diff --git a/app/assets/javascripts/admin/services/enterprise_relationships.js.coffee b/app/assets/javascripts/admin/services/enterprise_relationships.js.coffee
index 7a799f2f28..cad556efd8 100644
--- a/app/assets/javascripts/admin/services/enterprise_relationships.js.coffee
+++ b/app/assets/javascripts/admin/services/enterprise_relationships.js.coffee
@@ -2,7 +2,7 @@ angular.module("ofn.admin").factory 'EnterpriseRelationships', ($http, enterpris
   new class EnterpriseRelationships
     create_errors: ""
     all_permissions: [
-      'add_products_to_order_cycle'
+      'add_to_order_cycle'
       'manage_products'
     ]
 
@@ -24,5 +24,5 @@ angular.module("ofn.admin").factory 'EnterpriseRelationships', ($http, enterpris
 
     permission_presentation: (permission) ->
       switch permission
-        when "add_products_to_order_cycle" then "can add products to order cycle from"
-        when "manage_products" then "can manage the products of"
\ No newline at end of file
+        when "add_to_order_cycle" then "can add to order cycle"
+        when "manage_products" then "can manage the products of"
diff --git a/app/controllers/admin/order_cycles_controller.rb b/app/controllers/admin/order_cycles_controller.rb
index 566c660112..63daf918de 100644
--- a/app/controllers/admin/order_cycles_controller.rb
+++ b/app/controllers/admin/order_cycles_controller.rb
@@ -1,7 +1,10 @@
+require 'open_food_network/permissions'
 require 'open_food_network/order_cycle_form_applicator'
 
 module Admin
   class OrderCyclesController < ResourceController
+    include OrderCyclesHelper
+
     before_filter :load_order_cycle_set, :only => :index
 
     def show
@@ -23,7 +26,7 @@ module Admin
 
       respond_to do |format|
         if @order_cycle.save
-          OpenFoodNetwork::OrderCycleFormApplicator.new(@order_cycle, managed_enterprises).go!
+          OpenFoodNetwork::OrderCycleFormApplicator.new(@order_cycle, order_cycle_permitted_enterprises).go!
 
           flash[:notice] = 'Your order cycle has been created.'
           format.html { redirect_to admin_order_cycles_path }
@@ -40,7 +43,7 @@ module Admin
 
       respond_to do |format|
         if @order_cycle.update_attributes(params[:order_cycle])
-          OpenFoodNetwork::OrderCycleFormApplicator.new(@order_cycle, managed_enterprises).go!
+          OpenFoodNetwork::OrderCycleFormApplicator.new(@order_cycle, order_cycle_permitted_enterprises).go!
 
           flash[:notice] = 'Your order cycle has been updated.'
           format.html { redirect_to admin_order_cycles_path }
diff --git a/app/helpers/order_cycles_helper.rb b/app/helpers/order_cycles_helper.rb
index 92cd968e0b..dfd957a143 100644
--- a/app/helpers/order_cycles_helper.rb
+++ b/app/helpers/order_cycles_helper.rb
@@ -3,8 +3,20 @@ module OrderCyclesHelper
     @current_order_cycle ||= current_order(false).andand.order_cycle
   end
 
+  def order_cycle_permitted_enterprises
+    OpenFoodNetwork::Permissions.new(spree_current_user).order_cycle_enterprises
+  end
+
+  def order_cycle_producer_enterprises
+    order_cycle_permitted_enterprises.is_primary_producer.by_name
+  end
+
   def coordinating_enterprises
-    Enterprise.is_distributor.managed_by(spree_current_user).order('name')
+    order_cycle_hub_enterprises
+  end
+
+  def order_cycle_hub_enterprises
+    order_cycle_permitted_enterprises.is_distributor.by_name
   end
 
   def order_cycle_local_remote_class(distributor, order_cycle)
diff --git a/app/models/enterprise_relationship.rb b/app/models/enterprise_relationship.rb
index 5c10aafbbf..dba99cc7b3 100644
--- a/app/models/enterprise_relationship.rb
+++ b/app/models/enterprise_relationship.rb
@@ -9,12 +9,20 @@ class EnterpriseRelationship < ActiveRecord::Base
   scope :with_enterprises,
     joins('LEFT JOIN enterprises AS parent_enterprises ON parent_enterprises.id = enterprise_relationships.parent_id').
     joins('LEFT JOIN enterprises AS child_enterprises ON child_enterprises.id = enterprise_relationships.child_id')
-  scope :by_name, with_enterprises.order('parent_enterprises.name, child_enterprises.name')
 
   scope :involving_enterprises, ->(enterprises) {
     where('parent_id IN (?) OR child_id IN (?)', enterprises, enterprises)
   }
 
+  scope :permitting, ->(enterprises) { where('child_id IN (?)', enterprises) }
+
+  scope :with_permission, ->(permission) {
+    joins(:permissions).
+    where('enterprise_relationship_permissions.name = ?', permission)
+  }
+
+  scope :by_name, with_enterprises.order('child_enterprises.name, parent_enterprises.name')
+
 
   def permissions_list=(perms)
     perms.andand.each { |name| permissions.build name: name }
diff --git a/app/views/admin/enterprise_relationships/_enterprise_relationship.html.haml b/app/views/admin/enterprise_relationships/_enterprise_relationship.html.haml
index 56f0d46c01..6a7dcdc7f4 100644
--- a/app/views/admin/enterprise_relationships/_enterprise_relationship.html.haml
+++ b/app/views/admin/enterprise_relationships/_enterprise_relationship.html.haml
@@ -1,8 +1,8 @@
-%td {{ enterprise_relationship.parent_name }}
+%td {{ enterprise_relationship.child_name }}
 %td
   %ul
     %li{"ng-repeat" => "permission in enterprise_relationship.permissions"}
       {{ EnterpriseRelationships.permission_presentation(permission.name) }}
-%td {{ enterprise_relationship.child_name }}
+%td {{ enterprise_relationship.parent_name }}
 %td.actions
   %a.delete-enterprise-relationship.icon-trash.no-text{'ng-click' => 'delete(enterprise_relationship)'}
diff --git a/app/views/admin/enterprise_relationships/_form.html.haml b/app/views/admin/enterprise_relationships/_form.html.haml
index b9c2f265cd..86086c8781 100644
--- a/app/views/admin/enterprise_relationships/_form.html.haml
+++ b/app/views/admin/enterprise_relationships/_form.html.haml
@@ -1,14 +1,13 @@
 %tr
-  %td
-    %select{name: "enterprise_relationship_parent_id", "ng-model" => "parent_id", "ng-options" => "e.id as e.name for e in Enterprises.my_enterprises"}
-  %td
-    permits
-    / %div{"ng-repeat" => "permission in EnterpriseRelationships.all_permissions"}
-    /   %label
-    /     %input{type: "checkbox", "ng-model" => "permissions[permission]"}
-    /     {{ EnterpriseRelationships.permission_presentation(permission) }}
   %td
     %select{name: "enterprise_relationship_child_id", "ng-model" => "child_id", "ng-options" => "e.id as e.name for e in Enterprises.all_enterprises"}
+  %td
+    %div{"ng-repeat" => "permission in EnterpriseRelationships.all_permissions"}
+      %label
+        %input{type: "checkbox", "ng-model" => "permissions[permission]"}
+        {{ EnterpriseRelationships.permission_presentation(permission) }}
+  %td
+    %select{name: "enterprise_relationship_parent_id", "ng-model" => "parent_id", "ng-options" => "e.id as e.name for e in Enterprises.my_enterprises"}
   %td.actions
     %input{type: "button", value: "Create", "ng-click" => "create()"}
     .errors {{ EnterpriseRelationships.create_errors }}
diff --git a/app/views/admin/order_cycles/_exchange_form.html.haml b/app/views/admin/order_cycles/_exchange_form.html.haml
index 3539892034..8f81b9f03f 100644
--- a/app/views/admin/order_cycles/_exchange_form.html.haml
+++ b/app/views/admin/order_cycles/_exchange_form.html.haml
@@ -23,4 +23,4 @@
 
   = f.submit 'Add fee', 'ng-click' => 'addExchangeFee($event, exchange)'
 %td.actions
-  %a{'ng-click' => 'removeExchange($event, exchange)', :class => "icon-trash no-text"}
+  %a{'ng-click' => 'removeExchange($event, exchange)', :class => "icon-trash no-text remove-exchange"}
diff --git a/app/views/admin/order_cycles/_form.html.haml b/app/views/admin/order_cycles/_form.html.haml
index 68dfed9f1a..e859374a3b 100644
--- a/app/views/admin/order_cycles/_form.html.haml
+++ b/app/views/admin/order_cycles/_form.html.haml
@@ -25,7 +25,7 @@
     %tr.products{'ng-show' => 'exchange.showProducts'}
       = render 'exchange_supplied_products_form'
 
-= select_tag :new_supplier_id, options_from_collection_for_select(Enterprise.is_primary_producer.managed_by(spree_current_user).by_name, :id, :name), {'ng-model' => 'new_supplier_id'}
+= select_tag :new_supplier_id, options_from_collection_for_select(order_cycle_producer_enterprises, :id, :name), {'ng-model' => 'new_supplier_id'}
 = f.submit 'Add supplier', 'ng-click' => 'addSupplier($event)'
 
 
@@ -50,7 +50,7 @@
     %tr.products{'ng-show' => 'exchange.showProducts'}
       = render 'exchange_distributed_products_form'
 
-= select_tag :new_distributor_id, options_from_collection_for_select(Enterprise.is_distributor.managed_by(spree_current_user).by_name, :id, :name), {'ng-model' => 'new_distributor_id'}
+= select_tag :new_distributor_id, options_from_collection_for_select(order_cycle_hub_enterprises, :id, :name), {'ng-model' => 'new_distributor_id'}
 = f.submit 'Add distributor', 'ng-click' => 'addDistributor($event)'
 
 .actions
diff --git a/app/views/admin/order_cycles/show.rep b/app/views/admin/order_cycles/show.rep
index 04fc659813..fb71602eb6 100644
--- a/app/views/admin/order_cycles/show.rep
+++ b/app/views/admin/order_cycles/show.rep
@@ -9,7 +9,7 @@ r.element :order_cycle, @order_cycle do
     r.element :id
   end
 
-  r.list_of :exchanges, @order_cycle.exchanges.managed_by(spree_current_user).order('id ASC') do |exchange|
+  r.list_of :exchanges, OpenFoodNetwork::Permissions.new(spree_current_user).order_cycle_exchanges(@order_cycle).order('id ASC') do |exchange|
     r.element :id
     r.element :sender_id
     r.element :receiver_id
diff --git a/lib/open_food_network/permissions.rb b/lib/open_food_network/permissions.rb
new file mode 100644
index 0000000000..99c0aa0c15
--- /dev/null
+++ b/lib/open_food_network/permissions.rb
@@ -0,0 +1,37 @@
+module OpenFoodNetwork
+  class Permissions
+    def initialize(user)
+      @user = user
+    end
+
+    # Find enterprises that an admin is allowed to add to an order cycle
+    def order_cycle_enterprises
+      managed_enterprise_ids = managed_enterprises.pluck :id
+      permitted_enterprise_ids = related_enterprises_with(:add_to_order_cycle).pluck :id
+
+      Enterprise.where('id IN (?)', managed_enterprise_ids + permitted_enterprise_ids)
+    end
+
+    # Find the exchanges of an order cycle that an admin can manage
+    def order_cycle_exchanges(order_cycle)
+      enterprises = managed_enterprises + related_enterprises_with(:add_to_order_cycle)
+      order_cycle.exchanges.to_enterprises(enterprises).from_enterprises(enterprises)
+    end
+
+
+    private
+
+    def managed_enterprises
+      Enterprise.managed_by(@user)
+    end
+
+    def related_enterprises_with(permission)
+      parent_ids = EnterpriseRelationship.
+        permitting(managed_enterprises).
+        with_permission(permission).
+        pluck(:parent_id)
+
+      Enterprise.where('id IN (?)', parent_ids)
+    end
+  end
+end
diff --git a/spec/features/admin/enterprise_relationships_spec.rb b/spec/features/admin/enterprise_relationships_spec.rb
index 757f8bc2e6..7317f44066 100644
--- a/spec/features/admin/enterprise_relationships_spec.rb
+++ b/spec/features/admin/enterprise_relationships_spec.rb
@@ -14,9 +14,9 @@ feature %q{
     scenario "listing relationships" do
       # Given some enterprises with relationships
       e1, e2, e3, e4 = create(:enterprise), create(:enterprise), create(:enterprise), create(:enterprise)
-      create(:enterprise_relationship, parent: e1, child: e2, permissions_list: [:add_products_to_order_cycle])
+      create(:enterprise_relationship, parent: e1, child: e2, permissions_list: [:add_to_order_cycle])
       create(:enterprise_relationship, parent: e2, child: e3, permissions_list: [:manage_products])
-      create(:enterprise_relationship, parent: e3, child: e4, permissions_list: [:add_products_to_order_cycle, :manage_products])
+      create(:enterprise_relationship, parent: e3, child: e4, permissions_list: [:add_to_order_cycle, :manage_products])
 
       # When I go to the relationships page
       click_link 'Enterprises'
@@ -24,10 +24,10 @@ feature %q{
 
       # Then I should see the relationships
       within('table#enterprise-relationships') do
-        page.should have_relationship e1, e2, ['can add products to order cycle from']
+        page.should have_relationship e1, e2, ['can add to order cycle']
         page.should have_relationship e2, e3, ['can manage the products of']
         page.should have_relationship e3, e4,
-          ['can add products to order cycle from', 'can manage the products of']
+          ['can add to order cycle', 'can manage the products of']
       end
     end
 
@@ -38,16 +38,17 @@ feature %q{
 
       visit admin_enterprise_relationships_path
       select 'One', from: 'enterprise_relationship_parent_id'
-      #check 'can add products to order cycle from'
-      #check 'can manage the products of'
-      #uncheck 'can manage the products of'
+
+      check 'can add to order cycle'
+      check 'can manage the products of'
+      uncheck 'can manage the products of'
       select 'Two', from: 'enterprise_relationship_child_id'
       click_button 'Create'
 
-      page.should have_relationship e1, e2 #, ['can add products to order cycle from']
+      page.should have_relationship e1, e2, ['can add to order cycle']
       er = EnterpriseRelationship.where(parent_id: e1, child_id: e2).first
       er.should be_present
-      #er.permissions.map(&:name).should == ['add_products_to_order_cycle']
+      er.permissions.map(&:name).should == ['add_to_order_cycle']
     end
 
 
@@ -119,6 +120,6 @@ feature %q{
   def have_relationship(parent, child, perms=[])
     perms = perms.join(' ') || 'permits'
 
-    have_table_row [parent.name, perms, child.name, '']
+    have_table_row [child.name, perms, parent.name, '']
   end
 end
diff --git a/spec/features/admin/order_cycles_spec.rb b/spec/features/admin/order_cycles_spec.rb
index 2423a6dc05..76ee3bdfc2 100644
--- a/spec/features/admin/order_cycles_spec.rb
+++ b/spec/features/admin/order_cycles_spec.rb
@@ -436,26 +436,37 @@ feature %q{
 
   context "as an enterprise user" do
 
-    let(:supplier1) { create(:supplier_enterprise, name: 'First Supplier') }
-    let(:supplier2) { create(:supplier_enterprise, name: 'Another Supplier') }
-    let(:distributor1) { create(:distributor_enterprise, name: 'First Distributor') }
-    let(:distributor2) { create(:distributor_enterprise, name: 'Another Distributor') }
-    let!(:distributor1_fee) { create(:enterprise_fee, enterprise: distributor1, name: 'First Distributor Fee') }
-    before(:each) do
-      product = create(:product, supplier: supplier1)
-      product.distributors << distributor1
+    let!(:supplier_managed) { create(:supplier_enterprise, name: 'Managed supplier') }
+    let!(:supplier_unmanaged) { create(:supplier_enterprise, name: 'Unmanaged supplier') }
+    let!(:supplier_permitted) { create(:supplier_enterprise, name: 'Permitted supplier') }
+    let!(:distributor_managed) { create(:distributor_enterprise, name: 'Managed distributor') }
+    let!(:distributor_unmanaged) { create(:distributor_enterprise, name: 'Unmanaged Distributor') }
+    let!(:distributor_permitted) { create(:distributor_enterprise, name: 'Permitted distributor') }
+    let!(:distributor_managed_fee) { create(:enterprise_fee, enterprise: distributor_managed, name: 'Managed distributor fee') }
+    let!(:supplier_permitted_relationship) do
+      create(:enterprise_relationship, parent: supplier_permitted, child: supplier_managed,
+             permissions_list: [:add_to_order_cycle])
+    end
+    let!(:distributor_permitted_relationship) do
+      create(:enterprise_relationship, parent: distributor_permitted, child: distributor_managed,
+             permissions_list: [:add_to_order_cycle])
+    end
+
+    before do
+      product = create(:product, supplier: supplier_managed)
+      product.distributors << distributor_managed
       product.save!
 
       @new_user = create_enterprise_user
-      @new_user.enterprise_roles.build(enterprise: supplier1).save
-      @new_user.enterprise_roles.build(enterprise: distributor1).save
+      @new_user.enterprise_roles.build(enterprise: supplier_managed).save
+      @new_user.enterprise_roles.build(enterprise: distributor_managed).save
 
       login_to_admin_as @new_user
     end
 
     scenario "viewing a list of order cycles I am coordinating" do
-      oc_user_coordinating = create(:simple_order_cycle, { suppliers: [supplier1, supplier2], coordinator: supplier1, distributors: [distributor1, distributor2], name: 'Order Cycle 1' } )
-      oc_for_other_user = create(:simple_order_cycle, { coordinator: supplier2, name: 'Order Cycle 2' } )
+      oc_user_coordinating = create(:simple_order_cycle, { suppliers: [supplier_managed, supplier_unmanaged], coordinator: supplier_managed, distributors: [distributor_managed, distributor_unmanaged], name: 'Order Cycle 1' } )
+      oc_for_other_user = create(:simple_order_cycle, { coordinator: supplier_unmanaged, name: 'Order Cycle 2' } )
 
       click_link "Order Cycles"
 
@@ -464,8 +475,8 @@ feature %q{
       page.should_not have_content oc_for_other_user.name
 
       # The order cycle should not show enterprises that I don't manage
-      page.should_not have_selector 'td.suppliers',    text: supplier2.name
-      page.should_not have_selector 'td.distributors', text: distributor2.name
+      page.should_not have_selector 'td.suppliers',    text: supplier_unmanaged.name
+      page.should_not have_selector 'td.distributors', text: distributor_unmanaged.name
     end
 
     scenario "creating a new order cycle" do
@@ -476,57 +487,81 @@ feature %q{
       fill_in 'order_cycle_orders_open_at', with: '2012-11-06 06:00:00'
       fill_in 'order_cycle_orders_close_at', with: '2012-11-13 17:00:00'
 
-      select 'First Supplier', from: 'new_supplier_id'
+      select 'Managed supplier', from: 'new_supplier_id'
+      click_button 'Add supplier'
+      select 'Permitted supplier', from: 'new_supplier_id'
       click_button 'Add supplier'
 
-      select 'First Distributor', from: 'order_cycle_coordinator_id'
+      select 'Managed distributor', from: 'order_cycle_coordinator_id'
       click_button 'Add coordinator fee'
-      select 'First Distributor Fee', from: 'order_cycle_coordinator_fee_0_id'
+      select 'Managed distributor fee', from: 'order_cycle_coordinator_fee_0_id'
 
-      select 'First Distributor', from: 'new_distributor_id'
+      select 'Managed distributor', from: 'new_distributor_id'
+      click_button 'Add distributor'
+      select 'Permitted distributor', from: 'new_distributor_id'
       click_button 'Add distributor'
 
-      # Should only have suppliers / distributors listed which the user can manage
-      within "#new_supplier_id" do
-        page.should_not have_content supplier2.name
-      end
-      within "#new_distributor_id" do
-        page.should_not have_content distributor2.name
-      end
-      within "#order_cycle_coordinator_id" do
-        page.should_not have_content distributor2.name
-        page.should_not have_content supplier1.name
-        page.should_not have_content supplier2.name
+      # Should only have suppliers / distributors listed which the user is managing or
+      # has E2E permission to add products to order cycles
+      page.should_not have_select 'new_supplier_id', with_options: [supplier_unmanaged.name]
+      page.should_not have_select 'new_distributor_id', with_options: [distributor_unmanaged.name]
+
+      [distributor_unmanaged.name, supplier_managed.name, supplier_unmanaged.name].each do |enterprise_name|
+        page.should_not have_select 'order_cycle_coordinator_id', with_options: [enterprise_name]
       end
 
       click_button 'Create'
 
       flash_message.should == "Your order cycle has been created."
       order_cycle = OrderCycle.find_by_name('My order cycle')
-      order_cycle.coordinator.should == distributor1
+      order_cycle.suppliers.sort.should == [supplier_managed, supplier_permitted].sort
+      order_cycle.coordinator.should == distributor_managed
+      order_cycle.distributors.sort.should == [distributor_managed, distributor_permitted].sort
     end
 
-    scenario "editing an order cycle" do
-      oc = create(:simple_order_cycle, { suppliers: [supplier1, supplier2], coordinator: supplier1, distributors: [distributor1, distributor2], name: 'Order Cycle 1' } )
+    scenario "editing an order cycle does not affect exchanges we don't manage" do
+      oc = create(:simple_order_cycle, { suppliers: [supplier_managed, supplier_permitted, supplier_unmanaged], coordinator: supplier_managed, distributors: [distributor_managed, distributor_permitted, distributor_unmanaged], name: 'Order Cycle 1' } )
 
       visit edit_admin_order_cycle_path(oc)
 
-      # I should not see exchanges for supplier2 or distributor2
-      page.all('tr.supplier').count.should == 1
-      page.all('tr.distributor').count.should == 1
+      # I should not see exchanges for supplier_unmanaged or distributor_unmanaged
+      page.all('tr.supplier').count.should == 2
+      page.all('tr.distributor').count.should == 2
 
       # When I save, then those exchanges should remain
       click_button 'Update'
       page.should have_content "Your order cycle has been updated."
 
       oc.reload
-      oc.suppliers.sort.should == [supplier1, supplier2]
-      oc.coordinator.should == supplier1
-      oc.distributors.sort.should == [distributor1, distributor2]
+      oc.suppliers.sort.should == [supplier_managed, supplier_permitted, supplier_unmanaged].sort
+      oc.coordinator.should == supplier_managed
+      oc.distributors.sort.should == [distributor_managed, distributor_permitted, distributor_unmanaged].sort
     end
 
+    scenario "editing an order cycle" do
+      oc = create(:simple_order_cycle, { suppliers: [supplier_managed, supplier_permitted, supplier_unmanaged], coordinator: supplier_managed, distributors: [distributor_managed, distributor_permitted, distributor_unmanaged], name: 'Order Cycle 1' } )
+
+      visit edit_admin_order_cycle_path(oc)
+
+      # When I remove all the exchanges and save
+      page.find("tr.supplier-#{supplier_managed.id} a.remove-exchange").click
+      page.find("tr.supplier-#{supplier_permitted.id} a.remove-exchange").click
+      page.find("tr.distributor-#{distributor_managed.id} a.remove-exchange").click
+      page.find("tr.distributor-#{distributor_permitted.id} a.remove-exchange").click
+      click_button 'Update'
+
+      # Then the exchanges should be removed
+      page.should have_content "Your order cycle has been updated."
+
+      oc.reload
+      oc.suppliers.should == [supplier_unmanaged]
+      oc.coordinator.should == supplier_managed
+      oc.distributors.should == [distributor_unmanaged]
+    end
+
+
     scenario "cloning an order cycle" do
-      oc = create(:simple_order_cycle)
+      oc = create(:simple_order_cycle, coordinator: distributor_managed)
 
       click_link "Order Cycles"
       first('a.clone-order-cycle').click
diff --git a/spec/javascripts/unit/admin/services/enterprise_relationships_spec.js.coffee b/spec/javascripts/unit/admin/services/enterprise_relationships_spec.js.coffee
index 4e90f65335..9701377a73 100644
--- a/spec/javascripts/unit/admin/services/enterprise_relationships_spec.js.coffee
+++ b/spec/javascripts/unit/admin/services/enterprise_relationships_spec.js.coffee
@@ -12,5 +12,5 @@ describe "enterprise relationships", ->
     EnterpriseRelationships = _EnterpriseRelationships_
 
   it "presents permission names", ->
-    expect(EnterpriseRelationships.permission_presentation("add_products_to_order_cycle")).toEqual "can add products to order cycle from"
+    expect(EnterpriseRelationships.permission_presentation("add_to_order_cycle")).toEqual "can add to order cycle"
     expect(EnterpriseRelationships.permission_presentation("manage_products")).toEqual "can manage the products of"
diff --git a/spec/lib/open_food_network/permissions_spec.rb b/spec/lib/open_food_network/permissions_spec.rb
new file mode 100644
index 0000000000..b0a004cbf1
--- /dev/null
+++ b/spec/lib/open_food_network/permissions_spec.rb
@@ -0,0 +1,74 @@
+require 'open_food_network/permissions'
+
+module OpenFoodNetwork
+  describe Permissions do
+    let(:user) { double(:user) }
+    let(:permissions) { Permissions.new(user) }
+    let(:permission) { 'one' }
+    let(:e1) { create(:enterprise) }
+    let(:e2) { create(:enterprise) }
+
+    describe "finding enterprises that can be added to an order cycle" do
+      before do
+        permissions.stub(:managed_enterprises) { Enterprise.where('1=0') }
+        permissions.stub(:related_enterprises_with) { Enterprise.where('1=0') }
+      end
+
+      it "returns managed enterprises" do
+        permissions.stub(:managed_enterprises) { Enterprise.where(id: e1) }
+        permissions.order_cycle_enterprises.should == [e1]
+      end
+
+      it "returns permitted enterprises" do
+        permissions.stub(:related_enterprises_with) { Enterprise.where(id: e2) }
+        permissions.order_cycle_enterprises.should == [e2]
+      end
+    end
+
+    describe "finding exchanges of an order cycle that an admin can manage" do
+      let(:oc) { create(:simple_order_cycle) }
+      let!(:ex) { create(:exchange, order_cycle: oc, sender: e1, receiver: e2) }
+
+      before do
+        permissions.stub(:managed_enterprises) { [] }
+        permissions.stub(:related_enterprises_with) { [] }
+      end
+
+      it "returns exchanges involving enterprises managed by the user" do
+        permissions.stub(:managed_enterprises) { [e1, e2] }
+        permissions.order_cycle_exchanges(oc).should == [ex]
+      end
+
+      it "returns exchanges involving enterprises with E2E permission" do
+        permissions.stub(:related_enterprises_with) { [e1, e2] }
+        permissions.order_cycle_exchanges(oc).should == [ex]
+      end
+
+      it "does not return exchanges involving only the sender" do
+        permissions.stub(:managed_enterprises) { [e1] }
+        permissions.order_cycle_exchanges(oc).should == []
+      end
+
+      it "does not return exchanges involving only the receiver" do
+        permissions.stub(:managed_enterprises) { [e2] }
+        permissions.order_cycle_exchanges(oc).should == []
+      end
+    end
+
+    ########################################
+
+    describe "finding related enterprises with a particular permission" do
+      let!(:er) { create(:enterprise_relationship, parent: e1, child: e2, permissions_list: [permission]) }
+
+      it "returns the enterprises" do
+        permissions.stub(:managed_enterprises) { e2 }
+        permissions.send(:related_enterprises_with, permission).should == [e1]
+      end
+
+      it "returns an empty array when there are none" do
+        permissions.stub(:managed_enterprises) { e1 }
+        permissions.send(:related_enterprises_with, permission).should == []
+      end
+    end
+  end
+end
diff --git a/spec/models/enterprise_relationship_spec.rb b/spec/models/enterprise_relationship_spec.rb
index 6cdf3db657..3a6c48e891 100644
--- a/spec/models/enterprise_relationship_spec.rb
+++ b/spec/models/enterprise_relationship_spec.rb
@@ -6,10 +6,10 @@ describe EnterpriseRelationship do
     let(:e2)  { create(:enterprise, name: 'B') }
     let(:e3)  { create(:enterprise, name: 'C') }
 
-    it "sorts by parent, child enterprise name" do
-      er1 = create(:enterprise_relationship, parent: e1, child: e3)
-      er2 = create(:enterprise_relationship, parent: e2, child: e1)
-      er3 = create(:enterprise_relationship, parent: e1, child: e2)
+    it "sorts by child, parent enterprise name" do
+      er1 = create(:enterprise_relationship, parent: e3, child: e1)
+      er2 = create(:enterprise_relationship, parent: e1, child: e2)
+      er3 = create(:enterprise_relationship, parent: e2, child: e1)
 
       EnterpriseRelationship.by_name.should == [er3, er1, er2]
     end
@@ -43,5 +43,24 @@ describe EnterpriseRelationship do
         er.permissions.should be_empty
       end
     end
+
+    it "finds relationships that grant permissions to some enterprises" do
+      er1 = create(:enterprise_relationship, parent: e2, child: e1)
+      er2 = create(:enterprise_relationship, parent: e3, child: e2)
+      er3 = create(:enterprise_relationship, parent: e1, child: e3)
+
+      EnterpriseRelationship.permitting([e1, e2]).sort.should == [er1, er2]
+    end
+
+    it "finds relationships that grant a particular permission" do
+      er1 = create(:enterprise_relationship, parent: e1, child: e2,
+                   permissions_list: ['one', 'two'])
+      er2 = create(:enterprise_relationship, parent: e2, child: e3,
+                   permissions_list: ['two', 'three'])
+      er3 = create(:enterprise_relationship, parent: e3, child: e1,
+                   permissions_list: ['three', 'four'])
+
+      EnterpriseRelationship.with_permission('two').sort.should == [er1, er2].sort
+    end
   end
 end