diff --git a/src/c3nav/access/forms.py b/src/c3nav/access/forms.py
index c0c767fb..a19d785a 100644
--- a/src/c3nav/access/forms.py
+++ b/src/c3nav/access/forms.py
@@ -1,7 +1,7 @@
 from django.forms import ModelForm, MultipleChoiceField
 from django.utils.translation import ugettext_lazy as _
 
-from c3nav.access.models import AccessToken
+from c3nav.access.models import AccessToken, AccessUser
 from c3nav.mapdata.models import AreaLocation
 
 
@@ -47,3 +47,9 @@ class AccessTokenForm(ModelForm):
             data = [':full']
         data = ';'.join(data)
         return data
+
+
+class AccessUserForm(ModelForm):
+    class Meta:
+        model = AccessUser
+        fields = ['user_url', 'description']
diff --git a/src/c3nav/access/migrations/0005_auto_20161225_1018.py b/src/c3nav/access/migrations/0005_auto_20161225_1018.py
new file mode 100644
index 00000000..5c1c46f3
--- /dev/null
+++ b/src/c3nav/access/migrations/0005_auto_20161225_1018.py
@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.4 on 2016-12-25 10:18
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('access', '0004_auto_20161223_2225'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='accessuser',
+            name='author',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL, verbose_name='creator'),
+        ),
+    ]
diff --git a/src/c3nav/access/models.py b/src/c3nav/access/models.py
index d2b66000..6bf24c7a 100644
--- a/src/c3nav/access/models.py
+++ b/src/c3nav/access/models.py
@@ -31,7 +31,7 @@ class AccessOperator(models.Model):
 class AccessUser(models.Model):
     user_url = models.CharField(_('access name'), unique=True, max_length=200,
                                 help_text=_('Usually an URL to a profile somewhere'))
-    author = models.ForeignKey(AccessOperator, on_delete=models.PROTECT, null=True, blank=True,
+    author = models.ForeignKey(User, on_delete=models.PROTECT, null=True, blank=True,
                                verbose_name=_('creator'))
     description = models.TextField(_('description'), max_length=200, blank=True)
     creation_date = models.DateTimeField(_('creation date'), auto_now_add=True)
diff --git a/src/c3nav/access/templates/access/users.html b/src/c3nav/access/templates/access/users.html
index 7d692b5d..39291560 100644
--- a/src/c3nav/access/templates/access/users.html
+++ b/src/c3nav/access/templates/access/users.html
@@ -49,4 +49,22 @@
             <li class="next disabled"><a href="#">{% trans 'next' %} »</a></li>
         {% endif %}
     </ul>
+
+    <form method="POST">
+
+    <div class="panel panel-default">
+        <div class="panel-body">
+            <h4>{% trans 'Add new access user' %}</h4>
+            <div class="row">
+                {% csrf_token %}
+                {% bootstrap_form new_user_form form_group_class='form-group col-md-4' %}
+                <div class="form-group col-md-4">
+                    <label class="control-label">&nbsp;</label>
+                    <button type="submit" name="create" class="btn btn-primary btn-block btn-sm">{% trans 'Add new User' %}</button>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    </form>
 {% endblock %}
diff --git a/src/c3nav/access/views.py b/src/c3nav/access/views.py
index b74e06fc..2e307903 100644
--- a/src/c3nav/access/views.py
+++ b/src/c3nav/access/views.py
@@ -9,7 +9,7 @@ from django.shortcuts import get_object_or_404, redirect, render
 from django.urls import reverse
 
 from c3nav.access.apply import get_nonpublic_packages
-from c3nav.access.forms import AccessTokenForm
+from c3nav.access.forms import AccessTokenForm, AccessUserForm
 from c3nav.access.models import AccessToken, AccessUser
 from c3nav.editor.hosters import get_hoster_for_package
 
@@ -111,8 +111,20 @@ def user_list(request, page=1):
     except EmptyPage:
         return redirect('access.users')
 
+    if request.method == 'POST':
+        new_user_form = AccessUserForm(data=request.POST)
+        if new_user_form.is_valid():
+            user = new_user_form.instance
+            user.author = request.user
+            user.save()
+
+            return redirect('access.user', pk=user.id)
+    else:
+        new_user_form = AccessUserForm()
+
     return render(request, 'access/users.html', {
         'users': users,
+        'new_user_form': new_user_form,
     })