diff --git a/datasette/views/database.py b/datasette/views/database.py
index bd9e4a7c..8e08c3b1 100644
--- a/datasette/views/database.py
+++ b/datasette/views/database.py
@@ -68,8 +68,11 @@ class DatabaseView(DataView):
         for view_name in await db.view_names():
             view_visible, view_private = await self.ds.check_visibility(
                 request.actor,
-                "view-table",
-                (database, view_name),
+                permissions=[
+                    ("view-table", (database, view_name)),
+                    ("view-database", database),
+                    "view-instance",
+                ],
             )
             if view_visible:
                 views.append(
@@ -83,8 +86,11 @@ class DatabaseView(DataView):
         for table in table_counts:
             table_visible, table_private = await self.ds.check_visibility(
                 request.actor,
-                "view-table",
-                (database, table),
+                permissions=[
+                    ("view-table", (database, table)),
+                    ("view-database", database),
+                    "view-instance",
+                ],
             )
             if not table_visible:
                 continue
@@ -109,8 +115,11 @@ class DatabaseView(DataView):
         ).values():
             query_visible, query_private = await self.ds.check_visibility(
                 request.actor,
-                "view-query",
-                (database, query["name"]),
+                permissions=[
+                    ("view-query", (database, query["name"])),
+                    ("view-database", database),
+                    "view-instance",
+                ],
             )
             if query_visible:
                 canned_queries.append(dict(query, private=query_private))
diff --git a/tests/test_permissions.py b/tests/test_permissions.py
index 2d48431a..8812d0f7 100644
--- a/tests/test_permissions.py
+++ b/tests/test_permissions.py
@@ -493,4 +493,37 @@ def test_permissions_cascade(cascade_app_client, path, permissions, expected_sta
             path, permissions, expected_status, response.status
         )
     finally:
-        cascade_app_client.ds._local_metadata = previous_metadata
+        cascade_app_client.ds._metadata_local = previous_metadata
+
+
+def test_padlocks_on_database_page(cascade_app_client):
+    metadata = {
+        "databases": {
+            "fixtures": {
+                "allow": {"id": "test"},
+                "tables": {
+                    "123_starts_with_digits": {"allow": True},
+                    "simple_view": {"allow": True},
+                },
+                "queries": {"query_two": {"allow": True, "sql": "select 2"}},
+            }
+        }
+    }
+    previous_metadata = cascade_app_client.ds._metadata_local
+    try:
+        cascade_app_client.ds._metadata_local = metadata
+        response = cascade_app_client.get(
+            "/fixtures",
+            cookies={"ds_actor": cascade_app_client.actor_cookie({"id": "test"})},
+        )
+        # Tables
+        assert ">123_starts_with_digits</a></h3>" in response.text
+        assert ">Table With Space In Name</a> 🔒</h3>" in response.text
+        # Queries
+        assert ">from_async_hook</a> 🔒</li>" in response.text
+        assert ">query_two</a></li>" in response.text
+        # Views
+        assert ">paginated_view</a> 🔒</li>" in response.text
+        assert ">simple_view</a></li>" in response.text
+    finally:
+        cascade_app_client.ds._metadata_local = previous_metadata