diff --git a/src/automation/controllers/automation.controller.ts b/src/automation/controllers/automation.controller.ts
index 8d9d1ab..265638c 100644
--- a/src/automation/controllers/automation.controller.ts
+++ b/src/automation/controllers/automation.controller.ts
@@ -16,10 +16,11 @@ import {
   UpdateAutomationDto,
   UpdateAutomationStatusDto,
 } from '../dtos/automation.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { AutomationParamDto, SpaceParamDto } from '../dtos';
 import { ControllerRoute } from '@app/common/constants/controller-route';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Automation Module')
 @Controller({
@@ -30,7 +31,8 @@ export class AutomationController {
   constructor(private readonly automationService: AutomationService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_ADD')
   @Post()
   @ApiOperation({
     summary: ControllerRoute.AUTOMATION.ACTIONS.ADD_AUTOMATION_SUMMARY,
@@ -48,7 +50,8 @@ export class AutomationController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_VIEW')
   @Get(':spaceUuid')
   @ApiOperation({
     summary: ControllerRoute.AUTOMATION.ACTIONS.GET_AUTOMATION_BY_SPACE_SUMMARY,
@@ -63,7 +66,8 @@ export class AutomationController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_VIEW')
   @Get('details/:automationUuid')
   @ApiOperation({
     summary: ControllerRoute.AUTOMATION.ACTIONS.GET_AUTOMATION_DETAILS_SUMMARY,
@@ -78,7 +82,8 @@ export class AutomationController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_DELETE')
   @Delete(':automationUuid')
   @ApiOperation({
     summary: ControllerRoute.AUTOMATION.ACTIONS.DELETE_AUTOMATION_SUMMARY,
@@ -94,7 +99,8 @@ export class AutomationController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_UPDATE')
   @Put(':automationUuid')
   @ApiOperation({
     summary: ControllerRoute.AUTOMATION.ACTIONS.UPDATE_AUTOMATION_SUMMARY,
@@ -118,7 +124,8 @@ export class AutomationController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_UPDATE')
   @Put('status/:automationUuid')
   @ApiOperation({
     summary:
diff --git a/src/community/controllers/community.controller.ts b/src/community/controllers/community.controller.ts
index 5548e84..e823989 100644
--- a/src/community/controllers/community.controller.ts
+++ b/src/community/controllers/community.controller.ts
@@ -15,11 +15,12 @@ import { AddCommunityDto } from '../dtos/add.community.dto';
 import { GetCommunityParams } from '../dtos/get.community.dto';
 import { UpdateCommunityNameDto } from '../dtos/update.community.dto';
 // import { CheckUserCommunityGuard } from 'src/guards/user.community.guard';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { ControllerRoute } from '@app/common/constants/controller-route';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { PaginationRequestGetListDto } from '@app/common/dto/pagination.request.dto';
 import { ProjectParam } from '../dtos';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Community Module')
 @Controller({
@@ -30,7 +31,8 @@ export class CommunityController {
   constructor(private readonly communityService: CommunityService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_ADD')
   @Post()
   @ApiOperation({
     summary: ControllerRoute.COMMUNITY.ACTIONS.CREATE_COMMUNITY_SUMMARY,
@@ -44,7 +46,8 @@ export class CommunityController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_VIEW')
   @ApiOperation({
     summary: ControllerRoute.COMMUNITY.ACTIONS.GET_COMMUNITY_BY_ID_SUMMARY,
     description:
@@ -58,7 +61,8 @@ export class CommunityController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_VIEW')
   @ApiOperation({
     summary: ControllerRoute.COMMUNITY.ACTIONS.LIST_COMMUNITY_SUMMARY,
     description: ControllerRoute.COMMUNITY.ACTIONS.LIST_COMMUNITY_DESCRIPTION,
@@ -72,7 +76,8 @@ export class CommunityController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_UPDATE')
   @ApiOperation({
     summary: ControllerRoute.COMMUNITY.ACTIONS.UPDATE_COMMUNITY_SUMMARY,
     description: ControllerRoute.COMMUNITY.ACTIONS.UPDATE_COMMUNITY_DESCRIPTION,
@@ -86,7 +91,8 @@ export class CommunityController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_DELETE')
   @Delete('/:communityUuid')
   @ApiOperation({
     summary: ControllerRoute.COMMUNITY.ACTIONS.DELETE_COMMUNITY_SUMMARY,
diff --git a/src/device/controllers/device.controller.ts b/src/device/controllers/device.controller.ts
index a49b1f7..26b49ea 100644
--- a/src/device/controllers/device.controller.ts
+++ b/src/device/controllers/device.controller.ts
@@ -28,15 +28,15 @@ import {
   GetSceneFourSceneDeviceDto,
 } from '../dtos/control.device.dto';
 import { CheckRoomGuard } from 'src/guards/room.guard';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { CheckDeviceGuard } from 'src/guards/device.guard';
-import { SuperAdminRoleGuard } from 'src/guards/super.admin.role.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { CheckFourAndSixSceneDeviceTypeGuard } from 'src/guards/scene.device.type.guard';
 import { ControllerRoute } from '@app/common/constants/controller-route';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { DeviceSceneParamDto } from '../dtos/device.param.dto';
 import { DeleteSceneFromSceneDeviceDto } from '../dtos/delete.device.dto';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Device Module')
 @Controller({
@@ -46,7 +46,8 @@ import { DeleteSceneFromSceneDeviceDto } from '../dtos/delete.device.dto';
 export class DeviceController {
   constructor(private readonly deviceService: DeviceService) {}
   @ApiBearerAuth()
-  @UseGuards(SuperAdminRoleGuard, CheckDeviceGuard)
+  @UseGuards(PermissionsGuard, CheckDeviceGuard)
+  @Permissions('ASSIGN_DEVICE_TO_SPACE')
   @Post()
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.ADD_DEVICE_TO_USER_SUMMARY,
@@ -63,7 +64,8 @@ export class DeviceController {
     };
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
   @Get('user/:userUuid')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICES_BY_USER_SUMMARY,
@@ -74,7 +76,8 @@ export class DeviceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_IN_SPACE')
   @Get('space/:spaceUuid')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICES_BY_SPACE_UUID_SUMMARY,
@@ -85,7 +88,8 @@ export class DeviceController {
     return await this.deviceService.getDevicesBySpaceUuid(spaceUuid);
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard, CheckRoomGuard)
+  @UseGuards(PermissionsGuard, CheckRoomGuard)
+  @Permissions('UPDATE_DEVICE_IN_SUBSPACE')
   @Put('space')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.UPDATE_DEVICE_IN_ROOM_SUMMARY,
@@ -108,7 +112,8 @@ export class DeviceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
   @Get(':deviceUuid')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICE_DETAILS_SUMMARY,
@@ -125,7 +130,8 @@ export class DeviceController {
     );
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_UPDATE')
   @Put(':deviceUuid')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.UPDATE_DEVICE_SUMMARY,
@@ -149,7 +155,8 @@ export class DeviceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
   @Get(':deviceUuid/functions')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICE_INSTRUCTION_SUMMARY,
@@ -162,7 +169,8 @@ export class DeviceController {
     return await this.deviceService.getDeviceInstructionByDeviceId(deviceUuid);
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
   @Get(':deviceUuid/functions/status')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICE_STATUS_SUMMARY,
@@ -173,7 +181,8 @@ export class DeviceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_SINGLE_CONTROL')
   @Post(':deviceUuid/control')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.CONTROL_DEVICE_SUMMARY,
@@ -186,7 +195,8 @@ export class DeviceController {
     return await this.deviceService.controlDevice(controlDeviceDto, deviceUuid);
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('FIRMWARE_CONTROL')
   @Post(':deviceUuid/firmware/:firmwareVersion')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.UPDATE_DEVICE_FIRMWARE_SUMMARY,
@@ -203,7 +213,8 @@ export class DeviceController {
     );
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
   @Get('gateway/:gatewayUuid/devices')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICES_IN_GATEWAY_SUMMARY,
@@ -214,7 +225,8 @@ export class DeviceController {
     return await this.deviceService.getDevicesInGateway(gatewayUuid);
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
   @Get()
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_ALL_DEVICES_SUMMARY,
@@ -225,7 +237,8 @@ export class DeviceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
   @Get('report-logs/:deviceUuid')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICE_LOGS_SUMMARY,
@@ -238,7 +251,8 @@ export class DeviceController {
     return await this.deviceService.getDeviceLogs(deviceUuid, query);
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_BATCH_CONTROL')
   @Post('control/batch')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.BATCH_CONTROL_DEVICES_SUMMARY,
@@ -251,7 +265,8 @@ export class DeviceController {
     return await this.deviceService.batchControlDevices(batchControlDevicesDto);
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_BATCH_CONTROL')
   @Get('status/batch')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.BATCH_STATUS_DEVICES_SUMMARY,
@@ -264,7 +279,8 @@ export class DeviceController {
     return await this.deviceService.batchStatusDevices(batchStatusDevicesDto);
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_DELETE')
   @Post('factory/reset/:deviceUuid')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.BATCH_FACTORY_RESET_DEVICES_SUMMARY,
@@ -279,7 +295,8 @@ export class DeviceController {
     );
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
   @Get(':powerClampUuid/power-clamp/status')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_POWER_CLAMP_STATUS_SUMMARY,
@@ -294,7 +311,8 @@ export class DeviceController {
     );
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard, CheckFourAndSixSceneDeviceTypeGuard)
+  @UseGuards(PermissionsGuard, CheckFourAndSixSceneDeviceTypeGuard)
+  @Permissions('DEVICE_SINGLE_CONTROL')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.ADD_SCENE_TO_DEVICE_SUMMARY,
     description: ControllerRoute.DEVICE.ACTIONS.ADD_SCENE_TO_DEVICE_DESCRIPTION,
@@ -317,7 +335,8 @@ export class DeviceController {
     };
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard, CheckFourAndSixSceneDeviceTypeGuard)
+  @UseGuards(PermissionsGuard, CheckFourAndSixSceneDeviceTypeGuard)
+  @Permissions('DEVICE_VIEW')
   @Get(':deviceUuid/scenes')
   @ApiOperation({
     summary: ControllerRoute.DEVICE.ACTIONS.GET_SCENES_BY_DEVICE_SUMMARY,
@@ -334,7 +353,8 @@ export class DeviceController {
     );
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_DELETE')
   @Delete(':deviceUuid/scenes')
   @ApiOperation({
     summary:
diff --git a/src/group/controllers/group.controller.ts b/src/group/controllers/group.controller.ts
index a5d7cd7..513bbeb 100644
--- a/src/group/controllers/group.controller.ts
+++ b/src/group/controllers/group.controller.ts
@@ -1,9 +1,10 @@
 import { GroupService } from '../services/group.service';
 import { Controller, Get, UseGuards, Param, Req } from '@nestjs/common';
 import { ApiTags, ApiBearerAuth, ApiOperation } from '@nestjs/swagger';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { ControllerRoute } from '@app/common/constants/controller-route'; // Assuming this is where the routes are defined
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Group Module')
 @Controller({
@@ -14,7 +15,8 @@ export class GroupController {
   constructor(private readonly groupService: GroupService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_WIZARD')
   @Get(':spaceUuid')
   @ApiOperation({
     summary: ControllerRoute.GROUP.ACTIONS.GET_GROUPS_BY_SPACE_UUID_SUMMARY,
@@ -26,7 +28,8 @@ export class GroupController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_WIZARD')
   @Get(':spaceUuid/devices/:groupName')
   @ApiOperation({
     summary:
diff --git a/src/scene/controllers/scene.controller.ts b/src/scene/controllers/scene.controller.ts
index eaf67ec..655efe5 100644
--- a/src/scene/controllers/scene.controller.ts
+++ b/src/scene/controllers/scene.controller.ts
@@ -16,11 +16,12 @@ import {
   AddSceneTapToRunDto,
   UpdateSceneTapToRunDto,
 } from '../dtos/scene.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { SceneParamDto } from '../dtos';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { ControllerRoute } from '@app/common/constants/controller-route';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Scene Module')
 @Controller({
@@ -31,7 +32,8 @@ export class SceneController {
   constructor(private readonly sceneService: SceneService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_ADD')
   @Post('tap-to-run')
   @ApiOperation({
     summary: ControllerRoute.SCENE.ACTIONS.CREATE_TAP_TO_RUN_SCENE_SUMMARY,
@@ -45,7 +47,8 @@ export class SceneController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_DELETE')
   @Delete('tap-to-run/:sceneUuid')
   @ApiOperation({
     summary: ControllerRoute.SCENE.ACTIONS.DELETE_TAP_TO_RUN_SCENE_SUMMARY,
@@ -59,7 +62,8 @@ export class SceneController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_CONTROL')
   @Post('tap-to-run/:sceneUuid/trigger')
   @ApiOperation({
     summary: ControllerRoute.SCENE.ACTIONS.TRIGGER_TAP_TO_RUN_SCENE_SUMMARY,
@@ -71,7 +75,8 @@ export class SceneController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_VIEW')
   @Get('tap-to-run/:sceneUuid')
   @ApiOperation({
     summary: ControllerRoute.SCENE.ACTIONS.GET_TAP_TO_RUN_SCENE_SUMMARY,
@@ -84,7 +89,8 @@ export class SceneController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_UPDATE')
   @Put('tap-to-run/:sceneUuid')
   @ApiOperation({
     summary: ControllerRoute.SCENE.ACTIONS.UPDATE_TAP_TO_RUN_SCENE_SUMMARY,
@@ -102,7 +108,8 @@ export class SceneController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_ADD')
   @Post('icon')
   async addSceneIcon(@Body() addSceneIconDto: AddSceneIconDto) {
     const tapToRunScene = await this.sceneService.addSceneIcon(addSceneIconDto);
@@ -114,7 +121,8 @@ export class SceneController {
     };
   }
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_VIEW')
   @Get('icon')
   async getAllIcons() {
     const icons = await this.sceneService.getAllIcons();
diff --git a/src/space-model/controllers/space-model.controller.ts b/src/space-model/controllers/space-model.controller.ts
index 8475b6c..bedb81e 100644
--- a/src/space-model/controllers/space-model.controller.ts
+++ b/src/space-model/controllers/space-model.controller.ts
@@ -4,8 +4,9 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { SpaceModelService } from '../services';
 import { CreateSpaceModelDto } from '../dtos';
 import { ProjectParam } from 'src/community/dtos';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Space Model Module')
 @Controller({
@@ -16,7 +17,8 @@ export class SpaceModelController {
   constructor(private readonly spaceModelService: SpaceModelService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_MODULE_ADD')
   @ApiOperation({
     summary: ControllerRoute.SPACE_MODEL.ACTIONS.CREATE_SPACE_MODEL_SUMMARY,
     description:
diff --git a/src/space/controllers/space-device.controller.ts b/src/space/controllers/space-device.controller.ts
index 160a130..dbb1585 100644
--- a/src/space/controllers/space-device.controller.ts
+++ b/src/space/controllers/space-device.controller.ts
@@ -1,10 +1,11 @@
 import { ControllerRoute } from '@app/common/constants/controller-route';
 import { Controller, Get, Param, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { GetSpaceParam } from '../dtos';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { SpaceDeviceService } from '../services';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Space Module')
 @Controller({
@@ -15,7 +16,8 @@ export class SpaceDeviceController {
   constructor(private readonly spaceDeviceService: SpaceDeviceService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_IN_SPACE')
   @ApiOperation({
     summary: ControllerRoute.SPACE_DEVICES.ACTIONS.LIST_SPACE_DEVICE_SUMMARY,
     description:
diff --git a/src/space/controllers/space-scene.controller.ts b/src/space/controllers/space-scene.controller.ts
index 5517362..7d6a13d 100644
--- a/src/space/controllers/space-scene.controller.ts
+++ b/src/space/controllers/space-scene.controller.ts
@@ -1,11 +1,12 @@
 import { ControllerRoute } from '@app/common/constants/controller-route';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { Controller, Get, Param, Query, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { SpaceSceneService } from '../services';
 import { GetSceneDto } from '../../scene/dtos';
 import { GetSpaceParam } from '../dtos';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Space Module')
 @Controller({
@@ -16,7 +17,8 @@ export class SpaceSceneController {
   constructor(private readonly sceneService: SpaceSceneService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_VIEW')
   @ApiOperation({
     summary:
       ControllerRoute.SPACE_SCENE.ACTIONS.GET_TAP_TO_RUN_SCENE_BY_SPACE_SUMMARY,
diff --git a/src/space/controllers/space-user.controller.ts b/src/space/controllers/space-user.controller.ts
index 9efdac8..faf887a 100644
--- a/src/space/controllers/space-user.controller.ts
+++ b/src/space/controllers/space-user.controller.ts
@@ -3,8 +3,9 @@ import { Controller, Delete, Param, Post, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { SpaceUserService } from '../services';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { UserSpaceParam } from '../dtos';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Space Module')
 @Controller({
@@ -16,7 +17,8 @@ export class SpaceUserController {
 
   @ApiBearerAuth()
   @Post('/:userUuid')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('ASSIGN_USER_TO_SPACE')
   @ApiOperation({
     summary:
       ControllerRoute.SPACE_USER.ACTIONS.ASSOCIATE_SPACE_USER_DESCRIPTION,
@@ -31,7 +33,8 @@ export class SpaceUserController {
 
   @ApiBearerAuth()
   @Delete('/:userUuid')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DELETE_USER_FROM_SPACE')
   @ApiOperation({
     summary: ControllerRoute.SPACE_USER.ACTIONS.DISSOCIATE_SPACE_USER_SUMMARY,
     description:
diff --git a/src/space/controllers/space.controller.ts b/src/space/controllers/space.controller.ts
index d31bb23..18d556d 100644
--- a/src/space/controllers/space.controller.ts
+++ b/src/space/controllers/space.controller.ts
@@ -11,10 +11,11 @@ import {
   Put,
   UseGuards,
 } from '@nestjs/common';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { AddSpaceDto, CommunitySpaceParam, UpdateSpaceDto } from '../dtos';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { GetSpaceParam } from '../dtos/get.space.param';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Space Module')
 @Controller({
@@ -25,7 +26,8 @@ export class SpaceController {
   constructor(private readonly spaceService: SpaceService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_ADD')
   @ApiOperation({
     summary: ControllerRoute.SPACE.ACTIONS.CREATE_SPACE_SUMMARY,
     description: ControllerRoute.SPACE.ACTIONS.CREATE_SPACE_DESCRIPTION,
@@ -42,7 +44,8 @@ export class SpaceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_VIEW')
   @ApiOperation({
     summary:
       ControllerRoute.SPACE.ACTIONS.GET_COMMUNITY_SPACES_HIERARCHY_SUMMARY,
@@ -57,7 +60,8 @@ export class SpaceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_DELETE')
   @ApiOperation({
     summary: ControllerRoute.SPACE.ACTIONS.DELETE_SPACE_SUMMARY,
     description: ControllerRoute.SPACE.ACTIONS.DELETE_SPACE_DESCRIPTION,
@@ -68,7 +72,8 @@ export class SpaceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_UPDATE')
   @Put('/:spaceUuid')
   @ApiOperation({
     summary: ControllerRoute.SPACE.ACTIONS.UPDATE_SPACE_SUMMARY,
@@ -82,7 +87,8 @@ export class SpaceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_VIEW')
   @ApiOperation({
     summary: ControllerRoute.SPACE.ACTIONS.GET_SPACE_SUMMARY,
     description: ControllerRoute.SPACE.ACTIONS.GET_SPACE_DESCRIPTION,
@@ -93,7 +99,8 @@ export class SpaceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_VIEW')
   @ApiOperation({
     summary: ControllerRoute.SPACE.ACTIONS.GET_HEIRARCHY_SUMMARY,
     description: ControllerRoute.SPACE.ACTIONS.GET_HEIRARCHY_DESCRIPTION,
@@ -107,7 +114,8 @@ export class SpaceController {
 
   //should it be post?
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_MEMBER_ADD')
   @ApiOperation({
     summary: ControllerRoute.SPACE.ACTIONS.CREATE_INVITATION_CODE_SPACE_SUMMARY,
     description:
diff --git a/src/space/controllers/subspace/subspace-device.controller.ts b/src/space/controllers/subspace/subspace-device.controller.ts
index 189d490..1bb3db4 100644
--- a/src/space/controllers/subspace/subspace-device.controller.ts
+++ b/src/space/controllers/subspace/subspace-device.controller.ts
@@ -1,5 +1,4 @@
 import { ControllerRoute } from '@app/common/constants/controller-route';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import {
   Controller,
   Delete,
@@ -12,6 +11,8 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { DeviceSubSpaceParam, GetSubSpaceParam } from '../../dtos';
 import { SubspaceDeviceService } from 'src/space/services';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Space Module')
 @Controller({
@@ -22,7 +23,8 @@ export class SubSpaceDeviceController {
   constructor(private readonly subspaceDeviceService: SubspaceDeviceService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_IN_SUBSPACE')
   @ApiOperation({
     summary:
       ControllerRoute.SUBSPACE_DEVICE.ACTIONS.LIST_SUBSPACE_DEVICE_SUMMARY,
@@ -37,7 +39,8 @@ export class SubSpaceDeviceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('ASSIGN_DEVICE_TO_SUBSPACE')
   @ApiOperation({
     summary:
       ControllerRoute.SUBSPACE_DEVICE.ACTIONS.ASSOCIATE_SUBSPACE_DEVICE_SUMMARY,
@@ -53,7 +56,8 @@ export class SubSpaceDeviceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DELETE_DEVICE_FROM_SUBSPACE')
   @ApiOperation({
     summary:
       ControllerRoute.SUBSPACE_DEVICE.ACTIONS
diff --git a/src/space/controllers/subspace/subspace.controller.ts b/src/space/controllers/subspace/subspace.controller.ts
index 9f766c4..37e264b 100644
--- a/src/space/controllers/subspace/subspace.controller.ts
+++ b/src/space/controllers/subspace/subspace.controller.ts
@@ -14,8 +14,9 @@ import { SubSpaceService } from '../../services';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { AddSubspaceDto, GetSpaceParam, GetSubSpaceParam } from '../../dtos';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { PaginationRequestGetListDto } from '@app/common/dto/pagination.request.dto';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Space Module')
 @Controller({
@@ -26,7 +27,8 @@ export class SubSpaceController {
   constructor(private readonly subSpaceService: SubSpaceService) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_ADD')
   @Post()
   @ApiOperation({
     summary: ControllerRoute.SUBSPACE.ACTIONS.CREATE_SUBSPACE_SUMMARY,
@@ -40,7 +42,8 @@ export class SubSpaceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_VIEW')
   @ApiOperation({
     summary: ControllerRoute.SUBSPACE.ACTIONS.LIST_SUBSPACES_SUMMARY,
     description: ControllerRoute.SUBSPACE.ACTIONS.LIST_SUBSPACES_DESCRIPTION,
@@ -54,7 +57,8 @@ export class SubSpaceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_VIEW')
   @ApiOperation({
     summary: ControllerRoute.SUBSPACE.ACTIONS.GET_SUBSPACE_SUMMARY,
     description: ControllerRoute.SUBSPACE.ACTIONS.GET_SUBSPACE_DESCRIPTION,
@@ -65,7 +69,8 @@ export class SubSpaceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_UPDATE')
   @ApiOperation({
     summary: ControllerRoute.SUBSPACE.ACTIONS.UPDATE_SUBSPACE_SUMMARY,
     description: ControllerRoute.SUBSPACE.ACTIONS.UPDATE_SUBSPACE_DESCRIPTION,
@@ -79,7 +84,8 @@ export class SubSpaceController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_DELETE')
   @ApiOperation({
     summary: ControllerRoute.SUBSPACE.ACTIONS.DELETE_SUBSPACE_SUMMARY,
     description: ControllerRoute.SUBSPACE.ACTIONS.DELETE_SUBSPACE_DESCRIPTION,
diff --git a/src/vistor-password/controllers/visitor-password.controller.ts b/src/vistor-password/controllers/visitor-password.controller.ts
index 55276be..a298114 100644
--- a/src/vistor-password/controllers/visitor-password.controller.ts
+++ b/src/vistor-password/controllers/visitor-password.controller.ts
@@ -15,9 +15,10 @@ import {
   AddDoorLockOnlineMultipleDto,
   AddDoorLockOnlineOneTimeDto,
 } from '../dtos/temp-pass.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { ControllerRoute } from '@app/common/constants/controller-route';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';
 
 @ApiTags('Visitor Password Module')
 @Controller({
@@ -30,7 +31,8 @@ export class VisitorPasswordController {
   ) {}
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_ADD')
   @Post('temporary-password/online/multiple-time')
   @ApiOperation({
     summary:
@@ -58,7 +60,8 @@ export class VisitorPasswordController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_ADD')
   @Post('temporary-password/online/one-time')
   @ApiOperation({
     summary:
@@ -86,7 +89,8 @@ export class VisitorPasswordController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_ADD')
   @Post('temporary-password/offline/one-time')
   @ApiOperation({
     summary:
@@ -114,7 +118,8 @@ export class VisitorPasswordController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_ADD')
   @Post('temporary-password/offline/multiple-time')
   @ApiOperation({
     summary:
@@ -143,7 +148,8 @@ export class VisitorPasswordController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_VIEW')
   @Get()
   @ApiOperation({
     summary:
@@ -156,7 +162,8 @@ export class VisitorPasswordController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_VIEW')
   @Get('/devices')
   @ApiOperation({
     summary: