diff --git a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/Watcher.java b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/Watcher.java
index 1d9a203f54c..28dbd3d328b 100644
--- a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/Watcher.java
+++ b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/Watcher.java
@@ -123,8 +123,8 @@ public class Watcher {
 
         // adding the watcher privileges to shield
         if (Shield.enabled(settings)) {
-            Shield.registerClusterPrivilege("manage_watcher", "cluster:admin/watcher/*", "cluster:monitor/watcher/*");
-            Shield.registerClusterPrivilege("monitor_watcher", "cluster:monitor/watcher/*");
+            Shield.registerClusterPrivilege("manage_watcher", "cluster:admin/xpack/watcher/*", "cluster:monitor/xpack/watcher/*");
+            Shield.registerClusterPrivilege("monitor_watcher", "cluster:monitor/xpack/watcher/*");
         }
     }
 
diff --git a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/ack/AckWatchAction.java b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/ack/AckWatchAction.java
index 010872e11ee..14c983095fa 100644
--- a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/ack/AckWatchAction.java
+++ b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/ack/AckWatchAction.java
@@ -14,7 +14,7 @@ import org.elasticsearch.client.ElasticsearchClient;
 public class AckWatchAction extends Action<AckWatchRequest, AckWatchResponse, AckWatchRequestBuilder> {
 
     public static final AckWatchAction INSTANCE = new AckWatchAction();
-    public static final String NAME = "cluster:admin/watcher/watch/ack";
+    public static final String NAME = "cluster:admin/xpack/watcher/watch/ack";
 
     private AckWatchAction() {
         super(NAME);
diff --git a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/activate/ActivateWatchAction.java b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/activate/ActivateWatchAction.java
index 5ea0c3833ee..b8e5dbb408b 100644
--- a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/activate/ActivateWatchAction.java
+++ b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/activate/ActivateWatchAction.java
@@ -14,7 +14,7 @@ import org.elasticsearch.client.ElasticsearchClient;
 public class ActivateWatchAction extends Action<ActivateWatchRequest, ActivateWatchResponse, ActivateWatchRequestBuilder> {
 
     public static final ActivateWatchAction INSTANCE = new ActivateWatchAction();
-    public static final String NAME = "cluster:admin/watcher/watch/activate";
+    public static final String NAME = "cluster:admin/xpack/watcher/watch/activate";
 
     private ActivateWatchAction() {
         super(NAME);
diff --git a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/delete/DeleteWatchAction.java b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/delete/DeleteWatchAction.java
index ebe89e9b42f..2c795d9074d 100644
--- a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/delete/DeleteWatchAction.java
+++ b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/delete/DeleteWatchAction.java
@@ -14,7 +14,7 @@ import org.elasticsearch.client.ElasticsearchClient;
 public class DeleteWatchAction extends Action<DeleteWatchRequest, DeleteWatchResponse, DeleteWatchRequestBuilder> {
 
     public static final DeleteWatchAction INSTANCE = new DeleteWatchAction();
-    public static final String NAME = "cluster:admin/watcher/watch/delete";
+    public static final String NAME = "cluster:admin/xpack/watcher/watch/delete";
 
     private DeleteWatchAction() {
         super(NAME);
diff --git a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/execute/ExecuteWatchAction.java b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/execute/ExecuteWatchAction.java
index 7652db22c38..6f0b2e03740 100644
--- a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/execute/ExecuteWatchAction.java
+++ b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/execute/ExecuteWatchAction.java
@@ -15,7 +15,7 @@ import org.elasticsearch.client.ElasticsearchClient;
 public class ExecuteWatchAction extends Action<ExecuteWatchRequest, ExecuteWatchResponse, ExecuteWatchRequestBuilder> {
 
     public static final ExecuteWatchAction INSTANCE = new ExecuteWatchAction();
-    public static final String NAME = "cluster:admin/watcher/watch/execute";
+    public static final String NAME = "cluster:admin/xpack/watcher/watch/execute";
 
     private ExecuteWatchAction() {
         super(NAME);
diff --git a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/get/GetWatchAction.java b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/get/GetWatchAction.java
index 710dbbc1eff..3b081293bab 100644
--- a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/get/GetWatchAction.java
+++ b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/get/GetWatchAction.java
@@ -13,7 +13,7 @@ import org.elasticsearch.client.ElasticsearchClient;
 public class GetWatchAction extends org.elasticsearch.action.Action<GetWatchRequest, GetWatchResponse, GetWatchRequestBuilder> {
 
     public static final GetWatchAction INSTANCE = new GetWatchAction();
-    public static final String NAME = "cluster:monitor/watcher/watch/get";
+    public static final String NAME = "cluster:monitor/xpack/watcher/watch/get";
 
     private GetWatchAction() {
         super(NAME);
diff --git a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/put/PutWatchAction.java b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/put/PutWatchAction.java
index 2e99270a8ac..9025f6d7953 100644
--- a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/put/PutWatchAction.java
+++ b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/put/PutWatchAction.java
@@ -14,7 +14,7 @@ import org.elasticsearch.client.ElasticsearchClient;
 public class PutWatchAction extends Action<PutWatchRequest, PutWatchResponse, PutWatchRequestBuilder> {
 
     public static final PutWatchAction INSTANCE = new PutWatchAction();
-    public static final String NAME = "cluster:admin/watcher/watch/put";
+    public static final String NAME = "cluster:admin/xpack/watcher/watch/put";
 
     private PutWatchAction() {
         super(NAME);
diff --git a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/service/WatcherServiceAction.java b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/service/WatcherServiceAction.java
index 18db6c848e4..064d3379da4 100644
--- a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/service/WatcherServiceAction.java
+++ b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/service/WatcherServiceAction.java
@@ -14,7 +14,7 @@ import org.elasticsearch.client.ElasticsearchClient;
 public class WatcherServiceAction extends Action<WatcherServiceRequest, WatcherServiceResponse, WatcherServiceRequestBuilder> {
 
     public static final WatcherServiceAction INSTANCE = new WatcherServiceAction();
-    public static final String NAME = "cluster:admin/watcher/service";
+    public static final String NAME = "cluster:admin/xpack/watcher/service";
 
     private WatcherServiceAction() {
         super(NAME);
diff --git a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/stats/WatcherStatsAction.java b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/stats/WatcherStatsAction.java
index e5339e873ca..6400f429adc 100644
--- a/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/stats/WatcherStatsAction.java
+++ b/elasticsearch/x-pack/watcher/src/main/java/org/elasticsearch/watcher/transport/actions/stats/WatcherStatsAction.java
@@ -14,7 +14,7 @@ import org.elasticsearch.client.ElasticsearchClient;
 public class WatcherStatsAction extends Action<WatcherStatsRequest, WatcherStatsResponse, WatcherStatsRequestBuilder> {
 
     public static final WatcherStatsAction INSTANCE = new WatcherStatsAction();
-    public static final String NAME = "cluster:monitor/watcher/stats";
+    public static final String NAME = "cluster:monitor/xpack/watcher/stats";
 
     private WatcherStatsAction() {
         super(NAME);
diff --git a/elasticsearch/x-pack/watcher/src/test/java/org/elasticsearch/watcher/shield/BasicShieldTests.java b/elasticsearch/x-pack/watcher/src/test/java/org/elasticsearch/watcher/shield/BasicShieldTests.java
index 098cc58a92c..72920eceb8c 100644
--- a/elasticsearch/x-pack/watcher/src/test/java/org/elasticsearch/watcher/shield/BasicShieldTests.java
+++ b/elasticsearch/x-pack/watcher/src/test/java/org/elasticsearch/watcher/shield/BasicShieldTests.java
@@ -50,7 +50,7 @@ public class BasicShieldTests extends AbstractWatcherIntegrationTestCase {
             fail("authentication failure should have occurred");
         } catch (Exception e) {
             // transport_client is the default user
-            assertThat(e.getMessage(), equalTo("action [cluster:monitor/watcher/stats] is unauthorized for user [transport_client]"));
+            assertThat(e.getMessage(), equalTo("action [cluster:monitor/xpack/watcher/stats] is unauthorized for user [transport_client]"));
         }
     }
 
@@ -62,7 +62,7 @@ public class BasicShieldTests extends AbstractWatcherIntegrationTestCase {
                     .get();
             fail("authentication failure should have occurred");
         } catch (Exception e) {
-            assertThat(e.getMessage(), equalTo("action [cluster:monitor/watcher/stats] is unauthorized for user [test]"));
+            assertThat(e.getMessage(), equalTo("action [cluster:monitor/xpack/watcher/stats] is unauthorized for user [test]"));
         }
 
         try {
@@ -70,7 +70,7 @@ public class BasicShieldTests extends AbstractWatcherIntegrationTestCase {
                     .get();
             fail("authentication failure should have occurred");
         } catch (Exception e) {
-            assertThat(e.getMessage(), equalTo("action [cluster:monitor/watcher/watch/get] is unauthorized for user [test]"));
+            assertThat(e.getMessage(), equalTo("action [cluster:monitor/xpack/watcher/watch/get] is unauthorized for user [test]"));
         }
 
         // stats and get watch are allowed by role monitor:
@@ -89,7 +89,7 @@ public class BasicShieldTests extends AbstractWatcherIntegrationTestCase {
                     .get();
             fail("authentication failure should have occurred");
         } catch (Exception e) {
-            assertThat(e.getMessage(), equalTo("action [cluster:admin/watcher/watch/put] is unauthorized for user [monitor]"));
+            assertThat(e.getMessage(), equalTo("action [cluster:admin/xpack/watcher/watch/put] is unauthorized for user [monitor]"));
         }
     }
 
@@ -102,7 +102,7 @@ public class BasicShieldTests extends AbstractWatcherIntegrationTestCase {
                     .get();
             fail("authentication failure should have occurred");
         } catch (Exception e) {
-            assertThat(e.getMessage(), equalTo("action [cluster:admin/watcher/watch/put] is unauthorized for user [test]"));
+            assertThat(e.getMessage(), equalTo("action [cluster:admin/xpack/watcher/watch/put] is unauthorized for user [test]"));
         }
 
         TriggerEvent triggerEvent = new ScheduleTriggerEvent(new DateTime(UTC), new DateTime(UTC));
@@ -112,7 +112,7 @@ public class BasicShieldTests extends AbstractWatcherIntegrationTestCase {
                     .get();
             fail("authentication failure should have occurred");
         } catch (Exception e) {
-            assertThat(e.getMessage(), equalTo("action [cluster:admin/watcher/watch/execute] is unauthorized for user [test]"));
+            assertThat(e.getMessage(), equalTo("action [cluster:admin/xpack/watcher/watch/execute] is unauthorized for user [test]"));
         }
 
         try {
@@ -120,7 +120,7 @@ public class BasicShieldTests extends AbstractWatcherIntegrationTestCase {
                     .get();
             fail("authentication failure should have occurred");
         } catch (Exception e) {
-            assertThat(e.getMessage(), equalTo("action [cluster:admin/watcher/watch/delete] is unauthorized for user [test]"));
+            assertThat(e.getMessage(), equalTo("action [cluster:admin/xpack/watcher/watch/delete] is unauthorized for user [test]"));
         }
 
         // put, execute and delete watch apis are allowed by role admin: