diff --git a/e2e/ctl_v3_auth_test.go b/e2e/ctl_v3_auth_test.go
index 3b5107f464a..6c7ad5b5a10 100644
--- a/e2e/ctl_v3_auth_test.go
+++ b/e2e/ctl_v3_auth_test.go
@@ -29,6 +29,11 @@ func TestCtlV3AuthUserDeleteDuringOps(t *testing.T) { testCtl(t, authUserDeleteD
 func TestCtlV3AuthRoleRevokeDuringOps(t *testing.T) { testCtl(t, authRoleRevokeDuringOpsTest) }
 func TestCtlV3AuthTxn(t *testing.T)                 { testCtl(t, authTestTxn) }
 func TestCtlV3AuthPerfixPerm(t *testing.T)          { testCtl(t, authTestPrefixPerm) }
+func TestCtlV3AuthMemberAdd(t *testing.T)           { testCtl(t, authTestMemberAdd) }
+func TestCtlV3AuthMemberRemove(t *testing.T) {
+	testCtl(t, authTestMemberRemove, withQuorum(), withNoStrictReconfig())
+}
+func TestCtlV3AuthMemberUpdate(t *testing.T) { testCtl(t, authTestMemberUpdate) }
 
 func authEnableTest(cx ctlCtx) {
 	if err := authEnable(cx); err != nil {
@@ -454,3 +459,91 @@ func authTestPrefixPerm(cx ctlCtx) {
 		cx.t.Fatal(err)
 	}
 }
+
+func authTestMemberAdd(cx ctlCtx) {
+	if err := authEnable(cx); err != nil {
+		cx.t.Fatal(err)
+	}
+
+	cx.user, cx.pass = "root", "root"
+	authSetupTestUser(cx)
+
+	peerURL := fmt.Sprintf("http://localhost:%d", etcdProcessBasePort+11)
+	// ordinal user cannot add a new member
+	cx.user, cx.pass = "test-user", "pass"
+	if err := ctlV3MemberAdd(cx, peerURL); err == nil {
+		cx.t.Fatalf("ordinal user must not be allowed to add a member")
+	}
+
+	// root can add a new member
+	cx.user, cx.pass = "root", "root"
+	if err := ctlV3MemberAdd(cx, peerURL); err != nil {
+		cx.t.Fatal(err)
+	}
+}
+
+func authTestMemberRemove(cx ctlCtx) {
+	if err := authEnable(cx); err != nil {
+		cx.t.Fatal(err)
+	}
+
+	cx.user, cx.pass = "root", "root"
+	authSetupTestUser(cx)
+
+	n1 := cx.cfg.clusterSize
+	if n1 < 2 {
+		cx.t.Fatalf("%d-node is too small to test 'member remove'", n1)
+	}
+	resp, err := getMemberList(cx)
+	if err != nil {
+		cx.t.Fatal(err)
+	}
+	if n1 != len(resp.Members) {
+		cx.t.Fatalf("expected %d, got %d", n1, len(resp.Members))
+	}
+
+	var (
+		memIDToRemove = fmt.Sprintf("%x", resp.Header.MemberId)
+		clusterID     = fmt.Sprintf("%x", resp.Header.ClusterId)
+	)
+
+	// ordinal user cannot remove a member
+	cx.user, cx.pass = "test-user", "pass"
+	if err = ctlV3MemberRemove(cx, memIDToRemove, clusterID); err == nil {
+		cx.t.Fatalf("ordinal user must not be allowed to remove a member")
+	}
+
+	// root can remove a member
+	cx.user, cx.pass = "root", "root"
+	if err = ctlV3MemberRemove(cx, memIDToRemove, clusterID); err != nil {
+		cx.t.Fatal(err)
+	}
+}
+
+func authTestMemberUpdate(cx ctlCtx) {
+	if err := authEnable(cx); err != nil {
+		cx.t.Fatal(err)
+	}
+
+	cx.user, cx.pass = "root", "root"
+	authSetupTestUser(cx)
+
+	mr, err := getMemberList(cx)
+	if err != nil {
+		cx.t.Fatal(err)
+	}
+
+	// ordinal user cannot update a member
+	cx.user, cx.pass = "test-user", "pass"
+	peerURL := fmt.Sprintf("http://localhost:%d", etcdProcessBasePort+11)
+	memberID := fmt.Sprintf("%x", mr.Members[0].ID)
+	if err = ctlV3MemberUpdate(cx, memberID, peerURL); err == nil {
+		cx.t.Fatalf("ordinal user must not be allowed to update a member")
+	}
+
+	// root can update a member
+	cx.user, cx.pass = "root", "root"
+	if err = ctlV3MemberUpdate(cx, memberID, peerURL); err != nil {
+		cx.t.Fatal(err)
+	}
+}
diff --git a/e2e/ctl_v3_member_test.go b/e2e/ctl_v3_member_test.go
index c272a60a7ca..cfd99ac2e19 100644
--- a/e2e/ctl_v3_member_test.go
+++ b/e2e/ctl_v3_member_test.go
@@ -98,13 +98,16 @@ func ctlV3MemberRemove(cx ctlCtx, memberID, clusterID string) error {
 }
 
 func memberAddTest(cx ctlCtx) {
-	peerURL := fmt.Sprintf("http://localhost:%d", etcdProcessBasePort+11)
-	cmdArgs := append(cx.PrefixArgs(), "member", "add", "newmember", fmt.Sprintf("--peer-urls=%s", peerURL))
-	if err := spawnWithExpect(cmdArgs, " added to cluster "); err != nil {
+	if err := ctlV3MemberAdd(cx, fmt.Sprintf("http://localhost:%d", etcdProcessBasePort+11)); err != nil {
 		cx.t.Fatal(err)
 	}
 }
 
+func ctlV3MemberAdd(cx ctlCtx, peerURL string) error {
+	cmdArgs := append(cx.PrefixArgs(), "member", "add", "newmember", fmt.Sprintf("--peer-urls=%s", peerURL))
+	return spawnWithExpect(cmdArgs, " added to cluster ")
+}
+
 func memberUpdateTest(cx ctlCtx) {
 	mr, err := getMemberList(cx)
 	if err != nil {
@@ -112,8 +115,13 @@ func memberUpdateTest(cx ctlCtx) {
 	}
 
 	peerURL := fmt.Sprintf("http://localhost:%d", etcdProcessBasePort+11)
-	cmdArgs := append(cx.PrefixArgs(), "member", "update", fmt.Sprintf("%x", mr.Members[0].ID), fmt.Sprintf("--peer-urls=%s", peerURL))
-	if err = spawnWithExpect(cmdArgs, " updated in cluster "); err != nil {
+	memberID := fmt.Sprintf("%x", mr.Members[0].ID)
+	if err = ctlV3MemberUpdate(cx, memberID, peerURL); err != nil {
 		cx.t.Fatal(err)
 	}
 }
+
+func ctlV3MemberUpdate(cx ctlCtx, memberID, peerURL string) error {
+	cmdArgs := append(cx.PrefixArgs(), "member", "update", memberID, fmt.Sprintf("--peer-urls=%s", peerURL))
+	return spawnWithExpect(cmdArgs, " updated in cluster ")
+}