diff --git a/src/main/java/ru/soune/nocopy/adminpanel/handler/CreateAdminTemplateHandler.java b/src/main/java/ru/soune/nocopy/adminpanel/handler/CreateAdminTemplateHandler.java
index b24356a..e8839ec 100644
--- a/src/main/java/ru/soune/nocopy/adminpanel/handler/CreateAdminTemplateHandler.java
+++ b/src/main/java/ru/soune/nocopy/adminpanel/handler/CreateAdminTemplateHandler.java
@@ -3,12 +3,16 @@ package ru.soune.nocopy.adminpanel.handler;
 import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
+import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Component;
 import ru.soune.nocopy.adminpanel.dto.*;
 import ru.soune.nocopy.adminpanel.entity.AdminCreateTemplate;
+import ru.soune.nocopy.adminpanel.entity.AdminSection;
 import ru.soune.nocopy.adminpanel.service.AdminCreateTemplateService;
+import ru.soune.nocopy.adminpanel.service.AdminSectionPermissionService;
 import ru.soune.nocopy.adminpanel.util.MessageCode;
 
 import java.util.Arrays;
@@ -24,6 +28,10 @@ public class CreateAdminTemplateHandler implements RequestHandler {
 
     private final AdminCreateTemplateService adminCreateTemplateService;
 
+    private final AdminSectionPermissionService adminSectionPermissionService;
+
+    private final HttpServletRequest httpServletRequest;
+
     @Override
     public BaseResponse handle(BaseRequest request) {
         AdminCreateTemplateRequest adminCreateTemplateRequest = objectMapper.convertValue(request.getMessageBody(),
@@ -42,6 +50,7 @@ public class CreateAdminTemplateHandler implements RequestHandler {
 
     private BaseResponse handleDelete(BaseRequest request, AdminCreateTemplateRequest adminCreateTemplateRequest) {
         Long adminCreateTemplateRequestId = adminCreateTemplateRequest.getId();
+        Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
 
         if (adminCreateTemplateRequestId == null || !adminCreateTemplateService.existById(adminCreateTemplateRequestId)) {
             return BaseResponse.builder()
@@ -52,6 +61,17 @@ public class CreateAdminTemplateHandler implements RequestHandler {
                     .build();
         }
 
+        if (!adminSectionPermissionService.canWrite(currentUserId,
+                AdminSection.STAFF)) {
+
+            return BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                    .messageDesc(MessageCode.PERMISSION_DENIED.getDescription())
+                    .messageBody(Map.of("currentUserId", currentUserId))
+                    .build();
+        }
+
         adminCreateTemplateService.deleteTemplate(adminCreateTemplateRequestId);
 
 
@@ -65,6 +85,7 @@ public class CreateAdminTemplateHandler implements RequestHandler {
 
     private BaseResponse handleUpdate(BaseRequest request, AdminCreateTemplateRequest adminCreateTemplateRequest) {
         Map<String, Integer> permissionsMap = adminCreateTemplateRequest.getPermissions();
+        Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
 
         if (permissionsMap == null || permissionsMap.isEmpty()) {
             return BaseResponse.builder()
@@ -75,6 +96,17 @@ public class CreateAdminTemplateHandler implements RequestHandler {
                     .build();
         }
 
+        if (!adminSectionPermissionService.canWrite(currentUserId,
+                AdminSection.STAFF)) {
+
+            return BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                    .messageDesc(MessageCode.PERMISSION_DENIED.getDescription())
+                    .messageBody(Map.of("currentUserId", currentUserId))
+                    .build();
+        }
+
         ObjectNode node = objectMapper.createObjectNode();
 
         for (Map.Entry<String, Integer> entry: permissionsMap.entrySet()) {
@@ -106,6 +138,7 @@ public class CreateAdminTemplateHandler implements RequestHandler {
 
     private BaseResponse handleCreate(BaseRequest request, AdminCreateTemplateRequest adminCreateTemplateRequest) {
         Map<String, Integer> permissionsMap = adminCreateTemplateRequest.getPermissions();
+        Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
 
         if (permissionsMap == null || permissionsMap.isEmpty()) {
             return BaseResponse.builder()
@@ -115,6 +148,18 @@ public class CreateAdminTemplateHandler implements RequestHandler {
                     .build();
         }
 
+
+        if (!adminSectionPermissionService.canWrite(currentUserId,
+                AdminSection.STAFF)) {
+
+            return BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                    .messageDesc(MessageCode.PERMISSION_DENIED.getDescription())
+                    .messageBody(Map.of("currentUserId", currentUserId))
+                    .build();
+        }
+
         ObjectNode node = objectMapper.createObjectNode();
 
         for (Map.Entry<String, Integer> entry: permissionsMap.entrySet()) {
@@ -137,11 +182,25 @@ public class CreateAdminTemplateHandler implements RequestHandler {
     }
 
     private BaseResponse handleGetAll(BaseRequest request) {
+        Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+        if (!adminSectionPermissionService.canRead(currentUserId,
+                AdminSection.STAFF)) {
+
+            return BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                    .messageDesc(MessageCode.PERMISSION_DENIED.getDescription())
+                    .messageBody(Map.of("currentUserId", currentUserId))
+                    .build();
+        }
+
         List<AdminCreateTemplateResponse> templateResponses = adminCreateTemplateService.getAllTemplates()
                 .stream()
                 .map(this::convertToResponse)
                 .toList();
 
+
         return BaseResponse.builder()
                 .msgId(request.getMsgId())
                 .messageCode(MessageCode.SUCCESS.getCode())
@@ -152,6 +211,7 @@ public class CreateAdminTemplateHandler implements RequestHandler {
 
     private BaseResponse handleGetById(BaseRequest request, AdminCreateTemplateRequest adminCreateTemplateRequest) {
         Long id = adminCreateTemplateRequest.getId();
+        Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
 
         if (id == null || !adminCreateTemplateService.existById(id)) {
             return BaseResponse.builder()
@@ -162,6 +222,17 @@ public class CreateAdminTemplateHandler implements RequestHandler {
                     .build();
         }
 
+        if (!adminSectionPermissionService.canRead(currentUserId,
+                AdminSection.STAFF)) {
+
+            return BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                    .messageDesc(MessageCode.PERMISSION_DENIED.getDescription())
+                    .messageBody(Map.of("currentUserId", currentUserId))
+                    .build();
+        }
+
         AdminCreateTemplate template = adminCreateTemplateService.getTemplateById(adminCreateTemplateRequest.getId());
 
         return BaseResponse.builder()