diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/Roles.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/Roles.java
deleted file mode 100755
index e69de29bb2d..00000000000
diff --git a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SailingPermissionsForRoleProvider.java b/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SailingPermissionsForRoleProvider.java
deleted file mode 100755
index b3729c1e503..00000000000
--- a/java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SailingPermissionsForRoleProvider.java
+++ /dev/null
@@ -1,72 +0,0 @@
-package com.sap.sailing.domain.common.security;
-
-import java.util.ArrayList;
-import java.util.Collections;
-
-import com.sap.sse.security.shared.AbstractRoles;
-import com.sap.sse.security.shared.AdminRole;
-import com.sap.sse.security.shared.PermissionsForRoleProvider;
-import com.sap.sse.security.shared.RolePermissionModel;
-
-public class SailingPermissionsForRoleProvider implements PermissionsForRoleProvider {
-    public static final SailingPermissionsForRoleProvider INSTANCE = new SailingPermissionsForRoleProvider();
-    
-    @Override
-    public Iterable<String> getPermissions(String role, RolePermissionModel rolePermissionModel) {
-        final Iterable<String> result;
-        if (rolePermissionModel == null) {
-            if (AdminRole.getInstance().getName().equals(role)) {
-                ArrayList<String> permissions = new ArrayList<>();
-                permissions.add("*");
-                result = permissions;
-            } else if (AbstractRoles.eventmanager.getDisplayName().equals(role)) {
-                result = asList(
-                        // RaceBoard:
-                        Permission.MANAGE_MEDIA,
-                        Permission.MANAGE_MARK_PASSINGS,
-                        Permission.MANAGE_MARK_POSITIONS,
-                        
-                        // AdminConsole:
-                        Permission.MANAGE_ALL_COMPETITORS,
-                        Permission.MANAGE_COURSE_LAYOUT,
-                        Permission.MANAGE_DEVICE_CONFIGURATION,
-                        Permission.MANAGE_EVENTS,
-                        Permission.MANAGE_IGTIMI_ACCOUNTS,
-                        Permission.MANAGE_LEADERBOARD_GROUPS,
-                        Permission.MANAGE_LEADERBOARDS,
-                        Permission.MANAGE_LEADERBOARD_RESULTS,
-                        Permission.MANAGE_MEDIA,
-                        Permission.MANAGE_RACELOG_TRACKING,
-                        Permission.MANAGE_REGATTAS,
-                        Permission.MANAGE_RESULT_IMPORT_URLS,
-                        Permission.MANAGE_STRUCTURE_IMPORT_URLS,
-                        Permission.MANAGE_TRACKED_RACES,
-                        Permission.MANAGE_WIND,
-                        
-                        // back-end:
-                        Permission.EVENT,
-                        Permission.REGATTA,
-                        Permission.LEADERBOARD,
-                        Permission.LEADERBOARD_GROUP
-                        );
-            } else if (AbstractRoles.mediaeditor.getDisplayName().equals(role)) {
-                result = asList(Permission.MANAGE_MEDIA);
-            } else if (AbstractRoles.moderator.getDisplayName().equals(role)) {
-                result = asList(Permission.CAN_REPLAY_DURING_LIVE_RACES);
-            } else {
-                result = Collections.emptyList();
-            }
-        } else {
-            result = null; // TODO
-        }
-        return result;
-    }
-    
-    private Iterable<String> asList(Permission... permissions) {
-        ArrayList<String> list = new ArrayList<String>(permissions.length);
-        for (Permission permission : permissions) {
-            list.add(permission.getStringPermission());
-        }
-        return list;
-    }
-}
diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java
index 94e25d2ce62..f4321e18908 100755
--- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java
+++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java
@@ -14,7 +14,6 @@ import com.google.gwt.user.client.ui.HeaderPanel;
 import com.google.gwt.user.client.ui.RootLayoutPanel;
 import com.google.gwt.user.client.ui.Widget;
 import com.sap.sailing.domain.common.security.Permission;
-import com.sap.sailing.domain.common.security.SailingPermissionsForRoleProvider;
 import com.sap.sailing.gwt.common.authentication.FixedSailingAuthentication;
 import com.sap.sailing.gwt.common.authentication.SAPSailingHeaderWithAuthentication;
 import com.sap.sailing.gwt.ui.client.AbstractSailingEntryPoint;
@@ -87,7 +86,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
     }
     
     private Widget createAdminConsolePanel() {
-        AdminConsolePanel panel = new AdminConsolePanel(getUserService(), SailingPermissionsForRoleProvider.INSTANCE, 
+        AdminConsolePanel panel = new AdminConsolePanel(getUserService(), 
                 sailingService, getStringMessages().releaseNotes(), "/release_notes_admin.html", /* error reporter */ this, SecurityStylesheetResources.INSTANCE.css(), getStringMessages());
         panel.addStyleName("adminConsolePanel");
         
@@ -297,7 +296,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             roles.add(role);
         }
         final UserManagementPanel userManagementPanel = new UserManagementPanel(getUserService(), StringMessages.INSTANCE,
-                SailingPermissionsForRoleProvider.INSTANCE, roles, Arrays.<com.sap.sse.security.shared.Permission>asList(Permission.values()));
+                roles, Arrays.<com.sap.sse.security.shared.Permission>asList(Permission.values()));
         panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<UserManagementPanel>(userManagementPanel),
                 getStringMessages().userManagement(), Permission.MANAGE_USERS);
         
diff --git a/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java b/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java
index 0341996cdb5..5ceaf1598e2 100755
--- a/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java
+++ b/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java
@@ -26,7 +26,6 @@ import com.sap.sse.gwt.client.panels.AbstractTabLayoutPanel;
 import com.sap.sse.gwt.client.panels.HorizontalTabLayoutPanel;
 import com.sap.sse.gwt.client.panels.VerticalTabLayoutPanel;
 import com.sap.sse.security.shared.Permission;
-import com.sap.sse.security.shared.PermissionsForRoleProvider;
 import com.sap.sse.security.shared.WildcardPermission;
 import com.sap.sse.security.ui.client.UserService;
 import com.sap.sse.security.ui.client.UserStatusEventHandler;
@@ -96,8 +95,6 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      */
     private final Map<Widget, RefreshableAdminConsolePanel> panelsByWidget;
     
-    private final PermissionsForRoleProvider permissionsForRoleProvider;
-    
     /**
      * Generic selection handler that forwards selected tabs to a refresher that ensures that data gets reloaded. If
      * you add a new tab then make sure to have a look at #refreshDataFor(Widget widget) to ensure that upon
@@ -150,10 +147,9 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
         return target;
     }
 
-    public AdminConsolePanel(UserService userService, PermissionsForRoleProvider permissionsForRoleProvider,
+    public AdminConsolePanel(UserService userService,
             ServerInfoRetriever buildVersionRetriever, String releaseNotesAnchorLabel,
             String releaseNotesURL, ErrorReporter errorReporter, LoginPanelCss loginPanelCss, StringMessages stringMessages) {
-        this.permissionsForRoleProvider = permissionsForRoleProvider;
         this.permissionsAnyOfWhichIsRequiredToSeeWidget = new HashMap<>();
         this.userService = userService;
         roleSpecificTabs = new LinkedHashSet<>();
@@ -446,7 +442,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
     private boolean userHasPermissionsToSeeWidget(UserDTO user, Widget widget) {
         for (Permission requiredStringPermission : permissionsAnyOfWhichIsRequiredToSeeWidget.get(widget)) {
             WildcardPermission requiredPermission = new WildcardPermission(requiredStringPermission.getStringPermission());
-            for (WildcardPermission userPermission : user.getAllPermissions(permissionsForRoleProvider)) {
+            for (WildcardPermission userPermission : user.getAllPermissions()) {
                 if (requiredPermission.implies(userPermission) || userPermission.implies(requiredPermission)) {
                     return true;
                 }
diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java
index e34a7885228..4acdd342b51 100755
--- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java
+++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserManagementService.java
@@ -20,35 +20,35 @@ import com.sap.sse.security.ui.shared.UserDTO;
 import com.sap.sse.security.ui.shared.UserGroupDTO;
 
 public interface UserManagementService extends RemoteService {
-    Collection<AccessControlListDTO> getAccessControlListList();
+    Collection<AccessControlListDTO> getAccessControlListList() throws UnauthorizedException;
 
     AccessControlListDTO getAccessControlList(String idAsString);
 
-    AccessControlListDTO updateACL(String idAsString, Map<String, Set<String>> permissionStrings);
+    AccessControlListDTO updateACL(String idAsString, Map<String, Set<String>> permissionStrings) throws UnauthorizedException;
 
-    AccessControlListDTO addToACL(String idAsString, String tenantIdAsString, String permission);
+    AccessControlListDTO addToACL(String idAsString, String tenantIdAsString, String permission) throws UnauthorizedException;
 
-    AccessControlListDTO removeFromACL(String idAsString, String tenantIdAsString, String permission);
+    AccessControlListDTO removeFromACL(String idAsString, String tenantIdAsString, String permission) throws UnauthorizedException;
 
-    Collection<TenantDTO> getTenantList();
+    Collection<TenantDTO> getTenantList() throws UnauthorizedException;
 
-    TenantDTO createTenant(String name, String tenantOwner) throws TenantManagementException;
+    TenantDTO createTenant(String name, String tenantOwner) throws TenantManagementException, UnauthorizedException;
 
     UserGroupDTO addUserToTenant(String idAsString, String user) throws UnauthorizedException;
 
     UserGroupDTO removeUserFromTenant(String idAsString, String user) throws UnauthorizedException;
 
-    SuccessInfo deleteTenant(String idAsString);
+    SuccessInfo deleteTenant(String idAsString) throws UnauthorizedException;
 
-    Collection<UserDTO> getUserList();
+    Collection<UserDTO> getUserList() throws UnauthorizedException;
 
-    Collection<UserDTO> getFilteredSortedUserList(String filter);
+    Collection<UserDTO> getFilteredSortedUserList(String filter) throws UnauthorizedException;
 
-    UserDTO getCurrentUser();
+    UserDTO getCurrentUser() throws UnauthorizedException;
 
     SuccessInfo login(String username, String password);
 
-    UserDTO createSimpleUser(String name, String email, String password, String fullName, String company, String localeName, String validationBaseURL, String tenantOwner) throws UserManagementException, MailException;
+    UserDTO createSimpleUser(String name, String email, String password, String fullName, String company, String localeName, String validationBaseURL, String tenantOwner) throws UserManagementException, MailException, UnauthorizedException;
     
     /**
      * Either <code>oldPassword</code> or <code>passwordResetSecret</code> need to be provided, or the current user needs to have
@@ -64,13 +64,13 @@ public interface UserManagementService extends RemoteService {
 
     boolean validateEmail(String username, String validationSecret) throws UserManagementException;
 
-    SuccessInfo deleteUser(String username);
+    SuccessInfo deleteUser(String username) throws UnauthorizedException;
 
     SuccessInfo logout();
 
-    SuccessInfo setRolesForUser(String username, Iterable<UUID> roles);
+    SuccessInfo setRolesForUser(String username, Iterable<UUID> roles) throws UnauthorizedException;
 
-    SuccessInfo setPermissionsForUser(String username, Iterable<String> permissions);
+    SuccessInfo setPermissionsForUser(String username, Iterable<String> permissions) throws UnauthorizedException;
 
     Map<String, String> getSettings();
 
@@ -88,24 +88,24 @@ public interface UserManagementService extends RemoteService {
      * @param value must not be <code>null</code>
      * @throws UserManagementException 
      */
-    void setPreference(String username, String key, String value) throws UserManagementException;
+    void setPreference(String username, String key, String value) throws UserManagementException, UnauthorizedException;
     
-    void setPreferences(String username, Map<String, String> keyValuePairs) throws UserManagementException;
+    void setPreferences(String username, Map<String, String> keyValuePairs) throws UserManagementException, UnauthorizedException;
 
     /**
      * Permitted only for users with role {@link DefaultRoles#ADMIN} or when the subject's user name matches
      * <code>username</code>.
      */
-    void unsetPreference(String username, String key) throws UserManagementException;
+    void unsetPreference(String username, String key) throws UserManagementException, UnauthorizedException;
 
     /**
      * @return <code>null</code> if no preference for the user identified by <code>username</code> is found
      */
-    String getPreference(String username, String key) throws UserManagementException;
+    String getPreference(String username, String key) throws UserManagementException, UnauthorizedException;
     
-    Map<String, String> getPreferences(String username, List<String> keys) throws UserManagementException;
+    Map<String, String> getPreferences(String username, List<String> keys) throws UserManagementException, UnauthorizedException;
     
-    Map<String, String> getAllPreferences(String username) throws UserManagementException;
+    Map<String, String> getAllPreferences(String username) throws UserManagementException, UnauthorizedException;
 
     String getAccessToken(String username);
 
diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserDetailsView.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserDetailsView.java
index 6128284cdb7..14721d90217 100644
--- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserDetailsView.java
+++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserDetailsView.java
@@ -30,7 +30,6 @@ import com.sap.sse.gwt.client.controls.listedit.StringListEditorComposite;
 import com.sap.sse.gwt.client.dialog.DataEntryDialog;
 import com.sap.sse.security.shared.DefaultPermissions;
 import com.sap.sse.security.shared.Permission;
-import com.sap.sse.security.shared.PermissionsForRoleProvider;
 import com.sap.sse.security.shared.Role;
 import com.sap.sse.security.shared.UserManagementException;
 import com.sap.sse.security.shared.WildcardPermission;
@@ -59,14 +58,11 @@ public class UserDetailsView extends FlowPanel {
     private final ListBox allPermissionsList;
     private UserDTO user;
 
-    private final PermissionsForRoleProvider permissionForRoleProvider;
-
     public UserDetailsView(final UserService userService, UserDTO user, final StringMessages stringMessages,
-            final UserListDataProvider userListDataProvider, PermissionsForRoleProvider permissionsForRoleProvider,
+            final UserListDataProvider userListDataProvider,
             Iterable<Role> additionalRoles, Iterable<Permission> additionalPermissions) {
         final UserManagementServiceAsync userManagementService = userService.getUserManagementService();
         this.stringMessages = stringMessages;
-        this.permissionForRoleProvider = permissionsForRoleProvider;
         this.user = user;
         addStyleName("userDetailsView");
         List<String> defaultRoleNames = new ArrayList<>(); // TODO: add dynamic roles here
@@ -265,7 +261,7 @@ public class UserDetailsView extends FlowPanel {
             rolesEditor.setValue(user.getStringRoles(), /* fireEvents */ false);
             permissionsEditor.setValue(user.getStringPermissions(), /* fireEvents */ false);
             allPermissionsList.clear();
-            for (WildcardPermission permission : user.getAllPermissions(permissionForRoleProvider)) {
+            for (WildcardPermission permission : user.getAllPermissions()) {
                 allPermissionsList.addItem(permission.toString());
             }
         }
diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserManagementPanel.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserManagementPanel.java
index 59d48521fdd..3fdea73ecb8 100644
--- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserManagementPanel.java
+++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserManagementPanel.java
@@ -28,7 +28,6 @@ import com.google.gwt.view.client.SelectionChangeEvent.Handler;
 import com.google.gwt.view.client.SingleSelectionModel;
 import com.sap.sse.security.shared.Role;
 import com.sap.sse.security.shared.Permission;
-import com.sap.sse.security.shared.PermissionsForRoleProvider;
 import com.sap.sse.security.ui.client.UserChangeEventHandler;
 import com.sap.sse.security.ui.client.UserManagementServiceAsync;
 import com.sap.sse.security.ui.client.UserService;
@@ -50,11 +49,11 @@ public class UserManagementPanel extends DockPanel {
 
     private UserListDataProvider userListDataProvider;
     
-    public UserManagementPanel(final UserService userService, final StringMessages stringMessages, PermissionsForRoleProvider permissionsForRoleProvider) {
-        this(userService, stringMessages, permissionsForRoleProvider, Collections.<Role>emptySet(), Collections.<Permission>emptySet());
+    public UserManagementPanel(final UserService userService, final StringMessages stringMessages) {
+        this(userService, stringMessages, Collections.<Role>emptySet(), Collections.<Permission>emptySet());
     }
     
-    public UserManagementPanel(final UserService userService, final StringMessages stringMessages, PermissionsForRoleProvider permissionsForRoleProvider,
+    public UserManagementPanel(final UserService userService, final StringMessages stringMessages,
             Iterable<Role> additionalRoles, Iterable<Permission> additionalPermissions) {
         final UserManagementServiceAsync userManagementService = userService.getUserManagementService();
         VerticalPanel west = new VerticalPanel();
@@ -139,8 +138,7 @@ public class UserManagementPanel extends DockPanel {
         TextBox filterBox = new TextBox();
         userListDataProvider = new UserListDataProvider(userManagementService, filterBox);
         final UserDetailsView userDetailsView = new UserDetailsView(userService,
-                singleSelectionModel.getSelectedObject(), stringMessages, userListDataProvider,
-                permissionsForRoleProvider, additionalRoles, additionalPermissions);
+                singleSelectionModel.getSelectedObject(), stringMessages, userListDataProvider, additionalRoles, additionalPermissions);
         add(userDetailsView, DockPanel.CENTER);
         userDetailsView.addUserChangeEventHandler(new UserChangeEventHandler() {
             @Override
diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java
index 62d89424ec3..a7700e6bce7 100755
--- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java
+++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java
@@ -25,13 +25,11 @@ import javax.servlet.http.HttpSession;
 import org.apache.shiro.SecurityUtils;
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authz.AuthorizationException;
-import org.apache.shiro.authz.permission.WildcardPermission;
 import org.apache.shiro.subject.Subject;
 import org.osgi.framework.BundleContext;
 import org.osgi.util.tracker.ServiceTracker;
 
 import com.google.gwt.user.server.rpc.RemoteServiceServlet;
-import com.sap.sailing.domain.common.security.Permission;
 import com.sap.sse.common.Util;
 import com.sap.sse.common.mail.MailException;
 import com.sap.sse.common.util.NaturalComparator;
@@ -44,7 +42,6 @@ import com.sap.sse.security.shared.AccessControlList;
 import com.sap.sse.security.shared.Account;
 import com.sap.sse.security.shared.Account.AccountType;
 import com.sap.sse.security.shared.Owner;
-import com.sap.sse.security.shared.Permission.DefaultModes;
 import com.sap.sse.security.shared.Role;
 import com.sap.sse.security.shared.SocialUserAccount;
 import com.sap.sse.security.shared.TenantManagementException;
@@ -145,13 +142,17 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
     }
 
     @Override
-    public Collection<AccessControlListDTO> getAccessControlListList() {
-        List<AccessControlListDTO> acls = new ArrayList<>();
-        for (AccessControlList acl : getSecurityService().getAccessControlListList()) {
-            AccessControlListDTO aclDTO = createAclDTOFromAcl(acl);
-            acls.add(aclDTO);
+    public Collection<AccessControlListDTO> getAccessControlListList() throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("manage_access_control")) {
+            List<AccessControlListDTO> acls = new ArrayList<>();
+            for (AccessControlList acl : getSecurityService().getAccessControlListList()) {
+                AccessControlListDTO aclDTO = createAclDTOFromAcl(acl);
+                acls.add(aclDTO);
+            }
+            return acls;
+        } else {
+            throw new UnauthorizedException("Not permitted to manage access control");
         }
-        return acls;
     }
 
     @Override
@@ -160,61 +161,81 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
     }
 
     @Override
-    public AccessControlListDTO updateACL(String idAsString, Map<String, Set<String>> permissionStrings) {
-        Map<UserGroup, Set<String>> permissionMap = new HashMap<>();
-        for (String group : permissionStrings.keySet()) {
-            permissionMap.put(getSecurityService().getUserGroupByName(group), permissionStrings.get(group));
+    public AccessControlListDTO updateACL(String idAsString, Map<String, Set<String>> permissionStrings) throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("tenant:grant_permission,revoke_permission")) {
+            Map<UserGroup, Set<String>> permissionMap = new HashMap<>();
+            for (String group : permissionStrings.keySet()) {
+                permissionMap.put(getSecurityService().getUserGroupByName(group), permissionStrings.get(group));
+            }
+            return createAclDTOFromAcl(getSecurityService().updateACL(idAsString, permissionMap));
+        } else {
+            throw new UnauthorizedException("Not permitted to grant and revoke permissions for user");
         }
-        return createAclDTOFromAcl(getSecurityService().updateACL(idAsString, permissionMap));
     }
 
     @Override
-    public AccessControlListDTO addToACL(String idAsString, String tenantIdAsString, String permission) {
-        UUID tenantId = UUID.fromString(tenantIdAsString);
-        return createAclDTOFromAcl(getSecurityService().addToACL(idAsString, tenantId, permission));
-    }
-
-    @Override
-    public AccessControlListDTO removeFromACL(String idAsString, String tenantIdAsString, String permission) {
-        UUID tenantId = UUID.fromString(tenantIdAsString);
-        return createAclDTOFromAcl(getSecurityService().removeFromACL(idAsString, tenantId, permission));
-    }
-
-    @Override
-    public Collection<TenantDTO> getTenantList() {
-        List<TenantDTO> tenants = new ArrayList<>();
-        for (Tenant t : getSecurityService().getTenantList()) {
-            TenantDTO tenantDTO = createTenantDTOFromTenant(t);
-            tenants.add(tenantDTO);
+    public AccessControlListDTO addToACL(String idAsString, String tenantIdAsString, String permission) throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("tenant:grant_permission:" + tenantIdAsString)) {
+            UUID tenantId = UUID.fromString(tenantIdAsString);
+            return createAclDTOFromAcl(getSecurityService().addToACL(idAsString, tenantId, permission));
+        } else {
+            throw new UnauthorizedException("Not permitted to grant permission for user");
         }
-        return tenants;
     }
 
     @Override
-    public TenantDTO createTenant(String name, String tenantOwner) throws TenantManagementException {
-        UUID id = UUID.randomUUID();
-        Tenant tenant;
-        try {
-            tenant = getSecurityService().createTenant(id, name);
-        } catch (UserGroupManagementException e) {
-            throw new TenantManagementException(e.getMessage());
+    public AccessControlListDTO removeFromACL(String idAsString, String tenantIdAsString, String permission) throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("tenant:revoke_permission:" + tenantIdAsString)) {
+            UUID tenantId = UUID.fromString(tenantIdAsString);
+            return createAclDTOFromAcl(getSecurityService().removeFromACL(idAsString, tenantId, permission));
+        } else {
+            throw new UnauthorizedException("Not permitted to revoke permission for user");
+        }
+    }
+
+    @Override
+    public Collection<TenantDTO> getTenantList() throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("manage_tenants")) {
+            List<TenantDTO> tenants = new ArrayList<>();
+            for (Tenant t : getSecurityService().getTenantList()) {
+                TenantDTO tenantDTO = createTenantDTOFromTenant(t);
+                tenants.add(tenantDTO);
+            }
+            return tenants;
+        } else {
+            throw new UnauthorizedException("Not permitted to manage tenants");
+        }
+    }
+
+    @Override
+    public TenantDTO createTenant(String name, String tenantOwner) throws TenantManagementException, UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("tenant:create")) {
+            UUID id = UUID.randomUUID();
+            Tenant tenant;
+            try {
+                tenant = getSecurityService().createTenant(id, name);
+            } catch (UserGroupManagementException e) {
+                throw new TenantManagementException(e.getMessage());
+            }
+            getSecurityService().createOwnership(id.toString(), (String) SecurityUtils.getSubject().getPrincipal(), (UUID) getSecurityService().getTenantByName(tenantOwner).getId(), name);
+            return createTenantDTOFromTenant(tenant);
+        } else {
+            throw new UnauthorizedException("Not permitted to create tenants");
         }
-        getSecurityService().createOwnership(id.toString(), (String) SecurityUtils.getSubject().getPrincipal(), (UUID) getSecurityService().getTenantByName(tenantOwner).getId(), name);
-        return createTenantDTOFromTenant(tenant);
     }
 
     @Override
     public UserGroupDTO addUserToTenant(String idAsString, String user) throws UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted("usergroup:add_user:" + idAsString + ":" + user)) {
+        if (SecurityUtils.getSubject().isPermitted("tenant:add_user:" + idAsString)) {
             return createUserGroupDTOFromUserGroup(getSecurityService().addUserToUserGroup(UUID.fromString(idAsString), user));
         } else {
-            throw new UnauthorizedException("Not permitted to add user from tenant");
+            throw new UnauthorizedException("Not permitted to add user to tenant");
         }
     }
 
     @Override
     public UserGroupDTO removeUserFromTenant(String idAsString, String user) throws UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted(new WildcardPermission(UserGroup.class.getName() + ":remove-user:" + user, true))) {
+        if (SecurityUtils.getSubject().isPermitted("tenant:remove_user:" + idAsString)) {
             return createUserGroupDTOFromUserGroup(getSecurityService().removeUserFromUserGroup(UUID.fromString(idAsString), user));
         } else {
             throw new UnauthorizedException("Not permitted to remove user from tenant");
@@ -222,36 +243,48 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
     }
 
     @Override
-    public SuccessInfo deleteTenant(String idAsString) {
-        try {
-            UUID id = UUID.fromString(idAsString);
-            getSecurityService().deleteTenant(id);
-            getSecurityService().deleteACL(id.toString());
-            getSecurityService().deleteOwnership(id.toString());
-            return new SuccessInfo(true, "Deleted tenant: " + idAsString + ".", /* redirectURL */ null, null);
-        } catch (UserGroupManagementException e) {
-            return new SuccessInfo(false, "Could not delete tenant.", /* redirectURL */ null, null);
+    public SuccessInfo deleteTenant(String idAsString) throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("tenant:delete:" + idAsString)) {
+            try {
+                UUID id = UUID.fromString(idAsString);
+                getSecurityService().deleteTenant(id);
+                getSecurityService().deleteACL(id.toString());
+                getSecurityService().deleteOwnership(id.toString());
+                return new SuccessInfo(true, "Deleted tenant: " + idAsString + ".", /* redirectURL */ null, null);
+            } catch (UserGroupManagementException e) {
+                return new SuccessInfo(false, "Could not delete tenant.", /* redirectURL */ null, null);
+            }
+        } else {
+            throw new UnauthorizedException("Not permitted to delete tenant");
         }
     }
 
     @Override
-    public Collection<UserDTO> getUserList() {
-        List<UserDTO> users = new ArrayList<>();
-        for (User u : getSecurityService().getUserList()) {
-            UserDTO userDTO = createUserDTOFromUser(u);
-            users.add(userDTO);
+    public Collection<UserDTO> getUserList() throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("manage_users")) {
+            List<UserDTO> users = new ArrayList<>();
+            for (User u : getSecurityService().getUserList()) {
+                UserDTO userDTO = createUserDTOFromUser(u);
+                users.add(userDTO);
+            }
+            return users;
+        } else {
+            throw new UnauthorizedException("Not permitted to manage users");
         }
-        return users;
     }
 
     @Override
-    public UserDTO getCurrentUser() {
+    public UserDTO getCurrentUser() throws UnauthorizedException {
         logger.fine("Request: " + getThreadLocalRequest().getRequestURL());
         User user = getSecurityService().getCurrentUser();
         if (user == null) {
             return null;
         }
-        return createUserDTOFromUser(user);
+        if (SecurityUtils.getSubject().isPermitted("user:view:" + user.getName())) {
+            return createUserDTOFromUser(user);
+        } else {
+            throw new UnauthorizedException("Not permitted to view current user");
+        }
     }
 
     @Override
@@ -279,29 +312,31 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
     }
 
     @Override
-    public UserDTO createSimpleUser(String name, String email, String password, String fullName, String company, String localeName, String validationBaseURL, String tenantOwner) throws UserManagementException, MailException {
-        User u = null;
-        try {
-            u = getSecurityService().createSimpleUser(name, email, password, fullName, company, getLocaleFromLocaleName(localeName), validationBaseURL);
-            getSecurityService().createOwnership(name, (String) SecurityUtils.getSubject().getPrincipal(), (UUID) getSecurityService().getTenantByName(tenantOwner).getId());
-        } catch (UserManagementException | UserGroupManagementException e) {
-            logger.log(Level.SEVERE, "Error creating user "+name, e);
-            throw new UserManagementException(e.getMessage());
+    public UserDTO createSimpleUser(String name, String email, String password, String fullName, String company, String localeName, String validationBaseURL, String tenantOwner) throws UserManagementException, MailException, UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("user:create")) {
+            User u = null;
+            try {
+                u = getSecurityService().createSimpleUser(name, email, password, fullName, company, getLocaleFromLocaleName(localeName), validationBaseURL);
+                getSecurityService().createOwnership(name, (String) SecurityUtils.getSubject().getPrincipal(), (UUID) getSecurityService().getTenantByName(tenantOwner).getId());
+            } catch (UserManagementException | UserGroupManagementException e) {
+                logger.log(Level.SEVERE, "Error creating user "+name, e);
+                throw new UserManagementException(e.getMessage());
+            }
+            if (u == null) {
+                return null;
+            }
+            return createUserDTOFromUser(u);
+        } else {
+            throw new UnauthorizedException("Not permitted to create user");
         }
-        if (u == null) {
-            return null;
-        }
-        return createUserDTOFromUser(u);
     }
 
 
     @Override
     public void updateSimpleUserPassword(final String username, String oldPassword, String passwordResetSecret, String newPassword) throws UserManagementException {
-        // final Subject subject = SecurityUtils.getSubject();
-        // the signed-in subject has role ADMIN
-        // if (subject.hasRole(AdminRole.getInstance().getName()) ||
+        if (SecurityUtils.getSubject().isPermitted("user:edit:" + username)
             // someone knew a username and the correct password for that user
-        if ((oldPassword != null && getSecurityService().checkPassword(username, oldPassword))
+         || (oldPassword != null && getSecurityService().checkPassword(username, oldPassword))
             // someone provided the correct password reset secret for the correct username
          || (passwordResetSecret != null && getSecurityService().checkPasswordResetSecret(username, passwordResetSecret))) {
             getSecurityService().updateSimpleUserPassword(username, newPassword);
@@ -321,9 +356,9 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
 
     private void ensureThatUserInQuestionIsLoggedInOrCurrentUserIsAdmin(String username) throws UserManagementException {
         final Subject subject = SecurityUtils.getSubject();
-        // the signed-in subject has role ADMIN or is changing own user
-        //if (!subject.hasRole(AdminRole.getInstance().getName()) &&
-        if ((subject.getPrincipal() == null
+        // the signed-in subject has all permissions or is changing own user
+        if (SecurityUtils.getSubject().isPermitted("*") &&
+                (subject.getPrincipal() == null
                 || !username.equals(subject.getPrincipal().toString()))) {
             throw new UserManagementException(UserManagementException.INVALID_CREDENTIALS);
         }
@@ -365,31 +400,34 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
     }
 
     @Override
-    public Collection<UserDTO> getFilteredSortedUserList(String filter) {
-        List<UserDTO> users = new ArrayList<>();
-        for (User u : getSecurityService().getUserList()) {
-            if (filter != null && !"".equals(filter)) {
-                if (u.getName().contains(filter)) {
+    public Collection<UserDTO> getFilteredSortedUserList(String filter) throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("manage_users")) {
+            List<UserDTO> users = new ArrayList<>();
+            for (User u : getSecurityService().getUserList()) {
+                if (filter != null && !"".equals(filter)) {
+                    if (u.getName().contains(filter)) {
+                        users.add(createUserDTOFromUser(u));
+                    }
+                } else {
                     users.add(createUserDTOFromUser(u));
                 }
-            } else {
-                users.add(createUserDTOFromUser(u));
             }
+            Collections.sort(users, new Comparator<UserDTO>() {
+                private final NaturalComparator naturalComparator = new NaturalComparator(/* caseSensitive */ false);
+                @Override
+                public int compare(UserDTO u1, UserDTO u2) {
+                    return naturalComparator.compare(u1.getName(), u2.getName());
+                }
+            });
+            return users;
+        } else {
+            throw new UnauthorizedException("Not permitted to manage users");
         }
-        Collections.sort(users, new Comparator<UserDTO>() {
-            private final NaturalComparator naturalComparator = new NaturalComparator(/* caseSensitive */ false);
-            @Override
-            public int compare(UserDTO u1, UserDTO u2) {
-                return naturalComparator.compare(u1.getName(), u2.getName());
-            }
-        });
-        return users;
     }
 
     @Override
-    public SuccessInfo setRolesForUser(String username, Iterable<UUID> roles) {
-        // Subject currentSubject = SecurityUtils.getSubject();
-        // if (currentSubject.hasRole(AdminRole.getInstance().getName())) {
+    public SuccessInfo setRolesForUser(String username, Iterable<UUID> roles) throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("user:grant_permission,revoke_permission:" + username)) {
             User u = getSecurityService().getUserByName(username);
             if (u == null) {
                 return new SuccessInfo(false, "User does not exist.", /* redirectURL */null, null);
@@ -408,16 +446,14 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
             }
             return new SuccessInfo(true, "Set roles " + roles + " for user " + username, /* redirectURL */null,
                     createUserDTOFromUser(u));
-        //} else {
-        //    return new SuccessInfo(false, "You don't have the required permissions to add a role.", /* redirectURL */ null, null);
-        //}
+        } else {
+            throw new UnauthorizedException("Not permitted to grant permissions to user");
+        }
     }
 
     @Override
-    public SuccessInfo setPermissionsForUser(String username, Iterable<String> permissions) {
-        Subject currentSubject = SecurityUtils.getSubject();
-        //if (SecurityUtils.getSubject().hasRole(AdminRole.getInstance().getName()) ||
-        if (currentSubject.isPermitted(Permission.MANAGE_USERS.getStringPermissionForObjects(DefaultModes.UPDATE, username))) {
+    public SuccessInfo setPermissionsForUser(String username, Iterable<String> permissions) throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("user:grant_permission,revoke_permission:" + username)) {
             User u = getSecurityService().getUserByName(username);
             if (u == null) {
                 return new SuccessInfo(false, "User does not exist.", /* redirectURL */null, null);
@@ -437,12 +473,13 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
             return new SuccessInfo(true, "Set roles " + permissions + " for user " + username, /* redirectURL */null,
                     createUserDTOFromUser(u));
         } else {
-            return new SuccessInfo(false, "You don't have the required permissions to add a role.", /* redirectURL */ null, null);
+            throw new UnauthorizedException("Not permitted to grant or revoke permissions for user");
         }
     }
 
     @Override
-    public SuccessInfo deleteUser(String username) {
+    public SuccessInfo deleteUser(String username) throws UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("user:delete:" + username)) {
         try {
             getSecurityService().deleteUser(username);
             getSecurityService().deleteACL(username);
@@ -451,6 +488,9 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
         } catch (UserManagementException e) {
             return new SuccessInfo(false, "Could not delete user.", /* redirectURL */ null, null);
         }
+        } else {
+            throw new UnauthorizedException("Not permitted to delete user");
+        }
     }
 
     private RoleDTO createRoleDTOFromRole(Role role) {
@@ -603,45 +643,61 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
     }
 
     @Override
-    public void setPreference(String username, String key, String value) throws UserManagementException {
-        try {
-            getSecurityService().setPreference(username, key, value);
-        } catch (AuthorizationException e) {
-            throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
-        }
-    }
-    
-    @Override
-    public void setPreferences(String username, Map<String, String> keyValuePairs) throws UserManagementException {
-        try {
-            for (Entry<String, String> entry : keyValuePairs.entrySet()) {
-                getSecurityService().setPreference(username, entry.getKey(), entry.getValue());
+    public void setPreference(String username, String key, String value) throws UserManagementException, UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("user:edit:" + username)) {
+            try {
+                getSecurityService().setPreference(username, key, value);
+            } catch (AuthorizationException e) {
+                throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
             }
-        } catch (AuthorizationException e) {
-            throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
-        }
-    }
-
-    @Override
-    public void unsetPreference(String username, String key) throws UserManagementException {
-        try {
-            getSecurityService().unsetPreference(username, key);
-        } catch (AuthorizationException e) {
-            throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
-        }
-    }
-
-    @Override
-    public String getPreference(String username, String key) throws UserManagementException {
-        try {
-            return getSecurityService().getPreference(username, key);
-        } catch (AuthorizationException e) {
-            throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
+        } else {
+            throw new UnauthorizedException("Not permitted to edit user");
         }
     }
     
     @Override
-    public Map<String, String> getPreferences(String username, List<String> keys) throws UserManagementException {
+    public void setPreferences(String username, Map<String, String> keyValuePairs) throws UserManagementException, UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("user:edit:" + username)) {
+            try {
+                for (Entry<String, String> entry : keyValuePairs.entrySet()) {
+                    getSecurityService().setPreference(username, entry.getKey(), entry.getValue());
+                }
+            } catch (AuthorizationException e) {
+                throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
+            }
+        } else {
+            throw new UnauthorizedException("Not permitted to edit user");
+        }
+    }
+
+    @Override
+    public void unsetPreference(String username, String key) throws UserManagementException, UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("user:edit:" + username)) {
+            try {
+                getSecurityService().unsetPreference(username, key);
+            } catch (AuthorizationException e) {
+                throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
+            }
+        } else {
+            throw new UnauthorizedException("Not permitted to edit user");
+        }
+    }
+
+    @Override
+    public String getPreference(String username, String key) throws UserManagementException, UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("user:view:" + username)) {
+            try {
+                return getSecurityService().getPreference(username, key);
+            } catch (AuthorizationException e) {
+                throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
+            }
+        } else {
+            throw new UnauthorizedException("Not permitted to view user");
+        }
+    }
+    
+    @Override
+    public Map<String, String> getPreferences(String username, List<String> keys) throws UserManagementException, UnauthorizedException {
         Map<String, String> requestedPreferences = new HashMap<>();
         for (String key : keys) {
             requestedPreferences.put(key, getPreference(username, key));
@@ -650,18 +706,22 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
     }
     
     @Override
-    public Map<String, String> getAllPreferences(String username) throws UserManagementException {
-        try {
-            final Map<String, String> allPreferences = getSecurityService().getAllPreferences(username);
-            final Map<String, String> result = new HashMap<>();
-            for (Map.Entry<String, String> entry : allPreferences.entrySet()) {
-                if(!entry.getKey().startsWith("_")) {
-                    result.put(entry.getKey(), entry.getValue());
+    public Map<String, String> getAllPreferences(String username) throws UserManagementException, UnauthorizedException {
+        if (SecurityUtils.getSubject().isPermitted("user:view:" + username)) {
+            try {
+                final Map<String, String> allPreferences = getSecurityService().getAllPreferences(username);
+                final Map<String, String> result = new HashMap<>();
+                for (Map.Entry<String, String> entry : allPreferences.entrySet()) {
+                    if(!entry.getKey().startsWith("_")) {
+                        result.put(entry.getKey(), entry.getValue());
+                    }
                 }
+                return result;
+            } catch (AuthorizationException e) {
+                throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
             }
-            return result;
-        } catch (AuthorizationException e) {
-            throw new UserManagementException(UserManagementException.USER_DOESNT_HAVE_PERMISSION);
+        } else {
+            throw new UnauthorizedException("Not permitted to view user");
         }
     }
 
diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/shared/UserDTO.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/shared/UserDTO.java
index fa4dfe349bc..44bf8b82bc0 100644
--- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/shared/UserDTO.java
+++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/shared/UserDTO.java
@@ -119,7 +119,7 @@ public class UserDTO implements IsSerializable {
      * @return a set of permissions with no duplicates, all in the format parsable by
      *         {@link WildcardPermission#WildcardPermission(String)}
      */
-    public Iterable<WildcardPermission> getAllPermissions(PermissionsForRoleProvider permissionsForRoleProvider) {
+    public Iterable<WildcardPermission> getAllPermissions() {
         Set<WildcardPermission> result = new LinkedHashSet<>();
         Util.addAll(permissions, result);
         if (rolePermissionModel != null) {
diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/usermanagement/UserManagementEntryPoint.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/usermanagement/UserManagementEntryPoint.java
index 70f18afb47e..f7897293fbf 100755
--- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/usermanagement/UserManagementEntryPoint.java
+++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/usermanagement/UserManagementEntryPoint.java
@@ -26,8 +26,7 @@ public class UserManagementEntryPoint extends AbstractSecurityEntryPoint {
             public void onUserStatusChange(UserDTO user, boolean preAuthenticated) {
             }
         });
-        UserManagementPanel userManagementPanel = new UserManagementPanel(getUserService(), getStringMessages(),
-                /* permissionsForRoleProvider is null in this generic entry point */ null);
+        UserManagementPanel userManagementPanel = new UserManagementPanel(getUserService(), getStringMessages());
         center.add(new ScrollPanel(userManagementPanel), getStringMessages().users());
         final SettingsPanel settingsPanel = new SettingsPanel(getUserManagementService(), getStringMessages());
         center.add(new ScrollPanel(settingsPanel), getStringMessages().settings());
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/AbstractCompositeAuthrizingRealm.java b/java/com.sap.sse.security/src/com/sap/sse/security/AbstractCompositeAuthrizingRealm.java
index 652bfa9c648..e7949f3f5a5 100755
--- a/java/com.sap.sse.security/src/com/sap/sse/security/AbstractCompositeAuthrizingRealm.java
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/AbstractCompositeAuthrizingRealm.java
@@ -161,6 +161,7 @@ public abstract class AbstractCompositeAuthrizingRealm extends AuthorizingRealm
 
     @Override
     public boolean isPermitted(PrincipalCollection principals, Permission perm) {
+        //TODO check whether WildcardPermission functionality can be used here (perm instanceof)
         String[] parts = perm.toString().replaceAll("\\[|\\]", "").split(":");
         String user = (String) principals.getPrimaryPrincipal();