diff --git a/app/routes/entity_permissions.py b/app/routes/entity_permissions.py
index 8745a2e..413f9bb 100644
--- a/app/routes/entity_permissions.py
+++ b/app/routes/entity_permissions.py
@@ -151,10 +151,9 @@ async def get_entity_access(
 
 
 @router.get("/all")
-@require_permission("settings:read")
 async def list_all_permissions(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("settings:read")),
 ):
     """List ALL permission entries for the current tenant."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -187,11 +186,10 @@ async def list_entity_registry(
 
 
 @router.post("/bulk", status_code=status.HTTP_201_CREATED)
-@require_permission("settings:write")
 async def bulk_share_permissions(
     body: dict,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("settings:write")),
 ):
     """Bulk share multiple entities with a principal."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -213,11 +211,10 @@ async def bulk_share_permissions(
 
 
 @router.post("/bulk/unshare", status_code=status.HTTP_200_OK)
-@require_permission("settings:write")
 async def bulk_unshare_permissions(
     body: dict,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("settings:write")),
 ):
     """Bulk remove permissions for a principal from multiple entities."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -236,10 +233,9 @@ async def bulk_unshare_permissions(
 
 
 @router.get("/analytics")
-@require_permission("settings:read")
 async def get_permission_analytics(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("settings:read")),
 ):
     """Get permission analytics for the current tenant."""
     tenant_id = uuid.UUID(current_user["tenant_id"])