diff --git a/achievements.admin.inc b/achievements.admin.inc
index 864c6da..527141b 100644
--- a/achievements.admin.inc
+++ b/achievements.admin.inc
@@ -140,6 +140,11 @@ function achievements_manual_submit($form, &$form_state) {
 
   // if we've a valid user and achievement ID, give 'em the achievement, ya freeloaders.
   if ($account && $achievement && $form_state['clicked_button']['#achievement_action'] == 'give') {
+    if (!user_access('earn achievements', $account)) {
+      drupal_set_message(t('%username does not have permission to earn achievements.', // palm to forehead.
+        array('%username' => $account->name)), 'error');
+      return;
+    }
     achievements_unlocked($achievement['id'], $account->uid);
     drupal_set_message(t('%username has been given %achievement.', // yeah, yeah.
       array('%username' => $account->name, '%achievement' => $achievement['title'])));