diff --git a/.env b/.env
index 414a776c5..87cc05619 100644
--- a/.env
+++ b/.env
@@ -129,3 +129,17 @@ CLIENT_PULL_STRATEGY_INTERVAL=90000
 CLIENT_COLOR_SCHEME='{"type":"library","lat":56.0,"lng":10.0}'
 CLIENT_DEBUG=false
 ###< Client configuration ###
+
+# TODO: Write documentation.
+# See src/Security/Voter/AuthorizationVoterValues.php for complete default authorization array.
+# Example value:
+# AUTHORIZATION_OVERRIDE='{
+#   "SCREEN": {
+#     "LIST": ["ROLE_EDITOR"],
+#     "VIEW": ["ROLE_EDITOR"],
+#     "EDIT": ["ROLE_ADMIN"],
+#     "CREATE": ["ROLE_ADMIN"],
+#     "DELETE": ["ROLE_ADMIN"],
+#   }
+# }'
+AUTHORIZATION_OVERRIDE='{}'
diff --git a/assets/admin/app.jsx b/assets/admin/app.jsx
index 7c67ac413..988558ba5 100644
--- a/assets/admin/app.jsx
+++ b/assets/admin/app.jsx
@@ -70,7 +70,7 @@ function App() {
       roles: ["ROLE_ADMIN"],
     },
     screen: {
-      roles: ["ROLE_ADMIN"],
+      roles: ["ROLE_EDITOR", "ROLE_ADMIN"],
     },
     settings: {
       roles: ["ROLE_ADMIN"],
diff --git a/assets/admin/components/restricted-route.jsx b/assets/admin/components/restricted-route.jsx
index eb2ef3b12..1a45bc4c8 100644
--- a/assets/admin/components/restricted-route.jsx
+++ b/assets/admin/components/restricted-route.jsx
@@ -17,6 +17,9 @@ function RestrictedRoute({ children, roles }) {
   const userHasRequiredRole = context.selectedTenant.get?.roles.find((value) =>
     roles.includes(value),
   );
+
+  console.log("asd", roles, userHasRequiredRole, context.selectedTenant.get?.roles);
+
   if (context.authenticated.get && !userHasRequiredRole) {
     return <NoAccess />;
   }
diff --git a/assets/admin/components/screen/screen-form.jsx b/assets/admin/components/screen/screen-form.jsx
index 8f64516c0..f95bc0687 100644
--- a/assets/admin/components/screen/screen-form.jsx
+++ b/assets/admin/components/screen/screen-form.jsx
@@ -83,6 +83,32 @@ function ScreenForm({
     previewOrientationOptions[0].value,
   );
 
+  const hasPermission = (entity, action) => {
+    console.log("hasPermission", entity, action);
+
+    if (config?.authorization) {
+      const currentTenant = JSON.parse(localStorage.getItem("admin-selected-tenant"));
+      const userRoles = currentTenant?.roles;
+
+      const authorization = config.authorization;
+
+      console.log("authorization", authorization);
+
+      const requiredRoles = authorization[entity]?.[action];
+
+      console.log("requiredRoles", requiredRoles);
+
+      const intersect = requiredRoles.filter(value => userRoles.includes(value));
+
+      console.log("intersect", intersect);
+
+      if (intersect.length > 0) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   /**
    * Check if published is set
    *
@@ -382,24 +408,28 @@ function ScreenForm({
           >
             {t("cancel-button")}
           </Button>
-          <Button
-            variant="outline-primary"
-            type="button"
-            className="margin-right-button"
-            id="save_screen"
-            onClick={() => checkInputsHandleSubmit(false)}
-          >
-            {t("save-button")}
-          </Button>
-          <Button
-            variant="primary"
-            type="button"
-            onClick={() => checkInputsHandleSubmit(true)}
-            id="save_slide_an_close"
-            className="margin-right-button"
-          >
-            {t("save-button-and-close")}
-          </Button>
+          {hasPermission("Screen", "EDIT") && (
+            <>
+              <Button
+                variant="outline-primary"
+                type="button"
+                className="margin-right-button"
+                id="save_screen"
+                onClick={() => checkInputsHandleSubmit(false)}
+              >
+                {t("save-button")}
+              </Button>
+              <Button
+                variant="primary"
+                type="button"
+                onClick={() => checkInputsHandleSubmit(true)}
+                id="save_slide_an_close"
+                className="margin-right-button"
+              >
+                {t("save-button-and-close")}
+              </Button>
+            </>
+          )}
           {config?.enhancedPreview && (
             <Button
               variant="success"
diff --git a/config/api_platform/feed.yaml b/config/api_platform/feed.yaml
index 954079915..ac5f9827d 100644
--- a/config/api_platform/feed.yaml
+++ b/config/api_platform/feed.yaml
@@ -6,6 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "FEED", object: object})'
                 openapiContext:
                     operationId: get-feeds-id
                     description: Retrieves a feed resource.
@@ -32,6 +33,7 @@ resources:
             _api_Feed_get_data:
                 class: ApiPlatform\Metadata\Get
                 method: GET
+                security: 'is_granted("VIEW", {type: "FEED", object: object})'
                 uriTemplate: '/feeds/{id}/data'
                 read: false
                 controller: App\Controller\Api\FeedGetDataController
@@ -69,6 +71,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "FEED", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/feed_source.yaml b/config/api_platform/feed_source.yaml
index e1eae068b..458abbe9e 100644
--- a/config/api_platform/feed_source.yaml
+++ b/config/api_platform/feed_source.yaml
@@ -7,6 +7,7 @@ resources:
         processor: App\State\FeedSourceProcessor
         operations:
             ApiPlatform\Metadata\Get: &ref_0
+                security: 'is_granted("VIEW", {type: "FEED_SOURCE", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -30,7 +31,9 @@ resources:
                                 application/ld+json:
                                     examples: null
                             headers: {}
+
             _api_Feed_get_source_config:
+                security: 'is_granted("VIEW", {type: "FEED_SOURCE", object: object})'
                 class: ApiPlatform\Metadata\Get
                 method: GET
                 uriTemplate: '/feed-sources/{id}/config/{name}'
@@ -67,7 +70,9 @@ resources:
                                                   id: id1
                                                   value: value1
                             headers: {}
+
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "FEED_SOURCE", object: object})'
                 filters:
                     - entity.search_filter
                     - entity.blameable_filter
@@ -97,7 +102,7 @@ resources:
                           description: The number of items per page
                         - schema:
                               type: string
-                          pattern: '^[A-Za-z0-9]*$'
+                              pattern: '^[A-Za-z0-9]*$'
                           name: supportedFeedOutputType
                           in: query
                     responses:
@@ -107,8 +112,9 @@ resources:
                                 application/ld+json:
                                     examples: null
                             headers: {}
+
             ApiPlatform\Metadata\Put:
-                security: is_granted("ROLE_ADMIN")
+                security: 'is_granted("EDIT", {type: "FEED_SOURCE", object: object})'
                 openapiContext:
                     description: Update a Feed Source resource.
                     summary: Update a Feed Source resource.
@@ -123,8 +129,9 @@ resources:
                           name: id
                           in: path
                           required: true
+
             ApiPlatform\Metadata\Delete:
-                security: is_granted("ROLE_ADMIN")
+                security: 'is_granted("DELETE", {type: "FEED_SOURCE", object: object})'
                 openapiContext:
                     description: Delete a Feed Source resource.
                     summary: Delete a Feed Source resource.
@@ -139,15 +146,18 @@ resources:
                           name: id
                           in: path
                           required: true
+
             ApiPlatform\Metadata\Post:
-                security: is_granted("ROLE_ADMIN")
+                security: 'is_granted("CREATE", {type: "FEED_SOURCE", object: object})'
                 openapiContext:
                     operationId: create-v2-feed-source
                     description: Creates a Feed Source resource.
                     summary: Creates a Feed Source resource.
                     tags:
                         - FeedSources
+
             '_api_/feed_sources/{id}/slides_get': &ref_1
+                security: 'is_granted("LIST", {type: "FEED_SOURCE_SLIDES", object: object})'
                 normalizationContext:
                     groups:
                         - 'playlist-slide:read'
@@ -164,7 +174,7 @@ resources:
                 uriTemplate: '/feed-sources/{id}/slides'
                 openapiContext:
                     description: Retrieves collection of weighted slide resources (feedsource).
-                    summary: Retrieves collection of weighted slide resources  (feedsource).
+                    summary: Retrieves collection of weighted slide resources (feedsource).
                     operationId: get-v2-feed-source-slide-id
                     tags:
                         - FeedSources
diff --git a/config/api_platform/layout.yaml b/config/api_platform/layout.yaml
index 46fcf23cc..a8c8b4734 100644
--- a/config/api_platform/layout.yaml
+++ b/config/api_platform/layout.yaml
@@ -6,6 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "LAYOUT", object: object})'
                 uriTemplate: '/layouts/{id}'
                 normalizationContext:
                     jsonld_embed_context: true
@@ -32,6 +33,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "LAYOUT", object: object})'
                 uriTemplate: '/layouts'
                 openapiContext:
                     description: Retrieve a collection of layouts resources.
diff --git a/config/api_platform/media.yaml b/config/api_platform/media.yaml
index ef1c96254..c67739598 100644
--- a/config/api_platform/media.yaml
+++ b/config/api_platform/media.yaml
@@ -7,6 +7,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "MEDIA", object: object})'
                 uriTemplate: '/media/{id}'
                 normalizationContext:
                     jsonld_embed_context: true
@@ -33,6 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", {type: "MEDIA", object: object})'
                 openapiContext:
                     description: Delete a Media resource.
                     summary: Delete a Media resource.
@@ -49,6 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "MEDIA", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -84,6 +87,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", {type: "MEDIA", object: object})'
                 controller: App\Controller\Api\MediaController
                 deserialize: false
                 normalizationContext:
diff --git a/config/api_platform/playlist.yaml b/config/api_platform/playlist.yaml
index f68e743c7..5358d826c 100644
--- a/config/api_platform/playlist.yaml
+++ b/config/api_platform/playlist.yaml
@@ -10,6 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "PLAYLIST", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -35,6 +36,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
+                security: 'is_granted("EDIT", {type: "PLAYLIST", object: object})'
                 openapiContext:
                     description: Update a Playlist resource.
                     summary: Update a Playlist resource.
@@ -51,6 +53,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", {type: "PLAYLIST", object: object})'
                 openapiContext:
                     description: Delete a Playlist resource.
                     summary: Delete a Playlist resource.
@@ -67,6 +70,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "PLAYLIST", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -100,6 +104,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", {type: "PLAYLIST", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
diff --git a/config/api_platform/playlist_screen_region.yaml b/config/api_platform/playlist_screen_region.yaml
index d551b354b..f654c3af1 100644
--- a/config/api_platform/playlist_screen_region.yaml
+++ b/config/api_platform/playlist_screen_region.yaml
@@ -1,12 +1,11 @@
 ---
 resources:
     App\Entity\Tenant\PlaylistScreenRegion:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         output: App\Dto\PlaylistScreenRegion
 
         operations:
-            # prettier-ignore
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 # It needs to be here to generate ids in the collection lists.
                 uriTemplate: '/playlist-screen-regions/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -15,7 +14,7 @@ resources:
                     operationId: getPlaylistScreenRegionItem
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 uriTemplate: '/screens/{id}/regions/{regionId}/playlists/{playlistId}'
                 controller: App\Controller\Api\PlaylistScreenRegionDeleteController
                 read: false
@@ -52,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 uriTemplate: '/screens/{id}/regions/{regionId}/playlists'
                 controller: App\Controller\Api\PlaylistScreenRegionPutController
                 read: false
@@ -104,6 +103,7 @@ resources:
                             description: 'Not found'
 
             ApiPlatform\Metadata\GetCollection: &get_collection
+                security: 'is_granted("LIST", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 normalizationContext:
                     groups: ['playlist-screen-region:read']
                 provider: App\State\PlaylistScreenRegionProvider
diff --git a/config/api_platform/playlist_slide.yaml b/config/api_platform/playlist_slide.yaml
index a8c00187e..04db6a1b9 100644
--- a/config/api_platform/playlist_slide.yaml
+++ b/config/api_platform/playlist_slide.yaml
@@ -6,6 +6,7 @@ resources:
         operations:
             # prettier-ignore
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "PLAYLIST_SLIDE", object: object})'
                 # It needs to be here to generate id's in the collection lists.
                 uriTemplate: '/playlist-slides/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -14,6 +15,7 @@ resources:
                     operationId: getPlaylistSlideItem
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", {type: "PLAYLIST_SLIDE", object: object})'
                 uriTemplate: '/playlists/{id}/slides/{slideId}'
                 controller: App\Controller\Api\PlaylistSlideDeleteController
                 read: false
@@ -42,6 +44,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
+                security: 'is_granted("EDIT", {type: "PLAYLIST_SLIDE", object: object})'
                 uriTemplate: '/playlists/{id}/slides'
                 controller: App\Controller\Api\PlaylistSlidePutController
                 read: false
@@ -87,6 +90,7 @@ resources:
 
             # https://api-platform.com/docs/core/controllers/
             _api_/slides/{id}/playlists_get: &get_playlists
+                security: 'is_granted("LIST", {type: "SLIDE_PLAYLIST", object: object})'
                 normalizationContext:
                     groups: ['slides/playlists:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -136,6 +140,7 @@ resources:
                             headers: {}
 
             _api_/slides/{id}/playlists_put:
+                security: 'is_granted("EDIT", {type: "PLAYLIST_SLIDE", object: object})'
                 class: ApiPlatform\Metadata\Put
                 method: PUT
                 filters:
@@ -179,6 +184,7 @@ resources:
                                                 description: Playlist ULID
 
             _api_/playlists/{id}/slides_get: &get_slides
+                security: 'is_granted("LIST", {type: "PLAYLIST_SLIDE", object: object})'
                 normalizationContext:
                     groups: ['playlist-slide:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen.yaml b/config/api_platform/screen.yaml
index 3ff6b4f83..fc13ff43a 100644
--- a/config/api_platform/screen.yaml
+++ b/config/api_platform/screen.yaml
@@ -1,7 +1,6 @@
 ---
 resources:
     App\Entity\Tenant\Screen:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         input: App\Dto\ScreenInput
         output: App\Dto\Screen
         provider: App\State\ScreenProvider
@@ -9,6 +8,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "SCREEN", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -34,7 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", {type: "SCREEN", object: object})'
                 openapiContext:
                     description: Update a Screen resource.
                     summary: Update a Screen resource.
@@ -51,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", {type: "SCREEN", object: object})'
                 openapiContext:
                     description: Delete a Screen resource.
                     summary: Delete a Screen resource.
@@ -68,6 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "SCREEN", object: object})'
                 filters:
                     - 'App\Filter\MultipleSearchFilter'
                     - 'screen.screen_user_exists_filter'
@@ -105,7 +106,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("CREATE", {type: "SCREEN", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
diff --git a/config/api_platform/screen_campaign.yaml b/config/api_platform/screen_campaign.yaml
index 24b367528..51db0a4f8 100644
--- a/config/api_platform/screen_campaign.yaml
+++ b/config/api_platform/screen_campaign.yaml
@@ -1,18 +1,18 @@
 ---
 resources:
     App\Entity\Tenant\ScreenCampaign:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         output: App\Dto\ScreenCampaign
 
         operations:
             # prettier-ignore
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "SCREEN_CAMPAIGN", object: object})'
                 # It needs to be here to generate id's in the collection lists.
                 uriTemplate: '/screen-campaigns/{id}'
                 controller: App\Controller\Api\NotFoundAction
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", {type: "SCREEN_CAMPAIGN", object: object})'
                 uriTemplate: '/screens/{id}/campaigns/{campaignId}'
                 controller: App\Controller\Api\ScreenCampaignDeleteController
                 read: false
@@ -41,7 +41,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", {type: "SCREEN_CAMPAIGN", object: object})'
                 uriTemplate: '/screens/{id}/campaigns'
                 controller: App\Controller\Api\ScreenCampaignPutController
                 read: false
@@ -83,6 +83,7 @@ resources:
                                                     type: string
 
             _api_/screens/{id}/campaigns_get: &campaigns_get
+                security: 'is_granted("LIST", {type: "SCREEN_CAMPAIGN", object: object})'
                 normalizationContext:
                     groups: ['screen-campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -133,6 +134,7 @@ resources:
                             headers: {}
 
             _api_/campaigns/{id}/screens_get: &screens_get
+                security: 'is_granted("LIST", {type: "CAMPAIGN_SCREEN", object: object})'
                 normalizationContext:
                     groups: ['campaigns/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups.yaml b/config/api_platform/screen_groups.yaml
index 56274eeb3..756c2b8cd 100644
--- a/config/api_platform/screen_groups.yaml
+++ b/config/api_platform/screen_groups.yaml
@@ -1,7 +1,6 @@
 ---
 resources:
     App\Entity\Tenant\ScreenGroup:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         input: App\Dto\ScreenGroupInput
         output: App\Dto\ScreenGroup
         provider: App\State\ScreenGroupProvider
@@ -11,6 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "SCREEN_GROUP", object: object})'
                 uriTemplate: '/screen-groups/{id}'
                 openapiContext:
                     description: Retrieves a Screen group resource.
@@ -35,7 +35,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", {type: "SCREEN_GROUP", object: object})'
                 uriTemplate: '/screen-groups/{id}'
                 openapiContext:
                     description: Update a Screen group resource.
@@ -53,7 +53,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", {type: "SCREEN_GROUP", object: object})'
                 uriTemplate: '/screen-groups/{id}'
                 openapiContext:
                     description: Delete a Screen group resource.
@@ -71,7 +71,7 @@ resources:
                           required: true
 
             _api_/screens/{id}/screen-groups_put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", {type: "SCREEN_GROUP", object: object})'
                 class: ApiPlatform\Metadata\Put
                 method: PUT
                 uriTemplate: '/screens/{id}/screen-groups'
@@ -108,7 +108,7 @@ resources:
                                     examples:
 
             _api_/screens/{id}/screen-groups/{screenGroupId}_delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", {type: "SCREEN_GROUP", object: object})'
                 class: ApiPlatform\Metadata\Delete
                 method: DELETE
                 uriTemplate: '/screens/{id}/screen-groups/{screenGroupId}'
@@ -139,6 +139,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "SCREEN_GROUP", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -174,6 +175,7 @@ resources:
                             headers: {}
 
             _api_/screens/{id}/screen-groups_get: &get_screen_groups
+                security: 'is_granted("LIST", {type: "SCREEN_SCREEN_GROUP", object: object})'
                 normalizationContext:
                     groups: ['screens/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -211,6 +213,7 @@ resources:
                           description: The number of items per page
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", {type: "SCREEN_GROUP", object: object})'
                 uriTemplate: '/screen-groups'
                 openapiContext:
                     description: Create Screen group resources.
@@ -220,6 +223,7 @@ resources:
                         - ScreenGroups
 
             _api_/screen-groups/{id}/screens_get: &get_screens
+                security: 'is_granted("LIST", {type: "SCREEN_GROUP_SCREEN", object: object})'
                 normalizationContext:
                     groups: ['screen-groups/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups_campaign.yaml b/config/api_platform/screen_groups_campaign.yaml
index 0662937cd..3bbbe1f32 100644
--- a/config/api_platform/screen_groups_campaign.yaml
+++ b/config/api_platform/screen_groups_campaign.yaml
@@ -1,12 +1,12 @@
 ---
 resources:
     App\Entity\Tenant\ScreenGroupCampaign:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         output: App\Dto\ScreenGroupCampaign
 
         operations:
             # prettier-ignore
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "SCREEN_GROUP_CAMPAIGN", object: object})'
                 # It needs to be here to generate id's in the collection lists.
                 uriTemplate: '/screen-groups-campaigns/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -15,7 +15,7 @@ resources:
                     operationId: getScreenGroupCampaignItem
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", {type: "SCREEN_GROUP_CAMPAIGN", object: object})'
                 uriTemplate: '/screen-groups/{id}/campaigns/{campaignId}'
                 controller: App\Controller\Api\ScreenGroupCampaignDeleteController
                 read: false
@@ -44,7 +44,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", {type: "SCREEN_GROUP_CAMPAIGN", object: object})'
                 uriTemplate: '/screen-groups/{id}/campaigns'
                 controller: App\Controller\Api\ScreenGroupCampaignPutController
                 read: false
@@ -86,6 +86,7 @@ resources:
                                                     type: string
 
             getScreenGroupsCampaigns: &get_campaigns
+                security: 'is_granted("LIST", {type: "SCREEN_GROUP_CAMPAIGN", object: object})'
                 normalizationContext:
                     groups: ['screen-groups/campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -136,6 +137,7 @@ resources:
                             headers: {}
 
             getCampaignScreensGroups: &get_screen_groups
+                security: 'is_granted("LIST", {type: "CAMPAIGN_SCREEN_GROUP", object: object})'
                 normalizationContext:
                     groups: ['campaigns/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_layout_regions.yaml b/config/api_platform/screen_layout_regions.yaml
index a1c656708..ea2695a41 100644
--- a/config/api_platform/screen_layout_regions.yaml
+++ b/config/api_platform/screen_layout_regions.yaml
@@ -7,6 +7,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get:
+                security: 'is_granted("VIEW", {type: "SCREEN_LAYOUT_REGIONS", object: object})'
                 uriTemplate: '/layouts/regions/{id}'
                 controller: App\Controller\Api\NotFoundAction
                 openapiContext:
@@ -14,6 +15,7 @@ resources:
                     operationId: getScreenLayoutRegionsItem
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "SCREEN_LAYOUT_REGION", object: object})'
                 uriTemplate: '/layouts/regions'
                 controller: App\Controller\Api\NotFoundAction
                 openapiContext:
diff --git a/config/api_platform/slide.yaml b/config/api_platform/slide.yaml
index 96328776d..091fc1467 100644
--- a/config/api_platform/slide.yaml
+++ b/config/api_platform/slide.yaml
@@ -10,6 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "SLIDE", object: object})'
                 openapiContext:
                     operationId: get-v2-slide-id
                     description: Retrieves a Slide resource.
@@ -33,6 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
+                security: 'is_granted("EDIT", {type: "SLIDE", object: object})'
                 openapiContext:
                     description: Update a Slide resource.
                     summary: Update a Slide resource.
@@ -49,6 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", {type: "SLIDE", object: object})'
                 openapiContext:
                     description: Delete a Slide resource.
                     summary: Delete a Slide resource.
@@ -65,6 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "SLIDE", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -101,6 +105,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", {type: "SLIDE", object: object})'
                 openapiContext:
                     operationId: create-v2-slides
                     description: Creates a Slide resource.
diff --git a/config/api_platform/template.yaml b/config/api_platform/template.yaml
index 718bbf9ff..cd00b17b4 100644
--- a/config/api_platform/template.yaml
+++ b/config/api_platform/template.yaml
@@ -8,6 +8,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "TEMPLATE", object: object})'
                 openapiContext:
                     description: Retrieves a Template resource.
                     summary: Retrieve a Template resource.
@@ -31,6 +32,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "TEMPLATE", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/tenant.yaml b/config/api_platform/tenant.yaml
index 3a640e354..28ea943c3 100644
--- a/config/api_platform/tenant.yaml
+++ b/config/api_platform/tenant.yaml
@@ -6,6 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get:
+                security: 'is_granted("VIEW", {type: "TENANT", object: object})'
                 openapiContext:
                     description: Retrieves a tenant resource.
                     summary: Retrieve a tenant resource.
@@ -29,6 +30,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "TENANT", object: object})'
                 filters: ['entity.search_filter', 'entity.blameable_filter']
                 openapiContext:
                     operationId: get-v2-tenants
diff --git a/config/api_platform/theme.yaml b/config/api_platform/theme.yaml
index 917e6956b..d506e6118 100644
--- a/config/api_platform/theme.yaml
+++ b/config/api_platform/theme.yaml
@@ -1,7 +1,6 @@
 ---
 resources:
     App\Entity\Tenant\Theme:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN") or is_granted("ROLE_EDITOR")'
         input: App\Dto\ThemeInput
         output: App\Dto\Theme
         processor: App\State\ThemeProcessor
@@ -9,6 +8,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "THEME", object: object})'
                 normalizationContext:
                     groups: ['theme:read']
                 openapiContext:
@@ -34,6 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "THEME", object: object})'
                 normalizationContext:
                     groups: ['theme:read']
                 filters:
@@ -71,7 +72,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", {type: "THEME", object: object})'
                 openapiContext:
                     description: Update a Theme resource.
                     summary: Update a Theme resource.
@@ -88,7 +89,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", {type: "THEME", object: object})'
                 openapiContext:
                     description: Delete a Theme resource.
                     summary: Delete a Theme resource.
@@ -105,7 +106,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("CREATE", {type: "THEME", object: object})'
                 openapiContext:
                     operationId: create-v2-themes
                     description: Creates a Theme resource.
diff --git a/config/api_platform/user-activation-code.yaml b/config/api_platform/user-activation-code.yaml
index 5533be74d..f5cc2b994 100644
--- a/config/api_platform/user-activation-code.yaml
+++ b/config/api_platform/user-activation-code.yaml
@@ -8,14 +8,14 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                uriTemplate: /user-activation-codes/{id}
                 security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
-            ApiPlatform\Metadata\Delete:
                 uriTemplate: /user-activation-codes/{id}
+            ApiPlatform\Metadata\Delete:
                 security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
+                uriTemplate: /user-activation-codes/{id}
             ApiPlatform\Metadata\Post:
-                uriTemplate: /user-activation-codes
                 security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
+                uriTemplate: /user-activation-codes
                 input: App\Dto\UserActivationCodeInput
                 processor: App\State\UserActivationCodeProcessor
                 openapiContext:
@@ -25,13 +25,13 @@ resources:
                     tags:
                         - UserActivationCode
             ApiPlatform\Metadata\GetCollection:
-                uriTemplate: /user-activation-codes
                 security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
+                uriTemplate: /user-activation-codes
             _api_/user-activation-codes/refresh_code:
+                security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
                 class: ApiPlatform\Metadata\Post
                 method: POST
                 uriTemplate: /user-activation-codes/refresh
-                security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
                 controller: App\Controller\Api\UserRefreshCodeController
                 input: App\Dto\ActivationCode
                 openapiContext:
@@ -41,10 +41,10 @@ resources:
                     tags:
                         - UserActivationCode
             _api_/user-activation-codes/activate:
+                security: 'is_granted("ROLE_USER")'
                 class: ApiPlatform\Metadata\Post
                 method: POST
                 uriTemplate: /user-activation-codes/activate
-                security: 'is_granted("ROLE_USER")'
                 controller: App\Controller\Api\UserActivateController
                 input: App\Dto\ActivationCode
                 openapiContext:
diff --git a/config/api_platform/user.yaml b/config/api_platform/user.yaml
index a04b62987..6259e9bb9 100644
--- a/config/api_platform/user.yaml
+++ b/config/api_platform/user.yaml
@@ -1,14 +1,13 @@
 ---
 resources:
     App\Entity\User:
-        security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
         input: App\Dto\UserInput
         output: App\Dto\User
         provider: App\State\UserProvider
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", {type: "USER", object: object})'
                 uriTemplate: '/users/{id}'
-                security: 'is_granted("VIEW", object)'
                 openapiContext:
                     description: Retrieves User resource.
                     summary: Retrieve User resource.
@@ -30,8 +29,8 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\PUT:
+                security: 'is_granted("EDIT", {type: "USER", object: object})'
                 uriTemplate: '/users/{id}'
-                security: 'is_granted("EDIT", object)'
                 openapiContext:
                     description: Update User resource.
                     summary: Update User resource.
@@ -46,8 +45,8 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\DELETE:
+                security: 'is_granted("DELETE", {type: "USER", object: object})'
                 uriTemplate: '/users/{id}'
-                security: 'is_granted("DELETE", object)'
                 openapiContext:
                     description: Delete an User resource.
                     summary: Delete an User resource.
@@ -62,10 +61,10 @@ resources:
                           required: true
 
             _api_/users/{id}/remove_from_tenant:
+                security: 'is_granted("EDIT", {type: "USER", object: object})'
                 class: ApiPlatform\Metadata\Delete
                 uriTemplate: '/users/{id}/remove-from-tenant'
                 method: 'DELETE'
-                security: 'is_granted("EDIT", object)'
                 controller: App\Controller\Api\UserRemoveFromTenantController
                 openapiContext:
                     description: Remove a User resource from the current tenant.
@@ -84,6 +83,7 @@ resources:
                             description: User removed from tenant
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("LIST", {type: "USER", object: object})'
                 uriTemplate: '/users'
                 filters:
                     - 'user.search_filter'
@@ -118,8 +118,8 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\POST:
+                security: 'is_granted("CREATE", {type: "USER", object: object})'
                 uriTemplate: '/users'
-                security: 'is_granted("CREATE", object)'
                 openapiContext:
                     description: Create a User resource.
                     summary: Create a User resource.
diff --git a/config/services.yaml b/config/services.yaml
index b62f35f7f..75ed14fba 100644
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -53,6 +53,10 @@ services:
     Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface: '@Lexik\Bundle\JWTAuthenticationBundle\Security\Http\Authentication\AuthenticationFailureHandler'
     Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface: '@Lexik\Bundle\JWTAuthenticationBundle\Security\Http\Authentication\AuthenticationSuccessHandler'
 
+    App\Security\Voter\AuthorizationVoter:
+        arguments:
+            $authorizationOverride: '%env(json:AUTHORIZATION_OVERRIDE)%'
+
     App\EventListener\RelationsChecksumListener:
         arguments:
             $enabled: '%env(bool:RELATIONS_CHECKSUM_ENABLED)%'
diff --git a/src/Controller/Admin/AdminConfigController.php b/src/Controller/Admin/AdminConfigController.php
index 6d61d2afb..5cef96cb0 100644
--- a/src/Controller/Admin/AdminConfigController.php
+++ b/src/Controller/Admin/AdminConfigController.php
@@ -4,6 +4,7 @@
 
 namespace App\Controller\Admin;
 
+use App\Security\Voter\AuthorizationVoter;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Response;
@@ -18,6 +19,7 @@ public function __construct(
         private readonly bool $showScreenStatus,
         private readonly array $loginMethods,
         private readonly bool $enhancedPreview,
+        private readonly AuthorizationVoter $authorizationVoter,
     ) {}
 
     public function __invoke(): Response
@@ -28,6 +30,7 @@ public function __invoke(): Response
             'showScreenStatus' => $this->showScreenStatus,
             'loginMethods' => $this->loginMethods,
             'enhancedPreview' => $this->enhancedPreview,
+            'authorization' => $this->authorizationVoter->getAuthorization(),
         ]);
     }
 }
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
new file mode 100644
index 000000000..e36675888
--- /dev/null
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Security\Voter;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
+use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+final class AuthorizationVoter extends Voter {
+    private array $authorization;
+
+    public function __construct(
+        private readonly array $authorizationOverride,
+        private readonly RoleHierarchyInterface $roleHierarchy
+    ) {
+        $this->authorization = array_replace(AuthorizationVoterValues::AUTHORIZATION_DEFAULTS, $authorizationOverride);
+    }
+
+    public function getAuthorization(): array
+    {
+        return $this->authorization;
+    }
+
+    protected function supports(string $attribute, mixed $subject): bool
+    {
+        // https://symfony.com/doc/current/security/voters.html
+
+        // Supports entries of the form:
+        // security: 'is_granted("<ATTRIBUTE>", {type: "<TYPE>", object: object})'
+
+        if (in_array($attribute, AuthorizationVoterValues::ATTRIBUTES) &&
+            is_array($subject) &&
+            !empty($subject['type']) &&
+            in_array($subject['type'], AuthorizationVoterValues::TYPES)
+        ) {
+            return true;
+        }
+
+        return false;
+    }
+
+    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
+    {
+        $user = $token->getUser();
+
+        // if the user is anonymous, do not grant access
+        if (!$user instanceof UserInterface) {
+            return false;
+        }
+
+        $type = $subject['type'];
+        $object = $subject['object'] ?? null;
+
+        // For all entities check if the user is the creator.
+        if ($object !== null && $attribute !== AuthorizationVoterValues::LIST) {
+            $createdBy = null;
+
+            $isDTO = str_starts_with($object::class, "App\\Dto\\");
+            $isEntity = str_starts_with($object::class, "App\\Entity\\");
+
+            if ($isDTO) {
+                $createdBy = $object->createdBy;
+            } else if ($isEntity) {
+                $createdBy = $object->getCreatedBy();
+            }
+
+            $userIdentifier = $user->getUserIdentifier();
+
+            // The creator always has permission to use the object.
+            if ($userIdentifier === $createdBy) {
+                return true;
+            }
+        }
+
+        $userRoles = $user->getRoles();
+        $reachableRoles = $this->roleHierarchy->getReachableRoleNames($userRoles);
+
+        // Check the authorization array for demands for $class and $attribute.
+        $requiredRoles = $this->authorization[$type][$attribute];
+
+        $intersect = array_intersect($requiredRoles, $reachableRoles);
+
+        $allow = !empty($intersect);
+
+        return $allow;
+    }
+}
diff --git a/src/Security/Voter/AuthorizationVoterValues.php b/src/Security/Voter/AuthorizationVoterValues.php
new file mode 100644
index 000000000..c84bada9b
--- /dev/null
+++ b/src/Security/Voter/AuthorizationVoterValues.php
@@ -0,0 +1,236 @@
+<?php
+
+namespace App\Security\Voter;
+
+use App\Utils\Roles;
+
+class AuthorizationVoterValues
+{
+    public const string CAMPAIGN_SCREEN = "CAMPAIGN_SCREEN";
+    public const string CAMPAIGN_SCREEN_GROUP = "CAMPAIGN_SCREEN_GROUP";
+    public const string FEED = "FEED";
+    public const string FEED_SOURCE = "FEED_SOURCE";
+    public const string FEED_SOURCE_SLIDES = "FEED_SOURCE_SLIDES";
+    public const string LAYOUT = "LAYOUT";
+    public const string MEDIA = "MEDIA";
+    public const string PLAYLIST = "PLAYLIST";
+    public const string PLAYLIST_SCREEN_REGION = "PLAYLIST_SCREEN_REGION";
+    public const string PLAYLIST_SLIDE = "PLAYLIST_SLIDE";
+    public const string SCREEN = "SCREEN";
+    public const string SCREEN_CAMPAIGN = "SCREEN_CAMPAIGN";
+    public const string SCREEN_GROUP = "SCREEN_GROUP";
+    public const string SCREEN_GROUP_CAMPAIGN = "SCREEN_GROUP_CAMPAIGN";
+    public const string SCREEN_GROUP_SCREEN = "SCREEN_GROUP_SCREEN";
+    public const string SCREEN_LAYOUT_REGION = "SCREEN_LAYOUT_REGION";
+    public const string SCREEN_SCREEN_GROUP = "SCREEN_SCREEN_GROUP";
+    public const string SLIDE = "SLIDE";
+    public const string SLIDE_PLAYLIST = "SLIDE_PLAYLIST";
+    public const string TEMPLATE = "TEMPLATE";
+    public const string TENANT = "TENANT";
+    public const string THEME = "THEME";
+    public const string USER = "USER";
+
+    public const string EDIT = 'EDIT';
+    public const string VIEW = 'VIEW';
+    public const string LIST = 'LIST';
+    public const string CREATE = 'CREATE';
+    public const string DELETE = 'DELETE';
+
+    public const array ATTRIBUTES = [
+        self::EDIT,
+        self::VIEW,
+        self::LIST,
+        self::CREATE,
+        self::DELETE,
+    ];
+
+    public const array TYPES = [
+        self::CAMPAIGN_SCREEN,
+        self::CAMPAIGN_SCREEN_GROUP,
+        self::FEED,
+        self::FEED_SOURCE,
+        self::FEED_SOURCE_SLIDES,
+        self::LAYOUT,
+        self::MEDIA,
+        self::PLAYLIST,
+        self::PLAYLIST_SCREEN_REGION,
+        self::PLAYLIST_SLIDE,
+        self::SCREEN,
+        self::SCREEN_CAMPAIGN,
+        self::SCREEN_GROUP,
+        self::SCREEN_GROUP_CAMPAIGN,
+        self::SCREEN_GROUP_SCREEN,
+        self::SCREEN_LAYOUT_REGION,
+        self::SCREEN_SCREEN_GROUP,
+        self::SLIDE,
+        self::SLIDE_PLAYLIST,
+        self::TEMPLATE,
+        self::TENANT,
+        self::THEME,
+        self::USER,
+    ];
+
+    public const array AUTHORIZATION_DEFAULTS = [
+        self::CAMPAIGN_SCREEN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::CAMPAIGN_SCREEN_GROUP => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::FEED => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::FEED_SOURCE => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::FEED_SOURCE_SLIDES => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::LAYOUT => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::MEDIA => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::PLAYLIST => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::PLAYLIST_SCREEN_REGION => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::PLAYLIST_SLIDE => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_CAMPAIGN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_GROUP => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_GROUP_CAMPAIGN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_GROUP_SCREEN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_LAYOUT_REGION => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_SCREEN_GROUP => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SLIDE => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SLIDE_PLAYLIST => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::TEMPLATE => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::TENANT => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::THEME => [
+            self::EDIT => [Roles::ROLE_ADMIN],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_ADMIN],
+            self::DELETE => [Roles::ROLE_ADMIN],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::USER => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+    ];
+}
diff --git a/tests/Api/FeedSourceTest.php b/tests/Api/FeedSourceTest.php
index f72e32618..a7cbfd1b2 100644
--- a/tests/Api/FeedSourceTest.php
+++ b/tests/Api/FeedSourceTest.php
@@ -8,6 +8,7 @@
 use App\Entity\Tenant\FeedSource;
 use App\Entity\Tenant\Slide;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 use Symfony\Component\HttpClient\Exception\ClientException;
 
 class FeedSourceTest extends AbstractBaseApiTestCase
@@ -247,4 +248,91 @@ public function testDeleteFeedSourceInUse(): void
             $manager->getRepository(FeedSource::class)->findOneBy(['id' => $ulid])
         );
     }
+
+    public function testFeedSourceAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(FeedSource::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/feed-sources', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $response = $client->request('POST', '/v2/feed-sources', [
+            'json' => [
+                'title' => 'Test feed source for ROLE_EDITOR',
+                'feedType' => 'rss',
+                'secrets' => [],
+                'supportedFeedOutputType' => 'App\FeedType\Rss\RssOutputType',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testFeedSourceAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(FeedSource::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/feed-sources', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $client->request('POST', '/v2/feed-sources', [
+            'json' => [
+                'title' => 'Test feed source for ROLE_USER',
+                'feedType' => 'rss',
+                'secrets' => [],
+                'supportedFeedOutputType' => 'App\FeedType\Rss\RssOutputType',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/MediaTest.php b/tests/Api/MediaTest.php
index a18189a0f..e4a762d2c 100644
--- a/tests/Api/MediaTest.php
+++ b/tests/Api/MediaTest.php
@@ -5,7 +5,9 @@
 namespace App\Tests\Api;
 
 use App\Entity\Tenant;
+use App\Entity\Tenant\Media;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 
 class MediaTest extends AbstractBaseApiTestCase
@@ -160,4 +162,65 @@ public function testMediaUpload(): void
         // @TODO: hydra:member[0].assets: Object value found, but an array is required
         //        $this->assertMatchesResourceItemJsonSchema(Media::class);
     }
+
+    public function testMediaAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Media::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/media', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $uploadedFile = new UploadedFile(__DIR__.'/../files/test.png', 'test.png');
+        $response = $client->request('POST', '/v2/media', [
+            'headers' => ['Content-Type' => 'multipart/form-data'],
+            'extra' => [
+                'files' => [
+                    'file' => $uploadedFile,
+                ],
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testMediaAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Media::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/media', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $uploadedFile = new UploadedFile(__DIR__.'/../files/test.png', 'test.png');
+        $client->request('POST', '/v2/media', [
+            'headers' => ['Content-Type' => 'multipart/form-data'],
+            'extra' => [
+                'files' => [
+                    'file' => $uploadedFile,
+                ],
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/PlaylistsTest.php b/tests/Api/PlaylistsTest.php
index d0fabd239..2dd6b5cf3 100644
--- a/tests/Api/PlaylistsTest.php
+++ b/tests/Api/PlaylistsTest.php
@@ -6,6 +6,7 @@
 
 use App\Entity\Tenant\Playlist;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 use Symfony\Component\HttpFoundation\Response;
 
 class PlaylistsTest extends AbstractBaseApiTestCase
@@ -403,4 +404,85 @@ public function testSharedPlaylists(): void
 
         $this->assertCount(13, $response->toArray()['hydra:member']);
     }
+
+    public function testPlaylistAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Playlist::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/playlists', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $response = $client->request('POST', '/v2/playlists', [
+            'json' => [
+                'title' => 'Test playlist for ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testPlaylistAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Playlist::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/playlists', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $client->request('POST', '/v2/playlists', [
+            'json' => [
+                'title' => 'Test playlist for ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/ScreenGroupsTest.php b/tests/Api/ScreenGroupsTest.php
index 4046955b8..29c51b957 100644
--- a/tests/Api/ScreenGroupsTest.php
+++ b/tests/Api/ScreenGroupsTest.php
@@ -7,6 +7,7 @@
 use App\Entity\Tenant\Screen;
 use App\Entity\Tenant\ScreenGroup;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 
 class ScreenGroupsTest extends AbstractBaseApiTestCase
 {
@@ -227,4 +228,85 @@ public function testDeleteScreenGroupsScreenRelations(): void
 
         $this->assertFalse($screen->getScreenGroups()->contains($screenGroup));
     }
+
+    public function testScreenGroupAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(ScreenGroup::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/screen-groups', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $response = $client->request('POST', '/v2/screen-groups', [
+            'json' => [
+                'title' => 'Test screen group for ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testScreenGroupAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(ScreenGroup::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/screen-groups', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $client->request('POST', '/v2/screen-groups', [
+            'json' => [
+                'title' => 'Test screen group for ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/ScreensTest.php b/tests/Api/ScreensTest.php
index 1ea349674..f278694b1 100644
--- a/tests/Api/ScreensTest.php
+++ b/tests/Api/ScreensTest.php
@@ -11,6 +11,7 @@
 use App\Entity\Tenant\Screen;
 use App\Entity\Tenant\ScreenGroup;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 use Doctrine\ORM\EntityManager;
 
 class ScreensTest extends AbstractBaseApiTestCase
@@ -272,4 +273,89 @@ public function testDeleteScreen(): void
             static::getContainer()->get('doctrine')->getRepository(Screen::class)->findOneBy(['id' => $ulid])
         );
     }
+
+    public function testScreenAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Screen::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/screens', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $layoutIri = $this->findIriBy(ScreenLayout::class, ['title' => '2 boxes']);
+        $response = $client->request('POST', '/v2/screens', [
+            'json' => [
+                'title' => 'Test screen for ROLE_EDITOR',
+                'layout' => $layoutIri,
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testScreenAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Screen::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/screens', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $layoutIri = $this->findIriBy(ScreenLayout::class, ['title' => '2 boxes']);
+        $client->request('POST', '/v2/screens', [
+            'json' => [
+                'title' => 'Test screen for ROLE_USER',
+                'layout' => $layoutIri,
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/SlidesTest.php b/tests/Api/SlidesTest.php
index 492ef980b..b040c980c 100644
--- a/tests/Api/SlidesTest.php
+++ b/tests/Api/SlidesTest.php
@@ -9,6 +9,7 @@
 use App\Entity\Tenant\Slide;
 use App\Entity\Tenant\Theme;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 
 class SlidesTest extends AbstractBaseApiTestCase
 {
@@ -312,4 +313,93 @@ public function testDeleteSlide(): void
             static::getContainer()->get('doctrine')->getRepository(Slide::class)->findOneBy(['id' => $ulid])
         );
     }
+
+    public function testSlideAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Slide::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/slides', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $templateIri = $this->findIriBy(Template::class, ['title' => 'Image-Text']);
+        $themeIri = $this->findIriBy(Theme::class, ['title' => 'Image-Text']);
+        $response = $client->request('POST', '/v2/slides', [
+            'json' => [
+                'title' => 'Test slide for ROLE_EDITOR',
+                'template' => $templateIri,
+                'theme' => $themeIri,
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testSlideAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Slide::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/slides', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $templateIri = $this->findIriBy(Template::class, ['title' => 'Image-Text']);
+        $themeIri = $this->findIriBy(Theme::class, ['title' => 'Image-Text']);
+        $client->request('POST', '/v2/slides', [
+            'json' => [
+                'title' => 'Test slide for ROLE_USER',
+                'template' => $templateIri,
+                'theme' => $themeIri,
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/ThemesTest.php b/tests/Api/ThemesTest.php
index 4cb8ca9c8..4dd4be3a1 100644
--- a/tests/Api/ThemesTest.php
+++ b/tests/Api/ThemesTest.php
@@ -7,6 +7,7 @@
 use App\Entity\Tenant\Slide;
 use App\Entity\Tenant\Theme;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 
 class ThemesTest extends AbstractBaseApiTestCase
 {
@@ -215,4 +216,76 @@ public function testDeleteThemeInUse(): void
             static::getContainer()->get('doctrine')->getRepository(Theme::class)->findOneBy(['id' => $ulid])
         );
     }
+
+    public function testThemeAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Theme::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/themes', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+    }
+
+    public function testThemeAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Theme::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/themes', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testThemeAuthorizationRoleAdminCanCreateDelete(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_ADMIN);
+
+        // Test POST - ROLE_ADMIN should have access (not ROLE_EDITOR)
+        $response = $client->request('POST', '/v2/themes', [
+            'json' => [
+                'title' => 'Test theme for ROLE_ADMIN',
+                'logo' => 'data:image/svg+xml;base64,test',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test DELETE - ROLE_ADMIN should have access (not ROLE_EDITOR)
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testThemeAuthorizationRoleEditorCannotCreateDelete(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Theme::class, ['tenant' => $this->tenant]);
+
+        // Test POST - ROLE_EDITOR should be denied (only ROLE_ADMIN can create)
+        $client->request('POST', '/v2/themes', [
+            'json' => [
+                'title' => 'Test theme for ROLE_EDITOR',
+                'logo' => 'data:image/svg+xml;base64,test',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_EDITOR should be denied (only ROLE_ADMIN can delete)
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }