diff --git a/ApiCore-Backend/src/feedings/colony-feedings.controller.ts b/ApiCore-Backend/src/feedings/colony-feedings.controller.ts
index 5074b8d..10463e3 100644
--- a/ApiCore-Backend/src/feedings/colony-feedings.controller.ts
+++ b/ApiCore-Backend/src/feedings/colony-feedings.controller.ts
@@ -1,5 +1,6 @@
 import { Controller, Get, Param } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { FeedingsService } from './feedings.service';
 
 @ApiTags('feedings')
@@ -8,11 +9,13 @@ import { FeedingsService } from './feedings.service';
 export class ColonyFeedingsController {
   constructor(private readonly feedingsService: FeedingsService) {}
 
+  @RequirePermission('feedings:read')
   @Get(':id/feedings')
   findByColony(@Param('id') id: string) {
     return this.feedingsService.findByColony(id);
   }
 
+  @RequirePermission('feedings:read')
   @Get(':id/feedings/summary')
   summaryByColony(@Param('id') id: string) {
     return this.feedingsService.summaryByColony(id);
diff --git a/ApiCore-Backend/src/feedings/feedings.controller.ts b/ApiCore-Backend/src/feedings/feedings.controller.ts
index 330767c..8476166 100644
--- a/ApiCore-Backend/src/feedings/feedings.controller.ts
+++ b/ApiCore-Backend/src/feedings/feedings.controller.ts
@@ -1,7 +1,6 @@
 import { Body, Controller, Get, Param, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateFeedingDto } from './dto/create-feeding.dto';
@@ -14,17 +13,19 @@ import { FeedingsService } from './feedings.service';
 export class FeedingsController {
   constructor(private readonly feedingsService: FeedingsService) {}
 
+  @RequirePermission('feedings:read')
   @Get()
   findAll() {
     return this.feedingsService.findAll();
   }
 
+  @RequirePermission('feedings:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.feedingsService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('feedings:create')
   @Post()
   create(
     @Body() dto: CreateFeedingDto,
@@ -33,7 +34,7 @@ export class FeedingsController {
     return this.feedingsService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('feedings:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
diff --git a/ApiCore-Backend/src/swarm-control/colony-swarm-control-checks.controller.ts b/ApiCore-Backend/src/swarm-control/colony-swarm-control-checks.controller.ts
index c18e364..411bda9 100644
--- a/ApiCore-Backend/src/swarm-control/colony-swarm-control-checks.controller.ts
+++ b/ApiCore-Backend/src/swarm-control/colony-swarm-control-checks.controller.ts
@@ -1,5 +1,6 @@
 import { Controller, Get, Param } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { SwarmControlService } from './swarm-control.service';
 
 @ApiTags('swarm-control-checks')
@@ -8,6 +9,7 @@ import { SwarmControlService } from './swarm-control.service';
 export class ColonySwarmControlChecksController {
   constructor(private readonly swarmControlService: SwarmControlService) {}
 
+  @RequirePermission('swarm-control:read')
   @Get(':id/swarm-control-checks')
   findByColony(@Param('id') id: string) {
     return this.swarmControlService.findByColony(id);
diff --git a/ApiCore-Backend/src/swarm-control/swarm-control.controller.ts b/ApiCore-Backend/src/swarm-control/swarm-control.controller.ts
index f9c7d19..0bf6e2f 100644
--- a/ApiCore-Backend/src/swarm-control/swarm-control.controller.ts
+++ b/ApiCore-Backend/src/swarm-control/swarm-control.controller.ts
@@ -1,7 +1,6 @@
 import { Body, Controller, Get, Param, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateSwarmControlCheckDto } from './dto/create-swarm-control-check.dto';
@@ -14,17 +13,19 @@ import { SwarmControlService } from './swarm-control.service';
 export class SwarmControlController {
   constructor(private readonly swarmControlService: SwarmControlService) {}
 
+  @RequirePermission('swarm-control:read')
   @Get()
   findAll() {
     return this.swarmControlService.findAll();
   }
 
+  @RequirePermission('swarm-control:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.swarmControlService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('swarm-control:create')
   @Post()
   create(
     @Body() dto: CreateSwarmControlCheckDto,
@@ -33,7 +34,7 @@ export class SwarmControlController {
     return this.swarmControlService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('swarm-control:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
diff --git a/ApiCore-Backend/src/treatments/colony-treatments.controller.ts b/ApiCore-Backend/src/treatments/colony-treatments.controller.ts
index c881dac..dbe94c9 100644
--- a/ApiCore-Backend/src/treatments/colony-treatments.controller.ts
+++ b/ApiCore-Backend/src/treatments/colony-treatments.controller.ts
@@ -1,5 +1,6 @@
 import { Controller, Get, Param } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { TreatmentsService } from './treatments.service';
 
 @ApiTags('treatments')
@@ -8,6 +9,7 @@ import { TreatmentsService } from './treatments.service';
 export class ColonyTreatmentsController {
   constructor(private readonly treatmentsService: TreatmentsService) {}
 
+  @RequirePermission('treatments:read')
   @Get(':id/treatments')
   findByColony(@Param('id') id: string) {
     return this.treatmentsService.findByColony(id);
diff --git a/ApiCore-Backend/src/treatments/treatments.controller.ts b/ApiCore-Backend/src/treatments/treatments.controller.ts
index d54b5e7..c4c4dc7 100644
--- a/ApiCore-Backend/src/treatments/treatments.controller.ts
+++ b/ApiCore-Backend/src/treatments/treatments.controller.ts
@@ -1,7 +1,6 @@
 import { Body, Controller, Get, Param, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateTreatmentDto } from './dto/create-treatment.dto';
@@ -14,17 +13,19 @@ import { TreatmentsService } from './treatments.service';
 export class TreatmentsController {
   constructor(private readonly treatmentsService: TreatmentsService) {}
 
+  @RequirePermission('treatments:read')
   @Get()
   findAll() {
     return this.treatmentsService.findAll();
   }
 
+  @RequirePermission('treatments:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.treatmentsService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('treatments:create')
   @Post()
   create(
     @Body() dto: CreateTreatmentDto,
@@ -33,7 +34,7 @@ export class TreatmentsController {
     return this.treatmentsService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('treatments:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
diff --git a/ApiCore-Backend/src/varroa/colony-varroa-measurements.controller.ts b/ApiCore-Backend/src/varroa/colony-varroa-measurements.controller.ts
index 96b7797..1ee052e 100644
--- a/ApiCore-Backend/src/varroa/colony-varroa-measurements.controller.ts
+++ b/ApiCore-Backend/src/varroa/colony-varroa-measurements.controller.ts
@@ -1,5 +1,6 @@
 import { Controller, Get, Param } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { VarroaService } from './varroa.service';
 
 @ApiTags('varroa-measurements')
@@ -8,6 +9,7 @@ import { VarroaService } from './varroa.service';
 export class ColonyVarroaMeasurementsController {
   constructor(private readonly varroaService: VarroaService) {}
 
+  @RequirePermission('varroa:read')
   @Get(':id/varroa-measurements')
   findByColony(@Param('id') id: string) {
     return this.varroaService.findByColony(id);
diff --git a/ApiCore-Backend/src/varroa/varroa.controller.ts b/ApiCore-Backend/src/varroa/varroa.controller.ts
index 9bb511b..33de274 100644
--- a/ApiCore-Backend/src/varroa/varroa.controller.ts
+++ b/ApiCore-Backend/src/varroa/varroa.controller.ts
@@ -1,7 +1,6 @@
 import { Body, Controller, Get, Param, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateVarroaMeasurementDto } from './dto/create-varroa-measurement.dto';
@@ -14,17 +13,19 @@ import { VarroaService } from './varroa.service';
 export class VarroaController {
   constructor(private readonly varroaService: VarroaService) {}
 
+  @RequirePermission('varroa:read')
   @Get()
   findAll() {
     return this.varroaService.findAll();
   }
 
+  @RequirePermission('varroa:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.varroaService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('varroa:create')
   @Post()
   create(
     @Body() dto: CreateVarroaMeasurementDto,
@@ -33,7 +34,7 @@ export class VarroaController {
     return this.varroaService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('varroa:update')
   @Patch(':id')
   update(
     @Param('id') id: string,