diff --git a/core/net/src/main/java/org/onosproject/cluster/impl/ClusterMetadataManager.java b/core/net/src/main/java/org/onosproject/cluster/impl/ClusterMetadataManager.java
index f655fcc..2ec9ff3 100644
--- a/core/net/src/main/java/org/onosproject/cluster/impl/ClusterMetadataManager.java
+++ b/core/net/src/main/java/org/onosproject/cluster/impl/ClusterMetadataManager.java
@@ -15,17 +15,6 @@
  */
 package org.onosproject.cluster.impl;
 
-import static com.google.common.base.Preconditions.checkNotNull;
-import static org.slf4j.LoggerFactory.getLogger;
-
-import java.net.InetAddress;
-import java.net.MalformedURLException;
-import java.net.NetworkInterface;
-import java.net.SocketException;
-import java.net.URL;
-import java.util.Collection;
-import java.util.Enumeration;
-
 import org.apache.felix.scr.annotations.Activate;
 import org.apache.felix.scr.annotations.Component;
 import org.apache.felix.scr.annotations.Deactivate;
@@ -47,6 +36,19 @@
 import org.onosproject.store.service.Versioned;
 import org.slf4j.Logger;
 
+import java.net.InetAddress;
+import java.net.MalformedURLException;
+import java.net.NetworkInterface;
+import java.net.SocketException;
+import java.net.URL;
+import java.util.Collection;
+import java.util.Enumeration;
+
+import static com.google.common.base.Preconditions.checkNotNull;
+import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.CLUSTER_READ;
+import static org.slf4j.LoggerFactory.getLogger;
+
 /**
  * Implementation of ClusterMetadataService.
  */
@@ -77,6 +79,7 @@
 
     @Override
     public ClusterMetadata getClusterMetadata() {
+        checkPermission(CLUSTER_READ);
         Versioned<ClusterMetadata> metadata = getProvider().getClusterMetadata();
         return metadata.value();
     }
@@ -85,11 +88,13 @@
     @Override
     protected ClusterMetadataProviderService createProviderService(
             ClusterMetadataProvider provider) {
+        checkPermission(CLUSTER_READ);
         return new InternalClusterMetadataProviderService(provider);
     }
 
     @Override
     public ControllerNode getLocalNode() {
+        checkPermission(CLUSTER_READ);
         if (localNode == null) {
             establishSelfIdentity();
         }
@@ -188,4 +193,4 @@
             // TODO: notify listeners
         }
     }
-}
\ No newline at end of file
+}
diff --git a/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java b/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
index 56d369f..50a3350 100644
--- a/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
+++ b/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
@@ -187,6 +187,7 @@
 
     @Override
     public MastershipTerm getMastershipTerm(DeviceId deviceId) {
+        checkPermission(CLUSTER_READ);
         return store.getTermFor(deviceId);
     }
 
diff --git a/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java b/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
index eae8cf6..6b4f76e 100644
--- a/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
+++ b/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
@@ -50,8 +50,7 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Strings.isNullOrEmpty;
 import static org.onosproject.security.AppGuard.checkPermission;
-import static org.onosproject.security.AppPermission.Type.APP_READ;
-
+import static org.onosproject.security.AppPermission.Type.*;
 
 
 /**
@@ -149,12 +148,14 @@
 
     @Override
     public ApplicationId registerApplication(String name) {
+        checkPermission(APP_WRITE);
         checkNotNull(name, "Application ID cannot be null");
         return applicationIdStore.registerApplication(name);
     }
 
     @Override
     public ApplicationId registerApplication(String name, Runnable preDeactivate) {
+        checkPermission(APP_WRITE);
         ApplicationId id = registerApplication(name);
         appService.registerDeactivateHook(id, preDeactivate);
         return id;
@@ -162,6 +163,7 @@
 
     @Override
     public IdGenerator getIdGenerator(String topic) {
+        checkPermission(APP_READ);
         IdBlockAllocator allocator = new StoreBasedIdBlockAllocator(topic, idBlockStore);
         return new BlockAllocatorBasedIdGenerator(allocator);
     }
diff --git a/core/net/src/main/java/org/onosproject/event/impl/CoreEventDispatcher.java b/core/net/src/main/java/org/onosproject/event/impl/CoreEventDispatcher.java
index e63ecdf..3d9df6b 100644
--- a/core/net/src/main/java/org/onosproject/event/impl/CoreEventDispatcher.java
+++ b/core/net/src/main/java/org/onosproject/event/impl/CoreEventDispatcher.java
@@ -38,6 +38,8 @@
 import static org.onlab.util.Tools.groupedThreads;
 import static org.slf4j.LoggerFactory.getLogger;
 
+import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.*;
 /**
  * Simple implementation of an event dispatching service.
  */
@@ -96,6 +98,7 @@
 
     @Override
     public void setDispatchTimeLimit(long millis) {
+        checkPermission(EVENT_WRITE);
         checkArgument(millis >= WATCHDOG_MS,
                       "Time limit must be greater than %s", WATCHDOG_MS);
         maxProcessMillis = millis;
@@ -103,6 +106,7 @@
 
     @Override
     public long getDispatchTimeLimit() {
+        checkPermission(EVENT_READ);
         return maxProcessMillis;
     }
 
diff --git a/core/net/src/main/java/org/onosproject/net/config/impl/NetworkConfigManager.java b/core/net/src/main/java/org/onosproject/net/config/impl/NetworkConfigManager.java
index 9f041e6..2353c1e 100644
--- a/core/net/src/main/java/org/onosproject/net/config/impl/NetworkConfigManager.java
+++ b/core/net/src/main/java/org/onosproject/net/config/impl/NetworkConfigManager.java
@@ -42,6 +42,8 @@
 import java.util.Set;
 
 import static com.google.common.base.Preconditions.checkNotNull;
+import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.*;
 
 /**
  * Implementation of the network configuration subsystem.
@@ -142,6 +144,7 @@
 
     @Override
     public Set<Class> getSubjectClasses() {
+        checkPermission(CONFIG_READ);
         ImmutableSet.Builder<Class> builder = ImmutableSet.builder();
         factories.forEach((k, v) -> builder.add(k.subjectClass));
         return builder.build();
@@ -149,16 +152,19 @@
 
     @Override
     public SubjectFactory getSubjectFactory(String subjectClassKey) {
+        checkPermission(CONFIG_READ);
         return subjectClasses.get(subjectClassKey);
     }
 
     @Override
     public SubjectFactory getSubjectFactory(Class subjectClass) {
+        checkPermission(CONFIG_READ);
         return subjectClassKeys.get(subjectClass);
     }
 
     @Override
     public Class<? extends Config> getConfigClass(String subjectClassKey, String configKey) {
+        checkPermission(CONFIG_READ);
         checkNotNull(subjectClassKey, NULL_SCKEY_MSG);
         checkNotNull(configKey, NULL_CKEY_MSG);
         return configClasses.get(new ConfigIdentifier(subjectClassKey, configKey));
@@ -166,12 +172,14 @@
 
     @Override
     public <S> Set<S> getSubjects(Class<S> subjectClass) {
+        checkPermission(CONFIG_READ);
         checkNotNull(subjectClass, NULL_SCLASS_MSG);
         return store.getSubjects(subjectClass);
     }
 
     @Override
     public <S, C extends Config<S>> Set<S> getSubjects(Class<S> subjectClass, Class<C> configClass) {
+        checkPermission(CONFIG_READ);
         checkNotNull(subjectClass, NULL_SCLASS_MSG);
         checkNotNull(configClass, NULL_CCLASS_MSG);
         return store.getSubjects(subjectClass, configClass);
@@ -179,6 +187,7 @@
 
     @Override
     public <S> Set<Config<S>> getConfigs(S subject) {
+        checkPermission(CONFIG_READ);
         checkNotNull(subject, NULL_SUBJECT_MSG);
         Set<Class<? extends Config<S>>> configClasses = store.getConfigClasses(subject);
         ImmutableSet.Builder<Config<S>> cfg = ImmutableSet.builder();
@@ -188,6 +197,7 @@
 
     @Override
     public <S, C extends Config<S>> C getConfig(S subject, Class<C> configClass) {
+        checkPermission(CONFIG_READ);
         checkNotNull(subject, NULL_SUBJECT_MSG);
         checkNotNull(configClass, NULL_CCLASS_MSG);
         return store.getConfig(subject, configClass);
@@ -196,6 +206,7 @@
 
     @Override
     public <S, C extends Config<S>> C addConfig(S subject, Class<C> configClass) {
+        checkPermission(CONFIG_WRITE);
         checkNotNull(subject, NULL_SUBJECT_MSG);
         checkNotNull(configClass, NULL_CCLASS_MSG);
         return store.createConfig(subject, configClass);
@@ -203,6 +214,7 @@
 
     @Override
     public <S, C extends Config<S>> C applyConfig(S subject, Class<C> configClass, JsonNode json) {
+        checkPermission(CONFIG_WRITE);
         checkNotNull(subject, NULL_SUBJECT_MSG);
         checkNotNull(configClass, NULL_CCLASS_MSG);
         checkNotNull(json, NULL_JSON_MSG);
@@ -213,6 +225,7 @@
     @SuppressWarnings("unchecked")
     public <S, C extends Config<S>> C applyConfig(String subjectClassKey, S subject,
                                                   String configKey, JsonNode json) {
+        checkPermission(CONFIG_WRITE);
         checkNotNull(subjectClassKey, NULL_SCKEY_MSG);
         checkNotNull(subject, NULL_SUBJECT_MSG);
         checkNotNull(configKey, NULL_CKEY_MSG);
@@ -229,6 +242,7 @@
 
     @Override
     public <S, C extends Config<S>> void removeConfig(S subject, Class<C> configClass) {
+        checkPermission(CONFIG_WRITE);
         checkNotNull(subject, NULL_SUBJECT_MSG);
         checkNotNull(configClass, NULL_CCLASS_MSG);
         store.clearConfig(subject, configClass);
diff --git a/core/net/src/main/java/org/onosproject/net/edgeservice/impl/EdgeManager.java b/core/net/src/main/java/org/onosproject/net/edgeservice/impl/EdgeManager.java
index 7340fc5..314d10f 100644
--- a/core/net/src/main/java/org/onosproject/net/edgeservice/impl/EdgeManager.java
+++ b/core/net/src/main/java/org/onosproject/net/edgeservice/impl/EdgeManager.java
@@ -56,6 +56,8 @@
 import static org.onosproject.net.edge.EdgePortEvent.Type.EDGE_PORT_ADDED;
 import static org.onosproject.net.edge.EdgePortEvent.Type.EDGE_PORT_REMOVED;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.*;
 
 /**
  * This is an implementation of the edge net service.
@@ -107,11 +109,13 @@
 
     @Override
     public boolean isEdgePoint(ConnectPoint point) {
+        checkPermission(TOPOLOGY_READ);
         return !topologyService.isInfrastructure(topologyService.currentTopology(), point);
     }
 
     @Override
     public Iterable<ConnectPoint> getEdgePoints() {
+        checkPermission(TOPOLOGY_READ);
         ImmutableSet.Builder<ConnectPoint> builder = ImmutableSet.builder();
         connectionPoints.forEach((k, v) -> v.forEach(builder::add));
         return builder.build();
@@ -119,6 +123,7 @@
 
     @Override
     public Iterable<ConnectPoint> getEdgePoints(DeviceId deviceId) {
+        checkPermission(TOPOLOGY_READ);
         ImmutableSet.Builder<ConnectPoint> builder = ImmutableSet.builder();
         Set<ConnectPoint> set = connectionPoints.get(deviceId);
         if (set != null) {
@@ -129,6 +134,7 @@
 
     @Override
     public void emitPacket(ByteBuffer data, Optional<TrafficTreatment> treatment) {
+        checkPermission(PACKET_WRITE);
         TrafficTreatment.Builder builder = treatment.map(DefaultTrafficTreatment::builder)
                 .orElse(DefaultTrafficTreatment.builder());
         getEdgePoints().forEach(p -> packetService.emit(packet(builder, p, data)));
diff --git a/core/net/src/main/java/org/onosproject/net/flowobjective/impl/composition/FlowObjectiveCompositionManager.java b/core/net/src/main/java/org/onosproject/net/flowobjective/impl/composition/FlowObjectiveCompositionManager.java
index a64b976..2041b5b 100644
--- a/core/net/src/main/java/org/onosproject/net/flowobjective/impl/composition/FlowObjectiveCompositionManager.java
+++ b/core/net/src/main/java/org/onosproject/net/flowobjective/impl/composition/FlowObjectiveCompositionManager.java
@@ -272,6 +272,7 @@
 
     @Override
     public void initPolicy(String policy) {
+        checkPermission(FLOWRULE_WRITE);
         this.policy = policy;
         deviceService.getDevices().forEach(device ->
                 this.deviceCompositionTreeMap.put(device.id(), FlowObjectiveCompositionUtil.parsePolicyString(policy)));
diff --git a/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java b/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
index 60b279f..61fc0df 100644
--- a/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
+++ b/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
@@ -282,16 +282,19 @@
 
     @Override
     public <T extends Intent> void registerCompiler(Class<T> cls, IntentCompiler<T> compiler) {
+        checkPermission(INTENT_WRITE);
         compilerRegistry.registerCompiler(cls, compiler);
     }
 
     @Override
     public <T extends Intent> void unregisterCompiler(Class<T> cls) {
+        checkPermission(INTENT_WRITE);
         compilerRegistry.unregisterCompiler(cls);
     }
 
     @Override
     public Map<Class<? extends Intent>, IntentCompiler<? extends Intent>> getCompilers() {
+        checkPermission(INTENT_READ);
         return compilerRegistry.getCompilers();
     }
 
diff --git a/core/net/src/main/java/org/onosproject/net/key/impl/DeviceKeyManager.java b/core/net/src/main/java/org/onosproject/net/key/impl/DeviceKeyManager.java
index 3bff95f..8d0841a 100644
--- a/core/net/src/main/java/org/onosproject/net/key/impl/DeviceKeyManager.java
+++ b/core/net/src/main/java/org/onosproject/net/key/impl/DeviceKeyManager.java
@@ -38,7 +38,6 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.onosproject.security.AppPermission.Type.DEVICE_KEY_READ;
-import static org.onosproject.security.AppPermission.Type.DEVICE_KEY_WRITE;
 import static org.slf4j.LoggerFactory.getLogger;
 
 /**
@@ -72,14 +71,12 @@
 
     @Override
     public void addKey(DeviceKey deviceKey) {
-        checkPermission(DEVICE_KEY_WRITE);
         checkNotNull(deviceKey, "Device key cannot be null");
         store.createOrUpdateDeviceKey(deviceKey);
     }
 
     @Override
     public void removeKey(DeviceKeyId deviceKeyId) {
-        checkPermission(DEVICE_KEY_WRITE);
         checkNotNull(deviceKeyId, "Device key identifier cannot be null");
         store.deleteDeviceKey(deviceKeyId);
     }
diff --git a/core/net/src/main/java/org/onosproject/net/newresource/impl/ResourceManager.java b/core/net/src/main/java/org/onosproject/net/newresource/impl/ResourceManager.java
index 88c3ab6..5b29401 100644
--- a/core/net/src/main/java/org/onosproject/net/newresource/impl/ResourceManager.java
+++ b/core/net/src/main/java/org/onosproject/net/newresource/impl/ResourceManager.java
@@ -45,6 +45,9 @@
 import java.util.stream.Collectors;
 
 import static com.google.common.base.Preconditions.checkNotNull;
+import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.RESOURCE_WRITE;
+import static org.onosproject.security.AppPermission.Type.RESOURCE_READ;
 import static org.slf4j.LoggerFactory.getLogger;
 
 /**
@@ -82,6 +85,7 @@
     @Override
     public List<ResourceAllocation> allocate(ResourceConsumer consumer,
                                              List<Resource> resources) {
+        checkPermission(RESOURCE_WRITE);
         checkNotNull(consumer);
         checkNotNull(resources);
 
@@ -97,6 +101,7 @@
 
     @Override
     public boolean release(List<ResourceAllocation> allocations) {
+        checkPermission(RESOURCE_WRITE);
         checkNotNull(allocations);
 
         return store.release(allocations);
@@ -112,6 +117,7 @@
 
     @Override
     public List<ResourceAllocation> getResourceAllocations(ResourceId id) {
+        checkPermission(RESOURCE_READ);
         checkNotNull(id);
 
         return store.getResourceAllocations(id);
@@ -119,6 +125,7 @@
 
     @Override
     public <T> Collection<ResourceAllocation> getResourceAllocations(DiscreteResourceId parent, Class<T> cls) {
+        checkPermission(RESOURCE_READ);
         checkNotNull(parent);
         checkNotNull(cls);
 
@@ -131,6 +138,7 @@
 
     @Override
     public Collection<ResourceAllocation> getResourceAllocations(ResourceConsumer consumer) {
+        checkPermission(RESOURCE_READ);
         checkNotNull(consumer);
 
         Collection<Resource> resources = store.getResources(consumer);
@@ -141,6 +149,7 @@
 
     @Override
     public Set<Resource> getAvailableResources(DiscreteResourceId parent) {
+        checkPermission(RESOURCE_READ);
         checkNotNull(parent);
 
         Set<Resource> children = store.getChildResources(parent);
@@ -152,6 +161,7 @@
 
     @Override
     public <T> Set<Resource> getAvailableResources(DiscreteResourceId parent, Class<T> cls) {
+        checkPermission(RESOURCE_READ);
         checkNotNull(parent);
         checkNotNull(cls);
 
@@ -163,6 +173,7 @@
 
     @Override
     public <T> Set<T> getAvailableResourceValues(DiscreteResourceId parent, Class<T> cls) {
+        checkPermission(RESOURCE_READ);
         checkNotNull(parent);
         checkNotNull(cls);
 
@@ -174,6 +185,7 @@
 
     @Override
     public Set<Resource> getRegisteredResources(DiscreteResourceId parent) {
+        checkPermission(RESOURCE_READ);
         checkNotNull(parent);
 
         return store.getChildResources(parent);
@@ -181,6 +193,7 @@
 
     @Override
     public boolean isAvailable(Resource resource) {
+        checkPermission(RESOURCE_READ);
         checkNotNull(resource);
 
         return store.isAvailable(resource);
diff --git a/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java b/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
index ba16d13..5f6014d 100644
--- a/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
+++ b/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
@@ -175,6 +175,7 @@
 
     @Override
     public List<PacketProcessorEntry> getProcessors() {
+        checkPermission(PACKET_READ);
         return ImmutableList.copyOf(processors);
     }
 
@@ -233,6 +234,7 @@
 
     @Override
     public List<PacketRequest> getRequests() {
+        checkPermission(PACKET_READ);
         return store.existingRequests();
     }
 
diff --git a/core/net/src/main/java/org/onosproject/net/region/impl/RegionManager.java b/core/net/src/main/java/org/onosproject/net/region/impl/RegionManager.java
index 52634ea..f0580bd 100644
--- a/core/net/src/main/java/org/onosproject/net/region/impl/RegionManager.java
+++ b/core/net/src/main/java/org/onosproject/net/region/impl/RegionManager.java
@@ -43,6 +43,8 @@
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.collect.ImmutableList.of;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.REGION_READ;
 
 /**
  * Provides implementation of the region service APIs.
@@ -122,23 +124,27 @@
 
     @Override
     public Set<Region> getRegions() {
+        checkPermission(REGION_READ);
         return store.getRegions();
     }
 
     @Override
     public Region getRegion(RegionId regionId) {
+        checkPermission(REGION_READ);
         checkNotNull(regionId, REGION_ID_NULL);
         return store.getRegion(regionId);
     }
 
     @Override
     public Region getRegionForDevice(DeviceId deviceId) {
+        checkPermission(REGION_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getRegionForDevice(deviceId);
     }
 
     @Override
     public Set<DeviceId> getRegionDevices(RegionId regionId) {
+        checkPermission(REGION_READ);
         checkNotNull(regionId, REGION_ID_NULL);
         return store.getRegionDevices(regionId);
     }
diff --git a/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java b/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
index 08071ec..dc289e2 100644
--- a/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
+++ b/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
@@ -134,11 +134,13 @@
 
     @Override
     public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst) {
+        checkPermission(TOPOLOGY_READ);
         return getDisjointPaths(src, dst, (LinkWeight) null);
     }
 
     @Override
     public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst, LinkWeight weight) {
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(src, ELEMENT_ID_NULL);
         checkNotNull(dst, ELEMENT_ID_NULL);
 
@@ -173,12 +175,14 @@
     @Override
     public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst,
                                               Map<Link, Object> riskProfile) {
+        checkPermission(TOPOLOGY_READ);
         return getDisjointPaths(src, dst, null, riskProfile);
     }
 
     @Override
     public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst, LinkWeight weight,
                                               Map<Link, Object> riskProfile) {
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(src, ELEMENT_ID_NULL);
         checkNotNull(dst, ELEMENT_ID_NULL);
 
diff --git a/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java b/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
index 4425e1c..8c21730 100644
--- a/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
+++ b/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
@@ -166,6 +166,7 @@
 
     @Override
     public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src, DeviceId dst) {
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(src, DEVICE_ID_NULL);
         checkNotNull(dst, DEVICE_ID_NULL);
@@ -175,6 +176,7 @@
     @Override
     public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src,
                                               DeviceId dst, LinkWeight weight) {
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(src, DEVICE_ID_NULL);
         checkNotNull(dst, DEVICE_ID_NULL);
@@ -185,6 +187,7 @@
     @Override
     public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src, DeviceId dst,
                                               Map<Link, Object> riskProfile) {
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(src, DEVICE_ID_NULL);
         checkNotNull(dst, DEVICE_ID_NULL);
@@ -195,6 +198,7 @@
     public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src,
                                               DeviceId dst, LinkWeight weight,
                                               Map<Link, Object> riskProfile) {
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(src, DEVICE_ID_NULL);
         checkNotNull(dst, DEVICE_ID_NULL);