diff --git a/src/modules/notifications/controllers/notifications.controller.ts b/src/modules/notifications/controllers/notifications.controller.ts
index bccf4e5..0d1aa5f 100644
--- a/src/modules/notifications/controllers/notifications.controller.ts
+++ b/src/modules/notifications/controllers/notifications.controller.ts
@@ -11,6 +11,8 @@ import { AdminId } from 'src/common/decorators/admin-id.decorator';
 import { API_HEADER_SLUG } from 'src/common/constants/index';
 import { NotificationMessage } from 'src/common/enums/message.enum';
 import { SuperAdminAuthGuard } from 'src/modules/auth/guards/superAdminAuth.guard';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { Permission } from 'src/common/enums/permission.enum';
 
 @ApiTags('notifications')
 @Controller()
@@ -104,7 +106,7 @@ export class NotificationsController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
-  @Get('admin/notifications/unseen-count')
+   @Get('admin/notifications/unseen-count')
   @ApiOperation({ summary: 'Get unseen notifications count for admin' })
   async getAdminUnseenCount(@AdminId() adminId: string, @RestId() restaurantId: string) {
     const count = await this.notificationService.countUnseenByRestaurant(adminId, restaurantId);
@@ -132,6 +134,7 @@ export class NotificationsController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SETTINGS)
   @Get('admin/notification-preferences')
   @ApiOperation({ summary: 'Get all notification preferences for a restaurant' })
   async getPreferences(@RestId() restaurantId: string) {
@@ -140,6 +143,7 @@ export class NotificationsController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SETTINGS)
   @Patch('admin/notification-preferences/:id')
   @ApiOperation({ summary: 'Update notification channels' })
   @ApiParam({ name: 'id', description: 'Notification preference ID' })
diff --git a/src/modules/restaurants/controllers/restaurants.controller.ts b/src/modules/restaurants/controllers/restaurants.controller.ts
index 7752a13..a9bffed 100644
--- a/src/modules/restaurants/controllers/restaurants.controller.ts
+++ b/src/modules/restaurants/controllers/restaurants.controller.ts
@@ -16,6 +16,8 @@ import {
 import { RestId } from 'src/common/decorators';
 import { API_HEADER_SLUG } from 'src/common/constants';
 import { SuperAdminAuthGuard } from 'src/modules/auth/guards/superAdminAuth.guard';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { Permission } from 'src/common/enums/permission.enum';
 
 @ApiTags('restaurants')
 @Controller()
@@ -34,6 +36,7 @@ export class RestaurantsController {
   /** Admin Endpoints */
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.UPDATE_RESTAURANT)
   @Post('admin/restaurants')
   @ApiOperation({ summary: 'Create a new restaurant' })
   @ApiBody({ type: CreateRestaurantDto })
@@ -44,7 +47,7 @@ export class RestaurantsController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
-  @ApiBearerAuth('admin/restaurants')
+  @Permissions(Permission.UPDATE_RESTAURANT)
   @ApiOperation({ summary: 'Get restaurant by ID from request' })
   @Get('admin/restaurants/my-restaurant')
   async findOne(@RestId() restId: string) {
@@ -53,6 +56,7 @@ export class RestaurantsController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.UPDATE_RESTAURANT)
   @ApiOperation({ summary: 'Update a restaurant' })
   @ApiBody({ type: UpdateRestaurantDto })
   @Patch('admin/restaurants/my-restaurant')
@@ -62,6 +66,7 @@ export class RestaurantsController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.UPDATE_RESTAURANT)
   @ApiOperation({ summary: 'Delete a restaurant' })
   @Delete('admin/restaurants/:id')
   remove(@Param('id') id: string) {
diff --git a/src/modules/restaurants/controllers/schedule.controller.ts b/src/modules/restaurants/controllers/schedule.controller.ts
index e35fc20..65a7a76 100644
--- a/src/modules/restaurants/controllers/schedule.controller.ts
+++ b/src/modules/restaurants/controllers/schedule.controller.ts
@@ -18,30 +18,29 @@ import { FindSchedulesDto } from '../dto/find-schedules.dto';
 import { Schedule } from '../entities/schedule.entity';
 import { AdminAuthGuard } from 'src/modules/auth/guards/adminAuth.guard';
 import { RestId } from 'src/common/decorators/rest-id.decorator';
+import { Permissions } from 'src/common/decorators/permissions.decorator';
+import { Permission } from 'src/common/enums/permission.enum';
+import { API_HEADER_SLUG } from 'src/common/constants';
 
 @ApiTags('schedules')
 @Controller()
 export class ScheduleController {
-  constructor(private readonly scheduleService: ScheduleService) {}
+  constructor(private readonly scheduleService: ScheduleService) { }
 
   @Get('public/schedules/restaurant/:slug')
   @ApiOperation({ summary: 'Get schedule of a restaurant by slug' })
-  @ApiHeader({
-    name: 'X-Slug',
-    required: true,
-    schema: {
-      type: 'string',
-      default: 'zhivan',
-    },
-  })
+  @ApiHeader(API_HEADER_SLUG)
   @ApiParam({ name: 'slug', description: 'Restaurant Slug' })
   @ApiOkResponse({ description: 'Today schedule of the restaurant', type: Schedule })
   async getTodaySchedules(@Param('slug') slug: string): Promise<Schedule[]> {
     return this.scheduleService.findScheduleBySlug(slug);
   }
 
+  /********************  Admin Routes **********************/
+
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Post('admin/schedules')
   @ApiOperation({ summary: 'Create a new schedule' })
   @ApiBody({ type: CreateScheduleDto })
@@ -52,6 +51,7 @@ export class ScheduleController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Get('admin/schedules')
   @ApiOperation({ summary: 'Get all schedules' })
   @ApiQuery({
@@ -70,6 +70,7 @@ export class ScheduleController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Get('admin/schedules/:id')
   @ApiOperation({ summary: 'Get a schedule by ID' })
   @ApiParam({ name: 'id', description: 'Schedule ID' })
@@ -81,6 +82,7 @@ export class ScheduleController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Patch('admin/schedules/:id')
   @ApiOperation({ summary: 'Update a schedule' })
   @ApiParam({ name: 'id', description: 'Schedule ID' })
@@ -93,6 +95,7 @@ export class ScheduleController {
 
   @UseGuards(AdminAuthGuard)
   @ApiBearerAuth()
+  @Permissions(Permission.MANAGE_SCHEDULES)
   @Delete('admin/schedules/:id')
   @ApiOperation({ summary: 'Delete a schedule' })
   @ApiParam({ name: 'id', description: 'Schedule ID' })
diff --git a/src/modules/roles/controllers/roles.controller.ts b/src/modules/roles/controllers/roles.controller.ts
index cd4a083..2269181 100644
--- a/src/modules/roles/controllers/roles.controller.ts
+++ b/src/modules/roles/controllers/roles.controller.ts
@@ -36,7 +36,6 @@ export class RolesController {
     return adminPermissionNames;
   }
 
-  @Permissions('create_role')
   @Post()
   @ApiOperation({ summary: 'Create a new role' })
   @ApiBody({ type: CreateRoleDto })