diff --git a/patrole_tempest_plugin/tests/api/compute/admin/__init__.py b/patrole_tempest_plugin/tests/api/compute/admin/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/compute/admin/__init__.py
diff --git a/patrole_tempest_plugin/tests/api/compute/admin/test_admin_password_rbac.py b/patrole_tempest_plugin/tests/api/compute/admin/test_admin_password_rbac.py
new file mode 100644
index 0000000..953f518
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/compute/admin/test_admin_password_rbac.py
@@ -0,0 +1,69 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import testtools
+
+from tempest import config
+from tempest.lib.common.utils import data_utils
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.compute import rbac_base
+
+
+CONF = config.CONF
+
+
+class PasswordAdminRbacTest(rbac_base.BaseV2ComputeAdminRbacTest):
+
+    def tearDown(self):
+        rbac_utils.switch_role(self, switchToRbacRole=False)
+        super(PasswordAdminRbacTest, self).tearDown()
+
+    @classmethod
+    def setup_clients(cls):
+        super(PasswordAdminRbacTest, cls).setup_clients()
+        cls.client = cls.servers_client
+
+    @classmethod
+    def skip_checks(cls):
+        super(PasswordAdminRbacTest, cls).skip_checks()
+        if not CONF.compute_feature_enabled.api_extensions:
+            raise cls.skipException(
+                '%s skipped as no compute extensions enabled' % cls.__name__)
+
+    @classmethod
+    def resource_setup(cls):
+        super(PasswordAdminRbacTest, cls).resource_setup()
+        cls.server_id = cls.create_test_server(wait_until='ACTIVE')['id']
+
+    @testtools.skipUnless(CONF.compute_feature_enabled.change_password,
+                          'Change password not available.')
+    @rbac_rule_validation.action(
+        service="nova", rule="os_compute_api:os-admin-password")
+    @decorators.idempotent_id('908a7d59-3a66-441c-94cf-38e57ed14956')
+    def test_change_server_password(self):
+        rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.client.change_password(
+            self.server_id,
+            adminPass=data_utils.rand_password())
+
+    @rbac_rule_validation.action(
+        service="nova", rule="os_compute_api:os-admin-password:discoverable")
+    @decorators.idempotent_id('379fce8a-f1ff-11e6-bc64-92361f002671')
+    def test_admin_password_discoverable(self):
+        rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.extensions_client.show_extension('os-admin-password')
diff --git a/patrole_tempest_plugin/tests/api/compute/admin/test_admin_server_actions_rbac.py b/patrole_tempest_plugin/tests/api/compute/admin/test_admin_server_actions_rbac.py
new file mode 100644
index 0000000..c49ba82
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/compute/admin/test_admin_server_actions_rbac.py
@@ -0,0 +1,83 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest import config
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.rbac_utils import rbac_utils
+from patrole_tempest_plugin.tests.api.compute import rbac_base
+
+
+CONF = config.CONF
+
+
+class ServersAdminRbacTest(rbac_base.BaseV2ComputeAdminRbacTest):
+
+    def tearDown(self):
+        rbac_utils.switch_role(self, switchToRbacRole=False)
+        super(ServersAdminRbacTest, self).tearDown()
+
+    @classmethod
+    def setup_clients(cls):
+        super(ServersAdminRbacTest, cls).setup_clients()
+        cls.client = cls.servers_client
+
+    @classmethod
+    def skip_checks(cls):
+        super(ServersAdminRbacTest, cls).skip_checks()
+        if not CONF.compute_feature_enabled.api_extensions:
+            raise cls.skipException(
+                '%s skipped as no compute extensions enabled' % cls.__name__)
+
+    @classmethod
+    def resource_setup(cls):
+        super(ServersAdminRbacTest, cls).resource_setup()
+        cls.server_id = cls.create_test_server(wait_until='ACTIVE')['id']
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-admin-actions:reset_state")
+    @decorators.idempotent_id('ae84dd0b-f364-462e-b565-3457f9c019ef')
+    def test_reset_server_state(self):
+        rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.client.reset_state(self.server_id, state='error')
+        self.addCleanup(self.client.reset_state,
+                        self.server_id,
+                        state='active')
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-admin-actions:inject_network_info")
+    @decorators.idempotent_id('ce48c340-51c1-4cff-9b6e-0cc5ef008630')
+    def test_inject_network_info(self):
+        rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.client.inject_network_info(self.server_id)
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-admin-actions:reset_network")
+    @decorators.idempotent_id('2911a242-15c4-4fcb-80d5-80a8930661b0')
+    def test_reset_network(self):
+        rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.client.reset_network(self.server_id)
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-admin-actions:discoverable")
+    @decorators.idempotent_id('e9d2991f-a05e-4116-881b-e2a82bb173cf')
+    def test_admin_actions_discoverable(self):
+        rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.extensions_client.show_extension('os-admin-actions')