diff --git a/Changes b/Changes
index d4eac3ff..7a73a701 100644
--- a/Changes
+++ b/Changes
@@ -1,3 +1,9 @@
+2.049003 - 2021-09-03
+
+  [ENHANCEMENTS]
+
+  * Hide portctl features in Device Ports where ACLs would not permit the action
+
 2.049002 - 2021-09-03
 
   [NEW FEATURES]
diff --git a/lib/App/Netdisco/Web/Plugin/Device/Ports.pm b/lib/App/Netdisco/Web/Plugin/Device/Ports.pm
index 942d61dc..3a2236b6 100644
--- a/lib/App/Netdisco/Web/Plugin/Device/Ports.pm
+++ b/lib/App/Netdisco/Web/Plugin/Device/Ports.pm
@@ -4,6 +4,7 @@ use Dancer ':syntax';
 use Dancer::Plugin::DBIC;
 use Dancer::Plugin::Auth::Extensible;
 
+use App::Netdisco::Util::Port 'port_reconfig_check';
 use App::Netdisco::Util::Web (); # for sort_port
 use App::Netdisco::Web::Plugin;
 
@@ -202,6 +203,11 @@ get '/ajax/content/device/ports' => require_login sub {
     # sort ports
     @results = sort { &App::Netdisco::Util::Web::sort_port($a->port, $b->port) } @results;
 
+    # add acl on port config
+    if (param('c_admin') and user_has_role('port_control')) {
+      map {$_->{portctl} = (port_reconfig_check($_) ? false : true)} @results;
+    }
+
     # empty set would be a 'no records' msg
     return unless scalar @results;
 
diff --git a/share/views/ajax/device/ports.tt b/share/views/ajax/device/ports.tt
index 848351e3..c5311c35 100644
--- a/share/views/ajax/device/ports.tt
+++ b/share/views/ajax/device/ports.tt
@@ -70,7 +70,7 @@
       [% END %]
 
       [% IF params.c_port %]
-      [% IF user_can_port_control AND params.c_admin %]
+      [% IF user_can_port_control AND params.c_admin AND row.portctl %]
       [% IF row.up_admin == 'up' %]
       <td nowrap class="nd_editable-cell" data-action="down"
         data-order="[% row.port | html_entity %]" data-filter="[% row.port | html_entity %]"
@@ -89,7 +89,7 @@
             rel="tooltip" data-placement="top" data-offset="3"
             data-animation="" data-title="View Port Log"></i>
         </a>
-      [% IF user_can_port_control AND params.c_admin %]
+      [% IF user_can_port_control AND params.c_admin AND row.portctl %]
       [% IF row.up_admin == 'up' %]
         <span class="nd_hand-icon">
           <i class="icon-bullseye" data-action="bounce"
@@ -158,7 +158,7 @@
       [% END %]
 
       [% IF params.c_name %]
-      [% IF user_can_port_control AND params.c_admin %]
+      [% IF user_can_port_control AND params.c_admin AND row.portctl %]
       <td nowrap class="nd_editable-cell" contenteditable="true"
           data-field="c_name" data-for-device="[% device.ip | html_entity %]" data-for-port="[% row.port | html_entity %]">
       <i class="icon-edit nd_edit-icon"></i>
@@ -192,7 +192,7 @@
       [% END %]
 
       [% IF params.c_pvid %]
-      [% IF user_can_port_control AND params.c_admin %]
+      [% IF user_can_port_control AND params.c_admin AND row.portctl %]
       <td class="nd_editable-cell" contenteditable="true" data-default="[% row.vlan | html_entity %]"
         data-field="c_pvid" data-for-device="[% device.ip | html_entity %]" data-for-port="[% row.port | html_entity %]">
       <i class="icon-edit nd_edit-icon"></i>
@@ -239,7 +239,7 @@
       [% IF params.c_power %]
         [% IF row.power %]
           [% IF row.power.admin == 'true' %]
-            [% IF user_can_port_control AND params.c_admin %]
+            [% IF user_can_port_control AND params.c_admin AND row.portctl %]
               <td nowrap data-action="false"
                 data-field="c_power" data-for-device="[% device.ip | html_entity %]"
                 data-for-port="[% row.port | html_entity %]">
@@ -259,7 +259,7 @@
                 [% END %]
                 </span>
           [% ELSE %]
-            [% IF user_can_port_control AND params.c_admin %]
+            [% IF user_can_port_control AND params.c_admin AND row.portctl %]
               <td nowrap data-action="true"
                 data-field="c_power" data-for-device="[% device.ip | html_entity %]"
                 data-for-port="[% row.port | html_entity %]">
@@ -375,7 +375,7 @@
           [% END %]
         [% END %]
         [% END %]
-        [% IF user_can_port_control AND params.c_admin %]
+        [% IF user_can_port_control AND params.c_admin AND row.portctl %]
         <a class="nd_log-icon"
           href="[% uri_for('/admin/topology') | none %]?dev1=[% device.ip | uri %]&port1=[% row.port | uri %]">
           <i class="icon-link text-warning"