diff --git a/webclient/src/components/device/DeviceTable.vue b/webclient/src/components/device/DeviceTable.vue
index 0dd1746..1182999 100644
--- a/webclient/src/components/device/DeviceTable.vue
+++ b/webclient/src/components/device/DeviceTable.vue
@@ -43,7 +43,7 @@
       />
     </template>
 
-    <template v-if="showActions" #cell-actions="{ row }">
+    <template v-if="showActions && perm.has('devices.control')" #cell-actions="{ row }">
       <GnButton
         variant="warning"
         icon="ph-arrow-clockwise"
@@ -60,6 +60,7 @@
 <script setup>
 import { computed } from "vue";
 import { useDevicesStore } from "../../stores/devices";
+import { usePermission } from "../../composables/usePermission.js";
 import { GnTable, GnButton, GnBadge, useToast } from "gnexus-ui-kit/vue";
 import DeviceChannelsState from "../../features/devices/components/DeviceChannelsState.vue";
 
@@ -71,6 +72,7 @@
 
 const devicesStore = useDevicesStore();
 const toast = useToast();
+const perm = usePermission();
 
 const TYPE_ICONS = {
   relay: '<i class="ph ph-toggle-left"></i>',
diff --git a/webclient/src/components/script/ActionScriptsGrid.vue b/webclient/src/components/script/ActionScriptsGrid.vue
index ef9f74f..f76a326 100644
--- a/webclient/src/components/script/ActionScriptsGrid.vue
+++ b/webclient/src/components/script/ActionScriptsGrid.vue
@@ -19,6 +19,7 @@
       </template>
       <template #actions>
         <GnButton
+          v-if="perm.has('scripts.run')"
           variant="primary"
           icon="ph-play"
           :loading="scriptsStore.isRunning(script.alias)"
@@ -36,6 +37,7 @@
 import { useRouter } from "vue-router";
 import { useScriptsStore } from "../../stores/scripts";
 import { useAreasStore } from "../../stores/areas";
+import { usePermission } from "../../composables/usePermission.js";
 import {
   GnBadge,
   GnActionCard,
@@ -60,6 +62,7 @@
 const scriptsStore = useScriptsStore();
 const areasStore = useAreasStore();
 const toast = useToast();
+const perm = usePermission();
 
 function areaFor(script) {
   if (!script.area_id || !props.showAreaBadge) return null;
diff --git a/webclient/src/components/script/ScriptTable.vue b/webclient/src/components/script/ScriptTable.vue
index 0a4d5b6..0b5a73a 100644
--- a/webclient/src/components/script/ScriptTable.vue
+++ b/webclient/src/components/script/ScriptTable.vue
@@ -35,7 +35,7 @@
       <GnBadge :variant="row.state === 'enabled' ? 'success' : 'secondary'">{{ row.state }}</GnBadge>
     </template>
 
-    <template v-if="showActions" #cell-actions="{ row }">
+    <template v-if="showActions && perm.has('scripts.edit')" #cell-actions="{ row }">
       <GnButton
         v-if="row.state === 'enabled'"
         variant="secondary"
@@ -60,6 +60,7 @@
 import { computed } from "vue";
 import { useScriptsStore } from "../../stores/scripts";
 import { useAreasStore } from "../../stores/areas";
+import { usePermission } from "../../composables/usePermission.js";
 import { GnTable, GnBadge, GnButton } from "gnexus-ui-kit/vue";
 
 const props = defineProps({
@@ -74,6 +75,7 @@
 
 const scriptsStore = useScriptsStore();
 const areasStore = useAreasStore();
+const perm = usePermission();
 
 const areaById = computed(() => {
   const map = {};
diff --git a/webclient/src/components/script/__tests__/ActionScriptsGrid.spec.js b/webclient/src/components/script/__tests__/ActionScriptsGrid.spec.js
index 027596a..5de96f8 100644
--- a/webclient/src/components/script/__tests__/ActionScriptsGrid.spec.js
+++ b/webclient/src/components/script/__tests__/ActionScriptsGrid.spec.js
@@ -3,6 +3,7 @@
 import { setActivePinia, createPinia } from "pinia";
 import { useAreasStore } from "../../../stores/areas.js";
 import { useScriptsStore } from "../../../stores/scripts.js";
+import { useAuthStore } from "../../../stores/auth.js";
 import ActionScriptsGrid from "../ActionScriptsGrid.vue";
 
 vi.mock("gnexus-ui-kit/vue", async () => {
@@ -19,7 +20,13 @@
 
 describe("ActionScriptsGrid", () => {
   beforeEach(() => {
-    setActivePinia(createPinia());
+    const pinia = createPinia();
+    setActivePinia(pinia);
+    const authStore = useAuthStore(pinia);
+    authStore.$patch({
+      user: { id: 1 },
+      permissions: ["scripts.run"],
+    });
   });
 
   function createWrapper(props = {}) {
diff --git a/webclient/src/features/areas/pages/AreaDetailPage.vue b/webclient/src/features/areas/pages/AreaDetailPage.vue
index f70eb86..a6eaec4 100644
--- a/webclient/src/features/areas/pages/AreaDetailPage.vue
+++ b/webclient/src/features/areas/pages/AreaDetailPage.vue
@@ -57,6 +57,7 @@
       >
         <template #action>
           <GnButton
+            v-if="perm.has('areas.manage')"
             variant="primary"
             icon="ph-map-pin"
             @click="openAssign"
@@ -182,6 +183,7 @@
 import { useDevicesStore } from "../../../stores/devices";
 import { useFavoritesStore } from "../../../stores/favorites";
 import { useScriptsStore } from "../../../stores/scripts";
+import { usePermission } from "../../../composables/usePermission.js";
 import { useAreaAssign } from "../../../composables/useAreaAssign";
 import {
   GnPageHeader,
@@ -210,6 +212,7 @@
 const favoritesStore = useFavoritesStore();
 const scriptsStore = useScriptsStore();
 const toast = useToast();
+const perm = usePermission();
 
 const {
   showAssignModal,
@@ -224,29 +227,34 @@
 const isFavorite = computed(() => (area.value ? favoritesStore.has(area.value.id) : false));
 
 const areaActions = computed(() => {
-  const actions = [{ label: "Rename", icon: "ph-pencil", onSelect: openRename }];
+  const actions = [];
 
-  if (area.value?.parent_id > 0) {
-    actions.push(
-      { label: "Change parent area", icon: "ph-map-pin", onSelect: openAssign },
-      { label: "Unassign from parent", icon: "ph-x-circle", onSelect: openUnassign }
-    );
-  } else {
-    actions.push({
-      label: "Assign to area",
-      icon: "ph-map-pin",
-      onSelect: openAssign,
-    });
+  if (perm.has('areas.manage')) {
+    actions.push({ label: "Rename", icon: "ph-pencil", onSelect: openRename });
+
+    if (area.value?.parent_id > 0) {
+      actions.push(
+        { label: "Change parent area", icon: "ph-map-pin", onSelect: openAssign },
+        { label: "Unassign from parent", icon: "ph-x-circle", onSelect: openUnassign }
+      );
+    } else {
+      actions.push({
+        label: "Assign to area",
+        icon: "ph-map-pin",
+        onSelect: openAssign,
+      });
+    }
   }
 
-  actions.push(
-    {
-      label: isFavorite.value ? "Remove bookmark" : "Bookmark",
-      icon: isFavorite.value ? "ph-fill ph-bookmark-simple" : "ph-bookmark-simple",
-      onSelect: () => favoritesStore.toggle(area.value?.id),
-    },
-    { label: "Remove", icon: "ph-trash", danger: true, onSelect: openRemove }
-  );
+  actions.push({
+    label: isFavorite.value ? "Remove bookmark" : "Bookmark",
+    icon: isFavorite.value ? "ph-fill ph-bookmark-simple" : "ph-bookmark-simple",
+    onSelect: () => favoritesStore.toggle(area.value?.id),
+  });
+
+  if (perm.has('areas.manage')) {
+    actions.push({ label: "Remove", icon: "ph-trash", danger: true, onSelect: openRemove });
+  }
 
   return actions;
 });
diff --git a/webclient/src/features/areas/pages/AreaTreePage.vue b/webclient/src/features/areas/pages/AreaTreePage.vue
index d3a5db4..7775460 100644
--- a/webclient/src/features/areas/pages/AreaTreePage.vue
+++ b/webclient/src/features/areas/pages/AreaTreePage.vue
@@ -2,7 +2,7 @@
   <section class="page">
     <GnPageHeader title="Tree" kicker="Areas">
       <template #actions>
-        <GnButton variant="primary" icon="ph-plus" @click="openCreate">Create area</GnButton>
+        <GnButton v-if="perm.has('areas.manage')" variant="primary" icon="ph-plus" @click="openCreate">Create area</GnButton>
       </template>
     </GnPageHeader>
 
@@ -53,6 +53,7 @@
 <script setup>
 import { ref, reactive, onMounted } from "vue";
 import { useAreasStore } from "../../../stores/areas";
+import { usePermission } from "../../../composables/usePermission.js";
 import {
   GnPageHeader,
   GnButton,
@@ -68,6 +69,7 @@
 
 const areasStore = useAreasStore();
 const toast = useToast();
+const perm = usePermission();
 
 const showCreateModal = ref(false);
 const createLoading = ref(false);
diff --git a/webclient/src/features/devices/pages/DeviceDetailPage.vue b/webclient/src/features/devices/pages/DeviceDetailPage.vue
index 087e7ca..eec22e5 100644
--- a/webclient/src/features/devices/pages/DeviceDetailPage.vue
+++ b/webclient/src/features/devices/pages/DeviceDetailPage.vue
@@ -76,9 +76,20 @@
         :item="device"
         emptyMessage="This device is not assigned to any area."
         @assign="openAssign"
-      />
+      >
+        <template #action>
+          <GnButton
+            v-if="perm.has('devices.edit')"
+            variant="primary"
+            icon="ph-map-pin"
+            @click="openAssign"
+          >
+            {{ device?.area_id ? 'Change area' : 'Assign to area' }}
+          </GnButton>
+        </template>
+      </AreaAssignSection>
 
-      <div v-if="hasCompatibleFirmwares" class="devices-panel">
+      <div v-if="hasCompatibleFirmwares && perm.has('firmware.upload')" class="devices-panel">
         <div class="block-title">Firmware Update</div>
         <GnAlert variant="info">
           New firmware available:
@@ -260,6 +271,7 @@
 import { useDevicesStore } from "../../../stores/devices";
 import { useAreasStore } from "../../../stores/areas";
 import { useFirmwaresStore } from "../../../stores/firmwares";
+import { usePermission } from "../../../composables/usePermission.js";
 import { useAreaAssign } from "../../../composables/useAreaAssign";
 import {
   GnPageHeader,
@@ -285,6 +297,7 @@
 const areasStore = useAreasStore();
 const firmwaresStore = useFirmwaresStore();
 const toast = useToast();
+const perm = usePermission();
 
 const {
   areaOptions,
@@ -350,28 +363,41 @@
 
 
 const deviceActions = computed(() => {
-  const actions = [{ label: "Edit", icon: "ph-pencil", onSelect: openEdit }];
+  const actions = [];
 
-  if (device.value?.area_id) {
-    actions.push(
-      { label: "Change area", icon: "ph-map-pin", onSelect: openAssign },
-      { label: "Unassign from area", icon: "ph-x-circle", onSelect: openUnassign }
-    );
-  } else {
-    actions.push({ label: "Assign to area", icon: "ph-map-pin", onSelect: openAssign });
+  if (perm.has('devices.edit')) {
+    actions.push({ label: "Edit", icon: "ph-pencil", onSelect: openEdit });
+
+    if (device.value?.area_id) {
+      actions.push(
+        { label: "Change area", icon: "ph-map-pin", onSelect: openAssign },
+        { label: "Unassign from area", icon: "ph-x-circle", onSelect: openUnassign }
+      );
+    } else {
+      actions.push({ label: "Assign to area", icon: "ph-map-pin", onSelect: openAssign });
+    }
   }
 
-  actions.push(
-    { label: "ReSetup", icon: "ph-gear", onSelect: openResetup },
-    {
+  if (perm.has('devices.setup')) {
+    actions.push({ label: "ReSetup", icon: "ph-gear", onSelect: openResetup });
+  }
+
+  if (perm.has('devices.control')) {
+    actions.push({
       label: "Reboot",
       icon: "ph-arrow-clockwise",
       disabled: devicesStore.isRebooting(device.value?.id),
       onSelect: reboot,
-    },
-    { label: "Reset", icon: "ph-x", danger: true, onSelect: openReset },
-    { label: "Remove", icon: "ph-trash", danger: true, onSelect: remove }
-  );
+    });
+  }
+
+  if (perm.has('devices.edit')) {
+    actions.push({ label: "Reset", icon: "ph-x", danger: true, onSelect: openReset });
+  }
+
+  if (perm.has('devices.delete')) {
+    actions.push({ label: "Remove", icon: "ph-trash", danger: true, onSelect: remove });
+  }
 
   return actions;
 });
diff --git a/webclient/src/features/devices/pages/DevicesScanningPage.vue b/webclient/src/features/devices/pages/DevicesScanningPage.vue
index 315ad33..df89144 100644
--- a/webclient/src/features/devices/pages/DevicesScanningPage.vue
+++ b/webclient/src/features/devices/pages/DevicesScanningPage.vue
@@ -77,7 +77,7 @@
 
         <template #cell-actions="{ row }">
           <GnButton
-            v-if="row.status === 'setup'"
+            v-if="row.status === 'setup' && perm.has('devices.setup')"
             variant="primary"
             icon="ph-plus"
             size="sm"
@@ -120,6 +120,7 @@
 <script setup>
 import { ref, reactive } from "vue";
 import { useScanningStore } from "../../../stores/scanning";
+import { usePermission } from "../../../composables/usePermission.js";
 import {
   GnPageHeader,
   GnButton,
@@ -137,6 +138,7 @@
 
 const scanningStore = useScanningStore();
 const toast = useToast();
+const perm = usePermission();
 
 const showSetupModal = ref(false);
 const setupLoading = ref(false);
diff --git a/webclient/src/features/firmwares/pages/FirmwaresListPage.vue b/webclient/src/features/firmwares/pages/FirmwaresListPage.vue
index 2c153ef..f8d03ac 100644
--- a/webclient/src/features/firmwares/pages/FirmwaresListPage.vue
+++ b/webclient/src/features/firmwares/pages/FirmwaresListPage.vue
@@ -3,6 +3,7 @@
     <GnPageHeader title="Firmware Catalog" kicker="Firmwares">
       <template #actions>
         <GnButton
+          v-if="perm.has('firmware.upload')"
           :loading="firmwaresStore.isUpdating"
           icon="ph-arrow-clockwise"
           @click="handleRefresh"
@@ -60,12 +61,14 @@
 <script setup>
 import { ref, onMounted } from "vue";
 import { useFirmwaresStore } from "../../../stores/firmwares";
+import { usePermission } from "../../../composables/usePermission.js";
 import { GnPageHeader, GnButton, GnBadge } from "gnexus-ui-kit/vue";
 import AppEmptyState from "../../../components/feedback/AppEmptyState.vue";
 import AppErrorState from "../../../components/feedback/AppErrorState.vue";
 import AppLoadingState from "../../../components/feedback/AppLoadingState.vue";
 
 const firmwaresStore = useFirmwaresStore();
+const perm = usePermission();
 const error = ref(null);
 
 async function reload() {
diff --git a/webclient/src/features/scripts/pages/ScriptDetailPage.vue b/webclient/src/features/scripts/pages/ScriptDetailPage.vue
index 45f1b3d..f21e561 100644
--- a/webclient/src/features/scripts/pages/ScriptDetailPage.vue
+++ b/webclient/src/features/scripts/pages/ScriptDetailPage.vue
@@ -13,6 +13,7 @@
       <GnPageHeader :title="script.name || script.alias || script.name" :kicker="kicker">
         <template #actions>
           <GnSwitch
+            v-if="perm.has('scripts.edit')"
             :model-value="script.state === 'enabled'"
             label="Enabled"
             @update:model-value="toggleState($event)"
@@ -62,7 +63,18 @@
         :item="script"
         emptyMessage="This script is not assigned to any area."
         @assign="openAssign"
-      />
+      >
+        <template #action>
+          <GnButton
+            v-if="perm.has('scripts.edit')"
+            variant="primary"
+            icon="ph-map-pin"
+            @click="openAssign"
+          >
+            {{ script?.area_id ? 'Change area' : 'Assign to area' }}
+          </GnButton>
+        </template>
+      </AreaAssignSection>
 
       <div v-if="isScope && scopeActions.length > 0" class="devices-panel">
         <div class="block-title">Action scripts ({{ scopeActions.length }})</div>
@@ -177,6 +189,7 @@
 import "prismjs/components/prism-php";
 import { useScriptsStore } from "../../../stores/scripts";
 import { useAreasStore } from "../../../stores/areas";
+import { usePermission } from "../../../composables/usePermission.js";
 import { useAreaAssign } from "../../../composables/useAreaAssign";
 import {
   GnPageHeader,
@@ -200,6 +213,7 @@
 const scriptsStore = useScriptsStore();
 const areasStore = useAreasStore();
 const toast = useToast();
+const perm = usePermission();
 
 const {
   areaOptions,
@@ -220,7 +234,7 @@
 
 const scriptActions = computed(() => {
   const actions = [];
-  if (!isScope.value) {
+  if (!isScope.value && perm.has('scripts.edit')) {
     if (script.value?.area_id) {
       actions.push(
         { label: "Change area", icon: "ph-map-pin", onSelect: openAssign },
@@ -230,7 +244,7 @@
       actions.push({ label: "Assign to area", icon: "ph-map-pin", onSelect: openAssign });
     }
   }
-  if (isAction.value) {
+  if (isAction.value && perm.has('scripts.run')) {
     actions.push({
       label: "Run",
       icon: "ph-play",
diff --git a/webclient/src/features/scripts/pages/ScriptsScopesPage.vue b/webclient/src/features/scripts/pages/ScriptsScopesPage.vue
index 59276bf..f9e668a 100644
--- a/webclient/src/features/scripts/pages/ScriptsScopesPage.vue
+++ b/webclient/src/features/scripts/pages/ScriptsScopesPage.vue
@@ -39,7 +39,7 @@
 
         <template #cell-actions="{ row }">
           <GnButton
-            v-if="row.state === 'enabled'"
+            v-if="row.state === 'enabled' && perm.has('scripts.edit')"
             variant="secondary"
             icon="ph-pause"
             @click="toggle(row.name, false)"
@@ -47,7 +47,7 @@
             Disable
           </GnButton>
           <GnButton
-            v-else
+            v-else-if="perm.has('scripts.edit')"
             variant="primary"
             icon="ph-play"
             @click="toggle(row.name, true)"
@@ -64,6 +64,7 @@
 import { onMounted } from "vue";
 import { useRouter } from "vue-router";
 import { useScriptsStore } from "../../../stores/scripts";
+import { usePermission } from "../../../composables/usePermission.js";
 import { GnPageHeader, GnBadge, GnTable, GnButton } from "gnexus-ui-kit/vue";
 import AppEmptyState from "../../../components/feedback/AppEmptyState.vue";
 import AppErrorState from "../../../components/feedback/AppErrorState.vue";
@@ -71,6 +72,7 @@
 
 const router = useRouter();
 const scriptsStore = useScriptsStore();
+const perm = usePermission();
 
 const tableColumns = [
   { key: "name", label: "Name" },