diff --git a/platform/commonUI/browse/bundle.json b/platform/commonUI/browse/bundle.json
index d4e7a85036..1aa9068d81 100644
--- a/platform/commonUI/browse/bundle.json
+++ b/platform/commonUI/browse/bundle.json
@@ -117,7 +117,7 @@
                 "provides": "actionService",
                 "type": "provider",
                 "implementation": "creation/CreateActionProvider.js",
-                "depends": [ "typeService", "dialogService", "creationService" ]
+                "depends": [ "typeService", "dialogService", "creationService", "policyService" ]
             }
         ],
         "licenses": [
diff --git a/platform/commonUI/browse/src/creation/CreateAction.js b/platform/commonUI/browse/src/creation/CreateAction.js
index f21c7a8ba0..73132a7a5c 100644
--- a/platform/commonUI/browse/src/creation/CreateAction.js
+++ b/platform/commonUI/browse/src/creation/CreateAction.js
@@ -27,7 +27,7 @@ define(
          *        which handles the actual instantiation and persistence
          *        of the newly-created domain object
          */
-        function CreateAction(type, parent, context, dialogService, creationService) {
+        function CreateAction(type, parent, context, dialogService, creationService, policyService) {
             /*
              Overview of steps in object creation:
 
@@ -47,7 +47,7 @@ define(
             function perform() {
                 // The wizard will handle creating the form model based
                 // on the type...
-                var wizard = new CreateWizard(type, parent);
+                var wizard = new CreateWizard(type, parent, policyService);
 
                 // Create and persist the new object, based on user
                 // input.
diff --git a/platform/commonUI/browse/src/creation/CreateActionProvider.js b/platform/commonUI/browse/src/creation/CreateActionProvider.js
index 56c4396fdf..576e088947 100644
--- a/platform/commonUI/browse/src/creation/CreateActionProvider.js
+++ b/platform/commonUI/browse/src/creation/CreateActionProvider.js
@@ -22,7 +22,7 @@ define(
          *        introduced in this bundle), responsible for handling actual
          *        object creation.
          */
-        function CreateActionProvider(typeService, dialogService, creationService) {
+        function CreateActionProvider(typeService, dialogService, creationService, policyService) {
             return {
                 /**
                  * Get all Create actions which are applicable in the provided
@@ -53,7 +53,8 @@ define(
                             destination,
                             context,
                             dialogService,
-                            creationService
+                            creationService,
+                            policyService
                         );
                     });
                 }
diff --git a/platform/commonUI/browse/src/creation/CreateWizard.js b/platform/commonUI/browse/src/creation/CreateWizard.js
index b2986e5e06..8d19244e68 100644
--- a/platform/commonUI/browse/src/creation/CreateWizard.js
+++ b/platform/commonUI/browse/src/creation/CreateWizard.js
@@ -19,10 +19,19 @@ define(
          * @constructor
          * @memberof module:core/action/create-wizard
          */
-        function CreateWizard(type, parent) {
+        function CreateWizard(type, parent, policyService) {
             var model = type.getInitialModel(),
                 properties = type.getProperties();
 
+            function validateLocation(locatingObject) {
+                var locatingType = locatingObject.getCapability('type');
+                return policyService.allow(
+                    "composition",
+                    locatingType,
+                    type
+                );
+            }
+
             return {
                 /**
                  * Get the form model for this wizard; this is a description
@@ -54,6 +63,7 @@ define(
                     sections.push({ name: 'Location', rows: [{
                         name: "Save In",
                         control: "locator",
+                        validate: validateLocation,
                         key: "createParent"
                     }]});
 
diff --git a/platform/commonUI/browse/src/creation/LocatorController.js b/platform/commonUI/browse/src/creation/LocatorController.js
index 5b2ea72e35..72d1736bee 100644
--- a/platform/commonUI/browse/src/creation/LocatorController.js
+++ b/platform/commonUI/browse/src/creation/LocatorController.js
@@ -17,13 +17,25 @@ define(
             //               the full tree
             // * treeModel: The model for the embedded tree representation,
             //              used for bi-directional object selection.
-            function setLocatingObject(domainObject) {
+            function setLocatingObject(domainObject, priorObject) {
                 var context = domainObject &&
                     domainObject.getCapability("context");
 
-                $scope.rootObject = context && context.getRoot();
+                $scope.rootObject = (context && context.getRoot()) || $scope.rootObject;
                 $scope.treeModel.selectedObject = domainObject;
                 $scope.ngModel[$scope.field] = domainObject;
+
+                // Restrict which locations can be selected
+                if (domainObject &&
+                        $scope.structure &&
+                            $scope.structure.validate) {
+                    if (!$scope.structure.validate(domainObject)) {
+                        setLocatingObject(
+                            $scope.structure.validate(priorObject) ?
+                                    priorObject : undefined
+                        );
+                    }
+                }
             }
 
             // Initial state for the tree's model