 
 dompurify@^3.2.5:
-  version "3.4.13"
-  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.13.tgz#fc28949d59f92d62e28a3a764bcbeee35897a1be"
-  integrity sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==
+  version "3.4.17"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.17.tgz#074bbb24eaa419535ac19ffe7f663104b0e1543d"
+  integrity sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==
   optionalDependencies:
     "@types/trusted-types" "^2.0.7"
 
@@ -4113,9 +4113,9 @@ sortablejs@^1.15.6:
   integrity sha512-aNfiuwMEpfBM/CN6LY0ibyhxPfPbyFeBTYJKCvzkJ2GkUpazIt3H+QIPAMHwqQ7tMKaHz1Qj+rJJCqljnf4p3A==
 
 "source-map-js@>=0.6.2 <2.0.0", source-map-js@^1.2.1:
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46"
-  integrity sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==
+  version "1.2.2"
+  resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.2.tgz#79fb88d97535a21cb27162cb05d211b67acea4ab"
+  integrity sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==
 
 source-map-support@0.5.13:
   version "0.5.13"
@@ -4339,9 +4339,9 @@ undici-types@~6.20.0:
   integrity sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==
 
 undici@^6.16.1:
-  version "6.28.0"
-  resolved "https://registry.yarnpkg.com/undici/-/undici-6.28.0.tgz#9f0e385744fef5021d6596c5bccd783f61193c1c"
-  integrity sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==
+  version "6.29.0"
+  resolved "https://registry.yarnpkg.com/undici/-/undici-6.29.0.tgz#140fa16e337ac706d6ff12f03fbe5c4357e5f9a3"
+  integrity sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==
 
 unicode-canonical-property-names-ecmascript@^2.0.0:
   version "2.0.1"