diff --git a/core/net/src/main/java/org/onosproject/app/impl/ApplicationManager.java b/core/net/src/main/java/org/onosproject/app/impl/ApplicationManager.java
index a96d805..161659f 100644
--- a/core/net/src/main/java/org/onosproject/app/impl/ApplicationManager.java
+++ b/core/net/src/main/java/org/onosproject/app/impl/ApplicationManager.java
@@ -33,7 +33,8 @@
 import org.onosproject.event.AbstractListenerManager;
 import org.onosproject.core.Application;
 import org.onosproject.core.ApplicationId;
-import org.onosproject.core.Permission;
+import org.onosproject.security.Permission;
+import org.onosproject.security.SecurityUtil;
 import org.slf4j.Logger;
 
 import java.io.InputStream;
@@ -41,6 +42,7 @@
 
 import static com.google.common.base.Preconditions.checkNotNull;
 import static org.onosproject.app.ApplicationEvent.Type.*;
+import static org.onosproject.security.AppPermission.Type.*;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
 
@@ -87,34 +89,34 @@
 
     @Override
     public Set<Application> getApplications() {
-        checkPermission(Permission.APP_READ);
+        checkPermission(APP_READ);
         return store.getApplications();
     }
 
     @Override
     public ApplicationId getId(String name) {
-        checkPermission(Permission.APP_READ);
+        checkPermission(APP_READ);
         checkNotNull(name, "Name cannot be null");
         return store.getId(name);
     }
 
     @Override
     public Application getApplication(ApplicationId appId) {
-        checkPermission(Permission.APP_READ);
+        checkPermission(APP_READ);
         checkNotNull(appId, APP_ID_NULL);
         return store.getApplication(appId);
     }
 
     @Override
     public ApplicationState getState(ApplicationId appId) {
-        checkPermission(Permission.APP_READ);
+        checkPermission(APP_READ);
         checkNotNull(appId, APP_ID_NULL);
         return store.getState(appId);
     }
 
     @Override
     public Set<Permission> getPermissions(ApplicationId appId) {
-        checkPermission(Permission.APP_READ);
+        checkPermission(APP_READ);
         checkNotNull(appId, APP_ID_NULL);
         return store.getPermissions(appId);
     }
@@ -122,7 +124,9 @@
     @Override
     public Application install(InputStream appDescStream) {
         checkNotNull(appDescStream, "Application archive stream cannot be null");
-        return store.create(appDescStream);
+        Application app = store.create(appDescStream);
+        SecurityUtil.register(app.id());
+        return app;
     }
 
     @Override
@@ -138,6 +142,9 @@
     @Override
     public void activate(ApplicationId appId) {
         checkNotNull(appId, APP_ID_NULL);
+        if (!SecurityUtil.isAppSecured(appId)) {
+            return;
+        }
         store.activate(appId);
     }
 
diff --git a/core/net/src/main/java/org/onosproject/cfg/impl/ComponentConfigManager.java b/core/net/src/main/java/org/onosproject/cfg/impl/ComponentConfigManager.java
index 884d028..1933ee5 100644
--- a/core/net/src/main/java/org/onosproject/cfg/impl/ComponentConfigManager.java
+++ b/core/net/src/main/java/org/onosproject/cfg/impl/ComponentConfigManager.java
@@ -31,7 +31,6 @@
 import org.onosproject.cfg.ComponentConfigStore;
 import org.onosproject.cfg.ComponentConfigStoreDelegate;
 import org.onosproject.cfg.ConfigProperty;
-import org.onosproject.core.Permission;
 import org.osgi.service.cm.Configuration;
 import org.osgi.service.cm.ConfigurationAdmin;
 import org.slf4j.Logger;
@@ -50,6 +49,7 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
 
 
 /**
@@ -99,14 +99,14 @@
 
     @Override
     public Set<String> getComponentNames() {
-        checkPermission(Permission.CONFIG_READ);
+        checkPermission(CONFIG_READ);
 
         return ImmutableSet.copyOf(properties.keySet());
     }
 
     @Override
     public void registerProperties(Class<?> componentClass) {
-        checkPermission(Permission.CONFIG_WRITE);
+        checkPermission(CONFIG_WRITE);
 
         String componentName = componentClass.getName();
         String resourceName = componentClass.getSimpleName() + RESOURCE_EXT;
@@ -130,7 +130,7 @@
 
     @Override
     public void unregisterProperties(Class<?> componentClass, boolean clear) {
-        checkPermission(Permission.CONFIG_WRITE);
+        checkPermission(CONFIG_WRITE);
 
         String componentName = componentClass.getName();
         checkNotNull(componentName, COMPONENT_NULL);
@@ -148,7 +148,7 @@
 
     @Override
     public Set<ConfigProperty> getProperties(String componentName) {
-        checkPermission(Permission.CONFIG_READ);
+        checkPermission(CONFIG_READ);
 
         Map<String, ConfigProperty> map = properties.get(componentName);
         return map != null ? ImmutableSet.copyOf(map.values()) : null;
@@ -156,7 +156,7 @@
 
     @Override
     public void setProperty(String componentName, String name, String value) {
-        checkPermission(Permission.CONFIG_WRITE);
+        checkPermission(CONFIG_WRITE);
 
         checkNotNull(componentName, COMPONENT_NULL);
         checkNotNull(name, PROPERTY_NULL);
@@ -165,7 +165,7 @@
 
     @Override
     public void unsetProperty(String componentName, String name) {
-        checkPermission(Permission.CONFIG_WRITE);
+        checkPermission(CONFIG_WRITE);
 
         checkNotNull(componentName, COMPONENT_NULL);
         checkNotNull(name, PROPERTY_NULL);
diff --git a/core/net/src/main/java/org/onosproject/cluster/impl/ClusterManager.java b/core/net/src/main/java/org/onosproject/cluster/impl/ClusterManager.java
index a823817..04d1dfd 100644
--- a/core/net/src/main/java/org/onosproject/cluster/impl/ClusterManager.java
+++ b/core/net/src/main/java/org/onosproject/cluster/impl/ClusterManager.java
@@ -34,7 +34,6 @@
 import org.onosproject.cluster.ControllerNode;
 import org.onosproject.cluster.NodeId;
 import org.onosproject.event.AbstractListenerManager;
-import org.onosproject.core.Permission;
 import org.slf4j.Logger;
 
 import java.util.Set;
@@ -43,6 +42,8 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
+
 
 
 /**
@@ -86,26 +87,26 @@
 
     @Override
     public ControllerNode getLocalNode() {
-        checkPermission(Permission.CLUSTER_READ);
+        checkPermission(CLUSTER_READ);
         return store.getLocalNode();
     }
 
     @Override
     public Set<ControllerNode> getNodes() {
-        checkPermission(Permission.CLUSTER_READ);
+        checkPermission(CLUSTER_READ);
         return store.getNodes();
     }
 
     @Override
     public ControllerNode getNode(NodeId nodeId) {
-        checkPermission(Permission.CLUSTER_READ);
+        checkPermission(CLUSTER_READ);
         checkNotNull(nodeId, INSTANCE_ID_NULL);
         return store.getNode(nodeId);
     }
 
     @Override
     public ControllerNode.State getState(NodeId nodeId) {
-        checkPermission(Permission.CLUSTER_READ);
+        checkPermission(CLUSTER_READ);
         checkNotNull(nodeId, INSTANCE_ID_NULL);
         return store.getState(nodeId);
     }
@@ -113,7 +114,7 @@
 
     @Override
     public DateTime getLastUpdated(NodeId nodeId) {
-        checkPermission(Permission.CLUSTER_READ);
+        checkPermission(CLUSTER_READ);
         return store.getLastUpdated(nodeId);
     }
 
diff --git a/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java b/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
index 0ef66f4..56d369f 100644
--- a/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
+++ b/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
@@ -32,7 +32,6 @@
 import org.onosproject.cluster.RoleInfo;
 import org.onosproject.event.AbstractListenerManager;
 import org.onosproject.core.MetricsHelper;
-import org.onosproject.core.Permission;
 import org.onosproject.mastership.MastershipAdminService;
 import org.onosproject.mastership.MastershipEvent;
 import org.onosproject.mastership.MastershipListener;
@@ -62,6 +61,8 @@
 import static org.onosproject.net.MastershipRole.MASTER;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
+
 
 
 @Component(immediate = true)
@@ -136,7 +137,7 @@
 
     @Override
     public MastershipRole getLocalRole(DeviceId deviceId) {
-        checkPermission(Permission.CLUSTER_READ);
+        checkPermission(CLUSTER_READ);
 
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getRole(clusterService.getLocalNode().id(), deviceId);
@@ -144,7 +145,7 @@
 
     @Override
     public CompletableFuture<Void> relinquishMastership(DeviceId deviceId) {
-        checkPermission(Permission.CLUSTER_WRITE);
+        checkPermission(CLUSTER_WRITE);
         return store.relinquishRole(localNodeId, deviceId)
                     .thenAccept(this::post)
                     .thenApply(v -> null);
@@ -152,7 +153,7 @@
 
     @Override
     public CompletableFuture<MastershipRole> requestRoleFor(DeviceId deviceId) {
-        checkPermission(Permission.CLUSTER_WRITE);
+        checkPermission(CLUSTER_WRITE);
 
         checkNotNull(deviceId, DEVICE_ID_NULL);
         final Context timer = startTimer(requestRoleTimer);
@@ -162,7 +163,7 @@
 
     @Override
     public NodeId getMasterFor(DeviceId deviceId) {
-        checkPermission(Permission.CLUSTER_READ);
+        checkPermission(CLUSTER_READ);
 
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getMaster(deviceId);
@@ -170,7 +171,7 @@
 
     @Override
     public Set<DeviceId> getDevicesOf(NodeId nodeId) {
-        checkPermission(Permission.CLUSTER_READ);
+        checkPermission(CLUSTER_READ);
 
         checkNotNull(nodeId, NODE_ID_NULL);
         return store.getDevices(nodeId);
@@ -178,7 +179,7 @@
 
     @Override
     public RoleInfo getNodesFor(DeviceId deviceId) {
-        checkPermission(Permission.CLUSTER_READ);
+        checkPermission(CLUSTER_READ);
 
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getNodes(deviceId);
diff --git a/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java b/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
index bb42103..0761229 100644
--- a/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
+++ b/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
@@ -31,7 +31,6 @@
 import org.onosproject.core.CoreService;
 import org.onosproject.core.IdBlockStore;
 import org.onosproject.core.IdGenerator;
-import org.onosproject.core.Permission;
 import org.onosproject.core.Version;
 import org.onosproject.event.EventDeliveryService;
 import org.osgi.service.component.ComponentContext;
@@ -46,6 +45,8 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Strings.isNullOrEmpty;
 import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.*;
+
 
 
 /**
@@ -100,28 +101,28 @@
 
     @Override
     public Version version() {
-        checkPermission(Permission.APP_READ);
+        checkPermission(APP_READ);
 
         return version;
     }
 
     @Override
     public Set<ApplicationId> getAppIds() {
-        checkPermission(Permission.APP_READ);
+        checkPermission(APP_READ);
 
         return applicationIdStore.getAppIds();
     }
 
     @Override
     public ApplicationId getAppId(Short id) {
-        checkPermission(Permission.APP_READ);
+        checkPermission(APP_READ);
 
         return applicationIdStore.getAppId(id);
     }
 
     @Override
     public ApplicationId getAppId(String name) {
-        checkPermission(Permission.APP_READ);
+        checkPermission(APP_READ);
 
         return applicationIdStore.getAppId(name);
     }
diff --git a/core/net/src/main/java/org/onosproject/net/device/impl/DeviceManager.java b/core/net/src/main/java/org/onosproject/net/device/impl/DeviceManager.java
index 24ea9f9..d1bcae7 100644
--- a/core/net/src/main/java/org/onosproject/net/device/impl/DeviceManager.java
+++ b/core/net/src/main/java/org/onosproject/net/device/impl/DeviceManager.java
@@ -27,7 +27,6 @@
 import org.onosproject.cluster.ClusterService;
 import org.onosproject.cluster.NodeId;
 import org.onosproject.net.provider.AbstractListenerProviderRegistry;
-import org.onosproject.core.Permission;
 import org.onosproject.net.config.NetworkConfigEvent;
 import org.onosproject.net.config.NetworkConfigListener;
 import org.onosproject.net.config.NetworkConfigService;
@@ -77,6 +76,7 @@
 import static org.onosproject.net.MastershipRole.*;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
 
 
 /**
@@ -151,60 +151,60 @@
 
     @Override
     public int getDeviceCount() {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         return store.getDeviceCount();
     }
 
     @Override
     public Iterable<Device> getDevices() {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         return store.getDevices();
     }
 
     @Override
     public Iterable<Device> getAvailableDevices() {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         return store.getAvailableDevices();
     }
 
     @Override
     public Device getDevice(DeviceId deviceId) {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getDevice(deviceId);
     }
 
     @Override
     public MastershipRole getRole(DeviceId deviceId) {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return mastershipService.getLocalRole(deviceId);
     }
 
     @Override
     public List<Port> getPorts(DeviceId deviceId) {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getPorts(deviceId);
     }
 
     @Override
     public List<PortStatistics> getPortStatistics(DeviceId deviceId) {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getPortStatistics(deviceId);
     }
 
     @Override
     public List<PortStatistics> getPortDeltaStatistics(DeviceId deviceId) {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getPortDeltaStatistics(deviceId);
     }
 
     @Override
     public Port getPort(DeviceId deviceId, PortNumber portNumber) {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         checkNotNull(portNumber, PORT_NUMBER_NULL);
         return store.getPort(deviceId, portNumber);
@@ -212,7 +212,7 @@
 
     @Override
     public boolean isAvailable(DeviceId deviceId) {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
 
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.isAvailable(deviceId);
@@ -664,7 +664,7 @@
 
     @Override
     public Iterable<Device> getDevices(Type type) {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         Set<Device> results = new HashSet<>();
         Iterable<Device> devices = store.getDevices();
         if (devices != null) {
@@ -679,7 +679,7 @@
 
     @Override
     public Iterable<Device> getAvailableDevices(Type type) {
-        checkPermission(Permission.DEVICE_READ);
+        checkPermission(DEVICE_READ);
         Set<Device> results = new HashSet<>();
         Iterable<Device> availableDevices = store.getAvailableDevices();
         if (availableDevices != null) {
diff --git a/core/net/src/main/java/org/onosproject/net/driver/impl/DriverManager.java b/core/net/src/main/java/org/onosproject/net/driver/impl/DriverManager.java
index b395307..53bf30a 100644
--- a/core/net/src/main/java/org/onosproject/net/driver/impl/DriverManager.java
+++ b/core/net/src/main/java/org/onosproject/net/driver/impl/DriverManager.java
@@ -24,7 +24,6 @@
 import org.apache.felix.scr.annotations.Reference;
 import org.apache.felix.scr.annotations.ReferenceCardinality;
 import org.apache.felix.scr.annotations.Service;
-import org.onosproject.core.Permission;
 import org.onosproject.net.Device;
 import org.onosproject.net.DeviceId;
 import org.onosproject.net.device.DeviceService;
@@ -47,6 +46,8 @@
 import static org.onlab.util.Tools.nullIsNotFound;
 import static org.onosproject.net.AnnotationKeys.DRIVER;
 import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.*;
+
 
 
 /**
@@ -108,7 +109,7 @@
 
     @Override
     public Set<Driver> getDrivers() {
-        checkPermission(Permission.DRIVER_READ);
+        checkPermission(DRIVER_READ);
 
         ImmutableSet.Builder<Driver> builder = ImmutableSet.builder();
         drivers.values().forEach(builder::add);
@@ -117,7 +118,7 @@
 
     @Override
     public Set<Driver> getDrivers(Class<? extends Behaviour> withBehaviour) {
-        checkPermission(Permission.DRIVER_READ);
+        checkPermission(DRIVER_READ);
 
         return drivers.values().stream()
                 .filter(d -> d.hasBehaviour(withBehaviour))
@@ -126,14 +127,14 @@
 
     @Override
     public Driver getDriver(String driverName) {
-        checkPermission(Permission.DRIVER_READ);
+        checkPermission(DRIVER_READ);
 
         return nullIsNotFound(drivers.get(driverName), NO_DRIVER);
     }
 
     @Override
     public Driver getDriver(String mfr, String hw, String sw) {
-        checkPermission(Permission.DRIVER_READ);
+        checkPermission(DRIVER_READ);
 
         // First attempt a literal search.
         Driver driver = driverByKey.get(key(mfr, hw, sw));
@@ -160,7 +161,7 @@
 
     @Override
     public Driver getDriver(DeviceId deviceId) {
-        checkPermission(Permission.DRIVER_READ);
+        checkPermission(DRIVER_READ);
 
         Device device = nullIsNotFound(deviceService.getDevice(deviceId), NO_DEVICE);
         String driverName = device.annotations().value(DRIVER);
@@ -174,7 +175,7 @@
 
     @Override
     public DriverHandler createHandler(DeviceId deviceId, String... credentials) {
-        checkPermission(Permission.DRIVER_WRITE);
+        checkPermission(DRIVER_WRITE);
 
         Driver driver = getDriver(deviceId);
         return new DefaultDriverHandler(new DefaultDriverData(driver, deviceId));
diff --git a/core/net/src/main/java/org/onosproject/net/flow/impl/FlowRuleManager.java b/core/net/src/main/java/org/onosproject/net/flow/impl/FlowRuleManager.java
index 488d35c..a1d046c 100644
--- a/core/net/src/main/java/org/onosproject/net/flow/impl/FlowRuleManager.java
+++ b/core/net/src/main/java/org/onosproject/net/flow/impl/FlowRuleManager.java
@@ -36,7 +36,6 @@
 import org.onosproject.core.ApplicationId;
 import org.onosproject.core.CoreService;
 import org.onosproject.core.IdGenerator;
-import org.onosproject.core.Permission;
 import org.onosproject.net.Device;
 import org.onosproject.net.DeviceId;
 import org.onosproject.net.device.DeviceService;
@@ -79,6 +78,8 @@
 import static org.onosproject.net.flow.FlowRuleEvent.Type.RULE_REMOVE_REQUESTED;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
+
 
 
 /**
@@ -165,19 +166,19 @@
 
     @Override
     public int getFlowRuleCount() {
-        checkPermission(Permission.FLOWRULE_READ);
+        checkPermission(FLOWRULE_READ);
         return store.getFlowRuleCount();
     }
 
     @Override
     public Iterable<FlowEntry> getFlowEntries(DeviceId deviceId) {
-        checkPermission(Permission.FLOWRULE_READ);
+        checkPermission(FLOWRULE_READ);
         return store.getFlowEntries(deviceId);
     }
 
     @Override
     public void applyFlowRules(FlowRule... flowRules) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
 
         FlowRuleOperations.Builder builder = FlowRuleOperations.builder();
         for (int i = 0; i < flowRules.length; i++) {
@@ -188,7 +189,7 @@
 
     @Override
     public void removeFlowRules(FlowRule... flowRules) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
 
         FlowRuleOperations.Builder builder = FlowRuleOperations.builder();
         for (int i = 0; i < flowRules.length; i++) {
@@ -199,13 +200,13 @@
 
     @Override
     public void removeFlowRulesById(ApplicationId id) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
         removeFlowRules(Iterables.toArray(getFlowRulesById(id), FlowRule.class));
     }
 
     @Override
     public Iterable<FlowRule> getFlowRulesById(ApplicationId id) {
-        checkPermission(Permission.FLOWRULE_READ);
+        checkPermission(FLOWRULE_READ);
 
         Set<FlowRule> flowEntries = Sets.newHashSet();
         for (Device d : deviceService.getDevices()) {
@@ -220,7 +221,7 @@
 
     @Override
     public Iterable<FlowRule> getFlowRulesByGroupId(ApplicationId appId, short groupId) {
-        checkPermission(Permission.FLOWRULE_READ);
+        checkPermission(FLOWRULE_READ);
 
         Set<FlowRule> matches = Sets.newHashSet();
         long toLookUp = ((long) appId.id() << 16) | groupId;
@@ -236,7 +237,7 @@
 
     @Override
     public void apply(FlowRuleOperations ops) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
         operationsService.submit(new FlowOperationsProcessor(ops));
     }
 
diff --git a/core/net/src/main/java/org/onosproject/net/flowobjective/impl/FlowObjectiveManager.java b/core/net/src/main/java/org/onosproject/net/flowobjective/impl/FlowObjectiveManager.java
index 7d0713b..a76a298 100644
--- a/core/net/src/main/java/org/onosproject/net/flowobjective/impl/FlowObjectiveManager.java
+++ b/core/net/src/main/java/org/onosproject/net/flowobjective/impl/FlowObjectiveManager.java
@@ -27,7 +27,6 @@
 import org.onlab.osgi.ServiceDirectory;
 import org.onlab.util.ItemNotFoundException;
 import org.onosproject.cluster.ClusterService;
-import org.onosproject.core.Permission;
 import org.onosproject.mastership.MastershipEvent;
 import org.onosproject.mastership.MastershipListener;
 import org.onosproject.mastership.MastershipService;
@@ -62,6 +61,8 @@
 import static java.util.concurrent.Executors.newFixedThreadPool;
 import static org.onlab.util.Tools.groupedThreads;
 import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.*;
+
 
 
 /**
@@ -193,13 +194,13 @@
 
     @Override
     public void filter(DeviceId deviceId, FilteringObjective filteringObjective) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
         executorService.submit(new ObjectiveInstaller(deviceId, filteringObjective));
     }
 
     @Override
     public void forward(DeviceId deviceId, ForwardingObjective forwardingObjective) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
         if (queueObjective(deviceId, forwardingObjective)) {
             return;
         }
@@ -208,13 +209,13 @@
 
     @Override
     public void next(DeviceId deviceId, NextObjective nextObjective) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
         executorService.submit(new ObjectiveInstaller(deviceId, nextObjective));
     }
 
     @Override
     public int allocateNextId() {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
         return flowObjectiveStore.allocateNextId();
     }
 
diff --git a/core/net/src/main/java/org/onosproject/net/flowobjective/impl/composition/FlowObjectiveCompositionManager.java b/core/net/src/main/java/org/onosproject/net/flowobjective/impl/composition/FlowObjectiveCompositionManager.java
index 1d25c2e..3ef98bd 100644
--- a/core/net/src/main/java/org/onosproject/net/flowobjective/impl/composition/FlowObjectiveCompositionManager.java
+++ b/core/net/src/main/java/org/onosproject/net/flowobjective/impl/composition/FlowObjectiveCompositionManager.java
@@ -27,7 +27,6 @@
 import org.onlab.osgi.ServiceDirectory;
 import org.onlab.util.ItemNotFoundException;
 import org.onosproject.cluster.ClusterService;
-import org.onosproject.core.Permission;
 import org.onosproject.mastership.MastershipEvent;
 import org.onosproject.mastership.MastershipListener;
 import org.onosproject.mastership.MastershipService;
@@ -65,6 +64,7 @@
 import static java.util.concurrent.Executors.newFixedThreadPool;
 import static org.onlab.util.Tools.groupedThreads;
 import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.*;
 
 
 /**
@@ -217,7 +217,7 @@
 
     @Override
     public void filter(DeviceId deviceId, FilteringObjective filteringObjective) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
 
         List<FilteringObjective> filteringObjectives
                 = this.deviceCompositionTreeMap.get(deviceId).updateFilter(filteringObjective);
@@ -228,7 +228,7 @@
 
     @Override
     public void forward(DeviceId deviceId, ForwardingObjective forwardingObjective) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
 
         if (queueObjective(deviceId, forwardingObjective)) {
             return;
@@ -242,7 +242,7 @@
 
     @Override
     public void next(DeviceId deviceId, NextObjective nextObjective) {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
 
         List<NextObjective> nextObjectives = this.deviceCompositionTreeMap.get(deviceId).updateNext(nextObjective);
         for (NextObjective tmp : nextObjectives) {
@@ -252,7 +252,7 @@
 
     @Override
     public int allocateNextId() {
-        checkPermission(Permission.FLOWRULE_WRITE);
+        checkPermission(FLOWRULE_WRITE);
 
         return flowObjectiveStore.allocateNextId();
     }
diff --git a/core/net/src/main/java/org/onosproject/net/group/impl/GroupManager.java b/core/net/src/main/java/org/onosproject/net/group/impl/GroupManager.java
index 6c43f24..96e9b19 100644
--- a/core/net/src/main/java/org/onosproject/net/group/impl/GroupManager.java
+++ b/core/net/src/main/java/org/onosproject/net/group/impl/GroupManager.java
@@ -23,7 +23,6 @@
 import org.apache.felix.scr.annotations.Service;
 import org.onosproject.net.provider.AbstractListenerProviderRegistry;
 import org.onosproject.core.ApplicationId;
-import org.onosproject.core.Permission;
 import org.onosproject.net.DeviceId;
 import org.onosproject.net.device.DeviceEvent;
 import org.onosproject.net.device.DeviceListener;
@@ -51,6 +50,8 @@
 
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
+
 
 
 /**
@@ -96,7 +97,7 @@
      */
     @Override
     public void addGroup(GroupDescription groupDesc) {
-        checkPermission(Permission.GROUP_WRITE);
+        checkPermission(GROUP_WRITE);
         store.storeGroupDescription(groupDesc);
     }
 
@@ -115,7 +116,7 @@
      */
     @Override
     public Group getGroup(DeviceId deviceId, GroupKey appCookie) {
-        checkPermission(Permission.GROUP_READ);
+        checkPermission(GROUP_READ);
         return store.getGroup(deviceId, appCookie);
     }
 
@@ -137,7 +138,7 @@
                                   GroupBuckets buckets,
                                   GroupKey newCookie,
                                   ApplicationId appId) {
-        checkPermission(Permission.GROUP_WRITE);
+        checkPermission(GROUP_WRITE);
         store.updateGroupDescription(deviceId,
                                      oldCookie,
                                      UpdateType.ADD,
@@ -163,7 +164,7 @@
                                        GroupBuckets buckets,
                                        GroupKey newCookie,
                                        ApplicationId appId) {
-        checkPermission(Permission.GROUP_WRITE);
+        checkPermission(GROUP_WRITE);
         store.updateGroupDescription(deviceId,
                                      oldCookie,
                                      UpdateType.REMOVE,
@@ -185,7 +186,7 @@
     public void removeGroup(DeviceId deviceId,
                             GroupKey appCookie,
                             ApplicationId appId) {
-        checkPermission(Permission.GROUP_WRITE);
+        checkPermission(GROUP_WRITE);
         store.deleteGroupDescription(deviceId, appCookie);
     }
 
@@ -200,13 +201,13 @@
     @Override
     public Iterable<Group> getGroups(DeviceId deviceId,
                                      ApplicationId appId) {
-        checkPermission(Permission.GROUP_READ);
+        checkPermission(GROUP_READ);
         return store.getGroups(deviceId);
     }
 
     @Override
     public Iterable<Group> getGroups(DeviceId deviceId) {
-        checkPermission(Permission.GROUP_READ);
+        checkPermission(GROUP_READ);
         return store.getGroups(deviceId);
     }
 
diff --git a/core/net/src/main/java/org/onosproject/net/host/impl/HostManager.java b/core/net/src/main/java/org/onosproject/net/host/impl/HostManager.java
index 99d401a..9926338 100644
--- a/core/net/src/main/java/org/onosproject/net/host/impl/HostManager.java
+++ b/core/net/src/main/java/org/onosproject/net/host/impl/HostManager.java
@@ -26,7 +26,6 @@
 import org.onlab.packet.VlanId;
 import org.onosproject.incubator.net.intf.InterfaceService;
 import org.onosproject.net.provider.AbstractListenerProviderRegistry;
-import org.onosproject.core.Permission;
 import org.onosproject.net.config.NetworkConfigEvent;
 import org.onosproject.net.config.NetworkConfigListener;
 import org.onosproject.net.config.NetworkConfigService;
@@ -57,6 +56,7 @@
 import static com.google.common.base.Preconditions.checkState;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
 
 /**
  * Provides basic implementation of the host SB &amp; NB APIs.
@@ -118,66 +118,66 @@
 
     @Override
     public int getHostCount() {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         return store.getHostCount();
     }
 
     @Override
     public Iterable<Host> getHosts() {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         return store.getHosts();
     }
 
     @Override
     public Host getHost(HostId hostId) {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         checkNotNull(hostId, HOST_ID_NULL);
         return store.getHost(hostId);
     }
 
     @Override
     public Set<Host> getHostsByVlan(VlanId vlanId) {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         return store.getHosts(vlanId);
     }
 
     @Override
     public Set<Host> getHostsByMac(MacAddress mac) {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         checkNotNull(mac, "MAC address cannot be null");
         return store.getHosts(mac);
     }
 
     @Override
     public Set<Host> getHostsByIp(IpAddress ip) {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         checkNotNull(ip, "IP address cannot be null");
         return store.getHosts(ip);
     }
 
     @Override
     public Set<Host> getConnectedHosts(ConnectPoint connectPoint) {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         checkNotNull(connectPoint, "Connection point cannot be null");
         return store.getConnectedHosts(connectPoint);
     }
 
     @Override
     public Set<Host> getConnectedHosts(DeviceId deviceId) {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         checkNotNull(deviceId, "Device ID cannot be null");
         return store.getConnectedHosts(deviceId);
     }
 
     @Override
     public void startMonitoringIp(IpAddress ip) {
-        checkPermission(Permission.HOST_EVENT);
+        checkPermission(HOST_EVENT);
         monitor.addMonitoringFor(ip);
     }
 
     @Override
     public void stopMonitoringIp(IpAddress ip) {
-        checkPermission(Permission.HOST_EVENT);
+        checkPermission(HOST_EVENT);
         monitor.stopMonitoring(ip);
     }
 
@@ -212,13 +212,13 @@
 
     @Override
     public Set<PortAddresses> getAddressBindings() {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         return store.getAddressBindings();
     }
 
     @Override
     public Set<PortAddresses> getAddressBindingsForPort(ConnectPoint connectPoint) {
-        checkPermission(Permission.HOST_READ);
+        checkPermission(HOST_READ);
         return store.getAddressBindingsForPort(connectPoint);
     }
 
diff --git a/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java b/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
index d974009..4c828e7 100644
--- a/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
+++ b/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
@@ -25,7 +25,6 @@
 import org.onosproject.event.AbstractListenerManager;
 import org.onosproject.core.CoreService;
 import org.onosproject.core.IdGenerator;
-import org.onosproject.core.Permission;
 import org.onosproject.net.flow.FlowRule;
 import org.onosproject.net.flow.FlowRuleOperations;
 import org.onosproject.net.flow.FlowRuleOperationsContext;
@@ -67,6 +66,8 @@
 import static org.onosproject.net.intent.impl.phase.IntentProcessPhase.newInitialPhase;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
+
 
 /**
  * An implementation of intent service.
@@ -138,7 +139,7 @@
 
     @Override
     public void submit(Intent intent) {
-        checkPermission(Permission.INTENT_WRITE);
+        checkPermission(INTENT_WRITE);
         checkNotNull(intent, INTENT_NULL);
         IntentData data = new IntentData(intent, IntentState.INSTALL_REQ, null);
         store.addPending(data);
@@ -146,7 +147,7 @@
 
     @Override
     public void withdraw(Intent intent) {
-        checkPermission(Permission.INTENT_WRITE);
+        checkPermission(INTENT_WRITE);
         checkNotNull(intent, INTENT_NULL);
         IntentData data = new IntentData(intent, IntentState.WITHDRAW_REQ, null);
         store.addPending(data);
@@ -154,7 +155,7 @@
 
     @Override
     public void purge(Intent intent) {
-        checkPermission(Permission.INTENT_WRITE);
+        checkPermission(INTENT_WRITE);
         checkNotNull(intent, INTENT_NULL);
         IntentData data = new IntentData(intent, IntentState.PURGE_REQ, null);
         store.addPending(data);
@@ -162,45 +163,45 @@
 
     @Override
     public Intent getIntent(Key key) {
-        checkPermission(Permission.INTENT_READ);
+        checkPermission(INTENT_READ);
         return store.getIntent(key);
     }
 
     @Override
     public Iterable<Intent> getIntents() {
-        checkPermission(Permission.INTENT_READ);
+        checkPermission(INTENT_READ);
         return store.getIntents();
     }
 
     @Override
     public Iterable<IntentData> getIntentData() {
-        checkPermission(Permission.INTENT_READ);
+        checkPermission(INTENT_READ);
         return store.getIntentData(false, 0);
     }
 
     @Override
     public long getIntentCount() {
-        checkPermission(Permission.INTENT_READ);
+        checkPermission(INTENT_READ);
         return store.getIntentCount();
     }
 
     @Override
     public IntentState getIntentState(Key intentKey) {
-        checkPermission(Permission.INTENT_READ);
+        checkPermission(INTENT_READ);
         checkNotNull(intentKey, INTENT_ID_NULL);
         return store.getIntentState(intentKey);
     }
 
     @Override
     public List<Intent> getInstallableIntents(Key intentKey) {
-        checkPermission(Permission.INTENT_READ);
+        checkPermission(INTENT_READ);
         checkNotNull(intentKey, INTENT_ID_NULL);
         return store.getInstallableIntents(intentKey);
     }
 
     @Override
     public boolean isLocal(Key intentKey) {
-        checkPermission(Permission.INTENT_READ);
+        checkPermission(INTENT_READ);
         return store.isMaster(intentKey);
     }
 
@@ -221,7 +222,7 @@
 
     @Override
     public Iterable<Intent> getPending() {
-        checkPermission(Permission.INTENT_READ);
+        checkPermission(INTENT_READ);
 
         return store.getPending();
     }
diff --git a/core/net/src/main/java/org/onosproject/net/link/impl/LinkManager.java b/core/net/src/main/java/org/onosproject/net/link/impl/LinkManager.java
index b4cc17c..157288a 100644
--- a/core/net/src/main/java/org/onosproject/net/link/impl/LinkManager.java
+++ b/core/net/src/main/java/org/onosproject/net/link/impl/LinkManager.java
@@ -25,7 +25,6 @@
 import org.apache.felix.scr.annotations.ReferenceCardinality;
 import org.apache.felix.scr.annotations.Service;
 import org.onosproject.net.provider.AbstractListenerProviderRegistry;
-import org.onosproject.core.Permission;
 import org.onosproject.net.config.NetworkConfigEvent;
 import org.onosproject.net.config.NetworkConfigListener;
 import org.onosproject.net.config.NetworkConfigService;
@@ -59,6 +58,7 @@
 import static org.onosproject.net.LinkKey.linkKey;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
 
 
 /**
@@ -111,19 +111,19 @@
 
     @Override
     public int getLinkCount() {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         return store.getLinkCount();
     }
 
     @Override
     public Iterable<Link> getLinks() {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         return store.getLinks();
     }
 
     @Override
     public Iterable<Link> getActiveLinks() {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         return FluentIterable.from(getLinks())
                 .filter(new Predicate<Link>() {
 
@@ -136,7 +136,7 @@
 
     @Override
     public Set<Link> getDeviceLinks(DeviceId deviceId) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return Sets.union(store.getDeviceEgressLinks(deviceId),
                           store.getDeviceIngressLinks(deviceId));
@@ -144,21 +144,21 @@
 
     @Override
     public Set<Link> getDeviceEgressLinks(DeviceId deviceId) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getDeviceEgressLinks(deviceId);
     }
 
     @Override
     public Set<Link> getDeviceIngressLinks(DeviceId deviceId) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         checkNotNull(deviceId, DEVICE_ID_NULL);
         return store.getDeviceIngressLinks(deviceId);
     }
 
     @Override
     public Set<Link> getLinks(ConnectPoint connectPoint) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         checkNotNull(connectPoint, CONNECT_POINT_NULL);
         return Sets.union(store.getEgressLinks(connectPoint),
                           store.getIngressLinks(connectPoint));
@@ -166,21 +166,21 @@
 
     @Override
     public Set<Link> getEgressLinks(ConnectPoint connectPoint) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         checkNotNull(connectPoint, CONNECT_POINT_NULL);
         return store.getEgressLinks(connectPoint);
     }
 
     @Override
     public Set<Link> getIngressLinks(ConnectPoint connectPoint) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         checkNotNull(connectPoint, CONNECT_POINT_NULL);
         return store.getIngressLinks(connectPoint);
     }
 
     @Override
     public Link getLink(ConnectPoint src, ConnectPoint dst) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         checkNotNull(src, CONNECT_POINT_NULL);
         checkNotNull(dst, CONNECT_POINT_NULL);
         return store.getLink(src, dst);
diff --git a/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java b/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
index b093fe1..75239fd 100644
--- a/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
+++ b/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
@@ -23,7 +23,6 @@
 import org.apache.felix.scr.annotations.Service;
 import org.onosproject.core.ApplicationId;
 import org.onosproject.core.CoreService;
-import org.onosproject.core.Permission;
 import org.onosproject.net.Device;
 import org.onosproject.net.device.DeviceEvent;
 import org.onosproject.net.device.DeviceListener;
@@ -63,7 +62,7 @@
 import static org.onlab.util.Tools.groupedThreads;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
-
+import static org.onosproject.security.AppPermission.Type.*;
 
 /**
  * Provides a basic implementation of the packet SB &amp; NB APIs.
@@ -126,14 +125,14 @@
 
     @Override
     public void addProcessor(PacketProcessor processor, int priority) {
-        checkPermission(Permission.PACKET_EVENT);
+        checkPermission(PACKET_EVENT);
         checkNotNull(processor, "Processor cannot be null");
         processors.put(priority, processor);
     }
 
     @Override
     public void removeProcessor(PacketProcessor processor) {
-        checkPermission(Permission.PACKET_EVENT);
+        checkPermission(PACKET_EVENT);
         checkNotNull(processor, "Processor cannot be null");
         processors.values().remove(processor);
     }
@@ -141,7 +140,7 @@
     @Override
     public void requestPackets(TrafficSelector selector, PacketPriority priority,
                                ApplicationId appId) {
-        checkPermission(Permission.PACKET_READ);
+        checkPermission(PACKET_READ);
         checkNotNull(selector, "Selector cannot be null");
         checkNotNull(appId, "Application ID cannot be null");
 
@@ -154,7 +153,7 @@
     @Override
     public void cancelPackets(TrafficSelector selector, PacketPriority priority,
                               ApplicationId appId) {
-        checkPermission(Permission.PACKET_READ);
+        checkPermission(PACKET_READ);
         checkNotNull(selector, "Selector cannot be null");
         checkNotNull(appId, "Application ID cannot be null");
 
@@ -246,7 +245,7 @@
 
     @Override
     public void emit(OutboundPacket packet) {
-        checkPermission(Permission.PACKET_WRITE);
+        checkPermission(PACKET_WRITE);
         checkNotNull(packet, "Packet cannot be null");
         store.emit(packet);
     }
diff --git a/core/net/src/main/java/org/onosproject/net/proxyarp/impl/ProxyArpManager.java b/core/net/src/main/java/org/onosproject/net/proxyarp/impl/ProxyArpManager.java
index 474dd67..398260f 100644
--- a/core/net/src/main/java/org/onosproject/net/proxyarp/impl/ProxyArpManager.java
+++ b/core/net/src/main/java/org/onosproject/net/proxyarp/impl/ProxyArpManager.java
@@ -33,7 +33,6 @@
 import org.onlab.packet.ndp.NeighborAdvertisement;
 import org.onlab.packet.ndp.NeighborDiscoveryOptions;
 import org.onlab.packet.ndp.NeighborSolicitation;
-import org.onosproject.core.Permission;
 import org.onosproject.incubator.net.intf.Interface;
 import org.onosproject.incubator.net.intf.InterfaceService;
 import org.onosproject.net.ConnectPoint;
@@ -61,6 +60,7 @@
 import static org.onosproject.net.HostId.hostId;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
 
 
 @Component(immediate = true)
@@ -110,7 +110,8 @@
 
     @Override
     public boolean isKnown(IpAddress addr) {
-        checkPermission(Permission.PACKET_READ);
+        checkPermission(PACKET_READ);
+
         checkNotNull(addr, MAC_ADDR_NULL);
         Set<Host> hosts = hostService.getHostsByIp(addr);
         return !hosts.isEmpty();
@@ -118,7 +119,8 @@
 
     @Override
     public void reply(Ethernet eth, ConnectPoint inPort) {
-        checkPermission(Permission.PACKET_WRITE);
+        checkPermission(PACKET_WRITE);
+
         checkNotNull(eth, REQUEST_NULL);
 
         if (eth.getEtherType() == Ethernet.TYPE_ARP) {
@@ -316,7 +318,8 @@
 
     @Override
     public void forward(Ethernet eth, ConnectPoint inPort) {
-        checkPermission(Permission.PACKET_WRITE);
+        checkPermission(PACKET_WRITE);
+
         checkNotNull(eth, REQUEST_NULL);
 
         Host h = hostService.getHost(hostId(eth.getDestinationMAC(),
@@ -333,7 +336,7 @@
 
     @Override
     public boolean handlePacket(PacketContext context) {
-        checkPermission(Permission.PACKET_WRITE);
+        checkPermission(PACKET_WRITE);
 
         InboundPacket pkt = context.inPacket();
         Ethernet ethPkt = pkt.parsed();
diff --git a/core/net/src/main/java/org/onosproject/net/resource/impl/LinkResourceManager.java b/core/net/src/main/java/org/onosproject/net/resource/impl/LinkResourceManager.java
index 5762c0a..57a271a 100644
--- a/core/net/src/main/java/org/onosproject/net/resource/impl/LinkResourceManager.java
+++ b/core/net/src/main/java/org/onosproject/net/resource/impl/LinkResourceManager.java
@@ -23,7 +23,6 @@
 import org.apache.felix.scr.annotations.ReferenceCardinality;
 import org.apache.felix.scr.annotations.Service;
 import org.onosproject.event.AbstractListenerManager;
-import org.onosproject.core.Permission;
 import org.onosproject.net.Link;
 import org.onosproject.net.intent.IntentId;
 import org.onosproject.net.resource.ResourceAllocation;
@@ -58,6 +57,7 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
 
 
 /**
@@ -150,7 +150,7 @@
 
     @Override
     public LinkResourceAllocations requestResources(LinkResourceRequest req) {
-        checkPermission(Permission.LINK_WRITE);
+        checkPermission(LINK_WRITE);
 
         // TODO Concatenate multiple bandwidth requests.
         // TODO Support multiple lambda resource requests.
@@ -213,7 +213,7 @@
 
     @Override
     public void releaseResources(LinkResourceAllocations allocations) {
-        checkPermission(Permission.LINK_WRITE);
+        checkPermission(LINK_WRITE);
         final LinkResourceEvent event = store.releaseResources(allocations);
         if (event != null) {
             post(event);
@@ -223,32 +223,32 @@
     @Override
     public LinkResourceAllocations updateResources(LinkResourceRequest req,
             LinkResourceAllocations oldAllocations) {
-        checkPermission(Permission.LINK_WRITE);
+        checkPermission(LINK_WRITE);
         releaseResources(oldAllocations);
          return requestResources(req);
     }
 
     @Override
     public Iterable<LinkResourceAllocations> getAllocations() {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         return store.getAllocations();
     }
 
     @Override
     public Iterable<LinkResourceAllocations> getAllocations(Link link) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         return store.getAllocations(link);
     }
 
     @Override
     public LinkResourceAllocations getAllocations(IntentId intentId) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
         return store.getAllocations(intentId);
     }
 
     @Override
     public Iterable<ResourceRequest> getAvailableResources(Link link) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
 
         Set<ResourceAllocation> freeRes = store.getFreeResources(link);
         Set<ResourceRequest> result = new HashSet<>();
@@ -274,7 +274,7 @@
     @Override
     public Iterable<ResourceRequest> getAvailableResources(Link link,
             LinkResourceAllocations allocations) {
-        checkPermission(Permission.LINK_READ);
+        checkPermission(LINK_READ);
 
         Set<ResourceAllocation> allocatedRes = allocations.getResourceAllocation(link);
         Set<ResourceRequest> result = Sets.newHashSet(getAvailableResources(link));
diff --git a/core/net/src/main/java/org/onosproject/net/statistic/impl/StatisticManager.java b/core/net/src/main/java/org/onosproject/net/statistic/impl/StatisticManager.java
index a07f196..996ad14e 100644
--- a/core/net/src/main/java/org/onosproject/net/statistic/impl/StatisticManager.java
+++ b/core/net/src/main/java/org/onosproject/net/statistic/impl/StatisticManager.java
@@ -27,7 +27,6 @@
 import org.apache.felix.scr.annotations.Service;
 import org.onosproject.core.ApplicationId;
 import org.onosproject.core.GroupId;
-import org.onosproject.core.Permission;
 import org.onosproject.net.ConnectPoint;
 import org.onosproject.net.Link;
 import org.onosproject.net.Path;
@@ -51,6 +50,7 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 import static org.slf4j.LoggerFactory.getLogger;
 import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.*;
 
 
 /**
@@ -86,14 +86,14 @@
 
     @Override
     public Load load(Link link) {
-        checkPermission(Permission.STATISTIC_READ);
+        checkPermission(STATISTIC_READ);
 
         return load(link.src());
     }
 
     @Override
     public Load load(Link link, ApplicationId appId, Optional<GroupId> groupId) {
-        checkPermission(Permission.STATISTIC_READ);
+        checkPermission(STATISTIC_READ);
 
         Statistics stats = getStatistics(link.src());
         if (!stats.isValid()) {
@@ -114,14 +114,14 @@
 
     @Override
     public Load load(ConnectPoint connectPoint) {
-        checkPermission(Permission.STATISTIC_READ);
+        checkPermission(STATISTIC_READ);
 
         return loadInternal(connectPoint);
     }
 
     @Override
     public Link max(Path path) {
-        checkPermission(Permission.STATISTIC_READ);
+        checkPermission(STATISTIC_READ);
 
         if (path.links().isEmpty()) {
             return null;
@@ -140,7 +140,7 @@
 
     @Override
     public Link min(Path path) {
-        checkPermission(Permission.STATISTIC_READ);
+        checkPermission(STATISTIC_READ);
 
         if (path.links().isEmpty()) {
             return null;
@@ -159,7 +159,7 @@
 
     @Override
     public FlowRule highestHitter(ConnectPoint connectPoint) {
-        checkPermission(Permission.STATISTIC_READ);
+        checkPermission(STATISTIC_READ);
 
         Set<FlowEntry> hitters = statisticStore.getCurrentStatistic(connectPoint);
         if (hitters.isEmpty()) {
diff --git a/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java b/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
index 0852447..a238c7f 100644
--- a/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
+++ b/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
@@ -24,7 +24,6 @@
 import org.apache.felix.scr.annotations.Reference;
 import org.apache.felix.scr.annotations.ReferenceCardinality;
 import org.apache.felix.scr.annotations.Service;
-import org.onosproject.core.Permission;
 import org.onosproject.net.ConnectPoint;
 import org.onosproject.net.DefaultEdgeLink;
 import org.onosproject.net.DefaultPath;
@@ -51,6 +50,7 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 import static org.slf4j.LoggerFactory.getLogger;
 import static org.onosproject.security.AppGuard.checkPermission;
+import static org.onosproject.security.AppPermission.Type.*;
 
 
 /**
@@ -88,14 +88,14 @@
 
     @Override
     public Set<Path> getPaths(ElementId src, ElementId dst) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
 
         return getPaths(src, dst, null);
     }
 
     @Override
     public Set<Path> getPaths(ElementId src, ElementId dst, LinkWeight weight) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
 
         checkNotNull(src, ELEMENT_ID_NULL);
         checkNotNull(dst, ELEMENT_ID_NULL);
diff --git a/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java b/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
index 0a0db62..04c4f1c1 100644
--- a/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
+++ b/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
@@ -22,7 +22,6 @@
 import org.apache.felix.scr.annotations.ReferenceCardinality;
 import org.apache.felix.scr.annotations.Service;
 import org.onosproject.net.provider.AbstractListenerProviderRegistry;
-import org.onosproject.core.Permission;
 import org.onosproject.event.Event;
 import org.onosproject.net.ConnectPoint;
 import org.onosproject.net.DeviceId;
@@ -51,6 +50,8 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 import static org.onosproject.security.AppGuard.checkPermission;
 import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppPermission.Type.*;
+
 
 /**
  * Provides basic implementation of the topology SB &amp; NB APIs.
@@ -91,27 +92,27 @@
 
     @Override
     public Topology currentTopology() {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         return store.currentTopology();
     }
 
     @Override
     public boolean isLatest(Topology topology) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         return store.isLatest(topology);
     }
 
     @Override
     public Set<TopologyCluster> getClusters(Topology topology) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         return store.getClusters(topology);
     }
 
     @Override
     public TopologyCluster getCluster(Topology topology, ClusterId clusterId) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(topology, CLUSTER_ID_NULL);
         return store.getCluster(topology, clusterId);
@@ -119,7 +120,7 @@
 
     @Override
     public Set<DeviceId> getClusterDevices(Topology topology, TopologyCluster cluster) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(topology, CLUSTER_NULL);
         return store.getClusterDevices(topology, cluster);
@@ -127,7 +128,7 @@
 
     @Override
     public Set<Link> getClusterLinks(Topology topology, TopologyCluster cluster) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(topology, CLUSTER_NULL);
         return store.getClusterLinks(topology, cluster);
@@ -135,14 +136,14 @@
 
     @Override
     public TopologyGraph getGraph(Topology topology) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         return store.getGraph(topology);
     }
 
     @Override
     public Set<Path> getPaths(Topology topology, DeviceId src, DeviceId dst) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(src, DEVICE_ID_NULL);
         checkNotNull(dst, DEVICE_ID_NULL);
@@ -151,7 +152,7 @@
 
     @Override
     public Set<Path> getPaths(Topology topology, DeviceId src, DeviceId dst, LinkWeight weight) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
 
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(src, DEVICE_ID_NULL);
@@ -162,7 +163,7 @@
 
     @Override
     public boolean isInfrastructure(Topology topology, ConnectPoint connectPoint) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(connectPoint, CONNECTION_POINT_NULL);
         return store.isInfrastructure(topology, connectPoint);
@@ -170,7 +171,7 @@
 
     @Override
     public boolean isBroadcastPoint(Topology topology, ConnectPoint connectPoint) {
-        checkPermission(Permission.TOPOLOGY_READ);
+        checkPermission(TOPOLOGY_READ);
         checkNotNull(topology, TOPOLOGY_NULL);
         checkNotNull(connectPoint, CONNECTION_POINT_NULL);
         return store.isBroadcastPoint(topology, connectPoint);