diff --git a/ApiCore-Backend/src/apiaries/apiaries.controller.ts b/ApiCore-Backend/src/apiaries/apiaries.controller.ts
index 1d04d57..b28044f 100644
--- a/ApiCore-Backend/src/apiaries/apiaries.controller.ts
+++ b/ApiCore-Backend/src/apiaries/apiaries.controller.ts
@@ -8,8 +8,8 @@ import {
   Query,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { ApiaryStatus, LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { ApiaryStatus } from '../../generated/prisma';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateApiaryDto } from './dto/create-apiary.dto';
@@ -22,6 +22,7 @@ import { ApiariesService } from './apiaries.service';
 export class ApiariesController {
   constructor(private readonly apiariesService: ApiariesService) {}
 
+  @RequirePermission('apiaries:read')
   @Get()
   findAll(
     @Query('status') status?: ApiaryStatus,
@@ -30,12 +31,13 @@ export class ApiariesController {
     return this.apiariesService.findAll({ status, location });
   }
 
+  @RequirePermission('apiaries:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.apiariesService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('apiaries:create')
   @Post()
   create(
     @Body() dto: CreateApiaryDto,
@@ -44,7 +46,7 @@ export class ApiariesController {
     return this.apiariesService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('apiaries:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
@@ -54,13 +56,13 @@ export class ApiariesController {
     return this.apiariesService.update(id, dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('apiaries:deactivate')
   @Post(':id/deactivate')
   deactivate(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
     return this.apiariesService.deactivate(id, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('apiaries:deactivate')
   @Post(':id/reactivate')
   reactivate(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
     return this.apiariesService.reactivate(id, actor.id);
diff --git a/ApiCore-Backend/src/colonies/colonies.controller.ts b/ApiCore-Backend/src/colonies/colonies.controller.ts
index 2d9da8d..9f82fe1 100644
--- a/ApiCore-Backend/src/colonies/colonies.controller.ts
+++ b/ApiCore-Backend/src/colonies/colonies.controller.ts
@@ -8,8 +8,8 @@ import {
   Query,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { ColonyStatus, LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { ColonyStatus } from '../../generated/prisma';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateColonyDto } from './dto/create-colony.dto';
@@ -25,6 +25,7 @@ import { ColoniesService } from './colonies.service';
 export class ColoniesController {
   constructor(private readonly coloniesService: ColoniesService) {}
 
+  @RequirePermission('colonies:read')
   @Get()
   findAll(
     @Query('status') status?: ColonyStatus,
@@ -33,17 +34,19 @@ export class ColoniesController {
     return this.coloniesService.findAll({ status, apiaryId });
   }
 
+  @RequirePermission('colonies:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.coloniesService.findById(id);
   }
 
+  @RequirePermission('colonies:read')
   @Get(':id/history')
   getHistory(@Param('id') id: string) {
     return this.coloniesService.getHistory(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('colonies:create')
   @Post()
   create(
     @Body() dto: CreateColonyDto,
@@ -52,7 +55,7 @@ export class ColoniesController {
     return this.coloniesService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('colonies:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
@@ -62,7 +65,7 @@ export class ColoniesController {
     return this.coloniesService.update(id, dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('colonies:manage-lifecycle')
   @Post(':id/move')
   move(
     @Param('id') id: string,
@@ -72,7 +75,7 @@ export class ColoniesController {
     return this.coloniesService.move(id, dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('colonies:manage-lifecycle')
   @Post(':id/split')
   split(
     @Param('id') id: string,
@@ -82,7 +85,7 @@ export class ColoniesController {
     return this.coloniesService.split(id, dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('colonies:manage-lifecycle')
   @Post(':id/merge')
   merge(
     @Param('id') id: string,
@@ -92,13 +95,13 @@ export class ColoniesController {
     return this.coloniesService.merge(id, dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('colonies:manage-lifecycle')
   @Post(':id/dissolve')
   dissolve(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
     return this.coloniesService.dissolve(id, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('colonies:deactivate')
   @Post(':id/reactivate')
   reactivate(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
     return this.coloniesService.reactivate(id, actor.id);
diff --git a/ApiCore-Backend/src/inspections/colony-inspections.controller.ts b/ApiCore-Backend/src/inspections/colony-inspections.controller.ts
index 88b1ebc..b9832b4 100644
--- a/ApiCore-Backend/src/inspections/colony-inspections.controller.ts
+++ b/ApiCore-Backend/src/inspections/colony-inspections.controller.ts
@@ -1,5 +1,6 @@
 import { Controller, Get, Param } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { InspectionsService } from './inspections.service';
 
 @ApiTags('inspections')
@@ -8,6 +9,7 @@ import { InspectionsService } from './inspections.service';
 export class ColonyInspectionsController {
   constructor(private readonly inspectionsService: InspectionsService) {}
 
+  @RequirePermission('inspections:read')
   @Get(':id/inspections')
   findByColony(@Param('id') id: string) {
     return this.inspectionsService.findByColony(id);
diff --git a/ApiCore-Backend/src/inspections/inspections.controller.ts b/ApiCore-Backend/src/inspections/inspections.controller.ts
index 6cc59d9..e0a7ac3 100644
--- a/ApiCore-Backend/src/inspections/inspections.controller.ts
+++ b/ApiCore-Backend/src/inspections/inspections.controller.ts
@@ -1,7 +1,6 @@
 import { Body, Controller, Get, Param, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateInspectionDto } from './dto/create-inspection.dto';
@@ -15,17 +14,19 @@ import { InspectionsService } from './inspections.service';
 export class InspectionsController {
   constructor(private readonly inspectionsService: InspectionsService) {}
 
+  @RequirePermission('inspections:read')
   @Get()
   findAll() {
     return this.inspectionsService.findAll();
   }
 
+  @RequirePermission('inspections:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.inspectionsService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('inspections:create')
   @Post()
   create(
     @Body() dto: CreateInspectionDto,
@@ -34,7 +35,7 @@ export class InspectionsController {
     return this.inspectionsService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('inspections:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
@@ -44,7 +45,7 @@ export class InspectionsController {
     return this.inspectionsService.update(id, dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('tasks:create')
   @Post(':id/create-task')
   createTask(
     @Param('id') id: string,
diff --git a/ApiCore-Backend/src/queens/queens.controller.ts b/ApiCore-Backend/src/queens/queens.controller.ts
index 2303751..d7bb437 100644
--- a/ApiCore-Backend/src/queens/queens.controller.ts
+++ b/ApiCore-Backend/src/queens/queens.controller.ts
@@ -8,8 +8,8 @@ import {
   Query,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { QueenStatus, LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { QueenStatus } from '../../generated/prisma';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateQueenDto } from './dto/create-queen.dto';
@@ -24,33 +24,37 @@ import { QueensService } from './queens.service';
 export class QueensController {
   constructor(private readonly queensService: QueensService) {}
 
+  @RequirePermission('queens:read')
   @Get()
   findAll(@Query('status') status?: QueenStatus) {
     return this.queensService.findAll({ status });
   }
 
+  @RequirePermission('queens:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.queensService.findById(id);
   }
 
+  @RequirePermission('queens:read')
   @Get(':id/history')
   getHistory(@Param('id') id: string) {
     return this.queensService.getHistory(id);
   }
 
+  @RequirePermission('queens:read')
   @Get(':id/lineage')
   getLineage(@Param('id') id: string) {
     return this.queensService.getLineage(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('queens:create')
   @Post()
   create(@Body() dto: CreateQueenDto, @CurrentUser() actor: AuthenticatedUser) {
     return this.queensService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('queens:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
@@ -60,7 +64,7 @@ export class QueensController {
     return this.queensService.update(id, dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('queens:assign')
   @Post(':id/assign-colony')
   assignColony(
     @Param('id') id: string,
@@ -70,12 +74,13 @@ export class QueensController {
     return this.queensService.assignColony(id, dto, actor.id);
   }
 
+  @RequirePermission('queens:read')
   @Get(':id/evaluations')
   getEvaluations(@Param('id') id: string) {
     return this.queensService.getEvaluations(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('queens:evaluate')
   @Post(':id/evaluations')
   addEvaluation(
     @Param('id') id: string,
diff --git a/ApiCore-Backend/src/task-templates/task-templates.controller.ts b/ApiCore-Backend/src/task-templates/task-templates.controller.ts
index 4a2cf49..a8f11a9 100644
--- a/ApiCore-Backend/src/task-templates/task-templates.controller.ts
+++ b/ApiCore-Backend/src/task-templates/task-templates.controller.ts
@@ -1,7 +1,6 @@
 import { Body, Controller, Get, Param, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateTaskTemplateDto } from './dto/create-task-template.dto';
@@ -10,21 +9,23 @@ import { TaskTemplatesService } from './task-templates.service';
 
 @ApiTags('task-templates')
 @ApiBearerAuth()
-@Roles(Role.ADMIN, Role.BEEKEEPER)
 @Controller('task-templates')
 export class TaskTemplatesController {
   constructor(private readonly taskTemplatesService: TaskTemplatesService) {}
 
+  @RequirePermission('task-templates:read')
   @Get()
   findAll() {
     return this.taskTemplatesService.findAll();
   }
 
+  @RequirePermission('task-templates:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.taskTemplatesService.findById(id);
   }
 
+  @RequirePermission('task-templates:create')
   @Post()
   create(
     @Body() dto: CreateTaskTemplateDto,
@@ -33,6 +34,7 @@ export class TaskTemplatesController {
     return this.taskTemplatesService.create(dto, actor.id);
   }
 
+  @RequirePermission('task-templates:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
@@ -42,6 +44,7 @@ export class TaskTemplatesController {
     return this.taskTemplatesService.update(id, dto, actor.id);
   }
 
+  @RequirePermission('task-templates:deactivate')
   @Post(':id/deactivate')
   deactivate(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
     return this.taskTemplatesService.deactivate(id, actor.id);
diff --git a/ApiCore-Backend/src/tasks/tasks.controller.ts b/ApiCore-Backend/src/tasks/tasks.controller.ts
index 69b2e10..e59f0a2 100644
--- a/ApiCore-Backend/src/tasks/tasks.controller.ts
+++ b/ApiCore-Backend/src/tasks/tasks.controller.ts
@@ -8,12 +8,8 @@ import {
   Query,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import {
-  LegacyRole as Role,
-  TaskPriority,
-  TaskStatus,
-} from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { TaskPriority, TaskStatus } from '../../generated/prisma';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateTaskDto } from './dto/create-task.dto';
@@ -26,6 +22,7 @@ import { TasksService } from './tasks.service';
 export class TasksController {
   constructor(private readonly tasksService: TasksService) {}
 
+  @RequirePermission('tasks:read')
   @Get()
   findAll(
     @Query('status') status?: TaskStatus,
@@ -34,18 +31,19 @@ export class TasksController {
     return this.tasksService.findAll({ status, priority });
   }
 
+  @RequirePermission('tasks:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.tasksService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('tasks:create')
   @Post()
   create(@Body() dto: CreateTaskDto, @CurrentUser() actor: AuthenticatedUser) {
     return this.tasksService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('tasks:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
@@ -55,7 +53,7 @@ export class TasksController {
     return this.tasksService.update(id, dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('tasks:complete')
   @Post(':id/complete')
   complete(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
     return this.tasksService.complete(id, actor.id);