diff --git a/frontend/src/components/project/labels/LabelSchemeCard.vue b/frontend/src/components/project/labels/LabelSchemeCard.vue
index 969e5096..9c51d9e8 100644
--- a/frontend/src/components/project/labels/LabelSchemeCard.vue
+++ b/frontend/src/components/project/labels/LabelSchemeCard.vue
@@ -74,10 +74,10 @@ import {useToast} from '@/composables/useToast';
 import LabelChip from './LabelChip.vue';
 import CreateLabelForm from './CreateLabelForm.vue';
 import Button from '@/components/common/Button.vue';
+import {PERMISSIONS} from '@/services/auth/permissions.types';
 import Card from '@/components/common/Card.vue';
 import ModalWindow from '@/components/common/modal/ModalWindow.vue';
 import {AppLogger} from '@/core/logger/logger';
-import {PERMISSIONS} from '@/services/auth/permissions.types';
 
 const logger = AppLogger.createComponentLogger('LabelSchemeCard');
 
@@ -216,4 +216,4 @@ onMounted(fetchLabels);
     opacity: 0.7;
     border-color: var(--color-gray-300);
 }
-</style>
\ No newline at end of file
+</style>
diff --git a/frontend/src/components/project/workflow/WorkflowCard.vue b/frontend/src/components/project/workflow/WorkflowCard.vue
index ee62befd..1447cb2d 100644
--- a/frontend/src/components/project/workflow/WorkflowCard.vue
+++ b/frontend/src/components/project/workflow/WorkflowCard.vue
@@ -36,6 +36,7 @@
                 v-else
                 :to="pipelineUrl" 
                 class="action-button secondary"
+                v-permission="{ permission: PERMISSIONS.WORKFLOW.UPDATE }"
             >
                 <font-awesome-icon :icon="faDiagramProject" />
                 View Pipeline
@@ -47,6 +48,7 @@
                 :to="pipelineUrl" 
                 class="action-button secondary small"
                 title="View workflow pipeline"
+                v-permission="{ permission: PERMISSIONS.WORKFLOW.UPDATE }"
             >
                 <font-awesome-icon :icon="faDiagramProject" />
                 Pipeline
@@ -63,6 +65,7 @@ import { type ProjectRole } from '@/services/project/project.types';
 import { WorkflowNavigationHelper } from '@/core/workflow';
 import { FontAwesomeIcon } from '@fortawesome/vue-fontawesome';
 import { faDiagramProject } from '@fortawesome/free-solid-svg-icons';
+import { PERMISSIONS } from '@/services/auth/permissions.types';
 
 interface Props {
     workflow: Workflow;
@@ -233,4 +236,4 @@ const formatDate = (dateString: string): string => {
         }
     }
 }
-</style>
\ No newline at end of file
+</style>
diff --git a/frontend/src/composables/usePermissions.ts b/frontend/src/composables/usePermissions.ts
index 9cebcff3..af7fe970 100644
--- a/frontend/src/composables/usePermissions.ts
+++ b/frontend/src/composables/usePermissions.ts
@@ -1,6 +1,6 @@
-import { computed, type ComputedRef } from 'vue';
+import { computed, reactive, type ComputedRef } from 'vue';
 import { useAuthStore } from '@/stores/authStore';
-import { usePermissionStore } from '@/stores/permissionStore';
+import { authorizationService } from '@/services/auth';
 import { useProjectStore } from '@/stores/projectStore';
 
 /**
@@ -9,7 +9,35 @@ import { useProjectStore } from '@/stores/projectStore';
  */
 export function usePermissions() {
     const authStore = useAuthStore();
-    const permissionStore = usePermissionStore();
+    // Lightweight reactive cache for authorization checks
+    const resultsCache = reactive<Record<string, boolean>>({});
+    const pending = new Map<string, Promise<boolean>>();
+
+    const makeKey = (perm: string, ctx?: { projectId?: number; global?: boolean }): string => {
+        const pid = ctx?.projectId ?? projectStore.currentProject?.id ?? 0;
+        const scope = ctx?.global ? 'g' : 'p';
+        return `${scope}:${pid}:${perm}`;
+    };
+
+    const ensure = async (perm: string, ctx?: { projectId?: number; global?: boolean }): Promise<boolean> => {
+        const key = makeKey(perm, ctx);
+        if (key in resultsCache) return resultsCache[key];
+        if (pending.has(key)) return pending.get(key)!;
+        const promise = authorizationService
+            .authorize({ permission: perm, context: ctx?.projectId ? { projectId: ctx.projectId } : undefined })
+            .then((allow) => {
+                resultsCache[key] = allow;
+                pending.delete(key);
+                return allow;
+            })
+            .catch(() => {
+                resultsCache[key] = false;
+                pending.delete(key);
+                return false;
+            });
+        pending.set(key, promise);
+        return promise;
+    };
     const projectStore = useProjectStore();
 
     // Permission-based checks
@@ -18,37 +46,81 @@ export function usePermissions() {
      * Checks if user has a global permission (available regardless of project)
      */
     const hasGlobalPermission = (permission: string): boolean => {
-        return permissionStore.hasGlobalPermission(permission);
+        // Trigger async fetch; return cached value if present
+        void ensure(permission, { global: true });
+        const key = makeKey(permission, { global: true });
+        return !!resultsCache[key];
     };
 
     /**
      * Checks if user has any of the specified global permissions
      */
     const hasAnyGlobalPermission = (permissions: string[]): boolean => {
-        return permissionStore.hasAnyGlobalPermission(permissions);
+        permissions.forEach(p => void ensure(p, { global: true }));
+        return permissions.some(p => !!resultsCache[makeKey(p, { global: true })]);
     };
 
     /**
      * Checks if user has all of the specified global permissions
      */
     const hasAllGlobalPermissions = (permissions: string[]): boolean => {
-        return permissionStore.hasAllGlobalPermissions(permissions);
+        permissions.forEach(p => void ensure(p, { global: true }));
+        return permissions.every(p => !!resultsCache[makeKey(p, { global: true })]);
     };
 
     /**
-     * Checks if user has a permission in the current project
+     * Checks if user has a permission in the current project (sync; warms cache asynchronously)
      */
     const hasProjectPermission = (permission: string): boolean => {
         const currentProjectId = projectStore.currentProject?.id;
         if (!currentProjectId) return false;
-        return permissionStore.hasProjectPermission(permission, currentProjectId);
+        void ensure(permission, { projectId: currentProjectId });
+        return !!resultsCache[makeKey(permission, { projectId: currentProjectId })];
+    };
+
+    /**
+     * Asynchronously checks if user has a permission in the current project.
+     * Resolves after the authoritative backend check.
+     */
+    const hasProjectPermissionAsync = async (permission: string): Promise<boolean> => {
+        const currentProjectId = projectStore.currentProject?.id;
+        if (!currentProjectId) return false;
+        return ensure(permission, { projectId: currentProjectId });
     };
 
     /**
      * Checks if user has a permission in a specific project
      */
     const hasPermissionInProject = (permission: string, projectId: number): boolean => {
-        return permissionStore.hasProjectPermission(permission, projectId);
+        if (!projectId) return false;
+        void ensure(permission, { projectId });
+        return !!resultsCache[makeKey(permission, { projectId })];
+    };
+
+    /**
+     * Prefetch a project-scoped permission to warm the cache.
+     */
+    const prefetchProjectPermission = (permission: string, projectId?: number) => {
+        const pid = projectId ?? projectStore.currentProject?.id;
+        if (!pid) return Promise.resolve(false);
+        return ensure(permission, { projectId: pid });
+    };
+
+    /**
+     * Wraps an action with a project-scoped permission check. If denied, logs and does nothing.
+     * Usage: const onClick = guardProjectAction(PERMISSIONS.TASK.READ, () => {...})
+     */
+    const guardProjectAction = (permission: string, action: (...args: any[]) => any, projectId?: number) => {
+        return async (...args: any[]) => {
+            const pid = projectId ?? projectStore.currentProject?.id;
+            if (!pid) return;
+            const allowed = await ensure(permission, { projectId: pid });
+            if (!allowed) {
+                // TODO: soft-fail: optional place to integrate a toast/notification
+                return;
+            }
+            return action(...args);
+        };
     };
 
     /**
@@ -57,7 +129,8 @@ export function usePermissions() {
     const hasAnyProjectPermission = (permissions: string[]): boolean => {
         const currentProjectId = projectStore.currentProject?.id;
         if (!currentProjectId) return false;
-        return permissionStore.hasAnyProjectPermission(permissions, currentProjectId);
+        permissions.forEach(p => void ensure(p, { projectId: currentProjectId }));
+        return permissions.some(p => !!resultsCache[makeKey(p, { projectId: currentProjectId })]);
     };
 
     /**
@@ -66,33 +139,24 @@ export function usePermissions() {
     const hasAllProjectPermissions = (permissions: string[]): boolean => {
         const currentProjectId = projectStore.currentProject?.id;
         if (!currentProjectId) return false;
-        return permissionStore.hasAllProjectPermissions(permissions, currentProjectId);
+        permissions.forEach(p => void ensure(p, { projectId: currentProjectId }));
+        return permissions.every(p => !!resultsCache[makeKey(p, { projectId: currentProjectId })]);
     };
 
     /**
      * Checks if user has a permission anywhere (global or any project)
      */
     const hasAnyPermission = (permission: string): boolean => {
-        return permissionStore.hasAnyPermission(permission);
-    };
-
-    /**
-     * Checks if user is a member of the current project
-     */
-    const isCurrentProjectMember = computed(() => {
+        // Prefer project context when available
         const currentProjectId = projectStore.currentProject?.id;
-        if (!currentProjectId) return false;
-        return permissionStore.isProjectMember(currentProjectId);
-    });
+        if (currentProjectId) {
+            return hasProjectPermission(permission);
+        }
+        return hasGlobalPermission(permission);
+    };
 
-    /**
-     * Gets all permissions for the current project
-     */
-    const currentProjectPermissions = computed(() => {
-        const currentProjectId = projectStore.currentProject?.id;
-        if (!currentProjectId) return new Set<string>();
-        return permissionStore.getProjectPermissions(currentProjectId);
-    });
+    // Project membership proxy: treat project:read as membership capability
+    const isCurrentProjectMember = computed(() => hasProjectPermission('project:read'));
 
     // Reactive computed permission checkers
 
@@ -126,13 +190,33 @@ export function usePermissions() {
     const canUpdateProject = computed(() => hasProjectPermission('project:update'));
     const canDeleteProject = computed(() => hasProjectPermission('project:delete'));
     const canManageProjectMembers = computed(() => hasProjectPermission('projectMember:invite'));
-    const canManageDataSources = computed(() => hasProjectPermission('dataSource:create'));
-    const canManageWorkflows = computed(() => hasProjectPermission('workflow:create'));
-    const canManageLabelSchemes = computed(() => hasProjectPermission('labelScheme:create'));
+    const canManageDataSources = computed(() => hasProjectPermission('dataSource:update'));
+    const canManageWorkflows = computed(() => hasProjectPermission('workflow:update'));
+    const canManageLabelSchemes = computed(() => hasProjectPermission('labelScheme:update'));
     const canCreateAnnotations = computed(() => hasProjectPermission('annotation:create'));
     const canReviewAnnotations = computed(() => hasProjectPermission('annotation:review'));
     const canAssignTasks = computed(() => hasProjectPermission('task:assign'));
 
+    // Manager role check: use authoritative role from backend
+    const isManager = (projectId: number): boolean => {
+        if (!projectId) return false;
+        if (projectId === projectStore.currentProject?.id) {
+            if (!projectStore.currentUserMembership) {
+                // Load membership in background if missing
+                void projectStore.loadCurrentUserMembership(projectId);
+                return false;
+            }
+            return projectStore.isCurrentUserManager;
+        }
+        // Not the current project: require caller to load membership explicitly via store if needed
+        return false;
+    };
+
+    const isManagerCurrentProject = computed(() => {
+        const pid = projectStore.currentProjectId;
+        return pid ? isManager(pid) : false;
+    });
+
     return {
         // Global permission checks
         hasGlobalPermission,
@@ -141,6 +225,9 @@ export function usePermissions() {
 
         // Project permission checks
         hasProjectPermission,
+        hasProjectPermissionAsync,
+        prefetchProjectPermission,
+        guardProjectAction,
         hasPermissionInProject,
         hasAnyProjectPermission,
         hasAllProjectPermissions,
@@ -148,7 +235,6 @@ export function usePermissions() {
         // General permission checks
         hasAnyPermission,
         isCurrentProjectMember,
-        currentProjectPermissions,
 
         // Reactive permission checkers
         canDoGlobally,
@@ -168,10 +254,10 @@ export function usePermissions() {
         canCreateAnnotations,
         canReviewAnnotations,
         canAssignTasks,
+        isManager,
+        isManagerCurrentProject,
 
-        // Store references for advanced usage
-        permissionStore,
         authStore,
         projectStore,
     };
-}
\ No newline at end of file
+}
diff --git a/frontend/src/directives/vPermission.ts b/frontend/src/directives/vPermission.ts
index f934f622..bda0555e 100644
--- a/frontend/src/directives/vPermission.ts
+++ b/frontend/src/directives/vPermission.ts
@@ -1,7 +1,7 @@
 import type { App, DirectiveBinding } from 'vue';
 import { watch } from 'vue';
-import { usePermissionStore } from '@/stores/permissionStore';
 import { useProjectStore } from '@/stores/projectStore';
+import { authorizationService } from '@/services/auth';
 import { AppLogger } from '@/core/logger/logger';
 import type { PermissionDirectiveBinding } from '@/services/auth/permissions.types';
 
@@ -9,32 +9,25 @@ const logger = AppLogger.createServiceLogger('vPermission');
 
 export const vPermission = {
     mounted(el: HTMLElement, binding: DirectiveBinding<PermissionDirectiveBinding>) {
-        const permissionStore = usePermissionStore();
         const projectStore = useProjectStore();
         
-        // Initial check
-        checkPermission(el, binding);
+        // Initial check (async)
+        void checkPermission(el, binding);
         
-        // Watch for changes in permission store initialization and project ID
-        const unwatchPermissions = watch(
-            () => permissionStore.isInitialized,
-            () => {
-                checkPermission(el, binding);
-            }
-        );
+        // Watch for project changes to re-evaluate
         
         const unwatchProject = watch(
             () => projectStore.currentProjectId,
             () => {
-                checkPermission(el, binding);
+                void checkPermission(el, binding);
             }
         );
         
         // Store cleanup functions on the element for unmount
-        (el as any)._permissionWatchers = [unwatchPermissions, unwatchProject];
+        (el as any)._permissionWatchers = [unwatchProject];
     },
     updated(el: HTMLElement, binding: DirectiveBinding<PermissionDirectiveBinding>) {
-        checkPermission(el, binding);
+        void checkPermission(el, binding);
     },
     unmounted(el: HTMLElement) {
         // Cleanup watchers when directive is unmounted
@@ -46,15 +39,8 @@ export const vPermission = {
     }
 };
 
-function checkPermission(el: HTMLElement, binding: DirectiveBinding<PermissionDirectiveBinding>) {
-    const permissionStore = usePermissionStore();
+async function checkPermission(el: HTMLElement, binding: DirectiveBinding<PermissionDirectiveBinding>) {
     const projectStore = useProjectStore();
-    
-    // If permission store is not initialized, hide element by default
-    if (!permissionStore.isInitialized) {
-        hideElement(el);
-        return;
-    }
 
     const value = binding.value || {};
     const {
@@ -82,35 +68,41 @@ function checkPermission(el: HTMLElement, binding: DirectiveBinding<PermissionDi
 
     let hasPermission = false;
 
+    // TODO: Optimistically hide while checking - should show a spinner
+    hideElement(el);
+
     if (global) {
-        // Check global permissions
         if (mode === 'all') {
-            hasPermission = permissionStore.hasAllGlobalPermissions(permissionsToCheck);
+            const { results } = await authorizationService.authorizeBatch(
+                permissionsToCheck.map(p => ({ permission: p }))
+            );
+            hasPermission = results.every(Boolean);
         } else {
-            hasPermission = permissionStore.hasAnyGlobalPermission(permissionsToCheck);
+            const { results } = await authorizationService.authorizeBatch(
+                permissionsToCheck.map(p => ({ permission: p }))
+            );
+            hasPermission = results.some(Boolean);
         }
     } else {
-        // Check project permissions
         const projectId = project || projectStore.currentProject?.id;
-        
         if (!projectId) {
             logger.debug('No project ID available for permission check (project still loading)');
-            hideElement(el);
-            return;
+            return; // remain hidden
         }
-
         if (mode === 'all') {
-            hasPermission = permissionStore.hasAllProjectPermissions(permissionsToCheck, projectId);
+            const { results } = await authorizationService.authorizeBatch(
+                permissionsToCheck.map(p => ({ permission: p, context: { projectId } }))
+            );
+            hasPermission = results.every(Boolean);
         } else {
-            hasPermission = permissionStore.hasAnyProjectPermission(permissionsToCheck, projectId);
+            const { results } = await authorizationService.authorizeBatch(
+                permissionsToCheck.map(p => ({ permission: p, context: { projectId } }))
+            );
+            hasPermission = results.some(Boolean);
         }
     }
 
-    if (hasPermission) {
-        showElement(el);
-    } else {
-        hideElement(el);
-    }
+    if (hasPermission) showElement(el);
 }
 
 function showElement(el: HTMLElement) {
@@ -127,4 +119,4 @@ export function registerPermissionDirective(app: App) {
     app.directive('permission', vPermission);
 }
 
-export default vPermission;
\ No newline at end of file
+export default vPermission;
diff --git a/frontend/src/main.ts b/frontend/src/main.ts
index 2290d9d8..49778d06 100644
--- a/frontend/src/main.ts
+++ b/frontend/src/main.ts
@@ -9,7 +9,6 @@ import router from './router'
 
 import {setupInterceptors} from '@/services/apiClient'
 import {useAuthStore} from '@/stores/authStore'
-import {usePermissionStore} from '@/stores/permissionStore'
 import {logger, piniaLogger, AppLogger} from '@/core/logger/logger'
 import {useErrorHandler} from '@/composables/useErrorHandler'
 import {registerPermissionDirective} from '@/directives/vPermission';
@@ -45,8 +44,7 @@ async function initializeApp() {
     app.directive('click-outside', clickOutside);
 
     const authStore = useAuthStore();
-    const permissionStore = usePermissionStore();
-    setupInterceptors(authStore, permissionStore);
+    setupInterceptors(authStore);
     
     // Auth will be initialized lazily by the router when needed
     // This prevents unnecessary token refresh attempts on public pages
@@ -101,4 +99,4 @@ initializeApp().catch(error => {
             </div>
         </div>
     `;
-});
\ No newline at end of file
+});
diff --git a/frontend/src/router/index.ts b/frontend/src/router/index.ts
index 58b753ff..ae813cf0 100644
--- a/frontend/src/router/index.ts
+++ b/frontend/src/router/index.ts
@@ -5,9 +5,10 @@ import DefaultLayout from '@/layouts/DefaultLayout.vue';
 import WorkspaceLayout from '@/layouts/WorkspaceLayout.vue';
 import DataExplorerLayout from '@/layouts/DataExplorerLayout.vue';
 import { useAuthStore } from '@/stores/authStore';
-import { usePermissionStore } from '@/stores/permissionStore';
+import { authorizationService } from '@/services/auth';
 import { AppLogger } from '@/core/logger/logger';
 import { PUBLIC_ROUTE_NAMES, AUTH_ROUTE_NAMES } from './routes';
+import { PERMISSIONS } from '@/services/auth/permissions.types';
 
 const routes: Array<RouteRecordRaw> = [
     {
@@ -80,6 +81,7 @@ const routes: Array<RouteRecordRaw> = [
         props: true,
         meta: {
             layout: WorkspaceLayout,
+            permissions: [PERMISSIONS.TASK.READ],
         }
     },
     {
@@ -97,6 +99,7 @@ const routes: Array<RouteRecordRaw> = [
         props: true,
         meta: {
             layout: DefaultLayout,
+            permissions: [PERMISSIONS.PROJECT.READ],
         },
         children: [
             {
@@ -104,18 +107,21 @@ const routes: Array<RouteRecordRaw> = [
                 name: 'ProjectDashboard',
                 component: () => import('@/views/project/ProjectDashboardView.vue'),
                 props: true,
+                meta: { permissions: [PERMISSIONS.PROJECT.READ] },
             },
             {
                 path: 'label-schemes',
                 name: 'ProjectLabels',
                 component: () => import('@/views/project/LabelSchemesView.vue'),
                 props: true,
+                meta: { permissions: [PERMISSIONS.LABEL_SCHEME.READ] },
             },
             {
                 path: 'data-sources',
                 name: 'ProjectDataSources',
                 component: () => import('@/views/project/DataSourcesView.vue'),
                 props: true,
+                meta: { permissions: [PERMISSIONS.DATA_SOURCE.UPDATE] },
             },
             {
                 path: 'data-explorer/:dataSourceId',
@@ -124,6 +130,7 @@ const routes: Array<RouteRecordRaw> = [
                 props: true,
                 meta: {
                     layout: DataExplorerLayout,
+                    permissions: [PERMISSIONS.DATA_SOURCE.UPDATE],
                 }
             },
             {
@@ -131,24 +138,28 @@ const routes: Array<RouteRecordRaw> = [
                 name: 'ProjectWorkflows',
                 component: () => import('@/views/project/WorkflowsView.vue'),
                 props: true,
+                meta: { permissions: [PERMISSIONS.WORKFLOW.READ] },
             },
             {
                 path: 'workflows/:workflowId/pipeline',
                 name: 'WorkflowPipeline',
                 component: () => import('@/views/project/WorkflowPipelineView.vue'),
                 props: true,
+                meta: { permissions: [PERMISSIONS.WORKFLOW.UPDATE] },
             },
             {
                 path: 'workflows/:workflowId/stages/:stageId/tasks',
                 name: 'StageTasks',
                 component: () => import('@/views/project/TasksView.vue'),
                 props: true,
+                meta: { permissions: [PERMISSIONS.TASK.READ] },
             },
             {
                 path: 'settings',
                 name: 'ProjectSettings',
                 component: () => import('@/views/project/ProjectSettingsView.vue'),
                 props: true,
+                meta: { permissions: [PERMISSIONS.PROJECT_SETTINGS.READ] },
             },
         ],
     },
@@ -177,7 +188,6 @@ const logger = AppLogger.createServiceLogger('Router');
 // Navigation guards
 router.beforeEach(async (to, from, next) => {
     const authStore = useAuthStore();
-    const permissionStore = usePermissionStore();
     
     const isPublicRoute = PUBLIC_ROUTE_NAMES.includes(to.name as typeof PUBLIC_ROUTE_NAMES[number]);
     const isAuthRoute = AUTH_ROUTE_NAMES.includes(to.name as typeof AUTH_ROUTE_NAMES[number]);
@@ -228,70 +238,27 @@ router.beforeEach(async (to, from, next) => {
     } else if (!isPublicRoute && !authStore.isAuthenticated) {
         // If user is not authenticated and trying to access protected routes, redirect to login
         next({ name: 'Login' });
-    } else if (authStore.isAuthenticated && to.params.projectId) {
-        // Project-specific route - validate project membership using permission store
-        try {
-            const projectId = Number(to.params.projectId);
-            if (projectId && !isNaN(projectId)) {
-                // Ensure permissions are loaded
-                if (!permissionStore.isInitialized) {
-                    await permissionStore.loadUserPermissions();
-                }
-                
-                // Check if user is a member of the project
-                if (!permissionStore.isProjectMember(projectId)) {
-                    logger.warn(`User is not a member of project ${projectId}`);
-                    next({ name: 'Error', params: { type: 'unauthorized' } });
-                    return;
-                }
-                
-                // Check if route requires specific permissions
-                const requiredPermissions = to.meta?.permissions as string[] | undefined;
-                if (requiredPermissions && requiredPermissions.length > 0) {
-                    const hasRequiredPermissions = permissionStore.hasAllProjectPermissions(
-                        requiredPermissions, 
-                        projectId
-                    );
-                    
-                    if (!hasRequiredPermissions) {
-                        logger.warn(
-                            `User lacks required permissions for route ${String(to.name)}: ${requiredPermissions.join(', ')}`
-                        );
-                        next({ name: 'Error', params: { type: 'forbidden' } });
-                        return;
-                    }
-                }
-                
-                logger.info(`User has access to project ${projectId}`);
-            }
+    } else if (authStore.isAuthenticated) {
+        // If route defines permissions, verify via backend authorize (batch)
+        const requiredPermissions = (to.meta?.permissions as string[] | undefined) || [];
+        if (requiredPermissions.length === 0) {
             next();
-        } catch (error) {
-            logger.error('Error validating project access', error);
-            // If validation fails, redirect to error page
-            next({ name: 'Error', params: { type: 'unauthorized' } });
+            return;
         }
-    } else if (authStore.isAuthenticated && to.meta?.permissions) {
-        // Global route with permission requirements
+
         try {
-            // Ensure permissions are loaded
-            if (!permissionStore.isInitialized) {
-                await permissionStore.loadUserPermissions();
-            }
-            
-            const requiredPermissions = to.meta.permissions as string[];
-            const hasRequiredPermissions = permissionStore.hasAllGlobalPermissions(requiredPermissions);
-            
-            if (!hasRequiredPermissions) {
-                logger.warn(
-                    `User lacks required global permissions for route ${String(to.name)}: ${requiredPermissions.join(', ')}`
-                );
+            const projectId = to.params.projectId ? Number(to.params.projectId) : undefined;
+            const checks = requiredPermissions.map(p => ({ permission: p, context: projectId ? { projectId } : undefined }));
+            const { results } = await authorizationService.authorizeBatch(checks);
+            const allow = results.every(Boolean);
+            if (!allow) {
+                logger.warn(`Permission denied for route ${String(to.name)} with perms: ${requiredPermissions.join(', ')}`);
                 next({ name: 'Error', params: { type: 'forbidden' } });
                 return;
             }
-            
             next();
         } catch (error) {
-            logger.error('Error validating global permissions', error);
+            logger.error('Authorization check failed', error);
             next({ name: 'Error', params: { type: 'unauthorized' } });
         }
     } else {
diff --git a/frontend/src/services/apiClient.ts b/frontend/src/services/apiClient.ts
index 8c4f12b1..66e65496 100644
--- a/frontend/src/services/apiClient.ts
+++ b/frontend/src/services/apiClient.ts
@@ -2,7 +2,6 @@ import axios from 'axios';
 import type { AxiosInstance, AxiosResponse, InternalAxiosRequestConfig } from 'axios';
 import { env } from '@/config/env';
 import type { useAuthStore } from '@/stores/authStore';
-import type { usePermissionStore } from '@/stores/permissionStore';
 import { isAuthOrPublicPath, isAuthPath } from '@/router/routes';
 import { isPermissionChangingEndpoint, getPermissionChangeDescription } from '@/core/interceptors';
 import { AppLogger } from '@/core/logger/logger';
@@ -41,11 +40,9 @@ const processQueue = (error: Error | null, token: string | null = null) => {
  * Sets up the Axios interceptors for handling authentication and token refresh.
  * This should be called once when the application initializes.
  * @param authStore An instance of the authentication store.
- * @param permissionStore An instance of the permission store.
  */
 export function setupInterceptors(
-    authStore: ReturnType<typeof useAuthStore>,
-    permissionStore: ReturnType<typeof usePermissionStore>
+    authStore: ReturnType<typeof useAuthStore>
 ): void {
     // Request Interceptor: Add JWT token whenever available
     apiClient.interceptors.request.use(
@@ -69,18 +66,9 @@ export function setupInterceptors(
             const { url, method } = response.config;
             if (response.status >= 200 && response.status < 300 && 
                 isPermissionChangingEndpoint(url, method || 'GET')) {
-                
                 const description = getPermissionChangeDescription(url, method || 'GET');
                 logger.info(`Permission-changing request completed: ${method?.toUpperCase()} ${url} - ${description}`);
-                
-                // Automatically refresh permissions in the background
-                try {
-                    await permissionStore.refreshPermissions();
-                    logger.info('Automatically refreshed permissions after API call');
-                } catch (error) {
-                    // Don't fail the original request if permission refresh fails
-                    logger.warn('Failed to automatically refresh permissions after API call', error);
-                }
+                // FE now uses on-demand authorization checks; no global refresh required.
             }
             
             return response;
@@ -158,4 +146,4 @@ export function setupInterceptors(
     );
 }
 
-export default apiClient;
\ No newline at end of file
+export default apiClient;
diff --git a/frontend/src/services/auth/authorizationService.ts b/frontend/src/services/auth/authorizationService.ts
new file mode 100644
index 00000000..34567a63
--- /dev/null
+++ b/frontend/src/services/auth/authorizationService.ts
@@ -0,0 +1,46 @@
+import { BaseService } from '../base/baseService';
+import { AppLogger } from '@/core/logger/logger';
+
+export interface AuthorizationCheckContext {
+    projectId?: number;
+    [key: string]: any;
+}
+
+export interface AuthorizationCheck {
+    permission: string;
+    context?: AuthorizationCheckContext;
+}
+
+export interface AuthorizationBatchResponse {
+    results: boolean[];
+    policyVersion?: string;
+}
+
+/**
+ * AuthorizationService calls backend to evaluate permissions authoritatively.
+ * This replaces frontend-cached permission context and supports batching.
+ */
+class AuthorizationService extends BaseService {
+    protected readonly baseUrl = '/permissions';
+    private readonly log = AppLogger.createServiceLogger('AuthorizationService');
+
+    async authorize(check: AuthorizationCheck): Promise<boolean> {
+        const resp = await this.post<AuthorizationCheck, { allow: boolean; policyVersion?: string }>(
+            this.getBaseUrl('authorize'),
+            check
+        );
+        this.log.info(`authorize(${check.permission}) => ${resp.allow}`);
+        return resp.allow;
+    }
+
+    async authorizeBatch(checks: AuthorizationCheck[]): Promise<AuthorizationBatchResponse> {
+        const resp = await this.post<{ checks: AuthorizationCheck[] }, AuthorizationBatchResponse>(
+            this.getBaseUrl('authorize/batch'),
+            { checks }
+        );
+        this.log.info(`authorizeBatch(${checks.length}) => [${resp.results.join(',')}]`);
+        return resp;
+    }
+}
+
+export const authorizationService = new AuthorizationService("AuthorizationService");
diff --git a/frontend/src/services/auth/index.ts b/frontend/src/services/auth/index.ts
index 79a358ac..abd5cf81 100644
--- a/frontend/src/services/auth/index.ts
+++ b/frontend/src/services/auth/index.ts
@@ -1,2 +1,2 @@
 export { authService } from './authService';
-export { permissionService } from './permissionService';
\ No newline at end of file
+export { authorizationService } from './authorizationService';
diff --git a/frontend/src/services/auth/permissionService.ts b/frontend/src/services/auth/permissionService.ts
deleted file mode 100644
index ff0b9f33..00000000
--- a/frontend/src/services/auth/permissionService.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-import { BaseService } from '../base/baseService';
-import type { UserPermissionContext } from './permissions.types';
-
-/**
- * Service class for managing application configuration and permissions.
- */
-class PermissionService extends BaseService {
-    protected readonly baseUrl = '/configuration'; // TODO: Check BE and change endpoint to permission
-
-    constructor() {
-        super('ConfigurationService');
-    }
-
-    /**
-     * Gets the full user permission context including all project memberships and global permissions.
-     * This is used for comprehensive permission caching on the frontend.
-     */
-    async getUserPermissionContext(): Promise<UserPermissionContext> {
-        this.logger.info('Fetching user permission context...');
-        
-        const response = await this.get<UserPermissionContext>(
-            this.getBaseUrl('permissions/user-context')
-        );
-        
-        this.logger.info(
-            `Fetched permission context with ${response.permissions.length} total permissions across ${Object.keys(response.projectPermissions).length} projects`
-        );
-        return response;
-    }
-
-    /**
-     * Gets page-specific permissions for the current user.
-     * Hybrid mode endpoint that provides permissions on-demand for specific pages/routes.
-     */
-    async getPagePermissions(page: string, projectId?: number): Promise<string[]> {
-        this.logger.info(`Fetching page permissions for page '${page}'${projectId ? ` with project ${projectId}` : ''}...`);
-        
-        const params: Record<string, any> = { page };
-        if (projectId) {
-            params.projectId = projectId;
-        }
-        
-        const response = await this.get<string[]>(
-            this.getBaseUrl('permissions/page'),
-            { params }
-        );
-        
-        this.logger.info(`Fetched ${response.length} permissions for page '${page}'`);
-        return response;
-    }
-
-    /**
-     * Admin-only endpoint to reload permission configuration from file
-     */
-    async reloadPermissionConfiguration(): Promise<void> {
-        this.logger.info('Reloading permission configuration...');
-        
-        await this.post<void, void>(this.getBaseUrl('permissions/reload'), undefined);
-        
-        this.logger.info('Permission configuration reloaded successfully');
-    }
-}
-
-// Export singleton instance
-export const permissionService = new PermissionService();
diff --git a/frontend/src/services/auth/permissions.types.ts b/frontend/src/services/auth/permissions.types.ts
index 5062eb96..43c3cf78 100644
--- a/frontend/src/services/auth/permissions.types.ts
+++ b/frontend/src/services/auth/permissions.types.ts
@@ -1,11 +1,4 @@
-/**
- * User permission context containing all applicable permissions for a user
- */
-export interface UserPermissionContext {
-    permissions: string[];
-    projectPermissions: Record<number, string[]>;
-    globalPermissions: string[];
-}
+// FE no longer stores permission contexts; backend is source of truth.
 
 /**
  * Permission directive binding interface for v-permission directive
@@ -89,4 +82,4 @@ export const PERMISSIONS = {
         DELETE: 'annotation:delete',
         REVIEW: 'annotation:review'
     }
-} as const;
\ No newline at end of file
+} as const;
diff --git a/frontend/src/stores/__tests__/authStore.test.ts b/frontend/src/stores/__tests__/authStore.test.ts
index dbcbeb75..8455aef8 100644
--- a/frontend/src/stores/__tests__/authStore.test.ts
+++ b/frontend/src/stores/__tests__/authStore.test.ts
@@ -11,12 +11,7 @@ vi.mock("@/services/auth/authService", () => ({
     },
 }));
 
-vi.mock("../permissionStore", () => ({
-    usePermissionStore: vi.fn(() => ({
-        loadUserPermissions: vi.fn().mockResolvedValue(undefined),
-        clearPermissions: vi.fn(),
-    })),
-}));
+// No permission store in FE anymore; authorization is backend-driven.
 
 import { authService } from "@/services/auth/authService.ts";
 import { RoleEnum, type AuthTokens, type LoginDto, type UserDto } from "@/services/auth/auth.types";
diff --git a/frontend/src/stores/authStore.ts b/frontend/src/stores/authStore.ts
index c2e983c2..03514aa1 100644
--- a/frontend/src/stores/authStore.ts
+++ b/frontend/src/stores/authStore.ts
@@ -4,7 +4,6 @@ import { authService } from "@/services/auth/authService";
 import { env } from "@/config/env";
 import { AppLogger } from "@/core/logger/logger";
 import { LastProjectManager } from "@/core/persistence";
-import { usePermissionStore } from "./permissionStore";
 import { isUnauthorizedError } from "@/core/errors/errors";
 import type { AuthTokens, LoginDto, RegisterDto, RoleEnum, UserDto } from "@/services/auth/auth.types";
 
@@ -75,16 +74,7 @@ export const useAuthStore = defineStore("auth", {
                     // Only fetch user data if we successfully got tokens
                     await this.getCurrentUser();
                     
-                    logger.info("User data fetched successfully, loading permissions");
-                    // Load permissions after getting user data
-                    try {
-                        const permissionStore = usePermissionStore();
-                        await permissionStore.loadUserPermissions();
-                        logger.info("User permissions loaded during auth initialization");
-                    } catch (permissionError) {
-                        logger.warn("Failed to load permissions during initialization", permissionError);
-                        // Don't fail initialization if permissions fail to load
-                    }
+                    logger.info("User data fetched successfully");
                 } else {
                     logger.info("Token refresh failed during initialization - user will start as guest");
                 }
@@ -105,15 +95,7 @@ export const useAuthStore = defineStore("auth", {
                 this.user = response.user;
                 this.tokens = response.tokens;
 
-                // Load user permissions after successful login
-                try {
-                    const permissionStore = usePermissionStore();
-                    await permissionStore.loadUserPermissions();
-                    logger.info("User permissions loaded after login");
-                } catch (permissionError) {
-                    logger.warn("Failed to load permissions after login", permissionError);
-                    // Don't fail login if permissions fail to load
-                }
+                // Permissions now checked on-demand via backend authorize
 
             } catch (error) {
                 logger.error("Login failed", error);
@@ -146,9 +128,7 @@ export const useAuthStore = defineStore("auth", {
             } catch (error) {
                 logger.error("Logout request failed", error);
             } finally {
-                // Clear permission data on logout
-                const permissionStore = usePermissionStore();
-                permissionStore.clearPermissions();
+                // No frontend permission cache to clear
                 
                 this.user = null;
                 this.tokens = null;
@@ -162,9 +142,7 @@ export const useAuthStore = defineStore("auth", {
                 LastProjectManager.clearLastProject(this.user.email);
             }
             
-            // Clear permission data
-            const permissionStore = usePermissionStore();
-            permissionStore.clearPermissions();
+            // No frontend permission cache to clear
             
             this.user = null;
             this.tokens = null;
diff --git a/frontend/src/stores/permissionStore.ts b/frontend/src/stores/permissionStore.ts
deleted file mode 100644
index 213def28..00000000
--- a/frontend/src/stores/permissionStore.ts
+++ /dev/null
@@ -1,194 +0,0 @@
-import { defineStore } from "pinia";
-import { permissionService } from "@/services/auth";
-import type { UserPermissionContext } from "@/services/auth/permissions.types";
-import { AppLogger } from "@/core/logger/logger";
-
-const logger = AppLogger.createStoreLogger('PermissionStore');
-
-export const usePermissionStore = defineStore("permissions", {
-    state: () => ({
-        userContext: null as UserPermissionContext | null,
-        isLoading: false,
-        isInitialized: false,
-        error: null as string | null,
-    }),
-    
-    getters: {
-        /**
-         * Gets all permissions for the current user (global + all project permissions)
-         */
-        allPermissions(state): Set<string> {
-            if (!state.userContext) return new Set();
-            return new Set(state.userContext.permissions);
-        },
-
-        /**
-         * Gets global permissions (available regardless of project context)
-         */
-        globalPermissions(state): Set<string> {
-            if (!state.userContext) return new Set();
-            return new Set(state.userContext.globalPermissions);
-        },
-
-        /**
-         * Gets permissions for a specific project
-         */
-        getProjectPermissions: (state) => (projectId: number): Set<string> => {
-            if (!state.userContext || !projectId) return new Set();
-            const projectPermissions = state.userContext.projectPermissions[projectId];
-            return new Set(projectPermissions || []);
-        },
-
-        /**
-         * Checks if user has a specific permission globally
-         */
-        hasGlobalPermission: (state) => (permission: string): boolean => {
-            return state.userContext?.globalPermissions.includes(permission) || false;
-        },
-
-        /**
-         * Checks if user has a specific permission in any project
-         */
-        hasAnyPermission: (state) => (permission: string): boolean => {
-            return state.userContext?.permissions.includes(permission) || false;
-        },
-
-        /**
-         * Checks if user has a specific permission in a specific project
-         */
-        hasProjectPermission: (state) => (permission: string, projectId: number): boolean => {
-            if (!state.userContext || !projectId) return false;
-            const projectPermissions = state.userContext.projectPermissions[projectId];
-            return projectPermissions?.includes(permission) || false;
-        },
-
-        /**
-         * Checks if user has any of the specified permissions globally
-         */
-        hasAnyGlobalPermission: (state) => (permissions: string[]): boolean => {
-            if (!state.userContext) return false;
-            return permissions.some(permission => 
-                state.userContext!.globalPermissions.includes(permission)
-            );
-        },
-
-        /**
-         * Checks if user has all of the specified permissions globally
-         */
-        hasAllGlobalPermissions: (state) => (permissions: string[]): boolean => {
-            if (!state.userContext) return false;
-            return permissions.every(permission => 
-                state.userContext!.globalPermissions.includes(permission)
-            );
-        },
-
-        /**
-         * Checks if user has any of the specified permissions in a project
-         */
-        hasAnyProjectPermission: (state) => (permissions: string[], projectId: number): boolean => {
-            if (!state.userContext || !projectId) return false;
-            const projectPermissions = state.userContext.projectPermissions[projectId] || [];
-            return permissions.some(permission => projectPermissions.includes(permission));
-        },
-
-        /**
-         * Checks if user has all of the specified permissions in a project
-         */
-        hasAllProjectPermissions: (state) => (permissions: string[], projectId: number): boolean => {
-            if (!state.userContext || !projectId) return false;
-            const projectPermissions = state.userContext.projectPermissions[projectId] || [];
-            return permissions.every(permission => projectPermissions.includes(permission));
-        },
-
-        /**
-         * Gets all project IDs where user has membership
-         */
-        projectIds(state): number[] {
-            if (!state.userContext) return [];
-            return Object.keys(state.userContext.projectPermissions).map(id => parseInt(id));
-        },
-
-        /**
-         * Checks if user is a member of a specific project
-         */
-        isProjectMember: (state) => (projectId: number): boolean => {
-            if (!state.userContext || !projectId) return false;
-            return Object.prototype.hasOwnProperty.call(state.userContext.projectPermissions, projectId);
-        },
-    },
-
-    actions: {
-        /**
-         * Loads the full user permission context from the backend
-         */
-        async loadUserPermissions(): Promise<void> {
-            if (this.isLoading) return;
-            
-            this.isLoading = true;
-            this.error = null;
-            
-            try {
-                logger.info("Loading user permission context");
-                this.userContext = await permissionService.getUserPermissionContext();
-                this.isInitialized = true;
-                
-                const permissionCount = this.userContext.permissions.length;
-                const projectCount = this.projectIds.length;
-                
-                logger.info(`Loaded ${permissionCount} total permissions for ${projectCount} projects`);
-            } catch (error) {
-                this.error = "Failed to load user permissions";
-                logger.error("Failed to load user permission context", error);
-                throw error;
-            } finally {
-                this.isLoading = false;
-            }
-        },
-
-        /**
-         * Gets page-specific permissions (hybrid approach)
-         */
-        async getPagePermissions(page: string, projectId?: number): Promise<string[]> {
-            try {
-                logger.debug(`Getting page permissions for: ${page}${projectId ? ` (project: ${projectId})` : ''}`);
-                return await permissionService.getPagePermissions(page, projectId);
-            } catch (error) {
-                logger.error(`Failed to get page permissions for ${page}`, error);
-                return [];
-            }
-        },
-
-        /**
-         * Clears all permission data (for logout)
-         */
-        clearPermissions(): void {
-            this.userContext = null;
-            this.isInitialized = false;
-            this.error = null;
-            logger.info("Cleared user permissions");
-        },
-
-        /**
-         * Refreshes permission data from the backend
-         */
-        async refreshPermissions(): Promise<void> {
-            this.isInitialized = false;
-            await this.loadUserPermissions();
-        },
-
-        /**
-         * Admin-only: Reload permission configuration from file
-         */
-        async reloadConfiguration(): Promise<void> {
-            try {
-                await permissionService.reloadPermissionConfiguration();
-                // Refresh user permissions after configuration reload
-                await this.refreshPermissions();
-                logger.info("Permission configuration reloaded successfully");
-            } catch (error) {
-                logger.error("Failed to reload permission configuration", error);
-                throw error;
-            }
-        },
-    },
-});
\ No newline at end of file
diff --git a/frontend/src/stores/projectStore.ts b/frontend/src/stores/projectStore.ts
index 604e24ad..ea5bdbf7 100644
--- a/frontend/src/stores/projectStore.ts
+++ b/frontend/src/stores/projectStore.ts
@@ -16,6 +16,7 @@ const logger = AppLogger.createServiceLogger("ProjectStore");
 export const useProjectStore = defineStore("project", {
     state: (): ProjectState => ({
         currentProject: null,
+        currentUserMembership: null,
         teamMembers: [],
         projectLabels: [],
         loading: false,
@@ -48,6 +49,12 @@ export const useProjectStore = defineStore("project", {
         },
         labelCount(state): number {
             return state.projectLabels.length;
+        },
+        currentUserRole(state): ProjectRole | null {
+            return state.currentUserMembership?.role || null;
+        },
+        isCurrentUserManager(state): boolean {
+            return state.currentUserMembership?.role === 'MANAGER';
         }
     },
 
@@ -75,6 +82,7 @@ export const useProjectStore = defineStore("project", {
                 // Load related data in parallel
                 await Promise.all([
                     this.loadTeamMembers(projectId),
+                    this.loadCurrentUserMembership(projectId),
                 ]);
             } catch (error) {
                 logger.error(`Failed to load project ${projectId}`, error);
@@ -101,6 +109,18 @@ export const useProjectStore = defineStore("project", {
             }
         },
 
+        async loadCurrentUserMembership(projectId: number): Promise<void> {
+            try {
+                const membership = await projectMemberService.getCurrentUserMembership(projectId);
+                this.currentUserMembership = membership;
+                logger.info(`Loaded current user membership for project ${projectId}: ${membership?.role || 'none'}`);
+            } catch (error) {
+                logger.error(`Failed to load current user membership for project ${projectId}`, error);
+                // Don't throw error for membership loading as user might not be a member
+                this.currentUserMembership = null;
+            }
+        },
+
         addTeamMember(member: ProjectMember): void {
             this.teamMembers.push(member);
             logger.info(`Added team member: ${member.userName || member.email}`);
@@ -150,6 +170,7 @@ export const useProjectStore = defineStore("project", {
 
         clearProject(): void {
             this.currentProject = null;
+            this.currentUserMembership = null;
             this.teamMembers = [];
             this.projectLabels = [];
             this.currentStageType = '';
diff --git a/frontend/src/stores/projectStore.types.ts b/frontend/src/stores/projectStore.types.ts
index 6f4cdf3d..17718c00 100644
--- a/frontend/src/stores/projectStore.types.ts
+++ b/frontend/src/stores/projectStore.types.ts
@@ -4,6 +4,7 @@ import type { Label } from "@/services/project/labelScheme/label.types";
 
 export interface ProjectState {
     currentProject: Project | null;
+    currentUserMembership: ProjectMember | null;
     teamMembers: ProjectMember[];
     projectLabels: Label[];
     loading: boolean;
diff --git a/frontend/src/views/AnnotationWorkspace.vue b/frontend/src/views/AnnotationWorkspace.vue
index f5d7c7bd..5b6cedf9 100644
--- a/frontend/src/views/AnnotationWorkspace.vue
+++ b/frontend/src/views/AnnotationWorkspace.vue
@@ -139,7 +139,7 @@ import ModalWindow from "@/components/common/modal/ModalWindow.vue";
 import {FontAwesomeIcon} from "@fortawesome/vue-fontawesome";
 import {faPause, faForward, faUndo} from "@fortawesome/free-solid-svg-icons";
 import {usePermissions} from "@/composables/usePermissions";
-import {PERMISSIONS} from "@/services/auth/permissions.types";
+import { PERMISSIONS } from '@/services/auth/permissions.types';
 import {useToast} from "@/composables/useToast";
 
 const props = defineProps({
diff --git a/frontend/src/views/ProjectView.vue b/frontend/src/views/ProjectView.vue
index ada022e5..e102a272 100644
--- a/frontend/src/views/ProjectView.vue
+++ b/frontend/src/views/ProjectView.vue
@@ -67,9 +67,7 @@ const projects = ref<Project[]>([]);
 const loading = ref(false);
 const error = ref<string | null>(null);
 
-const canCreateProject = computed(() => {
-    return hasGlobalPermission(PERMISSIONS.PROJECT.CREATE);
-});
+const canCreateProject = computed(() => hasGlobalPermission(PERMISSIONS.PROJECT.CREATE));
 
 const openModal = () => isModalOpen.value = true;
 const closeModal = () => isModalOpen.value = false;
@@ -183,4 +181,4 @@ onMounted(() => {
         transform: scale(1.1);
     }
 }
-</style>
\ No newline at end of file
+</style>
diff --git a/frontend/src/views/dataExplorer/DataExplorerView.vue b/frontend/src/views/dataExplorer/DataExplorerView.vue
index ccb4a13f..84b9fbbe 100644
--- a/frontend/src/views/dataExplorer/DataExplorerView.vue
+++ b/frontend/src/views/dataExplorer/DataExplorerView.vue
@@ -1,10 +1,10 @@
 <template>
     <div class="explorer-container">
-        <!-- Permission check for data explorer access (Viewer and Manager only) -->
+        <!-- Permission check for data explorer access (Manager only) -->
         <div v-if="!canAccessDataExplorer" class="access-denied-container">
             <div class="access-denied">
                 <h2>Access Denied</h2>
-                <p>You don't have permission to access the data explorer. This section is only available to viewers and managers.</p>
+                <p>You don't have permission to access the data explorer. This section is only available to project managers.</p>
                 <Button variant="secondary" @click="navigateToProject">Back to Project</Button>
             </div>
         </div>
@@ -143,10 +143,10 @@ import AssetThumbnail from '@/components/project/AssetThumbnail.vue';
 import Button from '@/components/common/Button.vue';
 import UploadImagesModal from '@/components/project/UploadImagesModal.vue';
 import {assetService, dataSourceService} from '@/services/project';
+import { PERMISSIONS } from '@/services/auth/permissions.types';
 import {useAlert} from '@/composables/useAlert';
 import {AppLogger} from '@/core/logger/logger';
 import {usePermissions} from '@/composables/usePermissions';
-import {PERMISSIONS} from '@/services/auth/permissions.types';
 import { AssetStatus, type Asset } from '@/core/asset/asset.types';
 import type { AssetListParams } from '@/services/project/asset';
 
@@ -207,9 +207,8 @@ const hasActiveFilters = computed(() =>
     Boolean(filterStatus.value || (searchQuery.value && searchQuery.value.trim()))
 );
 
-const canAccessDataExplorer = computed(() => 
-    hasProjectPermission(PERMISSIONS.DATA_EXPLORER.READ)
-);
+// Manager-only for now
+const canAccessDataExplorer = computed(() => hasProjectPermission(PERMISSIONS.DATA_SOURCE.UPDATE));
 
 // Methods
 const navigateToProject = () => {
@@ -600,4 +599,4 @@ onMounted(async () => {
         line-height: 1.5;
     }
 }
-</style>
\ No newline at end of file
+</style>
diff --git a/frontend/src/views/project/DataSourcesView.vue b/frontend/src/views/project/DataSourcesView.vue
index a70c855f..d002780d 100644
--- a/frontend/src/views/project/DataSourcesView.vue
+++ b/frontend/src/views/project/DataSourcesView.vue
@@ -74,10 +74,8 @@ const isModalOpen = ref(false);
 const isLoading = ref(false);
 const isCreating = ref(false);
 
-// Permission checks - READ permission required as baseline to view data sources page
-const canManageDataSources = computed(() => 
-    hasProjectPermission(PERMISSIONS.DATA_SOURCE.READ)
-);
+// Manager-only access: require update permission
+const canManageDataSources = computed(() => hasProjectPermission(PERMISSIONS.DATA_SOURCE.UPDATE));
 
 const openModal = () => isModalOpen.value = true;
 const closeModal = () => isModalOpen.value = false;
@@ -196,4 +194,4 @@ onMounted(() => {
     }
 }
 
-</style>
\ No newline at end of file
+</style>
diff --git a/frontend/src/views/project/ProjectDetailView.vue b/frontend/src/views/project/ProjectDetailView.vue
index 27e82b3b..08cfb651 100644
--- a/frontend/src/views/project/ProjectDetailView.vue
+++ b/frontend/src/views/project/ProjectDetailView.vue
@@ -26,7 +26,7 @@
                     Dashboard
                 </router-link>
                 
-                <!-- Label Schemes - Available to all project members -->
+                <!-- Label Schemes - Viewable by all project members, edits are manager-only -->
                 <router-link 
                     :to="`/projects/${projectId}/label-schemes`" 
                     class="sub-nav-link" 
@@ -35,7 +35,7 @@
                     Label Schemes
                 </router-link>
                 
-                <!-- Data Sources - Available to all project members -->
+                <!-- Data Sources - Manager only -->
                 <router-link 
                     :to="`/projects/${projectId}/data-sources`" 
                     class="sub-nav-link" 
@@ -44,7 +44,7 @@
                     Data Sources
                 </router-link>
                 
-                <!-- Workflows - Available to all project members -->
+                <!-- Workflows - Manager only -->
                 <router-link 
                     :to="`/projects/${projectId}/workflows`" 
                     class="sub-nav-link" 
@@ -83,7 +83,7 @@ import type {Project} from '@/services/project/project.types';
 import {projectService} from '@/services/project';
 import {useAlert} from '@/composables/useAlert';
 import {AppLogger} from '@/core/logger/logger';
-import {PERMISSIONS} from '@/services/auth/permissions.types';
+import { PERMISSIONS } from '@/services/auth/permissions.types';
 
 const logger = AppLogger.createComponentLogger('ProjectDetailView');
 
@@ -216,4 +216,4 @@ onMounted(() => {
     opacity: 0;
     transform: translateY(20px);
 }
-</style>
\ No newline at end of file
+</style>
diff --git a/frontend/src/views/project/TasksView.vue b/frontend/src/views/project/TasksView.vue
index 3abda2bd..9531cee3 100644
--- a/frontend/src/views/project/TasksView.vue
+++ b/frontend/src/views/project/TasksView.vue
@@ -3,6 +3,7 @@
         <div class="view-header">
             <div class="header-left">
                 <Button 
+                    v-if="canManageTasks"
                     variant="secondary" 
                     @click="goBack"
                     class="back-button"
@@ -14,9 +15,9 @@
                     <p class="stage-description">{{ stageDescription || 'Manage tasks for this workflow stage' }}</p>
                 </div>
             </div>
-            <div class="view-actions">
+            <div class="view-actions" v-if="canManageTasks">
                 <Button 
-                    v-if="stageType === 'COMPLETION'"
+                    v-if="stageType === 'COMPLETION' && canManageTasks"
                     variant="secondary"
                     @click="handleExportCoco"
                     :disabled="isLoading"
@@ -26,7 +27,7 @@
                     Export COCO
                 </Button>
                 <Button 
-                    v-if="stageType !== 'ANNOTATION'"
+                    v-if="stageType !== 'ANNOTATION' && canManageTasks"
                     variant="secondary" 
                     @click="showVetoedTasks = !showVetoedTasks"
                     class="toggle-vetoed-button"
@@ -37,6 +38,7 @@
                     variant="secondary" 
                     @click="showDeferredTasks = !showDeferredTasks"
                     class="toggle-deferred-button"
+                    v-if="canManageTasks"
                 >
                     {{ showDeferredTasks ? 'Hide Deferred' : 'Show Deferred' }}
                 </Button>
@@ -44,6 +46,7 @@
                     variant="secondary" 
                     @click="showCompletedTasks = !showCompletedTasks"
                     class="toggle-completed-button"
+                    v-if="canManageTasks"
                 >
                     {{ showCompletedTasks ? 'Hide Completed' : 'Show Completed' }}
                 </Button>
@@ -51,6 +54,7 @@
                     variant="primary" 
                     @click="handleRefresh"
                     :disabled="isLoading"
+                    v-if="canManageTasks"
                 >
                     <font-awesome-icon :icon="faRefresh" />
                     Refresh
@@ -61,6 +65,7 @@
         <div class="tasks-container">            
             <!-- Bulk Operations Toolbar -->
             <TaskBulkOperationsToolbar
+                v-if="canManageTasks"
                 :selection-count="currentSelectionCount"
                 :team-members="projectStore.teamMembers || []"
                 :is-operation-in-progress="isBulkOperationInProgress"
@@ -92,7 +97,7 @@
             >
                 <!-- Custom cell renderers -->
 
-                <template #header-select>
+                <template v-if="canManageTasks" #header-select>
                     <TaskSelectionColumn
                         :show-header="true"
                         :tasks="tasks"
@@ -101,7 +106,7 @@
                     />
                 </template>
                 
-                <template #cell-select="{ row }">
+                <template v-if="canManageTasks" #cell-select="{ row }">
                     <TaskSelectionColumn
                         :task="row"
                         :is-task-selected="selection.isTaskSelected"
@@ -221,8 +226,8 @@ import { TaskStatus } from '@/services/project/task/task.types';
 import type { TableColumn, TableRowAction } from '@/core/table/table.types';
 import { useErrorHandler } from '@/composables/useErrorHandler';
 import { usePermissions } from '@/composables/usePermissions';
-import { useAssetPreview } from '@/composables/useAssetPreview';
 import { PERMISSIONS } from '@/services/auth/permissions.types';
+import { useAssetPreview } from '@/composables/useAssetPreview';
 import { useProjectStore } from '@/stores/projectStore';
 import { useAuthStore } from '@/stores/authStore';
 import { taskService, workflowStageService, assetService, exportService } from '@/services/project';
@@ -236,7 +241,7 @@ const route = useRoute();
 const router = useRouter();
 const { handleError } = useErrorHandler();
 const projectStore = useProjectStore();
-const { hasProjectPermission } = usePermissions();
+const { hasProjectPermission, isManager } = usePermissions();
 const { showToast } = useToast();
 const logger = AppLogger.createComponentLogger('TasksView');
 
@@ -284,25 +289,15 @@ const bulkOperationProgress = ref<string>('Processing...');
 // Computed properties for reactive props
 const currentSelectionCount = computed(() => selection.selectionCount.value);
 
-const canManageTasks = computed(() => {
-    return hasProjectPermission(PERMISSIONS.PROJECT.UPDATE);
-});
+const canManageTasks = computed(() => isManager(projectId.value));
 
-const canAssignTasks = computed(() => {
-    return hasProjectPermission(PERMISSIONS.TASK.ASSIGN);
-});
+const canAssignTasks = computed(() => hasProjectPermission(PERMISSIONS.TASK.ASSIGN));
 
-const canUpdateTaskStatus = computed(() => {
-    return hasProjectPermission(PERMISSIONS.TASK.UPDATE_STATUS);
-});
+const canUpdateTaskStatus = computed(() => hasProjectPermission(PERMISSIONS.TASK.UPDATE_STATUS));
 
-const canReviewTasks = computed(() => {
-    return hasProjectPermission(PERMISSIONS.ANNOTATION.REVIEW);
-});
+const canReviewTasks = computed(() => hasProjectPermission(PERMISSIONS.ANNOTATION.REVIEW));
 
-const isUserManager = computed(() => {
-    return canManageTasks.value;
-});
+const isUserManager = computed(() => canManageTasks.value);
 
 const currentUserEmail = computed(() => {
     const authStore = useAuthStore();
@@ -340,30 +335,30 @@ const isTaskClickable = (task: TaskTableRow): boolean => {
 
 
 // Table configuration
-const tableColumns: TableColumn[] = [
-    { key: 'select', label: '☐', sortable: false, width: '4%', align: 'center' },
-    { key: 'assetName', label: 'Asset', sortable: true, width: '26%' },
-    { key: 'priority', label: 'Priority', sortable: true, width: '8%', align: 'center' },
-    { key: 'status', label: 'Status', sortable: true, width: '12%', align: 'center' },
-    { key: 'assignedTo', label: 'Assigned To', sortable: true, width: '16%' },
-    { key: 'dueDate', label: 'Due Date', sortable: true, width: '12%', format: 'date' },
-    { key: 'createdAt', label: 'Created', sortable: true, width: '11%', format: 'datetime' },
-    { key: 'completedAt', label: 'Completed', sortable: true, width: '11%', format: 'datetime' },
-];
+const tableColumns = computed<TableColumn[]>(() => {
+    const cols: TableColumn[] = [
+        { key: 'assetName', label: 'Asset', sortable: true, width: '26%' },
+        { key: 'priority', label: 'Priority', sortable: true, width: '8%', align: 'center' },
+        { key: 'status', label: 'Status', sortable: true, width: '12%', align: 'center' },
+        { key: 'assignedTo', label: 'Assigned To', sortable: true, width: '16%' },
+        { key: 'dueDate', label: 'Due Date', sortable: true, width: '12%', format: 'date' },
+        { key: 'createdAt', label: 'Created', sortable: true, width: '11%', format: 'datetime' },
+        { key: 'completedAt', label: 'Completed', sortable: true, width: '11%', format: 'datetime' },
+    ];
+
+    if (canManageTasks.value) {
+        cols.unshift({ key: 'select', label: '☐', sortable: false, width: '4%', align: 'center' });
+    }
+    return cols;
+});
 
 const rowActions = computed((): TableRowAction<TaskTableRow>[] => {
+    if (!canManageTasks.value) return [];
+
     const actions: TableRowAction<TaskTableRow>[] = [
+        { key: 'edit', label: 'Edit', icon: faEdit, variant: 'secondary' },
         { 
-            key: 'edit', 
-            label: 'Edit', 
-            icon: faEdit, 
-            variant: 'secondary'
-        },
-        { 
-            key: 'assign', 
-            label: 'Assign', 
-            icon: faUserCog, 
-            variant: 'secondary',
+            key: 'assign', label: 'Assign', icon: faUserCog, variant: 'secondary',
             disabled: (row: TaskTableRow) => 
                 row.status === TaskStatus.SUSPENDED ||
                 row.status === TaskStatus.DEFERRED ||
@@ -372,30 +367,18 @@ const rowActions = computed((): TableRowAction<TaskTableRow>[] => {
                 row.status === TaskStatus.VETOED
         },
         { 
-            key: 'priority', 
-            label: 'Change Priority', 
-            icon: faSort, 
-            variant: 'secondary',
+            key: 'priority', label: 'Change Priority', icon: faSort, variant: 'secondary',
+            disabled: (row: TaskTableRow) => row.status === TaskStatus.ARCHIVED || row.status === TaskStatus.VETOED
+        },
+        { 
+            key: 'change-status', label: 'Change Status', icon: faBolt, variant: 'secondary',
             disabled: (row: TaskTableRow) => 
+                row.status === TaskStatus.COMPLETED ||
                 row.status === TaskStatus.ARCHIVED ||
                 row.status === TaskStatus.VETOED
         }
     ];
 
-    // Add single status change button for managers only
-    if (canManageTasks.value) {
-        actions.push({
-            key: 'change-status',
-            label: 'Change Status',
-            icon: faBolt,
-            variant: 'secondary',
-            disabled: (row: TaskTableRow) => 
-                row.status === TaskStatus.COMPLETED ||
-                row.status === TaskStatus.ARCHIVED ||
-                row.status === TaskStatus.VETOED
-        });
-    }
-
     return actions;
 });
 
diff --git a/frontend/src/views/project/WorkflowPipelineView.vue b/frontend/src/views/project/WorkflowPipelineView.vue
index 352f5a52..eb641341 100644
--- a/frontend/src/views/project/WorkflowPipelineView.vue
+++ b/frontend/src/views/project/WorkflowPipelineView.vue
@@ -1,5 +1,5 @@
 <template>
-    <div v-permission="{ permission: PERMISSIONS.WORKFLOW.READ }" class="workflow-pipeline-view">
+    <div v-permission="{ permission: PERMISSIONS.WORKFLOW.UPDATE }" class="workflow-pipeline-view">
         <div class="view-header">
             <div class="header-left">
                 <h2>Pipeline Viewer</h2>
@@ -48,6 +48,7 @@
 
 <script setup lang="ts">
 import {computed, onMounted, ref} from 'vue';
+import { PERMISSIONS } from '@/services/auth/permissions.types';
 import {useRoute, useRouter} from 'vue-router';
 import WorkflowPipelineViewer from '@/components/project/workflow/WorkflowPipelineViewer.vue';
 import StageAssignmentModal from '@/components/project/workflow/StageAssignmentModal.vue';
@@ -57,19 +58,16 @@ import type {WorkflowStage} from '@/services/project/workflow/workflowStage.type
 import {workflowStageService} from '@/services/project';
 import {useErrorHandler} from '@/composables/useErrorHandler';
 import {usePermissions} from '@/composables/usePermissions';
-import {PERMISSIONS} from '@/services/auth/permissions.types';
 import {AppLogger} from '@/core/logger/logger';
 
 const logger = AppLogger.createComponentLogger('WorkflowPipelineView');
 const route = useRoute();
 const router = useRouter();
 const { handleError } = useErrorHandler();
-const { hasProjectPermission } = usePermissions();
+const { hasProjectPermission, hasProjectPermissionAsync, prefetchProjectPermission, isManager } = usePermissions();
 
 // Permission checks
-const canManageWorkflows = computed(() => 
-    hasProjectPermission(PERMISSIONS.WORKFLOW.UPDATE)
-);
+const canManageWorkflows = computed(() => isManager(projectId.value));
 
 const workflowId = ref<number>(parseInt(route.params.workflowId as string));
 const projectId = ref<number>(parseInt(route.params.projectId as string));
@@ -143,8 +141,9 @@ const handleEditPipeline = () => {
     // TODO: Navigate to edit mode or show edit modal
 };
 
-const handleStageClick = (stage: WorkflowStagePipeline) => {
-    if (!hasProjectPermission(PERMISSIONS.TASK.READ)) {
+const handleStageClick = async (stage: WorkflowStagePipeline) => {
+    const allowed = await hasProjectPermissionAsync(PERMISSIONS.TASK.READ);
+    if (!allowed) {
         logger.warn('Unauthorized attempt to view stage tasks', { stageId: stage.id, stageName: stage.name });
         return;
     }
@@ -201,7 +200,9 @@ const handleStageUpdated = () => {
     closeEditModal();
 };
 
-onMounted(() => {
+onMounted(async () => {
+    // Warm permission cache to avoid first-click denial due to async fetch
+    await prefetchProjectPermission(PERMISSIONS.TASK.READ, projectId.value);
     loadPipelineData();
 });
 </script>
@@ -251,4 +252,4 @@ onMounted(() => {
     position: relative;
     overflow: hidden;
 }
-</style>
\ No newline at end of file
+</style>
diff --git a/frontend/src/views/project/WorkflowsView.vue b/frontend/src/views/project/WorkflowsView.vue
index 1add59f0..93cde467 100644
--- a/frontend/src/views/project/WorkflowsView.vue
+++ b/frontend/src/views/project/WorkflowsView.vue
@@ -219,4 +219,4 @@ onMounted(() => {
     max-width: 1000px;
     width: 90vw;
 }
-</style>
\ No newline at end of file
+</style>
diff --git a/server/Server.Tests/Controllers/AssetsControllerTests.cs b/server/Server.Tests/Controllers/AssetsControllerTests.cs
index ac91d22c..41655b09 100644
--- a/server/Server.Tests/Controllers/AssetsControllerTests.cs
+++ b/server/Server.Tests/Controllers/AssetsControllerTests.cs
@@ -96,7 +96,7 @@ public async Task GetAssetsForProject_Should_ReturnOkResult_WithAssets()
             };
 
             _mockAssetService.Setup(s => s.GetAssetsForProjectAsync(
-                projectId, null, null, null, null, true, 1, 25, true, 3600
+                projectId, null, null, null, null, true, 1, 25, true, 300
             )
             ).ReturnsAsync(expectedAssets);
 
@@ -111,7 +111,7 @@ public async Task GetAssetsForProject_Should_ReturnOkResult_WithAssets()
             Assert.Equal(expectedAssets.Data, paginatedResponse.Data);
 
             _mockAssetService.Verify(s => s.GetAssetsForProjectAsync(
-                projectId, null, null, null, null, true, 1, 25, true, 3600
+                projectId, null, null, null, null, true, 1, 25, true, 300
             ),
             Times.Once
             );
@@ -148,7 +148,7 @@ public async Task GetAssetsForProject_Should_ReturnOkResult_WithFilteredAssets()
             };
 
             _mockAssetService.Setup(s => s.GetAssetsForProjectAsync(
-                projectId, null, filterOn, filterQuery, sortBy, isAscending, pageNumber, pageSize, true, 3600)
+                projectId, null, filterOn, filterQuery, sortBy, isAscending, pageNumber, pageSize, true, 300)
             ).ReturnsAsync(expectedAssets);
 
             // Act
@@ -163,7 +163,7 @@ public async Task GetAssetsForProject_Should_ReturnOkResult_WithFilteredAssets()
 
             _mockAssetService.Verify(
                 s => s.GetAssetsForProjectAsync(
-                    projectId, null, filterOn, filterQuery, sortBy, isAscending, pageNumber, pageSize, true, 3600
+                    projectId, null, filterOn, filterQuery, sortBy, isAscending, pageNumber, pageSize, true, 300
                 ),
                 Times.Once
             );
@@ -184,7 +184,7 @@ public async Task GetAssetsForProject_Should_ReturnOkResult_WithEmptyList_WhenNo
             };
 
             _mockAssetService.Setup(s => s.GetAssetsForProjectAsync(
-                projectId, null, null, null, null, true, 1, 25, true, 3600
+                projectId, null, null, null, null, true, 1, 25, true, 300
             )).ReturnsAsync(expectedAssets);
 
             // Act
@@ -203,7 +203,7 @@ public async Task GetAssetsForProject_Should_ThrowException_WhenServiceThrowsExc
             // Arrange
             var projectId = 1;
             _mockAssetService.Setup(s => s.GetAssetsForProjectAsync(
-                projectId, null, null, null, null, true, 1, 25, true, 3600
+                projectId, null, null, null, null, true, 1, 25, true, 300
             )).ThrowsAsync(new Exception("Database error"));
 
             // Act & Assert
@@ -232,11 +232,11 @@ public async Task GetAssetById_Should_ReturnOkResult_WhenAssetExists()
                 UpdatedAt = DateTime.UtcNow,
             };
 
-            _mockAssetService.Setup(s => s.GetAssetByIdAsync(assetId))
+            _mockAssetService.Setup(s => s.GetAssetByIdAsync(It.IsAny<int>(), assetId))
                 .ReturnsAsync(expectedAsset);
 
             // Act
-            var result = await _controller.GetAssetById(assetId);
+            var result = await _controller.GetAssetById(1, assetId);
 
             // Assert
             var okResult = Assert.IsType<OkObjectResult>(result);
@@ -244,7 +244,7 @@ public async Task GetAssetById_Should_ReturnOkResult_WhenAssetExists()
             Assert.Equal(expectedAsset.Id, asset.Id);
             Assert.Equal(expectedAsset.Filename, asset.Filename);
 
-            _mockAssetService.Verify(s => s.GetAssetByIdAsync(assetId), Times.Once);
+            _mockAssetService.Verify(s => s.GetAssetByIdAsync(1, assetId), Times.Once);
         }
 
         [Fact]
@@ -253,11 +253,11 @@ public async Task GetAssetById_Should_ReturnNotFound_WhenAssetDoesNotExist()
             // Arrange
             var assetId = 999;
 
-            _mockAssetService.Setup(s => s.GetAssetByIdAsync(assetId))
+            _mockAssetService.Setup(s => s.GetAssetByIdAsync(It.IsAny<int>(), assetId))
                 .ReturnsAsync((AssetDto?)null);
 
             // Act
-            var result = await _controller.GetAssetById(assetId);
+            var result = await _controller.GetAssetById(1, assetId);
 
             // Assert
             var notFoundResult = Assert.IsType<NotFoundObjectResult>(result);
@@ -265,7 +265,7 @@ public async Task GetAssetById_Should_ReturnNotFound_WhenAssetDoesNotExist()
             Assert.Equal(404, errorResponse.StatusCode);
             Assert.Contains($"Asset with ID '{assetId}' was not found", errorResponse.Message);
 
-            _mockAssetService.Verify(s => s.GetAssetByIdAsync(assetId), Times.Once);
+            _mockAssetService.Verify(s => s.GetAssetByIdAsync(1, assetId), Times.Once);
         }
 
         [Fact]
@@ -274,12 +274,12 @@ public async Task GetAssetById_Should_ThrowException_WhenServiceThrowsException(
             // Arrange
             var assetId = 1;
 
-            _mockAssetService.Setup(s => s.GetAssetByIdAsync(assetId))
+            _mockAssetService.Setup(s => s.GetAssetByIdAsync(It.IsAny<int>(), assetId))
                 .ThrowsAsync(new Exception("Database error"));
 
             // Act & Assert
             var exception = await Assert.ThrowsAsync<Exception>(() => 
-                _controller.GetAssetById(assetId));
+                _controller.GetAssetById(1, assetId));
             Assert.Equal("Database error", exception.Message);
         }
 
@@ -381,11 +381,11 @@ public async Task UpdateAsset_Should_ReturnOkResult_WhenAssetUpdatedSuccessfully
                 UpdatedAt = DateTime.UtcNow,
             };
 
-            _mockAssetService.Setup(s => s.UpdateAssetAsync(assetId, updateAssetDto))
+            _mockAssetService.Setup(s => s.UpdateAssetAsync(1, assetId, updateAssetDto))
                 .ReturnsAsync(updatedAsset);
 
             // Act
-            var result = await _controller.UpdateAsset(assetId, updateAssetDto);
+            var result = await _controller.UpdateAsset(1, assetId, updateAssetDto);
 
             // Assert
             var okResult = Assert.IsType<OkObjectResult>(result);
@@ -394,7 +394,7 @@ public async Task UpdateAsset_Should_ReturnOkResult_WhenAssetUpdatedSuccessfully
             Assert.Equal(updatedAsset.Filename, asset.Filename);
             Assert.Equal(updatedAsset.Status, asset.Status);
 
-            _mockAssetService.Verify(s => s.UpdateAssetAsync(assetId, updateAssetDto), Times.Once);
+            _mockAssetService.Verify(s => s.UpdateAssetAsync(1, assetId, updateAssetDto), Times.Once);
         }
 
         [Fact]
@@ -408,11 +408,11 @@ public async Task UpdateAsset_Should_ReturnNotFound_WhenAssetDoesNotExist()
                 Status = AssetStatus.IMPORTED
             };
 
-            _mockAssetService.Setup(s => s.UpdateAssetAsync(assetId, updateAssetDto))
+            _mockAssetService.Setup(s => s.UpdateAssetAsync(1, assetId, updateAssetDto))
                 .ReturnsAsync((AssetDto?)null);
 
             // Act
-            var result = await _controller.UpdateAsset(assetId, updateAssetDto);
+            var result = await _controller.UpdateAsset(1, assetId, updateAssetDto);
 
             // Assert
             var notFoundResult = Assert.IsType<NotFoundObjectResult>(result);
@@ -420,7 +420,7 @@ public async Task UpdateAsset_Should_ReturnNotFound_WhenAssetDoesNotExist()
             Assert.Equal(404, errorResponse.StatusCode);
             Assert.Contains($"Asset with ID '{assetId}' was not found", errorResponse.Message);
 
-            _mockAssetService.Verify(s => s.UpdateAssetAsync(assetId, updateAssetDto), Times.Once);
+            _mockAssetService.Verify(s => s.UpdateAssetAsync(1, assetId, updateAssetDto), Times.Once);
         }
 
         [Fact]
@@ -434,12 +434,12 @@ public async Task UpdateAsset_Should_ThrowException_WhenServiceThrowsException()
                 Status = AssetStatus.IMPORTED
             };
 
-            _mockAssetService.Setup(s => s.UpdateAssetAsync(assetId, updateAssetDto))
+            _mockAssetService.Setup(s => s.UpdateAssetAsync(1, assetId, updateAssetDto))
                 .ThrowsAsync(new Exception("Database error"));
 
             // Act & Assert
             var exception = await Assert.ThrowsAsync<Exception>(() => 
-                _controller.UpdateAsset(assetId, updateAssetDto));
+                _controller.UpdateAsset(1, assetId, updateAssetDto));
             Assert.Equal("Database error", exception.Message);
         }
 
@@ -453,16 +453,16 @@ public async Task DeleteAsset_Should_ReturnNoContent_WhenAssetDeletedSuccessfull
             // Arrange
             var assetId = 1;
 
-            _mockAssetService.Setup(s => s.DeleteAssetAsync(assetId))
+            _mockAssetService.Setup(s => s.DeleteAssetAsync(1, assetId))
                 .ReturnsAsync(true);
 
             // Act
-            var result = await _controller.DeleteAsset(assetId);
+            var result = await _controller.DeleteAsset(1, assetId);
 
             // Assert
             Assert.IsType<NoContentResult>(result);
 
-            _mockAssetService.Verify(s => s.DeleteAssetAsync(assetId), Times.Once);
+            _mockAssetService.Verify(s => s.DeleteAssetAsync(1, assetId), Times.Once);
         }
 
         [Fact]
@@ -471,11 +471,11 @@ public async Task DeleteAsset_Should_ReturnNotFound_WhenAssetDoesNotExist()
             // Arrange
             var assetId = 999;
 
-            _mockAssetService.Setup(s => s.DeleteAssetAsync(assetId))
+            _mockAssetService.Setup(s => s.DeleteAssetAsync(1, assetId))
                 .ReturnsAsync(false);
 
             // Act
-            var result = await _controller.DeleteAsset(assetId);
+            var result = await _controller.DeleteAsset(1, assetId);
 
             // Assert
             var notFoundResult = Assert.IsType<NotFoundObjectResult>(result);
@@ -483,7 +483,7 @@ public async Task DeleteAsset_Should_ReturnNotFound_WhenAssetDoesNotExist()
             Assert.Equal(404, errorResponse.StatusCode);
             Assert.Contains($"Asset with ID '{assetId}' was not found", errorResponse.Message);
 
-            _mockAssetService.Verify(s => s.DeleteAssetAsync(assetId), Times.Once);
+            _mockAssetService.Verify(s => s.DeleteAssetAsync(1, assetId), Times.Once);
         }
 
         [Fact]
@@ -492,12 +492,12 @@ public async Task DeleteAsset_Should_ThrowException_WhenServiceThrowsException()
             // Arrange
             var assetId = 1;
 
-            _mockAssetService.Setup(s => s.DeleteAssetAsync(assetId))
+            _mockAssetService.Setup(s => s.DeleteAssetAsync(1, assetId))
                 .ThrowsAsync(new Exception("Database error"));
 
             // Act & Assert
             var exception = await Assert.ThrowsAsync<Exception>(() => 
-                _controller.DeleteAsset(assetId));
+                _controller.DeleteAsset(1, assetId));
             Assert.Equal("Database error", exception.Message);
         }
 
diff --git a/server/Server.Tests/Core/Workflow/Steps/AssetTransferStepTests.cs b/server/Server.Tests/Core/Workflow/Steps/AssetTransferStepTests.cs
index 039b858b..813b3963 100644
--- a/server/Server.Tests/Core/Workflow/Steps/AssetTransferStepTests.cs
+++ b/server/Server.Tests/Core/Workflow/Steps/AssetTransferStepTests.cs
@@ -42,7 +42,7 @@ public async System.Threading.Tasks.Task TransferAssetAsync_WithValidContext_Sho
         var context = new PipelineContext(task, asset, currentStage, "user123")
             .WithTargetStage(targetStage);
 
-        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.AssetId, currentStage.TargetDataSourceId!.Value))
+        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, currentStage.TargetDataSourceId!.Value))
             .ReturnsAsync(true);
 
         var step = CreateStep();
@@ -53,7 +53,7 @@ public async System.Threading.Tasks.Task TransferAssetAsync_WithValidContext_Sho
         // Assert
         Assert.NotNull(result);
         Assert.Equal(targetStage, result.TargetStage);
-        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.AssetId, currentStage.TargetDataSourceId!.Value), Times.Once);
+        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, currentStage.TargetDataSourceId!.Value), Times.Once);
     }
 
     [Fact]
@@ -67,7 +67,7 @@ public async System.Threading.Tasks.Task TransferAssetAsync_WithTransferFailure_
         var context = new PipelineContext(task, asset, currentStage, "user123")
             .WithTargetStage(targetStage);
 
-        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.AssetId, currentStage.TargetDataSourceId!.Value))
+        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, currentStage.TargetDataSourceId!.Value))
             .ReturnsAsync(false);
 
         var step = CreateStep();
@@ -132,7 +132,7 @@ public async System.Threading.Tasks.Task TransferAssetToAnnotationAsync_WithVali
         _mockDataSourceService.Setup(x => x.EnsureRequiredDataSourcesExistAsync(asset.ProjectId, false))
             .ReturnsAsync(mockWorkflowDataSources);
         
-        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.AssetId, mockDataSource.Id))
+        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, mockDataSource.Id))
             .ReturnsAsync(true);
 
         var step = CreateStep();
@@ -142,7 +142,7 @@ public async System.Threading.Tasks.Task TransferAssetToAnnotationAsync_WithVali
 
         // Assert
         Assert.NotNull(result);
-        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.AssetId, mockDataSource.Id), Times.Once);
+        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, mockDataSource.Id), Times.Once);
     }
 
     [Fact]
@@ -160,7 +160,7 @@ public async System.Threading.Tasks.Task TransferAssetToAnnotationAsync_WithTran
         _mockDataSourceService.Setup(x => x.EnsureRequiredDataSourcesExistAsync(asset.ProjectId, false))
             .ReturnsAsync(mockWorkflowDataSources);
                              
-        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.AssetId, mockDataSource.Id))
+        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, mockDataSource.Id))
             .ReturnsAsync(false);
 
         var step = CreateStep();
@@ -183,7 +183,7 @@ public async System.Threading.Tasks.Task ExecuteAsync_ShouldDelegateToTransferAs
         var context = new PipelineContext(task, asset, currentStage, "user123")
             .WithTargetStage(targetStage);
 
-        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.AssetId, currentStage.TargetDataSourceId!.Value))
+        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, currentStage.TargetDataSourceId!.Value))
             .ReturnsAsync(true);
 
         var step = CreateStep();
@@ -193,7 +193,7 @@ public async System.Threading.Tasks.Task ExecuteAsync_ShouldDelegateToTransferAs
 
         // Assert
         Assert.NotNull(result);
-        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.AssetId, currentStage.TargetDataSourceId!.Value), Times.Once);
+        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, currentStage.TargetDataSourceId!.Value), Times.Once);
     }
 
     [Fact]
@@ -207,7 +207,7 @@ public async System.Threading.Tasks.Task RollbackAsync_WithValidContext_ShouldTr
         var context = new PipelineContext(task, asset, currentStage, "user123")
             .WithTargetStage(targetStage);
 
-        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.AssetId, currentStage.TargetDataSourceId!.Value))
+        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, currentStage.TargetDataSourceId!.Value))
             .ReturnsAsync(true);
 
         var step = CreateStep();
@@ -217,7 +217,7 @@ public async System.Threading.Tasks.Task RollbackAsync_WithValidContext_ShouldTr
 
         // Assert
         Assert.True(result);
-        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.AssetId, currentStage.TargetDataSourceId!.Value), Times.Once);
+        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, currentStage.TargetDataSourceId!.Value), Times.Once);
     }
 
     [Fact]
@@ -229,7 +229,7 @@ public async System.Threading.Tasks.Task RollbackAsync_WithTransferFailure_Shoul
         var currentStage = CreateTestWorkflowStage(1, WorkflowStageType.ANNOTATION, 1);
         var context = new PipelineContext(task, asset, currentStage, "user123");
 
-        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(It.IsAny<int>(), It.IsAny<int>()))
+        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<int>()))
             .ReturnsAsync(false);
 
         var step = CreateStep();
@@ -268,7 +268,7 @@ public async System.Threading.Tasks.Task TransferAssetAsync_WithVariousWorkflowS
         var context = new PipelineContext(task, asset, currentStage, "user123")
             .WithTargetStage(targetStage);
 
-        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.AssetId, currentStage.TargetDataSourceId!.Value))
+        _mockAssetService.Setup(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, currentStage.TargetDataSourceId!.Value))
             .ReturnsAsync(true);
 
         var step = CreateStep();
@@ -278,7 +278,7 @@ public async System.Threading.Tasks.Task TransferAssetAsync_WithVariousWorkflowS
 
         // Assert
         Assert.NotNull(result);
-        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.AssetId, currentStage.TargetDataSourceId!.Value), Times.Once);
+        _mockAssetService.Verify(x => x.TransferAssetToDataSourceAsync(asset.ProjectId, asset.AssetId, currentStage.TargetDataSourceId!.Value), Times.Once);
     }
 
     #region Helper Methods
@@ -333,4 +333,4 @@ private AssetTransferStep CreateStep()
     }
 
     #endregion
-}
\ No newline at end of file
+}
diff --git a/server/Server.Tests/Services/AssetServiceTests.cs b/server/Server.Tests/Services/AssetServiceTests.cs
index c7d5deb1..efe7c6f3 100644
--- a/server/Server.Tests/Services/AssetServiceTests.cs
+++ b/server/Server.Tests/Services/AssetServiceTests.cs
@@ -68,7 +68,7 @@ public async System.Threading.Tasks.Task GetAssetByIdAsync_Should_ReturnAssetDto
                 .ReturnsAsync(asset);
 
             // Act
-            var result = await _assetService.GetAssetByIdAsync(assetId);
+            var result = await _assetService.GetAssetByIdAsync(asset.ProjectId, assetId);
 
             // Assert
             Assert.NotNull(result);
@@ -88,7 +88,7 @@ public async System.Threading.Tasks.Task GetAssetByIdAsync_Should_ReturnNull_Whe
                 .ReturnsAsync((Asset?)null);
 
             // Act
-            var result = await _assetService.GetAssetByIdAsync(assetId);
+            var result = await _assetService.GetAssetByIdAsync(1, assetId);
 
             // Assert
             Assert.Null(result);
diff --git a/server/Server.Tests/Services/TaskServiceTests.cs b/server/Server.Tests/Services/TaskServiceTests.cs
index d5a3eaec..e4e863a5 100644
--- a/server/Server.Tests/Services/TaskServiceTests.cs
+++ b/server/Server.Tests/Services/TaskServiceTests.cs
@@ -70,7 +70,7 @@ public async Task GetTaskByIdAsync_Should_ReturnTaskDto_WhenTaskExists()
                 .ReturnsAsync(task);
 
             // Act
-            var result = await _taskService.GetTaskByIdAsync(taskId);
+            var result = await _taskService.GetTaskByIdAsync(1, taskId);
 
             // Assert
             Assert.NotNull(result);
@@ -91,7 +91,7 @@ public async Task GetTaskByIdAsync_Should_ReturnNull_WhenTaskDoesNotExist()
                 .ReturnsAsync((LaberisTask?)null);
 
             // Act
-            var result = await _taskService.GetTaskByIdAsync(taskId);
+            var result = await _taskService.GetTaskByIdAsync(1, taskId);
 
             // Assert
             Assert.Null(result);
diff --git a/server/Server.Tests/Services/TaskServiceUnifiedStatusTests.cs b/server/Server.Tests/Services/TaskServiceUnifiedStatusTests.cs
index fc1c98d3..a039656d 100644
--- a/server/Server.Tests/Services/TaskServiceUnifiedStatusTests.cs
+++ b/server/Server.Tests/Services/TaskServiceUnifiedStatusTests.cs
@@ -52,6 +52,7 @@ public TaskServiceUnifiedStatusTests()
     public async System.Threading.Tasks.Task ChangeTaskStatusAsync_TaskNotFound_ShouldReturnNull()
     {
         // Arrange
+        const int projectId = 1;
         const int taskId = 999;
         const string userId = "user123";
 
@@ -60,7 +61,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_TaskNotFound_Shou
             .ReturnsAsync((LaberisTask?)null);
 
         // Act
-        var result = await _taskService.ChangeTaskStatusAsync(taskId, TaskStatus.COMPLETED, userId);
+        var result = await _taskService.ChangeTaskStatusAsync(projectId, taskId, TaskStatus.COMPLETED, userId);
 
         // Assert
         Assert.Null(result);
@@ -71,6 +72,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_TaskNotFound_Shou
     public async System.Threading.Tasks.Task ChangeTaskStatusAsync_AlreadyInTargetStatus_ShouldReturnTaskWithoutChanges()
     {
         // Arrange
+        const int projectId = 1;
         const int taskId = 1;
         const string userId = "user123";
         var existingTask = CreateTestTask(taskId, WorkflowStageType.ANNOTATION);
@@ -82,7 +84,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_AlreadyInTargetSt
             .ReturnsAsync(existingTask);
 
         // Act
-        var result = await _taskService.ChangeTaskStatusAsync(taskId, TaskStatus.COMPLETED, userId);
+        var result = await _taskService.ChangeTaskStatusAsync(projectId, taskId, TaskStatus.COMPLETED, userId);
 
         // Assert
         Assert.NotNull(result);
@@ -99,6 +101,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_AlreadyInTargetSt
     public async System.Threading.Tasks.Task ChangeTaskStatusAsync_InvalidTransition_ShouldThrowException()
     {
         // Arrange
+        const int projectId = 1;
         const int taskId = 1;
         const string userId = "user123";
         var existingTask = CreateTestTask(taskId, WorkflowStageType.ANNOTATION);
@@ -115,7 +118,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_InvalidTransition
 
         // Act & Assert
         var exception = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => _taskService.ChangeTaskStatusAsync(taskId, TaskStatus.SUSPENDED, userId));
+            () => _taskService.ChangeTaskStatusAsync(projectId, taskId, TaskStatus.SUSPENDED, userId));
 
         Assert.Equal(errorMessage, exception.Message);
         _mockTaskRepository.Verify(x => x.SaveChangesAsync(), Times.Never);
@@ -125,6 +128,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_InvalidTransition
     public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ValidSuspension_ShouldUpdateTaskAndLogEvent()
     {
         // Arrange
+        const int projectId = 1;
         const int taskId = 1;
         const string userId = "user123";
         var existingTask = CreateTestTask(taskId, WorkflowStageType.ANNOTATION);
@@ -149,7 +153,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ValidSuspension_S
             .ReturnsAsync(new TaskEventDto { Id = 1, EventType = TaskEventType.STATUS_CHANGED });
 
         // Act
-        var result = await _taskService.ChangeTaskStatusAsync(taskId, TaskStatus.SUSPENDED, userId);
+        var result = await _taskService.ChangeTaskStatusAsync(projectId, taskId, TaskStatus.SUSPENDED, userId);
 
         // Assert
         Assert.NotNull(result);
@@ -168,6 +172,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ValidSuspension_S
     public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ValidCompletion_ShouldUpdateTaskAndLogEvent()
     {
         // Arrange
+        const int projectId = 1;
         const int taskId = 1;
         const string userId = "user123";
         var existingTask = CreateTestTask(taskId, WorkflowStageType.ANNOTATION);
@@ -192,7 +197,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ValidCompletion_S
             .ReturnsAsync(new TaskEventDto { Id = 1, EventType = TaskEventType.STATUS_CHANGED });
 
         // Act - disable asset movement to test pure status change
-        var result = await _taskService.ChangeTaskStatusAsync(taskId, TaskStatus.COMPLETED, userId);
+        var result = await _taskService.ChangeTaskStatusAsync(projectId, taskId, TaskStatus.COMPLETED, userId);
 
         // Assert
         Assert.NotNull(result);
@@ -211,6 +216,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ValidCompletion_S
     public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ValidUnsuspension_ShouldClearSuspendedAt()
     {
         // Arrange
+        const int projectId = 1;
         const int taskId = 1;
         const string userId = "user123";
         var existingTask = CreateTestTask(taskId, WorkflowStageType.ANNOTATION);
@@ -235,7 +241,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ValidUnsuspension
             .ReturnsAsync(new TaskEventDto { Id = 1, EventType = TaskEventType.STATUS_CHANGED });
 
         // Act
-        var result = await _taskService.ChangeTaskStatusAsync(taskId, TaskStatus.IN_PROGRESS, userId);
+        var result = await _taskService.ChangeTaskStatusAsync(projectId, taskId, TaskStatus.IN_PROGRESS, userId);
 
         // Assert
         Assert.NotNull(result);
@@ -253,6 +259,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ValidUnsuspension
     public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ArchiveCompleted_ShouldSetBothTimestamps()
     {
         // Arrange
+        const int projectId = 1;
         const int taskId = 1;
         const string userId = "manager123";
         var existingTask = CreateTestTask(taskId, WorkflowStageType.COMPLETION);
@@ -277,7 +284,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ArchiveCompleted_
             .ReturnsAsync(new TaskEventDto { Id = 1, EventType = TaskEventType.STATUS_CHANGED });
 
         // Act
-        var result = await _taskService.ChangeTaskStatusAsync(taskId, TaskStatus.ARCHIVED, userId);
+        var result = await _taskService.ChangeTaskStatusAsync(projectId, taskId, TaskStatus.ARCHIVED, userId);
 
         // Assert
         Assert.NotNull(result);
@@ -295,6 +302,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_ArchiveCompleted_
     public async System.Threading.Tasks.Task ChangeTaskStatusAsync_WithAssetMovementDisabled_ShouldNotMoveAsset()
     {
         // Arrange
+        const int projectId = 1;
         const int taskId = 1;
         const string userId = "user123";
         var existingTask = CreateTestTask(taskId, WorkflowStageType.ANNOTATION);
@@ -319,7 +327,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_WithAssetMovement
             .ReturnsAsync(new TaskEventDto { Id = 1, EventType = TaskEventType.STATUS_CHANGED });
 
         // Act - disable asset movement
-        var result = await _taskService.ChangeTaskStatusAsync(taskId, TaskStatus.COMPLETED, userId);
+        var result = await _taskService.ChangeTaskStatusAsync(projectId, taskId, TaskStatus.COMPLETED, userId);
 
         // Assert
         Assert.NotNull(result);
@@ -337,6 +345,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_WithAssetMovement
     public async System.Threading.Tasks.Task ChangeTaskStatusAsync_SuspendedChangesRequiredToInProgress_ShouldHandleChangesRequiredCorrectly()
     {
         // Arrange - This tests the exact issue: CHANGES_REQUIRED → SUSPENDED → IN_PROGRESS (frontend call)
+        const int projectId = 1;
         const int taskId = 1;
         const string userId = "user123";
         var originalChangesRequiredTime = DateTime.UtcNow.AddDays(-1);
@@ -365,7 +374,7 @@ public async System.Threading.Tasks.Task ChangeTaskStatusAsync_SuspendedChangesR
             .ReturnsAsync(new TaskEventDto { Id = 1, EventType = TaskEventType.STATUS_CHANGED });
 
         // Act - Frontend explicitly changes status to IN_PROGRESS when starting annotation
-        var result = await _taskService.ChangeTaskStatusAsync(taskId, TaskStatus.IN_PROGRESS, userId);
+        var result = await _taskService.ChangeTaskStatusAsync(projectId, taskId, TaskStatus.IN_PROGRESS, userId);
 
         // Assert
         Assert.NotNull(result);
@@ -434,4 +443,4 @@ private static Mock<UserManager<ApplicationUser>> MockUserManager()
             services.Object, 
             logger.Object);
     }
-}
\ No newline at end of file
+}
diff --git a/server/Server/Controllers/AnnotationsController.cs b/server/Server/Controllers/AnnotationsController.cs
index 3041a16e..b223320e 100644
--- a/server/Server/Controllers/AnnotationsController.cs
+++ b/server/Server/Controllers/AnnotationsController.cs
@@ -27,6 +27,7 @@ public AnnotationsController(IAnnotationService annotationService, ILogger<Annot
     /// <summary>
     /// Gets all annotations for a specific task with optional filtering, sorting, and pagination.
     /// </summary>
+    /// <param name="projectId">The project ID from the route used to scope access.</param>
     /// <param name="taskId">The ID of the task to get annotations for.</param>
     /// <param name="filterOn">The field to filter on (e.g., "annotation_type", "is_prediction", "annotator_user_id").</param>
     /// <param name="filterQuery">The value to filter by.</param>
@@ -42,6 +43,7 @@ public AnnotationsController(IAnnotationService annotationService, ILogger<Annot
     [ProducesResponseType(typeof(IEnumerable<AnnotationDto>), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
     public async Task<IActionResult> GetAnnotationsForTask(
+        int projectId,
         int taskId,
         [FromQuery] string? filterOn = null,
         [FromQuery] string? filterQuery = null,
@@ -54,7 +56,7 @@ public async Task<IActionResult> GetAnnotationsForTask(
         try
         {
             var annotations = await _annotationService.GetAnnotationsForTaskAsync(
-                taskId, filterOn, filterQuery, sortBy, isAscending, pageNumber, pageSize);
+                projectId, taskId, filterOn, filterQuery, sortBy, isAscending, pageNumber, pageSize);
             return Ok(annotations);
         }
         catch (Exception ex)
@@ -70,6 +72,7 @@ public async Task<IActionResult> GetAnnotationsForTask(
     /// <summary>
     /// Gets all annotations for a specific asset with optional filtering, sorting, and pagination.
     /// </summary>
+    /// <param name="projectId">The project ID from the route used to scope access.</param>
     /// <param name="assetId">The ID of the asset to get annotations for.</param>
     /// <param name="filterOn">The field to filter on (e.g., "annotation_type", "is_prediction", "annotator_user_id").</param>
     /// <param name="filterQuery">The value to filter by.</param>
@@ -85,6 +88,7 @@ public async Task<IActionResult> GetAnnotationsForTask(
     [ProducesResponseType(typeof(IEnumerable<AnnotationDto>), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
     public async Task<IActionResult> GetAnnotationsForAsset(
+        int projectId,
         int assetId,
         [FromQuery] string? filterOn = null,
         [FromQuery] string? filterQuery = null,
@@ -97,7 +101,7 @@ public async Task<IActionResult> GetAnnotationsForAsset(
         try
         {
             var annotations = await _annotationService.GetAnnotationsForAssetAsync(
-                assetId, filterOn, filterQuery, sortBy, isAscending, pageNumber, pageSize);
+                projectId, assetId, filterOn, filterQuery, sortBy, isAscending, pageNumber, pageSize);
             return Ok(annotations);
         }
         catch (Exception ex)
@@ -111,19 +115,20 @@ public async Task<IActionResult> GetAnnotationsForAsset(
     }
 
     /// <summary>
-    /// Gets a specific annotation by its unique ID.
+    /// Gets a specific annotation by ID within the given project scope.
     /// </summary>
-    /// <param name="annotationId">The ID of the annotation.</param>
+    /// <param name="projectId">The project ID from the route used to scope access.</param>
+    /// <param name="annotationId">The ID of the annotation to retrieve.</param>
     /// <returns>The requested annotation.</returns>
     [HttpGet("{annotationId:long}")]
     [Authorize(Policy = "CanAccessAnnotationWorkspace")]  // Annotator, Reviewer, Manager
     [ProducesResponseType(typeof(AnnotationDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> GetAnnotationById(long annotationId)
+    public async Task<IActionResult> GetAnnotationById(int projectId, long annotationId)
     {
         try
         {
-            var annotation = await _annotationService.GetAnnotationByIdAsync(annotationId);
+            var annotation = await _annotationService.GetAnnotationByIdAsync(projectId, annotationId);
 
             if (annotation == null)
             {
@@ -168,10 +173,15 @@ public async Task<IActionResult> CreateAnnotation(int projectId, [FromBody] Crea
 
         try
         {
-            var newAnnotation = await _annotationService.CreateAnnotationAsync(createAnnotationDto, annotatorUserId);
+            var newAnnotation = await _annotationService.CreateAnnotationAsync(projectId, createAnnotationDto, annotatorUserId);
             return CreatedAtAction(nameof(GetAnnotationById), 
                 new { projectId, annotationId = newAnnotation.Id }, newAnnotation);
         }
+        catch (ArgumentException ex)
+        {
+            _logger.LogWarning(ex, "Invalid create annotation request for project {ProjectId}", projectId);
+            return BadRequest(ex.Message);
+        }
         catch (Exception ex)
         {
             _logger.LogError(ex, "An error occurred while creating annotation for task {TaskId}.", createAnnotationDto.TaskId);
@@ -182,6 +192,7 @@ public async Task<IActionResult> CreateAnnotation(int projectId, [FromBody] Crea
     /// <summary>
     /// Updates an existing annotation.
     /// </summary>
+    /// <param name="projectId">The project ID used to scope access.</param>
     /// <param name="annotationId">The ID of the annotation to update.</param>
     /// <param name="updateAnnotationDto">The data to update the annotation with.</param>
     /// <returns>The updated annotation.</returns>
@@ -195,11 +206,11 @@ public async Task<IActionResult> CreateAnnotation(int projectId, [FromBody] Crea
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-    public async Task<IActionResult> UpdateAnnotation(long annotationId, [FromBody] UpdateAnnotationDto updateAnnotationDto)
+    public async Task<IActionResult> UpdateAnnotation(int projectId, long annotationId, [FromBody] UpdateAnnotationDto updateAnnotationDto)
     {
         try
         {
-            var updatedAnnotation = await _annotationService.UpdateAnnotationAsync(annotationId, updateAnnotationDto);
+            var updatedAnnotation = await _annotationService.UpdateAnnotationAsync(projectId, annotationId, updateAnnotationDto);
 
             if (updatedAnnotation == null)
             {
@@ -218,6 +229,7 @@ public async Task<IActionResult> UpdateAnnotation(long annotationId, [FromBody]
     /// <summary>
     /// Deletes an annotation by its ID.
     /// </summary>
+    /// <param name="projectId">The project ID used to scope access.</param>
     /// <param name="annotationId">The ID of the annotation to delete.</param>
     /// <returns>No content if successful.</returns>
     /// <response code="204">If the annotation was successfully deleted.</response>
@@ -228,11 +240,11 @@ public async Task<IActionResult> UpdateAnnotation(long annotationId, [FromBody]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-    public async Task<IActionResult> DeleteAnnotation(long annotationId)
+    public async Task<IActionResult> DeleteAnnotation(int projectId, long annotationId)
     {
         try
         {
-            var result = await _annotationService.DeleteAnnotationAsync(annotationId);
+            var result = await _annotationService.DeleteAnnotationAsync(projectId, annotationId);
 
             if (!result)
             {
diff --git a/server/Server/Controllers/AssetsController.cs b/server/Server/Controllers/AssetsController.cs
index 63802c65..0c53ea0e 100644
--- a/server/Server/Controllers/AssetsController.cs
+++ b/server/Server/Controllers/AssetsController.cs
@@ -62,14 +62,15 @@ public async Task<IActionResult> GetAssetsForProject(
     /// <summary>
     /// Gets a specific asset by its unique ID.
     /// </summary>
+    /// <param name="projectId">The ID of the project from the route used to scope access.</param>
     /// <param name="assetId">The ID of the asset.</param>
     /// <returns>The requested asset.</returns>
     [HttpGet("{assetId:int}")]
     [ProducesResponseType(typeof(AssetDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> GetAssetById(int assetId)
+    public async Task<IActionResult> GetAssetById(int projectId, int assetId)
     {
-        var asset = await _assetService.GetAssetByIdAsync(assetId);
+        var asset = await _assetService.GetAssetByIdAsync(projectId, assetId);
         return asset == null ? this.CreateNotFoundResponse("Asset", assetId) : Ok(asset);
     }
 
@@ -177,6 +178,7 @@ public async Task<IActionResult> CreateAsset(int projectId, [FromBody] CreateAss
     /// <summary>
     /// Updates an existing asset.
     /// </summary>
+    /// <param name="projectId">The ID of the project from the route used to scope access.</param>
     /// <param name="assetId">The ID of the asset to update.</param>
     /// <param name="updateAssetDto">The data to update the asset with.</param>
     /// <returns>The updated asset.</returns>
@@ -189,15 +191,16 @@ public async Task<IActionResult> CreateAsset(int projectId, [FromBody] CreateAss
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-    public async Task<IActionResult> UpdateAsset(int assetId, [FromBody] UpdateAssetDto updateAssetDto)
+    public async Task<IActionResult> UpdateAsset(int projectId, int assetId, [FromBody] UpdateAssetDto updateAssetDto)
     {
-        var updatedAsset = await _assetService.UpdateAssetAsync(assetId, updateAssetDto);
+        var updatedAsset = await _assetService.UpdateAssetAsync(projectId, assetId, updateAssetDto);
         return updatedAsset == null ? this.CreateNotFoundResponse("Asset", assetId) : Ok(updatedAsset);
     }
 
     /// <summary>
     /// Deletes an asset by its ID.
     /// </summary>
+    /// <param name="projectId">The ID of the project from the route used to scope access.</param>
     /// <param name="assetId">The ID of the asset to delete.</param>
     /// <returns>No content if successful.</returns>
     /// <response code="204">If the asset was successfully deleted.</response>
@@ -207,9 +210,9 @@ public async Task<IActionResult> UpdateAsset(int assetId, [FromBody] UpdateAsset
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-    public async Task<IActionResult> DeleteAsset(int assetId)
+    public async Task<IActionResult> DeleteAsset(int projectId, int assetId)
     {
-        var result = await _assetService.DeleteAssetAsync(assetId);
+        var result = await _assetService.DeleteAssetAsync(projectId, assetId);
         return !result ? this.CreateNotFoundResponse("Asset", assetId) : NoContent();
     }
 
@@ -299,6 +302,7 @@ public async Task<IActionResult> UploadAssets(
     /// Transfers an asset to a different data source.
     /// This involves copying the file in MinIO and updating the database record.
     /// </summary>
+    /// <param name="projectId">The ID of the project from the route used to scope access.</param>
     /// <param name="assetId">The ID of the asset to transfer.</param>
     /// <param name="transferAssetDto">The transfer request containing the target data source ID.</param>
     /// <returns>Success status of the transfer operation.</returns>
@@ -312,11 +316,11 @@ public async Task<IActionResult> UploadAssets(
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-    public async Task<IActionResult> TransferAsset(int assetId, [FromBody] TransferAssetDto transferAssetDto)
+    public async Task<IActionResult> TransferAsset(int projectId, int assetId, [FromBody] TransferAssetDto transferAssetDto)
     {
         try
         {
-            var result = await _assetService.TransferAssetToDataSourceAsync(assetId, transferAssetDto.TargetDataSourceId);
+            var result = await _assetService.TransferAssetToDataSourceAsync(projectId, assetId, transferAssetDto.TargetDataSourceId);
             
             if (!result)
             {
diff --git a/server/Server/Controllers/ConfigurationController.cs b/server/Server/Controllers/ConfigurationController.cs
deleted file mode 100644
index 3e59a2e6..00000000
--- a/server/Server/Controllers/ConfigurationController.cs
+++ /dev/null
@@ -1,150 +0,0 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.AspNetCore.RateLimiting;
-using server.Models.DTOs.Configuration;
-using server.Services.Interfaces;
-using System.Security.Claims;
-
-namespace server.Controllers
-{
-    /// <summary>
-    /// Controller for serving application configuration to the frontend.
-    /// Provides permission rules, feature flags, and other configuration data.
-    /// </summary>
-    [Route("api/[controller]")]
-    [ApiController]
-    [Authorize(Policy = "RequireAuthenticatedUser")]
-    [EnableRateLimiting("public")]
-    public class ConfigurationController : ControllerBase
-    {
-        private readonly IPermissionConfigurationService _permissionConfigurationService;
-        private readonly ILogger<ConfigurationController> _logger;
-
-        public ConfigurationController(
-            IPermissionConfigurationService permissionConfigurationService,
-            ILogger<ConfigurationController> logger)
-        {
-            _permissionConfigurationService = permissionConfigurationService ?? throw new ArgumentNullException(nameof(permissionConfigurationService));
-            _logger = logger ?? throw new ArgumentNullException(nameof(logger));
-        }
-
-        /// <summary>
-        /// Reloads the permission configuration from the configuration file.
-        /// This endpoint is restricted to admin users only.
-        /// </summary>
-        /// <returns>Success message</returns>
-        /// <response code="200">Configuration reloaded successfully</response>
-        /// <response code="401">If the user is not authenticated</response>
-        /// <response code="403">If the user is not an admin</response>
-        /// <response code="500">If an error occurs reloading the configuration</response>
-        [HttpPost("permissions/reload")]
-        [Authorize(Policy = "RequireAdminRole")]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        [ProducesResponseType(StatusCodes.Status401Unauthorized)]
-        [ProducesResponseType(StatusCodes.Status403Forbidden)]
-        [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-        public IActionResult ReloadPermissionConfiguration()
-        {
-            try
-            {
-                _logger.LogInformation("Admin user requesting permission configuration reload");
-                
-                _permissionConfigurationService.ReloadConfiguration();
-                
-                _logger.LogInformation("Permission configuration reloaded successfully");
-                return Ok(new { message = "Permission configuration reloaded successfully" });
-            }
-            catch (Exception ex)
-            {
-                _logger.LogError(ex, "Failed to reload permission configuration");
-                return StatusCode(StatusCodes.Status500InternalServerError,
-                    "An error occurred while reloading the permission configuration");
-            }
-        }
-
-        /// <summary>
-        /// Gets page-specific permissions for the current user.
-        /// Hybrid mode endpoint that provides permissions on-demand for specific pages/routes.
-        /// </summary>
-        /// <param name="page">The page/route identifier to get permissions for</param>
-        /// <param name="projectId">Optional project ID for project-specific permissions</param>
-        /// <returns>User permissions for the requested page</returns>
-        /// <response code="200">Returns the page permissions</response>
-        /// <response code="401">If the user is not authenticated</response>
-        /// <response code="500">If an error occurs loading the permissions</response>
-        [HttpGet("permissions/page")]
-        [ProducesResponseType(typeof(HashSet<string>), StatusCodes.Status200OK)]
-        [ProducesResponseType(StatusCodes.Status401Unauthorized)]
-        [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-        public async Task<IActionResult> GetPagePermissions([FromQuery] string page, [FromQuery] int? projectId = null)
-        {
-            try
-            {
-                if (string.IsNullOrWhiteSpace(page))
-                {
-                    return BadRequest("Page parameter is required");
-                }
-
-                _logger.LogDebug("Fetching page permissions for page '{Page}' with project {ProjectId}", page, projectId);
-
-                var userId = HttpContext.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
-                if (string.IsNullOrEmpty(userId))
-                {
-                    return Unauthorized();
-                }
-
-                var permissions = await _permissionConfigurationService.GetPagePermissionsAsync(userId, page, projectId);
-                
-                _logger.LogDebug("Successfully retrieved {PermissionCount} permissions for page '{Page}' and project {ProjectId}", 
-                    permissions.Count, page, projectId);
-
-                return Ok(permissions);
-            }
-            catch (Exception ex)
-            {
-                _logger.LogError(ex, "Failed to retrieve page permissions for page '{Page}' and project {ProjectId}", page, projectId);
-                return StatusCode(StatusCodes.Status500InternalServerError, 
-                    "An error occurred while loading the page permissions");
-            }
-        }
-
-        /// <summary>
-        /// Gets the full user permission context including all project memberships and global permissions.
-        /// This can be used for comprehensive permission caching on the frontend.
-        /// </summary>
-        /// <returns>Complete user permission context</returns>
-        /// <response code="200">Returns the user permission context</response>
-        /// <response code="401">If the user is not authenticated</response>
-        /// <response code="500">If an error occurs loading the permissions</response>
-        [HttpGet("permissions/user-context")]
-        [ProducesResponseType(typeof(UserPermissionContext), StatusCodes.Status200OK)]
-        [ProducesResponseType(StatusCodes.Status401Unauthorized)]
-        [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-        public async Task<IActionResult> GetUserPermissionContext()
-        {
-            try
-            {
-                var userId = HttpContext.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
-                if (string.IsNullOrEmpty(userId))
-                {
-                    return Unauthorized();
-                }
-
-                _logger.LogDebug("Building permission context for user {UserId}", userId);
-
-                var context = await _permissionConfigurationService.BuildUserPermissionContextAsync(userId);
-                
-                _logger.LogDebug("Successfully built permission context for user {UserId} with {PermissionCount} total permissions across {ProjectCount} projects", 
-                    userId, context.Permissions.Count, context.ProjectPermissions.Count);
-
-                return Ok(context);
-            }
-            catch (Exception ex)
-            {
-                _logger.LogError(ex, "Failed to build permission context for user");
-                return StatusCode(StatusCodes.Status500InternalServerError, 
-                    "An error occurred while building the permission context");
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/server/Server/Controllers/IssuesController.cs b/server/Server/Controllers/IssuesController.cs
index 7c6ab14a..c29fc7e9 100644
--- a/server/Server/Controllers/IssuesController.cs
+++ b/server/Server/Controllers/IssuesController.cs
@@ -1,15 +1,17 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.RateLimiting;
+using server.Authentication;
 using server.Models.DTOs.Issue;
 using server.Services.Interfaces;
 using System.Security.Claims;
 
 namespace server.Controllers;
 
-[Route("api/[controller]")]
+[Route("api/projects/{projectId:int}/[controller]")]
 [ApiController]
 [Authorize]
+[ProjectAccess]
 [EnableRateLimiting("project")]
 public class IssuesController : ControllerBase
 {
diff --git a/server/Server/Controllers/PermissionsController.cs b/server/Server/Controllers/PermissionsController.cs
new file mode 100644
index 00000000..f9548ceb
--- /dev/null
+++ b/server/Server/Controllers/PermissionsController.cs
@@ -0,0 +1,143 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Identity;
+using server.Models.Domain;
+using server.Models.Domain.Enums;
+using server.Models.DTOs.Authz;
+using server.Services.Interfaces;
+
+namespace server.Controllers;
+
+[ApiController]
+[Route("api/permissions")]
+[Authorize]
+public class PermissionsController : ControllerBase
+{
+    private readonly ILogger<PermissionsController> _logger;
+    private readonly UserManager<ApplicationUser> _userManager;
+    private readonly IPermissionConfigurationService _permissionConfig;
+    private readonly IProjectMembershipService _membershipService;
+
+    public PermissionsController(
+        ILogger<PermissionsController> logger,
+        UserManager<ApplicationUser> userManager,
+        IPermissionConfigurationService permissionConfig,
+        IProjectMembershipService membershipService)
+    {
+        _logger = logger;
+        _userManager = userManager;
+        _permissionConfig = permissionConfig;
+        _membershipService = membershipService;
+    }
+
+    /// <summary>
+    /// Reloads the permission configuration from the configuration source.
+    /// Restricted to administrators.
+    /// </summary>
+    /// <returns>Success message on completion.</returns>
+    /// <response code="200">Configuration reloaded successfully</response>
+    /// <response code="401">If the user is not authenticated</response>
+    /// <response code="403">If the user is not an admin</response>
+    /// <response code="500">If an error occurs during reload</response>
+    [HttpPost("reload")]
+    [Authorize(Policy = "RequireAdminRole")]
+    public IActionResult ReloadPermissionConfiguration()
+    {
+        try
+        {
+            _logger.LogInformation("Admin requested permission configuration reload");
+            _permissionConfig.ReloadConfiguration();
+            _logger.LogInformation("Permission configuration reload completed successfully");
+            return Ok(new { message = "Permission configuration reloaded successfully" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to reload permission configuration");
+            return StatusCode(StatusCodes.Status500InternalServerError,
+                "An error occurred while reloading the permission configuration");
+        }
+    }
+
+    [HttpPost("authorize")]
+    public async Task<ActionResult<AuthorizationResponseDto>> AuthorizeAsync([FromBody] AuthorizationCheckDto request)
+    {
+        if (request is null || string.IsNullOrWhiteSpace(request.Permission))
+        {
+            return BadRequest("Permission is required");
+        }
+
+        var user = await _userManager.GetUserAsync(User);
+        if (user is null)
+        {
+            return Unauthorized();
+        }
+
+        var allow = await EvaluateAsync(user, request.Permission, request.Context);
+        return Ok(new AuthorizationResponseDto { Allow = allow, PolicyVersion = null });
+    }
+
+    [HttpPost("authorize/batch")]
+    public async Task<ActionResult<AuthorizationBatchResponseDto>> AuthorizeBatchAsync([FromBody] AuthorizationBatchRequestDto request)
+    {
+        if (request is null || request.Checks is null)
+        {
+            return BadRequest("Checks are required");
+        }
+
+        var user = await _userManager.GetUserAsync(User);
+        if (user is null)
+        {
+            return Unauthorized();
+        }
+
+        var results = new List<bool>(request.Checks.Count);
+        foreach (var check in request.Checks)
+        {
+            if (check is null || string.IsNullOrWhiteSpace(check.Permission))
+            {
+                results.Add(false);
+                continue;
+            }
+            var allow = await EvaluateAsync(user, check.Permission, check.Context);
+            results.Add(allow);
+        }
+
+        return Ok(new AuthorizationBatchResponseDto { Results = results, PolicyVersion = null });
+    }
+
+    private async Task<bool> EvaluateAsync(ApplicationUser user, string permission, AuthorizationContextDto? context)
+    {
+        // Global permissions (no project context)
+        if (context?.ProjectId is null)
+        {
+            var roles = await _userManager.GetRolesAsync(user);
+            var perms = _permissionConfig.GetGlobalPermissionsForUser(roles);
+            var allow = perms.Contains(permission);
+            _logger.LogDebug("Authorize (global): user {UserId}, perm {Perm} => {Allow}", user.Id, permission, allow);
+            return allow;
+        }
+
+        // Project-scoped permissions
+        var projectId = context.ProjectId.Value;
+
+        // First, confirm membership
+        var isMember = await _membershipService.IsProjectMemberAsync(user.Id, projectId);
+        if (!isMember)
+        {
+            _logger.LogDebug("Authorize: user {UserId} not a member of project {ProjectId}", user.Id, projectId);
+            return false;
+        }
+
+        var role = await _membershipService.GetUserRoleInProjectAsync(user.Id, projectId);
+        if (role is null)
+        {
+            _logger.LogDebug("Authorize: user {UserId} has no role in project {ProjectId}", user.Id, projectId);
+            return false;
+        }
+
+        var allowRole = _permissionConfig.HasPermission(role.Value, permission);
+        _logger.LogDebug("Authorize: user {UserId} role {Role} in project {ProjectId}, perm {Perm} => {Allow}", 
+            user.Id, role.Value, projectId, permission, allowRole);
+        return allowRole;
+    }
+}
diff --git a/server/Server/Controllers/TasksController.cs b/server/Server/Controllers/TasksController.cs
index d8649140..3002da67 100644
--- a/server/Server/Controllers/TasksController.cs
+++ b/server/Server/Controllers/TasksController.cs
@@ -168,6 +168,7 @@ public async Task<IActionResult> GetMyTasksOrUnassigned(
     /// Gets a specific task by its unique ID, with automatic lock acquisition if autoAssign=true.
     /// If the task is locked by another user and autoAssign=true, attempts to find and return the next available task.
     /// </summary>
+    /// <param name="projectId">The ID of the project the task must belong to.</param>
     /// <param name="taskId">The ID of the task.</param>
     /// <param name="autoAssign">Whether to automatically acquire a lock for the task.</param>
     /// <returns>The requested task or next available task if original is locked.</returns>
@@ -177,7 +178,7 @@ public async Task<IActionResult> GetMyTasksOrUnassigned(
     [ProducesResponseType(StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(StatusCodes.Status403Forbidden)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
-    public async Task<IActionResult> GetTaskById(int taskId, [FromQuery] bool autoAssign = false)
+    public async Task<IActionResult> GetTaskById(int projectId, int taskId, [FromQuery] bool autoAssign = false)
     {
         var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
         if (string.IsNullOrEmpty(userId))
@@ -187,7 +188,7 @@ public async Task<IActionResult> GetTaskById(int taskId, [FromQuery] bool autoAs
 
         try
         {
-            TaskDto? task = await _taskService.GetTaskByIdAsync(taskId, userId, autoAssign);
+            TaskDto? task = await _taskService.GetTaskByIdAsync(projectId, taskId, userId, autoAssign);
             
             if (task == null)
             {
@@ -316,6 +317,7 @@ public async Task<IActionResult> CreateTask(int projectId, [FromBody] CreateTask
     /// <summary>
     /// Updates an existing task.
     /// </summary>
+    /// <param name="projectId">The ID of the project the task must belong to.</param>
     /// <param name="taskId">The ID of the task to update.</param>
     /// <param name="updateTaskDto">The data to update the task with.</param>
     /// <returns>The updated task.</returns>
@@ -329,13 +331,13 @@ public async Task<IActionResult> CreateTask(int projectId, [FromBody] CreateTask
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status403Forbidden)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-    public async Task<IActionResult> UpdateTask(int taskId, [FromBody] UpdateTaskDto updateTaskDto)
+    public async Task<IActionResult> UpdateTask(int projectId, int taskId, [FromBody] UpdateTaskDto updateTaskDto)
     {
         var updatingUserId = User.FindFirstValue(ClaimTypes.NameIdentifier);
         
         try
         {
-            var updatedTask = await _taskService.UpdateTaskAsync(taskId, updateTaskDto, updatingUserId);
+            var updatedTask = await _taskService.UpdateTaskAsync(projectId, taskId, updateTaskDto, updatingUserId);
 
             if (updatedTask == null)
             {
@@ -359,6 +361,7 @@ public async Task<IActionResult> UpdateTask(int taskId, [FromBody] UpdateTaskDto
     /// <summary>
     /// Assigns a task to a user.
     /// </summary>
+    /// <param name="projectId">The ID of the project the task must belong to.</param>
     /// <param name="taskId">The ID of the task to assign.</param>
     /// <param name="userId">The ID of the user to assign the task to.</param>
     /// <returns>The updated task.</returns>
@@ -373,7 +376,7 @@ public async Task<IActionResult> UpdateTask(int taskId, [FromBody] UpdateTaskDto
     [ProducesResponseType(StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(StatusCodes.Status403Forbidden)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-    public async Task<IActionResult> AssignTask(int taskId, string userId)
+    public async Task<IActionResult> AssignTask(int projectId, int taskId, string userId)
     {
         var assigningUserId = User.FindFirstValue(ClaimTypes.NameIdentifier);
         if (string.IsNullOrEmpty(assigningUserId))
@@ -383,7 +386,7 @@ public async Task<IActionResult> AssignTask(int taskId, string userId)
 
         try
         {
-            var updatedTask = await _taskService.AssignTaskAsync(taskId, userId, assigningUserId);
+            var updatedTask = await _taskService.AssignTaskAsync(projectId, taskId, userId, assigningUserId);
 
             if (updatedTask == null)
             {
@@ -412,6 +415,7 @@ public async Task<IActionResult> AssignTask(int taskId, string userId)
     /// <summary>
     /// Assigns a task to the current authenticated user.
     /// </summary>
+    /// <param name="projectId">The ID of the project the task must belong to.</param>
     /// <param name="taskId">The ID of the task to assign to current user.</param>
     /// <returns>The updated task.</returns>
     /// <response code="200">Returns the updated task.</response>
@@ -425,7 +429,7 @@ public async Task<IActionResult> AssignTask(int taskId, string userId)
     [ProducesResponseType(StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-    public async Task<IActionResult> AssignTaskToCurrentUser(int taskId)
+    public async Task<IActionResult> AssignTaskToCurrentUser(int projectId, int taskId)
     {
         var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
         if (string.IsNullOrEmpty(userId))
@@ -435,7 +439,7 @@ public async Task<IActionResult> AssignTaskToCurrentUser(int taskId)
 
         try
         {
-            var updatedTask = await _taskService.AssignTaskAsync(taskId, userId, userId);
+            var updatedTask = await _taskService.AssignTaskAsync(projectId, taskId, userId, userId);
 
             if (updatedTask == null)
             {
@@ -510,6 +514,7 @@ public async Task<IActionResult> GetTasksForWorkflowStage(
     /// Changes the status of a task using the unified status change system with workflow-aware validation.
     /// This endpoint handles all task status transitions according to workflow stage rules.
     /// </summary>
+    /// <param name="projectId">The ID of the project the task must belong to.</param>
     /// <param name="taskId">The ID of the task to change status for.</param>
     /// <param name="dto">The status change request containing target status and options.</param>
     /// <returns>The updated task with the new status.</returns>
@@ -524,7 +529,7 @@ public async Task<IActionResult> GetTasksForWorkflowStage(
     [ProducesResponseType(StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status500InternalServerError)]
-    public async Task<IActionResult> ChangeTaskStatus(int taskId, [FromBody] ChangeTaskStatusDto dto)
+    public async Task<IActionResult> ChangeTaskStatus(int projectId, int taskId, [FromBody] ChangeTaskStatusDto dto)
     {
         try
         {
@@ -534,7 +539,7 @@ public async Task<IActionResult> ChangeTaskStatus(int taskId, [FromBody] ChangeT
                 return Unauthorized("User ID claim not found in token.");
             }
 
-            var updatedTask = await _taskService.ChangeTaskStatusAsync(taskId, dto.TargetStatus, userId);
+            var updatedTask = await _taskService.ChangeTaskStatusAsync(projectId, taskId, dto.TargetStatus, userId);
 
             if (updatedTask == null)
             {
diff --git a/server/Server/Controllers/WorkflowStagesController.cs b/server/Server/Controllers/WorkflowStagesController.cs
index 85ad0664..5e2cc9fd 100644
--- a/server/Server/Controllers/WorkflowStagesController.cs
+++ b/server/Server/Controllers/WorkflowStagesController.cs
@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.RateLimiting;
+using server.Authentication;
 using server.Models.DTOs.WorkflowStage;
 using server.Services.Interfaces;
 
@@ -9,6 +10,7 @@ namespace server.Controllers;
 [Route("api/projects/{projectId:int}/workflows/{workflowId:int}/stages")]
 [ApiController]
 [Authorize]
+[ProjectAccess]
 [EnableRateLimiting("project")]
 public class WorkflowStagesController : ControllerBase
 {
diff --git a/server/Server/Core/Storage/MinioStorageService.cs b/server/Server/Core/Storage/MinioStorageService.cs
index e94c2de4..bf6f720d 100644
--- a/server/Server/Core/Storage/MinioStorageService.cs
+++ b/server/Server/Core/Storage/MinioStorageService.cs
@@ -278,12 +278,12 @@ public async Task<FileMetadata> GetFileMetadataAsync(string bucketName, string o
         }
         catch (ObjectNotFoundException)
         {
-            _logger.LogWarning("File metadata not found in MinIO: {BucketName}/{ObjectName}", bucketName, objectName);
-            throw new NotFoundException($"File not found: {bucketName}/{objectName}");
+            _logger.LogWarning("File metadata not found in MinIO for requested object");
+            throw new NotFoundException("File not found");
         }
         catch (MinioException ex)
         {
-            _logger.LogError(ex, "Failed to get file metadata from MinIO bucket '{BucketName}' with object name '{ObjectName}'", bucketName, objectName);
+            _logger.LogError(ex, "Failed to get file metadata from MinIO storage");
             throw new StorageException($"Failed to get file metadata: {ex.Message}", ex);
         }
         catch (Exception ex)
@@ -311,12 +311,12 @@ public async Task<string> GetPresignedUrlAsync(string bucketName, string objectN
         }
         catch (ObjectNotFoundException)
         {
-            _logger.LogWarning("Object not found for presigned URL generation: {BucketName}/{ObjectName}", bucketName, objectName);
-            throw new NotFoundException($"Object not found: {bucketName}/{objectName}");
+            _logger.LogWarning("Object not found for presigned URL generation");
+            throw new NotFoundException("Object not found");
         }
         catch (MinioException ex)
         {
-            _logger.LogError(ex, "Failed to generate presigned URL for MinIO object '{ObjectName}' in bucket '{BucketName}'", objectName, bucketName);
+            _logger.LogError(ex, "Failed to generate presigned URL for MinIO object");
             throw new StorageException($"Failed to generate presigned URL: {ex.Message}", ex);
         }
         catch (Exception ex)
diff --git a/server/Server/Core/Workflow/Steps/AssetTransferStep.cs b/server/Server/Core/Workflow/Steps/AssetTransferStep.cs
index 366c1477..4c6900f1 100644
--- a/server/Server/Core/Workflow/Steps/AssetTransferStep.cs
+++ b/server/Server/Core/Workflow/Steps/AssetTransferStep.cs
@@ -64,6 +64,7 @@ public async Task<PipelineContext> TransferAssetAsync(
         try
         {
             var transferResult = await _assetService.TransferAssetToDataSourceAsync(
+                context.Asset.ProjectId,
                 context.Asset.AssetId,
                 context.CurrentStage.TargetDataSourceId.Value);
 
@@ -114,6 +115,7 @@ public async Task<PipelineContext> TransferAssetToAnnotationAsync(
         try
         {
             var transferResult = await _assetService.TransferAssetToDataSourceAsync(
+                context.Asset.ProjectId,
                 context.Asset.AssetId,
                 annotationDataSourceId);
 
@@ -164,6 +166,7 @@ public async Task<bool> RollbackAsync(PipelineContext context, CancellationToken
         try
         {
             var rollbackResult = await _assetService.TransferAssetToDataSourceAsync(
+                context.Asset.ProjectId,
                 context.Asset.AssetId,
                 rollbackDataSourceId);
 
@@ -186,4 +189,4 @@ public async Task<bool> RollbackAsync(PipelineContext context, CancellationToken
             return false;
         }
     }
-}
\ No newline at end of file
+}
diff --git a/server/Server/Extensions/ServiceCollectionExtensions.cs b/server/Server/Extensions/ServiceCollectionExtensions.cs
index 3d02bc92..2649797f 100644
--- a/server/Server/Extensions/ServiceCollectionExtensions.cs
+++ b/server/Server/Extensions/ServiceCollectionExtensions.cs
@@ -68,6 +68,12 @@ public static IServiceCollection AddApplicationConfigurations(this IServiceColle
             .ValidateDataAnnotations()
             .ValidateOnStart();
 
+        // Configure and validate Security settings
+        services.AddOptions<SecuritySettings>()
+            .Bind(configuration.GetSection(SecuritySettings.SectionName))
+            .ValidateDataAnnotations()
+            .ValidateOnStart();
+
         return services;
     }
 
@@ -243,4 +249,4 @@ public static IServiceCollection AddPipelineServices(this IServiceCollection ser
 
         return services;
     }
-}
\ No newline at end of file
+}
diff --git a/server/Server/Models/Configurations/SecuritySettings.cs b/server/Server/Models/Configurations/SecuritySettings.cs
new file mode 100644
index 00000000..e85684ea
--- /dev/null
+++ b/server/Server/Models/Configurations/SecuritySettings.cs
@@ -0,0 +1,19 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace server.Configs;
+
+/// <summary>
+/// Security-related application settings.
+/// </summary>
+public record SecuritySettings
+{
+    public const string SectionName = "Security";
+
+    /// <summary>
+    /// Default expiry for presigned URLs in seconds.
+    /// Keep small in production to reduce exposure window.
+    /// </summary>
+    [Range(60, 86400)]
+    public int PresignedUrlExpirySeconds { get; init; } = 300; // 5 minutes
+}
+
diff --git a/server/Server/Models/DTOs/Authz/AuthorizationDtos.cs b/server/Server/Models/DTOs/Authz/AuthorizationDtos.cs
new file mode 100644
index 00000000..7aecdb68
--- /dev/null
+++ b/server/Server/Models/DTOs/Authz/AuthorizationDtos.cs
@@ -0,0 +1,30 @@
+namespace server.Models.DTOs.Authz;
+
+public class AuthorizationCheckDto
+{
+    public required string Permission { get; init; }
+    public AuthorizationContextDto? Context { get; init; }
+}
+
+public class AuthorizationContextDto
+{
+    public int? ProjectId { get; init; }
+}
+
+public class AuthorizationBatchRequestDto
+{
+    public required List<AuthorizationCheckDto> Checks { get; init; }
+}
+
+public class AuthorizationResponseDto
+{
+    public required bool Allow { get; init; }
+    public string? PolicyVersion { get; init; }
+}
+
+public class AuthorizationBatchResponseDto
+{
+    public required List<bool> Results { get; init; }
+    public string? PolicyVersion { get; init; }
+}
+
diff --git a/server/Server/Services/AnnotationService.cs b/server/Server/Services/AnnotationService.cs
index b2d745f5..e80a9b93 100644
--- a/server/Server/Services/AnnotationService.cs
+++ b/server/Server/Services/AnnotationService.cs
@@ -9,23 +9,42 @@ namespace server.Services;
 public class AnnotationService : IAnnotationService
 {
     private readonly IAnnotationRepository _annotationRepository;
+    private readonly ITaskRepository _taskRepository;
+    private readonly IAssetRepository _assetRepository;
     private readonly ILogger<AnnotationService> _logger;
 
     public AnnotationService(
         IAnnotationRepository annotationRepository,
+        ITaskRepository taskRepository,
+        IAssetRepository assetRepository,
         ILogger<AnnotationService> logger)
     {
         _annotationRepository = annotationRepository ?? throw new ArgumentNullException(nameof(annotationRepository));
+        _taskRepository = taskRepository ?? throw new ArgumentNullException(nameof(taskRepository));
+        _assetRepository = assetRepository ?? throw new ArgumentNullException(nameof(assetRepository));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
     }
 
     public async Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForTaskAsync(
+        int projectId,
         int taskId,
         string? filterOn = null, string? filterQuery = null, string? sortBy = null,
         bool isAscending = true, int pageNumber = 1, int pageSize = 25)
     {
         _logger.LogInformation("Fetching annotations for task: {TaskId}", taskId);
-
+        var task = await _taskRepository.GetByIdAsync(taskId);
+        if (task == null || task.ProjectId != projectId)
+        {
+            _logger.LogWarning("Task {TaskId} not found in project {ProjectId}", taskId, projectId);
+            return new PaginatedResponse<AnnotationDto>
+            {
+                Data = Array.Empty<AnnotationDto>(),
+                PageSize = pageSize,
+                CurrentPage = pageNumber,
+                TotalPages = 0,
+                TotalItems = 0
+            };
+        }
         var (annotations, totalCount) = await _annotationRepository.GetAllWithCountAsync(
             filter: a => a.TaskId == taskId,
             filterOn: filterOn,
@@ -52,12 +71,25 @@ public async Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForTaskAsync(
     }
 
     public async Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForAssetAsync(
+        int projectId,
         int assetId,
         string? filterOn = null, string? filterQuery = null, string? sortBy = null,
         bool isAscending = true, int pageNumber = 1, int pageSize = 25)
     {
         _logger.LogInformation("Fetching annotations for asset: {AssetId}", assetId);
-
+        var asset = await _assetRepository.GetByIdAsync(assetId);
+        if (asset == null || asset.ProjectId != projectId)
+        {
+            _logger.LogWarning("Asset {AssetId} not found in project {ProjectId}", assetId, projectId);
+            return new PaginatedResponse<AnnotationDto>
+            {
+                Data = Array.Empty<AnnotationDto>(),
+                PageSize = pageSize,
+                CurrentPage = pageNumber,
+                TotalPages = 0,
+                TotalItems = 0
+            };
+        }
         var (annotations, totalCount) = await _annotationRepository.GetAllWithCountAsync(
             filter: a => a.AssetId == assetId,
             filterOn: filterOn,
@@ -83,7 +115,7 @@ public async Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForAssetAsync(
         };
     }
 
-    public async Task<AnnotationDto?> GetAnnotationByIdAsync(long annotationId)
+    public async Task<AnnotationDto?> GetAnnotationByIdAsync(int projectId, long annotationId)
     {
         _logger.LogInformation("Fetching annotation with ID: {AnnotationId}", annotationId);
 
@@ -95,15 +127,31 @@ public async Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForAssetAsync(
             return null;
         }
 
+        // Verify project scope via task
+        var task = await _taskRepository.GetByIdAsync(annotation.TaskId);
+        if (task == null || task.ProjectId != projectId)
+        {
+            _logger.LogWarning("Annotation {AnnotationId} does not belong to project {ProjectId}", annotationId, projectId);
+            return null;
+        }
+
         _logger.LogInformation("Successfully fetched annotation with ID: {AnnotationId}", annotationId);
         return MapToDto(annotation);
     }
 
-    public async Task<AnnotationDto> CreateAnnotationAsync(CreateAnnotationDto createDto, string annotatorUserId)
+    public async Task<AnnotationDto> CreateAnnotationAsync(int projectId, CreateAnnotationDto createDto, string annotatorUserId)
     {
         _logger.LogInformation("Creating new annotation for task: {TaskId}, asset: {AssetId}",
             createDto.TaskId, createDto.AssetId);
 
+        // Validate task and asset belong to project
+        var task = await _taskRepository.GetByIdAsync(createDto.TaskId);
+        var asset = await _assetRepository.GetByIdAsync(createDto.AssetId);
+        if (task == null || asset == null || task.ProjectId != projectId || asset.ProjectId != projectId)
+        {
+            throw new ArgumentException("Task or asset does not belong to the specified project");
+        }
+
         var annotation = new Annotation
         {
             AnnotationType = createDto.AnnotationType,
@@ -130,7 +178,7 @@ public async Task<AnnotationDto> CreateAnnotationAsync(CreateAnnotationDto creat
         return MapToDto(annotation);
     }
 
-    public async Task<AnnotationDto?> UpdateAnnotationAsync(long annotationId, UpdateAnnotationDto updateDto)
+    public async Task<AnnotationDto?> UpdateAnnotationAsync(int projectId, long annotationId, UpdateAnnotationDto updateDto)
     {
         _logger.LogInformation("Updating annotation with ID: {AnnotationId}", annotationId);
 
@@ -141,6 +189,13 @@ public async Task<AnnotationDto> CreateAnnotationAsync(CreateAnnotationDto creat
             return null;
         }
 
+        var task = await _taskRepository.GetByIdAsync(existingAnnotation.TaskId);
+        if (task == null || task.ProjectId != projectId)
+        {
+            _logger.LogWarning("Annotation {AnnotationId} does not belong to project {ProjectId}", annotationId, projectId);
+            return null;
+        }
+
         existingAnnotation.Data = updateDto.Data ?? existingAnnotation.Data;
         existingAnnotation.LabelId = updateDto.LabelId ?? existingAnnotation.LabelId;
         existingAnnotation.IsPrediction = updateDto.IsPrediction ??
@@ -159,7 +214,7 @@ public async Task<AnnotationDto> CreateAnnotationAsync(CreateAnnotationDto creat
         return MapToDto(existingAnnotation);
     }
 
-    public async Task<bool> DeleteAnnotationAsync(long annotationId)
+    public async Task<bool> DeleteAnnotationAsync(int projectId, long annotationId)
     {
         _logger.LogInformation("Deleting annotation with ID: {AnnotationId}", annotationId);
 
@@ -171,6 +226,13 @@ public async Task<bool> DeleteAnnotationAsync(long annotationId)
             return false;
         }
 
+        var task = await _taskRepository.GetByIdAsync(annotation.TaskId);
+        if (task == null || task.ProjectId != projectId)
+        {
+            _logger.LogWarning("Attempt to delete annotation {AnnotationId} from mismatched project {ProjectId}", annotationId, projectId);
+            return false;
+        }
+
         _annotationRepository.Remove(annotation);
         await _annotationRepository.SaveChangesAsync();
 
diff --git a/server/Server/Services/AssetService.cs b/server/Server/Services/AssetService.cs
index 636117a3..6ba150ec 100644
--- a/server/Server/Services/AssetService.cs
+++ b/server/Server/Services/AssetService.cs
@@ -8,6 +8,8 @@
 using server.Utils;
 using server.Exceptions;
 using LaberisTask = server.Models.Domain.Task;
+using Microsoft.Extensions.Options;
+using server.Configs;
 
 namespace server.Services;
 
@@ -21,6 +23,7 @@ public class AssetService : IAssetService
     private readonly IDomainEventService _domainEventService;
     private readonly ITaskService _taskService;
     private readonly ILogger<AssetService> _logger;
+    private readonly int _defaultPresignedExpirySeconds;
 
     public AssetService(
         IAssetRepository assetRepository,
@@ -30,7 +33,8 @@ public AssetService(
         IWorkflowStageRepository workflowStageRepository,
         IDomainEventService domainEventService,
         ITaskService taskService,
-        ILogger<AssetService> logger)
+        ILogger<AssetService> logger,
+        IOptions<SecuritySettings>? securityOptions = null)
     {
         _assetRepository = assetRepository ?? throw new ArgumentNullException(nameof(assetRepository));
         _fileStorageService = fileStorageService ?? throw new ArgumentNullException(nameof(fileStorageService));
@@ -40,16 +44,21 @@ public AssetService(
         _domainEventService = domainEventService ?? throw new ArgumentNullException(nameof(domainEventService));
         _taskService = taskService ?? throw new ArgumentNullException(nameof(taskService));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _defaultPresignedExpirySeconds = securityOptions?.Value.PresignedUrlExpirySeconds ?? 300;
     }
 
     #region GET Methods
 
+    /// <summary>
+    /// Retrieves all assets for the specified project with optional filters and sorting.
+    /// Generates presigned URLs with a short expiry configured by SecuritySettings.
+    /// </summary>
     public async Task<PaginatedResponse<AssetDto>> GetAssetsForProjectAsync(
         int projectId,
         int? dataSourceId = null,
         string? filterOn = null, string? filterQuery = null, string? sortBy = null,
         bool isAscending = true, int pageNumber = 1, int pageSize = 25,
-        bool includeUrls = true, int urlExpiryInSeconds = 3600)
+        bool includeUrls = true, int urlExpiryInSeconds = 300)
     {
         _logger.LogInformation("Fetching assets for project: {ProjectId}, dataSource: {DataSourceId}", projectId, dataSourceId);
 
@@ -80,7 +89,8 @@ public async Task<PaginatedResponse<AssetDto>> GetAssetsForProjectAsync(
                     if (dataSource != null)
                     {
                         var bucketName = _storageService.GenerateBucketName(asset.ProjectId, dataSource.Name);
-                        imageUrl = await _storageService.GetPresignedUrlAsync(bucketName, asset.ExternalId, urlExpiryInSeconds);
+                        var expiry = urlExpiryInSeconds > 0 ? urlExpiryInSeconds : _defaultPresignedExpirySeconds;
+                        imageUrl = await _storageService.GetPresignedUrlAsync(bucketName, asset.ExternalId, expiry);
                     }
                 }
                 catch (Exception ex)
@@ -118,7 +128,10 @@ public async Task<PaginatedResponse<AssetDto>> GetAssetsForProjectAsync(
         };
     }
 
-    public async Task<AssetDto?> GetAssetByIdAsync(int assetId)
+    /// <summary>
+    /// Retrieves an asset by ID within the given project scope, returning null on mismatch.
+    /// </summary>
+    public async Task<AssetDto?> GetAssetByIdAsync(int projectId, int assetId)
     {
         _logger.LogInformation("Fetching asset with ID: {AssetId}", assetId);
 
@@ -130,6 +143,12 @@ public async Task<PaginatedResponse<AssetDto>> GetAssetsForProjectAsync(
             return null;
         }
 
+        if (asset.ProjectId != projectId)
+        {
+            _logger.LogWarning("Asset {AssetId} does not belong to project {ProjectId}", assetId, projectId);
+            return null;
+        }
+
         // Generate presigned URL for the asset
         string? imageUrl = null;
         try
@@ -139,7 +158,7 @@ public async Task<PaginatedResponse<AssetDto>> GetAssetsForProjectAsync(
             if (dataSource != null)
             {
                 var bucketName = _storageService.GenerateBucketName(asset.ProjectId, dataSource.Name);
-                imageUrl = await _storageService.GetPresignedUrlAsync(bucketName, asset.ExternalId, 3600); // 1 hour expiry
+                imageUrl = await _storageService.GetPresignedUrlAsync(bucketName, asset.ExternalId, _defaultPresignedExpirySeconds);
             }
         }
         catch (Exception ex)
@@ -213,7 +232,10 @@ public async Task<AssetDto> CreateAssetAsync(int projectId, CreateAssetDto creat
 
     #endregion
 
-    public async Task<AssetDto?> UpdateAssetAsync(int assetId, UpdateAssetDto updateDto)
+    /// <summary>
+    /// Updates an asset within the given project scope, returning null if not found or mismatched.
+    /// </summary>
+    public async Task<AssetDto?> UpdateAssetAsync(int projectId, int assetId, UpdateAssetDto updateDto)
     {
         _logger.LogInformation("Updating asset with ID: {AssetId}", assetId);
 
@@ -225,6 +247,12 @@ public async Task<AssetDto> CreateAssetAsync(int projectId, CreateAssetDto creat
             return null;
         }
 
+        if (asset.ProjectId != projectId)
+        {
+            _logger.LogWarning("Asset {AssetId} does not belong to project {ProjectId}", assetId, projectId);
+            return null;
+        }
+
         asset.Filename = updateDto.Filename ?? asset.Filename;
         asset.MimeType = updateDto.MimeType ?? asset.MimeType;
         asset.SizeBytes = updateDto.SizeBytes ?? asset.SizeBytes;
@@ -251,7 +279,10 @@ public async Task<AssetDto> CreateAssetAsync(int projectId, CreateAssetDto creat
         return MapToDto(asset);
     }
 
-    public async Task<bool> DeleteAssetAsync(int assetId)
+    /// <summary>
+    /// Deletes an asset by ID within the given project scope.
+    /// </summary>
+    public async Task<bool> DeleteAssetAsync(int projectId, int assetId)
     {
         _logger.LogInformation("Deleting asset with ID: {AssetId}", assetId);
 
@@ -263,6 +294,12 @@ public async Task<bool> DeleteAssetAsync(int assetId)
             return false;
         }
 
+        if (asset.ProjectId != projectId)
+        {
+            _logger.LogWarning("Attempt to delete asset {AssetId} from mismatched project {ProjectId}", assetId, projectId);
+            return false;
+        }
+
         _assetRepository.Remove(asset);
         await _assetRepository.SaveChangesAsync();
 
@@ -499,10 +536,11 @@ public async Task<bool> ValidateAssetBelongsToProjectAsync(int assetId, int proj
     /// Transfers an asset from its current data source to a target data source.
     /// This involves copying the file in MinIO and updating the database record.
     /// </summary>
+    /// <param name="projectId">The ID of the project the asset belongs to</param>
     /// <param name="assetId">The ID of the asset to transfer</param>
     /// <param name="targetDataSourceId">The ID of the target data source</param>
     /// <returns>True if the transfer was successful, false otherwise</returns>
-    public async Task<bool> TransferAssetToDataSourceAsync(int assetId, int targetDataSourceId)
+    public async Task<bool> TransferAssetToDataSourceAsync(int projectId, int assetId, int targetDataSourceId)
     {
         try
         {
@@ -514,6 +552,12 @@ public async Task<bool> TransferAssetToDataSourceAsync(int assetId, int targetDa
                 return false;
             }
 
+            if (asset.ProjectId != projectId)
+            {
+                _logger.LogWarning("Attempt to transfer asset {AssetId} from mismatched project {ProjectId}", assetId, projectId);
+                return false;
+            }
+
             _logger.LogInformation("Starting asset transfer for asset {AssetId} from data source {CurrentDataSourceId} to {TargetDataSourceId}",
                 asset.AssetId, asset.DataSourceId, targetDataSourceId);
 
diff --git a/server/Server/Services/Interfaces/IAnnotationService.cs b/server/Server/Services/Interfaces/IAnnotationService.cs
index c3f06035..8a95f301 100644
--- a/server/Server/Services/Interfaces/IAnnotationService.cs
+++ b/server/Server/Services/Interfaces/IAnnotationService.cs
@@ -8,6 +8,7 @@ public interface IAnnotationService
     /// <summary>
     /// Retrieves all annotations for a specific task, optionally filtered and sorted.
     /// </summary>
+    /// <param name="projectId">The ID of the project used to scope access.</param>
     /// <param name="taskId">The ID of the task to retrieve annotations for.</param>
     /// <param name="filterOn">The field to filter on (e.g., "annotation_type", "is_prediction", "annotator_user_id").</param>
     /// <param name="filterQuery">The query string to filter by.</param>
@@ -17,6 +18,7 @@ public interface IAnnotationService
     /// <param name="pageSize">The number of items per page.</param>
     /// <returns>A task that represents the asynchronous operation, containing a collection of AnnotationDto.</returns>
     Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForTaskAsync(
+        int projectId,
         int taskId,
         string? filterOn = null, string? filterQuery = null, string? sortBy = null,
         bool isAscending = true, int pageNumber = 1, int pageSize = 25
@@ -25,6 +27,7 @@ Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForTaskAsync(
     /// <summary>
     /// Retrieves all annotations for a specific asset, optionally filtered and sorted.
     /// </summary>
+    /// <param name="projectId">The ID of the project used to scope access.</param>
     /// <param name="assetId">The ID of the asset to retrieve annotations for.</param>
     /// <param name="filterOn">The field to filter on (e.g., "annotation_type", "is_prediction", "annotator_user_id").</param>
     /// <param name="filterQuery">The query string to filter by.</param>
@@ -34,6 +37,7 @@ Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForTaskAsync(
     /// <param name="pageSize">The number of items per page.</param>
     /// <returns>A task that represents the asynchronous operation, containing a collection of AnnotationDto.</returns>
     Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForAssetAsync(
+        int projectId,
         int assetId,
         string? filterOn = null, string? filterQuery = null, string? sortBy = null,
         bool isAscending = true, int pageNumber = 1, int pageSize = 25
@@ -42,30 +46,34 @@ Task<PaginatedResponse<AnnotationDto>> GetAnnotationsForAssetAsync(
     /// <summary>
     /// Retrieves an annotation by its ID.
     /// </summary>
+    /// <param name="projectId">The ID of the project used to scope access.</param>
     /// <param name="annotationId">The ID of the annotation to retrieve.</param>
     /// <returns>A task that represents the asynchronous operation, containing the AnnotationDto if found, otherwise null.</returns>
-    Task<AnnotationDto?> GetAnnotationByIdAsync(long annotationId);
+    Task<AnnotationDto?> GetAnnotationByIdAsync(int projectId, long annotationId);
 
     /// <summary>
     /// Creates a new annotation.
     /// </summary>
+    /// <param name="projectId">The ID of the project used to scope access.</param>
     /// <param name="createDto">The DTO containing information for the new annotation.</param>
     /// <param name="annotatorUserId">The ID of the user creating the annotation.</param>
     /// <returns>A task that represents the asynchronous operation, containing the newly created AnnotationDto.</returns>
-    Task<AnnotationDto> CreateAnnotationAsync(CreateAnnotationDto createDto, string annotatorUserId);
+    Task<AnnotationDto> CreateAnnotationAsync(int projectId, CreateAnnotationDto createDto, string annotatorUserId);
 
     /// <summary>
     /// Updates an existing annotation.
     /// </summary>
+    /// <param name="projectId">The ID of the project used to scope access.</param>
     /// <param name="annotationId">The ID of the annotation to update.</param>
     /// <param name="updateDto">The DTO containing updated annotation information.</param>
     /// <returns>A task that represents the asynchronous operation, containing the updated AnnotationDto if successful, otherwise null.</returns>
-    Task<AnnotationDto?> UpdateAnnotationAsync(long annotationId, UpdateAnnotationDto updateDto);
+    Task<AnnotationDto?> UpdateAnnotationAsync(int projectId, long annotationId, UpdateAnnotationDto updateDto);
 
     /// <summary>
     /// Deletes an annotation by its ID.
     /// </summary>
+    /// <param name="projectId">The ID of the project used to scope access.</param>
     /// <param name="annotationId">The ID of the annotation to delete.</param>
     /// <returns>A task that represents the asynchronous operation, returning true if the annotation was successfully deleted, otherwise false.</returns>
-    Task<bool> DeleteAnnotationAsync(long annotationId);
+    Task<bool> DeleteAnnotationAsync(int projectId, long annotationId);
 }
diff --git a/server/Server/Services/Interfaces/IAssetService.cs b/server/Server/Services/Interfaces/IAssetService.cs
index 4fef9809..bf100cd8 100644
--- a/server/Server/Services/Interfaces/IAssetService.cs
+++ b/server/Server/Services/Interfaces/IAssetService.cs
@@ -18,22 +18,23 @@ public interface IAssetService
     /// <param name="pageNumber">The page number for pagination (1-based index).</param>
     /// <param name="pageSize">The number of items per page.</param>
     /// <param name="includeUrls">Whether to include presigned URLs in the response (default: true).</param>
-    /// <param name="urlExpiryInSeconds">The expiry time for URLs in seconds (default: 1 hour).</param>
+    /// <param name="urlExpiryInSeconds">The expiry time for URLs in seconds (default: 300 seconds).</param>
     /// <returns>A task that represents the asynchronous operation, containing a collection of AssetDto.</returns>
     Task<PaginatedResponse<AssetDto>> GetAssetsForProjectAsync(
         int projectId,
         int? dataSourceId = null,
         string? filterOn = null, string? filterQuery = null, string? sortBy = null,
         bool isAscending = true, int pageNumber = 1, int pageSize = 25,
-        bool includeUrls = true, int urlExpiryInSeconds = 3600
+        bool includeUrls = true, int urlExpiryInSeconds = 300
     );
 
     /// <summary>
-    /// Retrieves an asset by its ID.
+    /// Retrieves an asset by its ID within project scope.
     /// </summary>
+    /// <param name="projectId">The ID of the project to scope the asset to.</param>
     /// <param name="assetId">The ID of the asset to retrieve.</param>
     /// <returns>A task that represents the asynchronous operation, containing the AssetDto if found, otherwise null.</returns>
-    Task<AssetDto?> GetAssetByIdAsync(int assetId);
+    Task<AssetDto?> GetAssetByIdAsync(int projectId, int assetId);
 
     /// <summary>
     /// Gets the count of available assets for task creation in a specific data source.
@@ -59,28 +60,31 @@ Task<PaginatedResponse<AssetDto>> GetAssetsForProjectAsync(
     Task<AssetDto> CreateAssetAsync(int projectId, CreateAssetDto createDto);
 
     /// <summary>
-    /// Updates an existing asset.
+    /// Updates an existing asset within project scope.
     /// </summary>
+    /// <param name="projectId">The project ID used to scope access.</param>
     /// <param name="assetId">The ID of the asset to update.</param>
     /// <param name="updateDto">The DTO containing updated asset information.</param>
     /// <returns>A task that represents the asynchronous operation, containing the updated AssetDto if successful, otherwise null.</returns>
-    Task<AssetDto?> UpdateAssetAsync(int assetId, UpdateAssetDto updateDto);
+    Task<AssetDto?> UpdateAssetAsync(int projectId, int assetId, UpdateAssetDto updateDto);
 
     /// <summary>
-    /// Deletes an asset by its ID.
+    /// Deletes an asset by its ID within project scope.
     /// </summary>
+    /// <param name="projectId">The project ID used to scope access.</param>
     /// <param name="assetId">The ID of the asset to delete.</param>
     /// <returns>A task that represents the asynchronous operation, returning true if the asset was successfully deleted, otherwise false.</returns>
-    Task<bool> DeleteAssetAsync(int assetId);
+    Task<bool> DeleteAssetAsync(int projectId, int assetId);
 
     /// <summary>
-    /// Transfers an asset from its current data source to a target data source.
+    /// Transfers an asset from its current data source to a target data source within project scope.
     /// This involves copying the file in MinIO and updating the database record.
     /// </summary>
+    /// <param name="projectId">The project ID used to scope access.</param>
     /// <param name="assetId">The ID of the asset to transfer</param>
     /// <param name="targetDataSourceId">The ID of the target data source</param>
     /// <returns>True if the transfer was successful, false otherwise</returns>
-    Task<bool> TransferAssetToDataSourceAsync(int assetId, int targetDataSourceId);
+    Task<bool> TransferAssetToDataSourceAsync(int projectId, int assetId, int targetDataSourceId);
 
     /// <summary>
     /// Uploads a single asset file.
@@ -97,4 +101,4 @@ Task<PaginatedResponse<AssetDto>> GetAssetsForProjectAsync(
     /// <param name="bulkUploadDto">The bulk upload DTO containing the files and metadata.</param>
     /// <returns>A task that represents the asynchronous operation, containing the bulk upload result.</returns>
     Task<BulkUploadResultDto> UploadAssetsAsync(int projectId, BulkUploadAssetDto bulkUploadDto);
-}
\ No newline at end of file
+}
diff --git a/server/Server/Services/Interfaces/IPermissionConfigurationService.cs b/server/Server/Services/Interfaces/IPermissionConfigurationService.cs
index 31e6c9ca..912e1888 100644
--- a/server/Server/Services/Interfaces/IPermissionConfigurationService.cs
+++ b/server/Server/Services/Interfaces/IPermissionConfigurationService.cs
@@ -30,6 +30,13 @@ public interface IPermissionConfigurationService
         /// <returns>HashSet of global permission strings</returns>
         HashSet<string> GetGlobalPermissions();
 
+        /// <summary>
+        /// Gets global permissions for a specific user based on system roles.
+        /// </summary>
+        /// <param name="userRoles">Identity roles of the user</param>
+        /// <returns>Global permissions available to the user</returns>
+        HashSet<string> GetGlobalPermissionsForUser(IList<string> userRoles);
+
         /// <summary>
         /// Builds a comprehensive permission context for a user based on their project memberships.
         /// </summary>
@@ -52,4 +59,4 @@ public interface IPermissionConfigurationService
         /// </summary>
         void ReloadConfiguration();
     }
-}
\ No newline at end of file
+}
diff --git a/server/Server/Services/Interfaces/ITaskService.cs b/server/Server/Services/Interfaces/ITaskService.cs
index d7fa40d5..744e7887 100644
--- a/server/Server/Services/Interfaces/ITaskService.cs
+++ b/server/Server/Services/Interfaces/ITaskService.cs
@@ -42,11 +42,12 @@ Task<PaginatedResponse<TaskDto>> GetTasksForUserAsync(
     /// <summary>
     /// Retrieves a task by its ID with optional automatic lock acquisition.
     /// </summary>
+    /// <param name="projectId">The ID of the project the task must belong to.</param>
     /// <param name="taskId">The ID of the task to retrieve.</param>
     /// <param name="userId">The ID of the user requesting the task (for lock operations).</param>
     /// <param name="acquireLock">Whether to automatically acquire a lock for the task.</param>
     /// <returns>A task that represents the asynchronous operation, containing the TaskDto if found, otherwise null.</returns>
-    Task<TaskDto?> GetTaskByIdAsync(int taskId, string? userId = null, bool acquireLock = false);
+    Task<TaskDto?> GetTaskByIdAsync(int projectId, int taskId, string? userId = null, bool acquireLock = false);
 
     /// <summary>
     /// Gets all tasks for a specific workflow stage, properly filtered by the stage's input data source.
@@ -79,20 +80,22 @@ Task<PaginatedResponse<TaskDto>> GetTasksForWorkflowStageAsync(
     /// <summary>
     /// Updates an existing task.
     /// </summary>
+    /// <param name="projectId">The ID of the project the task must belong to.</param>
     /// <param name="taskId">The ID of the task to update.</param>
     /// <param name="updateDto">The DTO containing updated task information.</param>
     /// <param name="updatingUserId">The ID of the user performing the update (for role validation when changing assignments).</param>
     /// <returns>A task that represents the asynchronous operation, containing the updated TaskDto if successful, otherwise null.</returns>
-    Task<TaskDto?> UpdateTaskAsync(int taskId, UpdateTaskDto updateDto, string? updatingUserId = null);
+    Task<TaskDto?> UpdateTaskAsync(int projectId, int taskId, UpdateTaskDto updateDto, string? updatingUserId = null);
 
     /// <summary>
     /// Assigns a task to a user.
     /// </summary>
+    /// <param name="projectId">The ID of the project the task must belong to.</param>
     /// <param name="taskId">The ID of the task to assign.</param>
     /// <param name="userId">The ID of the user to assign the task to.</param>
     /// <param name="assigningUserId">The ID of the user performing the assignment (for role validation).</param>
     /// <returns>A task that represents the asynchronous operation, containing the updated TaskDto if successful, otherwise null.</returns>
-    Task<TaskDto?> AssignTaskAsync(int taskId, string userId, string? assigningUserId = null);
+    Task<TaskDto?> AssignTaskAsync(int projectId, int taskId, string userId, string? assigningUserId = null);
 
     /// <summary>
     /// Creates tasks for all available assets in a specific workflow stage based on its input data source.
@@ -107,11 +110,12 @@ Task<PaginatedResponse<TaskDto>> GetTasksForWorkflowStageAsync(
     /// Changes the status of a task with workflow-aware validation and optional asset movement.
     /// This unified method handles all task status transitions according to the workflow stage rules.
     /// </summary>
+    /// <param name="projectId">The ID of the project the task must belong to.</param>
     /// <param name="taskId">The ID of the task to change status for.</param>
     /// <param name="targetStatus">The target status to change the task to.</param>
     /// <param name="userId">The ID of the user performing the action.</param>
     /// <returns>A task that represents the asynchronous operation, containing the updated TaskDto if successful, otherwise null.</returns>
-    Task<TaskDto?> ChangeTaskStatusAsync(int taskId, Models.Domain.Enums.TaskStatus targetStatus, string userId);
+    Task<TaskDto?> ChangeTaskStatusAsync(int projectId, int taskId, Models.Domain.Enums.TaskStatus targetStatus, string userId);
 
     /// <summary>
     /// Retrieves tasks that are either assigned to a specific user or are unassigned (available for pickup).
diff --git a/server/Server/Services/TaskService.cs b/server/Server/Services/TaskService.cs
index 348d2995..bae0c6ed 100644
--- a/server/Server/Services/TaskService.cs
+++ b/server/Server/Services/TaskService.cs
@@ -108,9 +108,9 @@ public async Task<PaginatedResponse<TaskDto>> GetTasksForUserAsync(
         };
     }
 
-    public async Task<TaskDto?> GetTaskByIdAsync(int taskId, string? userId = null, bool autoAssign = false)
+    public async Task<TaskDto?> GetTaskByIdAsync(int projectId, int taskId, string? userId = null, bool autoAssign = false)
     {
-        _logger.LogInformation("Fetching task with ID: {TaskId} for user: {UserId}, autoAssign: {AutoAssign}", taskId, userId, autoAssign);
+        _logger.LogInformation("Fetching task with ID: {TaskId} for project: {ProjectId} and user: {UserId}, autoAssign: {AutoAssign}", taskId, projectId, userId, autoAssign);
 
         var task = await _taskRepository.GetByIdAsync(taskId);
 
@@ -120,6 +120,13 @@ public async Task<PaginatedResponse<TaskDto>> GetTasksForUserAsync(
             return null;
         }
 
+        // Validate task belongs to the specified project
+        if (task.ProjectId != projectId)
+        {
+            _logger.LogWarning("Task {TaskId} belongs to project {TaskProjectId} but was requested for project {RequestedProjectId}", taskId, task.ProjectId, projectId);
+            return null;
+        }
+
         // Auto-assign task if it's unassigned and autoAssign is true
         if (!string.IsNullOrEmpty(userId) && task.AssignedToUserId == null && autoAssign)
         {
@@ -220,9 +227,9 @@ public async Task<TaskDto> CreateTaskAsync(int projectId, CreateTaskDto createDt
         return MapToDto(task);
     }
 
-    public async Task<TaskDto?> UpdateTaskAsync(int taskId, UpdateTaskDto updateDto, string? updatingUserId = null)
+    public async Task<TaskDto?> UpdateTaskAsync(int projectId, int taskId, UpdateTaskDto updateDto, string? updatingUserId = null)
     {
-        _logger.LogInformation("Updating task with ID: {TaskId} by user: {UpdatingUserId}", taskId, updatingUserId);
+        _logger.LogInformation("Updating task with ID: {TaskId} for project: {ProjectId} by user: {UpdatingUserId}", taskId, projectId, updatingUserId);
 
         var existingTask = await _taskRepository.GetByIdAsync(taskId);
         if (existingTask == null)
@@ -231,6 +238,13 @@ public async Task<TaskDto> CreateTaskAsync(int projectId, CreateTaskDto createDt
             return null;
         }
 
+        // Validate task belongs to the specified project
+        if (existingTask.ProjectId != projectId)
+        {
+            _logger.LogWarning("Task {TaskId} belongs to project {TaskProjectId} but was requested for update in project {RequestedProjectId}", taskId, existingTask.ProjectId, projectId);
+            return null;
+        }
+
         // Determine what type of changes are requested
         var isAssignmentChangeRequested = updateDto.AssignedToEmail != null || updateDto.AssignedToUserId != null;
         var isNonAssignmentChangeRequested =
@@ -326,9 +340,9 @@ public async Task<TaskDto> CreateTaskAsync(int projectId, CreateTaskDto createDt
         return MapToDto(existingTask);
     }
 
-    public async Task<TaskDto?> AssignTaskAsync(int taskId, string userId, string? assigningUserId = null)
+    public async Task<TaskDto?> AssignTaskAsync(int projectId, int taskId, string userId, string? assigningUserId = null)
     {
-        _logger.LogInformation("Assigning task {TaskId} to user: {UserId} by user: {AssigningUserId}", taskId, userId, assigningUserId);
+        _logger.LogInformation("Assigning task {TaskId} in project {ProjectId} to user: {UserId} by user: {AssigningUserId}", taskId, projectId, userId, assigningUserId);
 
         var existingTask = await _taskRepository.GetByIdAsync(taskId);
         if (existingTask == null)
@@ -337,6 +351,13 @@ public async Task<TaskDto> CreateTaskAsync(int projectId, CreateTaskDto createDt
             return null;
         }
 
+        // Validate task belongs to the specified project
+        if (existingTask.ProjectId != projectId)
+        {
+            _logger.LogWarning("Task {TaskId} belongs to project {TaskProjectId} but was requested for assignment in project {RequestedProjectId}", taskId, existingTask.ProjectId, projectId);
+            return null;
+        }
+
         // Validate assignment permissions if assigningUserId is provided
         if (!string.IsNullOrEmpty(assigningUserId))
         {
@@ -435,10 +456,10 @@ public async Task<int> CreateTasksForWorkflowStageAsync(int projectId, int workf
         return tasksCreated;
     }
 
-    public async Task<TaskDto?> ChangeTaskStatusAsync(int taskId, TaskStatus targetStatus, string userId)
+    public async Task<TaskDto?> ChangeTaskStatusAsync(int projectId, int taskId, TaskStatus targetStatus, string userId)
     {
-        _logger.LogInformation("Changing task {TaskId} status to {TargetStatus} by user {UserId}",
-            taskId, targetStatus, userId);
+        _logger.LogInformation("Changing task {TaskId} status to {TargetStatus} in project {ProjectId} by user {UserId}",
+            taskId, targetStatus, projectId, userId);
 
         var existingTask = await _taskRepository.GetByIdAsync(taskId);
         if (existingTask == null)
@@ -447,11 +468,18 @@ public async Task<int> CreateTasksForWorkflowStageAsync(int projectId, int workf
             return null;
         }
 
+        // Validate task belongs to the specified project
+        if (existingTask.ProjectId != projectId)
+        {
+            _logger.LogWarning("Task {TaskId} belongs to project {TaskProjectId} but was requested for status change in project {RequestedProjectId}", taskId, existingTask.ProjectId, projectId);
+            return null;
+        }
+
         // Auto-assign unassigned tasks to the current user before status change
         if (string.IsNullOrEmpty(existingTask.AssignedToUserId))
         {
             _logger.LogInformation("Task {TaskId} is unassigned, auto-assigning to user {UserId}", taskId, userId);
-            await AssignTaskAsync(taskId, userId, userId);
+            await AssignTaskAsync(projectId, taskId, userId, userId);
             // Refresh the task after assignment
             existingTask = await _taskRepository.GetByIdAsync(taskId);
             if (existingTask == null)
diff --git a/server/Server/appsettings.Development.json b/server/Server/appsettings.Development.json
index 28cb319c..cd4e60e6 100644
--- a/server/Server/appsettings.Development.json
+++ b/server/Server/appsettings.Development.json
@@ -17,7 +17,13 @@
     }
   },
   "Authentication": {
-    "UseFakeUser": true
+    "UseFakeUser": false
+  },
+  "WebApp": {
+    "ClientUrl": "http://localhost:5173"
+  },
+  "Security": {
+    "PresignedUrlExpirySeconds": 1800
   },
   "RateLimiting": {
     "GlobalPermitLimit": 1000,
diff --git a/server/Server/appsettings.json b/server/Server/appsettings.json
index 1129f4a7..c474e775 100644
--- a/server/Server/appsettings.json
+++ b/server/Server/appsettings.json
@@ -7,6 +7,9 @@
     }
   },
   "AllowedHosts": "*",
+  "Security": {
+    "PresignedUrlExpirySeconds": 300
+  },
   "RateLimiting": {
     "GlobalPermitLimit": 100,
     "GlobalWindowInSeconds": 60,