diff --git a/core/net/src/main/java/org/onosproject/cluster/impl/ClusterMetadataManager.java b/core/net/src/main/java/org/onosproject/cluster/impl/ClusterMetadataManager.java
index f655fcc..2ec9ff3 100644
--- a/core/net/src/main/java/org/onosproject/cluster/impl/ClusterMetadataManager.java
+++ b/core/net/src/main/java/org/onosproject/cluster/impl/ClusterMetadataManager.java
@@ -15,17 +15,6 @@
  */
 package org.onosproject.cluster.impl;
 
-import static com.google.common.base.Preconditions.checkNotNull;
-import static org.slf4j.LoggerFactory.getLogger;
-
-import java.net.InetAddress;
-import java.net.MalformedURLException;
-import java.net.NetworkInterface;
-import java.net.SocketException;
-import java.net.URL;
-import java.util.Collection;
-import java.util.Enumeration;
-
 import org.apache.felix.scr.annotations.Activate;
 import org.apache.felix.scr.annotations.Component;
 import org.apache.felix.scr.annotations.Deactivate;
@@ -47,6 +36,19 @@
 import org.onosproject.store.service.Versioned;
 import org.slf4j.Logger;
 
+import java.net.InetAddress;
+import java.net.MalformedURLException;
+import java.net.NetworkInterface;
+import java.net.SocketException;
+import java.net.URL;
+import java.util.Collection;
+import java.util.Enumeration;
+
+import static com.google.common.base.Preconditions.checkNotNull;
+import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.CLUSTER_READ;
+import static org.slf4j.LoggerFactory.getLogger;
+
 /**
  * Implementation of ClusterMetadataService.
  */
@@ -77,6 +79,7 @@
 
     @Override
     public ClusterMetadata getClusterMetadata() {
+        checkPermission(CLUSTER_READ);
         Versioned<ClusterMetadata> metadata = getProvider().getClusterMetadata();
         return metadata.value();
     }
@@ -85,11 +88,13 @@
     @Override
     protected ClusterMetadataProviderService createProviderService(
             ClusterMetadataProvider provider) {
+        checkPermission(CLUSTER_READ);
         return new InternalClusterMetadataProviderService(provider);
     }
 
     @Override
     public ControllerNode getLocalNode() {
+        checkPermission(CLUSTER_READ);
         if (localNode == null) {
             establishSelfIdentity();
         }
@@ -188,4 +193,4 @@
             // TODO: notify listeners
         }
     }
-}
\ No newline at end of file
+}