diff --git a/test/screenplay_web/ensure_pa_message_admin_test.exs b/test/screenplay_web/ensure_pa_message_admin_test.exs
new file mode 100644
index 00000000..6f17b28e
--- /dev/null
+++ b/test/screenplay_web/ensure_pa_message_admin_test.exs
@@ -0,0 +1,23 @@
+defmodule ScreenplayWeb.EnsurePaMessageAdminTest do
+  use ScreenplayWeb.ConnCase
+
+  describe "init/1" do
+    test "passes options through unchanged" do
+      assert ScreenplayWeb.EnsurePaMessageAdmin.init([]) == []
+    end
+  end
+
+  describe "call/2" do
+    @tag :authenticated_pa_message_admin
+    test "does nothing when user is a PA message admin", %{conn: conn} do
+      assert conn == ScreenplayWeb.EnsurePaMessageAdmin.call(conn, [])
+    end
+
+    @tag :authenticated
+    test "redirects to Dashboard when user is not a PA message admin", %{conn: conn} do
+      conn = ScreenplayWeb.EnsurePaMessageAdmin.call(conn, [])
+
+      assert redirected_to(conn) =~ "/dashboard"
+    end
+  end
+end
diff --git a/test/support/conn_case.ex b/test/support/conn_case.ex
index 524660d5..dc7ed203 100644
--- a/test/support/conn_case.ex
+++ b/test/support/conn_case.ex
@@ -61,6 +61,20 @@ defmodule ScreenplayWeb.ConnCase do
 
           {conn, user}
 
+        tags[:authenticated_pa_message_admin] ->
+          user = "test_user"
+
+          conn =
+            Phoenix.ConnTest.build_conn()
+            |> Plug.Test.init_test_session(%{})
+            |> Guardian.Plug.sign_in(ScreenplayWeb.AuthManager, user, %{
+              "roles" => ["pa-message-admin"]
+            })
+            |> Plug.Conn.put_session(:username, user)
+            |> assign(:roles, [:pa_message_admin])
+
+          {conn, user}
+
         true ->
           {Phoenix.ConnTest.build_conn(), nil}
       end