diff --git a/src/__phutil_library_map__.php b/src/__phutil_library_map__.php
index 3c9a329d99..f82c92d02b 100644
--- a/src/__phutil_library_map__.php
+++ b/src/__phutil_library_map__.php
@@ -1365,6 +1365,7 @@ phutil_register_library_map(array(
     'HarbormasterBuildTransactionEditor' => 'applications/harbormaster/editor/HarbormasterBuildTransactionEditor.php',
     'HarbormasterBuildTransactionQuery' => 'applications/harbormaster/query/HarbormasterBuildTransactionQuery.php',
     'HarbormasterBuildUnitMessage' => 'applications/harbormaster/storage/build/HarbormasterBuildUnitMessage.php',
+    'HarbormasterBuildUnitMessageQuery' => 'applications/harbormaster/query/HarbormasterBuildUnitMessageQuery.php',
     'HarbormasterBuildViewController' => 'applications/harbormaster/controller/HarbormasterBuildViewController.php',
     'HarbormasterBuildWorker' => 'applications/harbormaster/worker/HarbormasterBuildWorker.php',
     'HarbormasterBuildable' => 'applications/harbormaster/storage/HarbormasterBuildable.php',
@@ -6983,7 +6984,11 @@ phutil_register_library_map(array(
     'HarbormasterBuildTransaction' => 'PhabricatorApplicationTransaction',
     'HarbormasterBuildTransactionEditor' => 'PhabricatorApplicationTransactionEditor',
     'HarbormasterBuildTransactionQuery' => 'PhabricatorApplicationTransactionQuery',
-    'HarbormasterBuildUnitMessage' => 'HarbormasterDAO',
+    'HarbormasterBuildUnitMessage' => array(
+      'HarbormasterDAO',
+      'PhabricatorPolicyInterface',
+    ),
+    'HarbormasterBuildUnitMessageQuery' => 'PhabricatorCursorPagedPolicyAwareQuery',
     'HarbormasterBuildViewController' => 'HarbormasterController',
     'HarbormasterBuildWorker' => 'HarbormasterWorker',
     'HarbormasterBuildable' => array(
diff --git a/src/applications/differential/controller/DifferentialChangesetViewController.php b/src/applications/differential/controller/DifferentialChangesetViewController.php
index c41f951394..35793a2108 100644
--- a/src/applications/differential/controller/DifferentialChangesetViewController.php
+++ b/src/applications/differential/controller/DifferentialChangesetViewController.php
@@ -420,15 +420,17 @@ final class DifferentialChangesetViewController extends DifferentialController {
   }
 
   private function loadCoverage(DifferentialChangeset $changeset) {
+    $viewer = $this->getViewer();
+
     $target_phids = $changeset->getDiff()->getBuildTargetPHIDs();
     if (!$target_phids) {
       return null;
     }
 
-    $unit = id(new HarbormasterBuildUnitMessage())->loadAllWhere(
-      'buildTargetPHID IN (%Ls)',
-      $target_phids);
-
+    $unit = id(new HarbormasterBuildUnitMessageQuery())
+      ->setViewer($viewer)
+      ->withBuildTargetPHIDs($target_phids)
+      ->execute();
     if (!$unit) {
       return null;
     }
diff --git a/src/applications/differential/controller/DifferentialController.php b/src/applications/differential/controller/DifferentialController.php
index 8fe5b5caca..334d46c3cb 100644
--- a/src/applications/differential/controller/DifferentialController.php
+++ b/src/applications/differential/controller/DifferentialController.php
@@ -192,9 +192,10 @@ abstract class DifferentialController extends PhabricatorController {
     $all_target_phids = array_mergev($target_map);
 
     if ($all_target_phids) {
-      $unit_messages = id(new HarbormasterBuildUnitMessage())->loadAllWhere(
-        'buildTargetPHID IN (%Ls)',
-        $all_target_phids);
+      $unit_messages = id(new HarbormasterBuildUnitMessageQuery())
+        ->setViewer($viewer)
+        ->withBuildTargetPHIDs($all_target_phids)
+        ->execute();
       $unit_messages = mgroup($unit_messages, 'getBuildTargetPHID');
     } else {
       $unit_messages = array();
diff --git a/src/applications/differential/storage/DifferentialDiff.php b/src/applications/differential/storage/DifferentialDiff.php
index e4c33dc766..a39610c54c 100644
--- a/src/applications/differential/storage/DifferentialDiff.php
+++ b/src/applications/differential/storage/DifferentialDiff.php
@@ -387,9 +387,10 @@ final class DifferentialDiff
       return array();
     }
 
-    $unit = id(new HarbormasterBuildUnitMessage())->loadAllWhere(
-      'buildTargetPHID IN (%Ls)',
-      $target_phids);
+    $unit = id(new HarbormasterBuildUnitMessageQuery())
+      ->setViewer($viewer)
+      ->withBuildTargetPHIDs($target_phids)
+      ->execute();
 
     $map = array();
     foreach ($unit as $message) {
diff --git a/src/applications/harbormaster/controller/HarbormasterBuildableViewController.php b/src/applications/harbormaster/controller/HarbormasterBuildableViewController.php
index 1e79ad2b46..40f6587116 100644
--- a/src/applications/harbormaster/controller/HarbormasterBuildableViewController.php
+++ b/src/applications/harbormaster/controller/HarbormasterBuildableViewController.php
@@ -312,9 +312,10 @@ final class HarbormasterBuildableViewController
       'buildTargetPHID IN (%Ls)',
       $target_phids);
 
-    $unit_data = id(new HarbormasterBuildUnitMessage())->loadAllWhere(
-      'buildTargetPHID IN (%Ls)',
-      $target_phids);
+    $unit_data = id(new HarbormasterBuildUnitMessageQuery())
+      ->setViewer($viewer)
+      ->withBuildTargetPHIDs($target_phids)
+      ->execute();
 
     if ($lint_data) {
       $lint_table = id(new HarbormasterLintPropertyView())
diff --git a/src/applications/harbormaster/controller/HarbormasterUnitMessageListController.php b/src/applications/harbormaster/controller/HarbormasterUnitMessageListController.php
index d548ceac98..a87d17c4fa 100644
--- a/src/applications/harbormaster/controller/HarbormasterUnitMessageListController.php
+++ b/src/applications/harbormaster/controller/HarbormasterUnitMessageListController.php
@@ -31,9 +31,10 @@ final class HarbormasterUnitMessageListController
 
     $unit_data = array();
     if ($target_phids) {
-      $unit_data = id(new HarbormasterBuildUnitMessage())->loadAllWhere(
-        'buildTargetPHID IN (%Ls)',
-        $target_phids);
+      $unit_data = id(new HarbormasterBuildUnitMessageQuery())
+        ->setViewer($viewer)
+        ->withBuildTargetPHIDs($target_phids)
+        ->execute();
     } else {
       $unit_data = array();
     }
diff --git a/src/applications/harbormaster/controller/HarbormasterUnitMessageViewController.php b/src/applications/harbormaster/controller/HarbormasterUnitMessageViewController.php
index 5cb33c0c9a..7111db654f 100644
--- a/src/applications/harbormaster/controller/HarbormasterUnitMessageViewController.php
+++ b/src/applications/harbormaster/controller/HarbormasterUnitMessageViewController.php
@@ -12,7 +12,10 @@ final class HarbormasterUnitMessageViewController
 
     $message_id = $request->getURIData('id');
 
-    $message = id(new HarbormasterBuildUnitMessage())->load($message_id);
+    $message = id(new HarbormasterBuildUnitMessageQuery())
+      ->setViewer($viewer)
+      ->withIDs(array($message_id))
+      ->executeOne();
     if (!$message) {
       return new Aphront404Response();
     }
diff --git a/src/applications/harbormaster/query/HarbormasterBuildUnitMessageQuery.php b/src/applications/harbormaster/query/HarbormasterBuildUnitMessageQuery.php
new file mode 100644
index 0000000000..fbd33a5d95
--- /dev/null
+++ b/src/applications/harbormaster/query/HarbormasterBuildUnitMessageQuery.php
@@ -0,0 +1,64 @@
+<?php
+
+final class HarbormasterBuildUnitMessageQuery
+  extends PhabricatorCursorPagedPolicyAwareQuery {
+
+  private $ids;
+  private $phids;
+  private $targetPHIDs;
+
+  public function withIDs(array $ids) {
+    $this->ids = $ids;
+    return $this;
+  }
+
+  public function withPHIDs(array $phids) {
+    $this->phids = $phids;
+    return $this;
+  }
+
+  public function withBuildTargetPHIDs(array $target_phids) {
+    $this->targetPHIDs = $target_phids;
+    return $this;
+  }
+
+  public function newResultObject() {
+    return new HarbormasterBuildUnitMessage();
+  }
+
+  protected function loadPage() {
+    return $this->loadStandardPage($this->newResultObject());
+  }
+
+  protected function buildWhereClauseParts(AphrontDatabaseConnection $conn) {
+    $where = parent::buildWhereClauseParts($conn);
+
+    if ($this->ids !== null) {
+      $where[] = qsprintf(
+        $conn,
+        'id IN (%Ld)',
+        $this->ids);
+    }
+
+    if ($this->phids !== null) {
+      $where[] = qsprintf(
+        $conn,
+        'phid in (%Ls)',
+        $this->phids);
+    }
+
+    if ($this->targetPHIDs !== null) {
+      $where[] = qsprintf(
+        $conn,
+        'buildTargetPHID in (%Ls)',
+        $this->targetPHIDs);
+    }
+
+    return $where;
+  }
+
+  public function getQueryApplicationClass() {
+    return 'PhabricatorHarbormasterApplication';
+  }
+
+}
diff --git a/src/applications/harbormaster/storage/build/HarbormasterBuildUnitMessage.php b/src/applications/harbormaster/storage/build/HarbormasterBuildUnitMessage.php
index b2f566c3eb..1f5e5e1440 100644
--- a/src/applications/harbormaster/storage/build/HarbormasterBuildUnitMessage.php
+++ b/src/applications/harbormaster/storage/build/HarbormasterBuildUnitMessage.php
@@ -1,7 +1,8 @@
 <?php
 
 final class HarbormasterBuildUnitMessage
-  extends HarbormasterDAO {
+  extends HarbormasterDAO
+  implements PhabricatorPolicyInterface {
 
   protected $buildTargetPHID;
   protected $engine;
@@ -259,4 +260,25 @@ final class HarbormasterBuildUnitMessage
     return implode("\0", $parts);
   }
 
+
+/* -(  PhabricatorPolicyInterface  )----------------------------------------- */
+
+
+  public function getCapabilities() {
+    return array(
+      PhabricatorPolicyCapability::CAN_VIEW,
+    );
+  }
+
+  public function getPolicy($capability) {
+    switch ($capability) {
+      case PhabricatorPolicyCapability::CAN_VIEW:
+        return PhabricatorPolicies::getMostOpenPolicy();
+    }
+  }
+
+  public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
+    return false;
+  }
+
 }