diff --git a/ApiCore-Backend/src/audit/audit.controller.ts b/ApiCore-Backend/src/audit/audit.controller.ts
index 4b6161c..178ed3d 100644
--- a/ApiCore-Backend/src/audit/audit.controller.ts
+++ b/ApiCore-Backend/src/audit/audit.controller.ts
@@ -1,7 +1,6 @@
 import { Controller, Get, Query } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { AuditLogService } from './audit-log.service';
 
 @ApiTags('audit-log')
@@ -10,7 +9,7 @@ import { AuditLogService } from './audit-log.service';
 export class AuditController {
   constructor(private readonly auditLogService: AuditLogService) {}
 
-  @Roles(Role.ADMIN)
+  @RequirePermission('audit:read')
   @Get()
   findAll(
     @Query('entityType') entityType?: string,
diff --git a/ApiCore-Backend/src/automation/automation.controller.ts b/ApiCore-Backend/src/automation/automation.controller.ts
index a1d665e..e1bf2b0 100644
--- a/ApiCore-Backend/src/automation/automation.controller.ts
+++ b/ApiCore-Backend/src/automation/automation.controller.ts
@@ -1,7 +1,6 @@
 import { Body, Controller, Get, Param, Patch } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { AutomationService } from './automation.service';
@@ -9,16 +8,17 @@ import { UpdateAutomationRuleDto } from './dto/update-automation-rule.dto';
 
 @ApiTags('automation-rules')
 @ApiBearerAuth()
-@Roles(Role.ADMIN)
 @Controller('automation-rules')
 export class AutomationController {
   constructor(private readonly automationService: AutomationService) {}
 
+  @RequirePermission('automation:read')
   @Get()
   findAll() {
     return this.automationService.findAll();
   }
 
+  @RequirePermission('automation:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
diff --git a/ApiCore-Backend/src/import/import.controller.ts b/ApiCore-Backend/src/import/import.controller.ts
index 04f2dc8..84ea6a6 100644
--- a/ApiCore-Backend/src/import/import.controller.ts
+++ b/ApiCore-Backend/src/import/import.controller.ts
@@ -8,8 +8,7 @@ import {
 } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
 import { ApiBearerAuth, ApiConsumes, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { ImportService } from './import.service';
@@ -18,11 +17,11 @@ const MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024;
 
 @ApiTags('import')
 @ApiBearerAuth()
-@Roles(Role.ADMIN)
 @Controller('import')
 export class ImportController {
   constructor(private readonly importService: ImportService) {}
 
+  @RequirePermission('import:execute')
   @Post(':entity')
   @ApiConsumes('multipart/form-data')
   @UseInterceptors(
diff --git a/ApiCore-Backend/src/users/users.controller.ts b/ApiCore-Backend/src/users/users.controller.ts
index d4f0990..efffabd 100644
--- a/ApiCore-Backend/src/users/users.controller.ts
+++ b/ApiCore-Backend/src/users/users.controller.ts
@@ -1,7 +1,6 @@
 import { Body, Controller, Get, Param, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateUserDto } from './dto/create-user.dto';
@@ -11,25 +10,28 @@ import { UsersService } from './users.service';
 @ApiTags('users')
 @ApiBearerAuth()
 @Controller('users')
-@Roles(Role.ADMIN)
 export class UsersController {
   constructor(private readonly usersService: UsersService) {}
 
+  @RequirePermission('users:read')
   @Get()
   findAll() {
     return this.usersService.findAll();
   }
 
+  @RequirePermission('users:create')
   @Post()
   create(@Body() dto: CreateUserDto, @CurrentUser() actor: AuthenticatedUser) {
     return this.usersService.create(dto, actor.id);
   }
 
+  @RequirePermission('users:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.usersService.findSummaryById(id);
   }
 
+  @RequirePermission('users:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
@@ -39,11 +41,13 @@ export class UsersController {
     return this.usersService.update(id, dto, actor.id);
   }
 
+  @RequirePermission('users:deactivate')
   @Post(':id/deactivate')
   deactivate(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
     return this.usersService.deactivate(id, actor.id);
   }
 
+  @RequirePermission('users:deactivate')
   @Post(':id/activate')
   activate(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
     return this.usersService.activate(id, actor.id);
diff --git a/ApiCore-Backend/src/webhooks/webhooks.controller.ts b/ApiCore-Backend/src/webhooks/webhooks.controller.ts
index c96b1ff..aa6795c 100644
--- a/ApiCore-Backend/src/webhooks/webhooks.controller.ts
+++ b/ApiCore-Backend/src/webhooks/webhooks.controller.ts
@@ -8,8 +8,7 @@ import {
   Post,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateWebhookDto } from './dto/create-webhook.dto';
@@ -17,16 +16,17 @@ import { WebhooksService } from './webhooks.service';
 
 @ApiTags('webhooks')
 @ApiBearerAuth()
-@Roles(Role.ADMIN)
 @Controller('webhooks')
 export class WebhooksController {
   constructor(private readonly webhooksService: WebhooksService) {}
 
+  @RequirePermission('webhooks:read')
   @Get()
   findAll() {
     return this.webhooksService.findAll();
   }
 
+  @RequirePermission('webhooks:create')
   @Post()
   create(
     @Body() dto: CreateWebhookDto,
@@ -35,6 +35,7 @@ export class WebhooksController {
     return this.webhooksService.create(dto, actor.id);
   }
 
+  @RequirePermission('webhooks:delete')
   @Delete(':id')
   @HttpCode(204)
   delete(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
diff --git a/ApiCore-Backend/test/authorization-coverage.e2e-spec.ts b/ApiCore-Backend/test/authorization-coverage.e2e-spec.ts
index 856ff29..c643292 100644
--- a/ApiCore-Backend/test/authorization-coverage.e2e-spec.ts
+++ b/ApiCore-Backend/test/authorization-coverage.e2e-spec.ts
@@ -22,12 +22,7 @@ const ALLOWLIST = new Set([
 ]);
 
 describe('Authorization coverage (e2e)', () => {
-  // TODO(RBAC migration): re-enable once every controller carries
-  // @RequirePermission (Phase 2 of the RBAC rollout). Right now most GET
-  // routes have no @Roles/@RequirePermission at all (authenticated-only),
-  // which this test correctly flags — that's the known, tracked starting
-  // state, not a regression to fix here.
-  it.skip('every non-public route requires a role or a catalog-valid permission', async () => {
+  it('every non-public route requires a role or a catalog-valid permission', async () => {
     const moduleRef = await Test.createTestingModule({
       imports: [AppModule, DiscoveryModule],
     }).compile();