diff --git a/.claude/worktrees/agent-a203fc082069b1faf b/.claude/worktrees/agent-a203fc082069b1faf
new file mode 160000
index 0000000..ade41b4
--- /dev/null
+++ b/.claude/worktrees/agent-a203fc082069b1faf
@@ -0,0 +1 @@
+Subproject commit ade41b4a60b1381b8f3027f457139f5b9879a869
diff --git a/Distribution/Data/Seed/RoleAndPermissionSeed.cs b/Distribution/Data/Seed/RoleAndPermissionSeed.cs
index 0cd8f37..a984e4d 100644
--- a/Distribution/Data/Seed/RoleAndPermissionSeed.cs
+++ b/Distribution/Data/Seed/RoleAndPermissionSeed.cs
@@ -7,175 +7,22 @@ public static class RoleAndPermissionSeed
 {
     private static readonly DateTime SeedDate = new(2026, 8, 18);
 
-    private static readonly Guid SalesRepId        = new("10000000-0000-0000-0000-000000000001");
-    private static readonly Guid SupervisorId       = new("10000000-0000-0000-0000-000000000002");
-    private static readonly Guid AreaManagerId      = new("10000000-0000-0000-0000-000000000003");
-    private static readonly Guid AreaSupervisorId   = new("10000000-0000-0000-0000-000000000004");
-    private static readonly Guid RegionalManagerId  = new("10000000-0000-0000-0000-000000000005");
-    private static readonly Guid RegionalAgencyId   = new("10000000-0000-0000-0000-000000000006");
-
-    // Permission IDs — stable, deterministic
-    private static readonly Guid P01 = new("20000000-0000-0000-0000-000000000001"); // loading-sheet.view
-    private static readonly Guid P02 = new("20000000-0000-0000-0000-000000000002"); // loading-sheet.manage
-    private static readonly Guid P03 = new("20000000-0000-0000-0000-000000000003"); // ride.view
-    private static readonly Guid P04 = new("20000000-0000-0000-0000-000000000004"); // ride.manage
-    private static readonly Guid P05 = new("20000000-0000-0000-0000-000000000005"); // delivery-task.view
-    private static readonly Guid P06 = new("20000000-0000-0000-0000-000000000006"); // delivery-task.manage
-    private static readonly Guid P07 = new("20000000-0000-0000-0000-000000000007"); // store.view
-    private static readonly Guid P08 = new("20000000-0000-0000-0000-000000000008"); // store.manage
-    private static readonly Guid P09 = new("20000000-0000-0000-0000-000000000009"); // invoice.view
-    private static readonly Guid P10 = new("20000000-0000-0000-0000-000000000010"); // payment.manage
-    private static readonly Guid P11 = new("20000000-0000-0000-0000-000000000011"); // return.view
-    private static readonly Guid P12 = new("20000000-0000-0000-0000-000000000012"); // return.manage
-    private static readonly Guid P13 = new("20000000-0000-0000-0000-000000000013"); // shop-po.view
-    private static readonly Guid P14 = new("20000000-0000-0000-0000-000000000014"); // stock.view
-    private static readonly Guid P15 = new("20000000-0000-0000-0000-000000000015"); // stock.manage
-    private static readonly Guid P16 = new("20000000-0000-0000-0000-000000000016"); // claim.view
-    private static readonly Guid P17 = new("20000000-0000-0000-0000-000000000017"); // claim.manage
-    private static readonly Guid P18 = new("20000000-0000-0000-0000-000000000018"); // user.view
-    private static readonly Guid P19 = new("20000000-0000-0000-0000-000000000019"); // route.view
-    private static readonly Guid P20 = new("20000000-0000-0000-0000-000000000020"); // scheme.view
-    private static readonly Guid P21 = new("20000000-0000-0000-0000-000000000021"); // scheme.manage
-    private static readonly Guid P22 = new("20000000-0000-0000-0000-000000000022"); // route.manage
-    private static readonly Guid P23 = new("20000000-0000-0000-0000-000000000023"); // price-list.view
-    private static readonly Guid P24 = new("20000000-0000-0000-0000-000000000024"); // region.view
-    private static readonly Guid P25 = new("20000000-0000-0000-0000-000000000025"); // price-list.manage
-    private static readonly Guid P26 = new("20000000-0000-0000-0000-000000000026"); // grn.view
-    private static readonly Guid P27 = new("20000000-0000-0000-0000-000000000027"); // grn.manage
-    private static readonly Guid P28 = new("20000000-0000-0000-0000-000000000028"); // supplier.view
-    private static readonly Guid P29 = new("20000000-0000-0000-0000-000000000029"); // region.manage
-    private static readonly Guid P30 = new("20000000-0000-0000-0000-000000000030"); // warehouse.view
-    private static readonly Guid P31 = new("20000000-0000-0000-0000-000000000031"); // warehouse.manage
-    private static readonly Guid P32 = new("20000000-0000-0000-0000-000000000032"); // purchase-order.view
-    private static readonly Guid P33 = new("20000000-0000-0000-0000-000000000033"); // purchase-order.manage
-    private static readonly Guid P34 = new("20000000-0000-0000-0000-000000000034"); // purchase-return.manage
-    private static readonly Guid P35 = new("20000000-0000-0000-0000-000000000035"); // supplier-claim.view
-    private static readonly Guid P36 = new("20000000-0000-0000-0000-000000000036"); // supplier-claim.manage
-    private static readonly Guid P37 = new("20000000-0000-0000-0000-000000000037"); // brand.view
-    private static readonly Guid P38 = new("20000000-0000-0000-0000-000000000038"); // brand.manage
-    private static readonly Guid P39 = new("20000000-0000-0000-0000-000000000039"); // category.view
-    private static readonly Guid P40 = new("20000000-0000-0000-0000-000000000040"); // category.manage
-    private static readonly Guid P41 = new("20000000-0000-0000-0000-000000000041"); // item.view
-    private static readonly Guid P42 = new("20000000-0000-0000-0000-000000000042"); // item.manage
-    private static readonly Guid P43 = new("20000000-0000-0000-0000-000000000043"); // uom.view
-    private static readonly Guid P44 = new("20000000-0000-0000-0000-000000000044"); // uom.manage
-    private static readonly Guid P45 = new("20000000-0000-0000-0000-000000000045"); // vehicle.view
-    private static readonly Guid P46 = new("20000000-0000-0000-0000-000000000046"); // vehicle.manage
-    private static readonly Guid P47 = new("20000000-0000-0000-0000-000000000047"); // driver.view
-    private static readonly Guid P48 = new("20000000-0000-0000-0000-000000000048"); // driver.manage
-    private static readonly Guid P49 = new("20000000-0000-0000-0000-000000000049"); // role.view
-    private static readonly Guid P50 = new("20000000-0000-0000-0000-000000000050"); // user.manage
-    private static readonly Guid P51 = new("20000000-0000-0000-0000-000000000051"); // sync.manage
-    private static readonly Guid P52 = new("20000000-0000-0000-0000-000000000052"); // sys-config.view
-    private static readonly Guid P53 = new("20000000-0000-0000-0000-000000000053"); // sys-config.manage
-    private static readonly Guid P54 = new("20000000-0000-0000-0000-000000000054"); // supplier.manage
+    private static readonly Guid SalesRepId = new("10000000-0000-0000-0000-000000000001");
+    private static readonly Guid SupervisorId = new("10000000-0000-0000-0000-000000000002");
+    private static readonly Guid AreaManagerId = new("10000000-0000-0000-0000-000000000003");
+    private static readonly Guid AreaSupervisorId = new("10000000-0000-0000-0000-000000000004");
+    private static readonly Guid RegionalManagerId = new("10000000-0000-0000-0000-000000000005");
+    private static readonly Guid RegionalAgencyId = new("10000000-0000-0000-0000-000000000006");
 
     public static void Apply(ModelBuilder modelBuilder)
     {
         modelBuilder.Entity<Role>().HasData(
-            new Role { Id = SalesRepId,       Name = "SalesRep",       Level = 10, CreatedAt = SeedDate, IsActive = true },
-            new Role { Id = SupervisorId,     Name = "Supervisor",     Level = 20, CreatedAt = SeedDate, IsActive = true },
-            new Role { Id = AreaManagerId,    Name = "AreaManager",    Level = 30, CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = SalesRepId, Name = "SalesRep", Level = 10, CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = SupervisorId, Name = "Supervisor", Level = 20, CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = AreaManagerId, Name = "AreaManager", Level = 30, CreatedAt = SeedDate, IsActive = true },
             new Role { Id = AreaSupervisorId, Name = "AreaSupervisor", Level = 40, CreatedAt = SeedDate, IsActive = true },
-            new Role { Id = RegionalManagerId,Name = "RegionalManager",Level = 50, CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = RegionalManagerId, Name = "RegionalManager", Level = 50, CreatedAt = SeedDate, IsActive = true },
             new Role { Id = RegionalAgencyId, Name = "RegionalAgency", Level = 60, CreatedAt = SeedDate, IsActive = true }
         );
-
-        modelBuilder.Entity<Permission>().HasData(
-            new Permission { Id = P01, Code = "loading-sheet.view",     Description = "View loading sheets",          CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P02, Code = "loading-sheet.manage",   Description = "Create/edit loading sheets",   CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P03, Code = "ride.view",              Description = "View rides",                   CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P04, Code = "ride.manage",            Description = "Create/manage rides",          CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P05, Code = "delivery-task.view",     Description = "View delivery tasks",          CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P06, Code = "delivery-task.manage",   Description = "Manage delivery tasks",        CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P07, Code = "store.view",             Description = "View stores",                  CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P08, Code = "store.manage",           Description = "Create/edit stores",           CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P09, Code = "invoice.view",           Description = "View invoices",                CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P10, Code = "payment.manage",         Description = "Record payments",              CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P11, Code = "return.view",            Description = "View returns",                 CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P12, Code = "return.manage",          Description = "Create/manage returns",        CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P13, Code = "shop-po.view",           Description = "View shop purchase orders",   CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P14, Code = "stock.view",             Description = "View stock",                   CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P15, Code = "stock.manage",           Description = "Manage stock movements",       CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P16, Code = "claim.view",             Description = "View claims",                  CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P17, Code = "claim.manage",           Description = "Create/settle claims",         CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P18, Code = "user.view",              Description = "View users",                   CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P19, Code = "route.view",             Description = "View routes",                  CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P20, Code = "scheme.view",            Description = "View schemes",                 CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P21, Code = "scheme.manage",          Description = "Create/edit schemes",          CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P22, Code = "route.manage",           Description = "Create/edit routes",           CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P23, Code = "price-list.view",        Description = "View price lists",             CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P24, Code = "region.view",            Description = "View regions",                 CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P25, Code = "price-list.manage",      Description = "Create/edit price lists",      CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P26, Code = "grn.view",               Description = "View goods receipts",          CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P27, Code = "grn.manage",             Description = "Create goods receipts",        CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P28, Code = "supplier.view",          Description = "View suppliers",               CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P29, Code = "region.manage",          Description = "Create/edit regions",          CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P30, Code = "warehouse.view",         Description = "View warehouses",              CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P31, Code = "warehouse.manage",       Description = "Create/edit warehouses",       CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P32, Code = "purchase-order.view",    Description = "View purchase orders",         CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P33, Code = "purchase-order.manage",  Description = "Create/manage purchase orders",CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P34, Code = "purchase-return.manage", Description = "Create purchase returns",      CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P35, Code = "supplier-claim.view",    Description = "View supplier claims",         CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P36, Code = "supplier-claim.manage",  Description = "Manage supplier claims",       CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P37, Code = "brand.view",             Description = "View brands",                  CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P38, Code = "brand.manage",           Description = "Create/edit brands",           CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P39, Code = "category.view",          Description = "View categories",              CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P40, Code = "category.manage",        Description = "Create/edit categories",       CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P41, Code = "item.view",              Description = "View items",                   CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P42, Code = "item.manage",            Description = "Create/edit items",            CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P43, Code = "uom.view",               Description = "View units of measure",        CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P44, Code = "uom.manage",             Description = "Create/edit units of measure", CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P45, Code = "vehicle.view",           Description = "View vehicles",                CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P46, Code = "vehicle.manage",         Description = "Create/edit vehicles",         CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P47, Code = "driver.view",            Description = "View driver profiles",         CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P48, Code = "driver.manage",          Description = "Manage driver profiles",       CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P49, Code = "role.view",              Description = "View roles",                   CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P50, Code = "user.manage",            Description = "Create/edit/deactivate users", CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P51, Code = "sync.manage",            Description = "Trigger data sync",            CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P52, Code = "sys-config.view",        Description = "View system config",           CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P53, Code = "sys-config.manage",      Description = "Edit system config",           CreatedAt = SeedDate, IsActive = true },
-            new Permission { Id = P54, Code = "supplier.manage",        Description = "Create/edit suppliers",        CreatedAt = SeedDate, IsActive = true }
-        );
-
-        // RolePermission seed — cumulative by role level
-        // Each row needs a stable Id because RolePermission inherits Template
-        // Using 30000000-00RR-0000-0000-00000000PPPP (RR = role index, PPPP = permission index)
-        var rp = new List<RolePermission>();
-
-        // SalesRep (10): P01-P15
-        var salesRepPermissions = new[] { P01, P02, P03, P04, P05, P06, P07, P09, P10, P11, P12, P13, P14, P15 };
-        foreach (var (p, i) in salesRepPermissions.Select((p, i) => (p, i + 1)))
-            rp.Add(Rp(new Guid($"30000000-0001-0000-0000-{i:D12}"), SalesRepId, p));
-
-        // Supervisor (20): + P16-P20
-        var supervisorExtra = new[] { P16, P17, P18, P19, P20 };
-        foreach (var (p, i) in supervisorExtra.Select((p, i) => (p, i + 1)))
-            rp.Add(Rp(new Guid($"30000000-0002-0000-0000-{i:D12}"), SupervisorId, p));
-
-        // AreaManager (30): + P08, P21, P22, P23
-        var areaManagerExtra = new[] { P08, P21, P22, P23 };
-        foreach (var (p, i) in areaManagerExtra.Select((p, i) => (p, i + 1)))
-            rp.Add(Rp(new Guid($"30000000-0003-0000-0000-{i:D12}"), AreaManagerId, p));
-
-        // AreaSupervisor (40): + P24, P25, P26, P27, P28
-        var areaSupervisorExtra = new[] { P24, P25, P26, P27, P28 };
-        foreach (var (p, i) in areaSupervisorExtra.Select((p, i) => (p, i + 1)))
-            rp.Add(Rp(new Guid($"30000000-0004-0000-0000-{i:D12}"), AreaSupervisorId, p));
-
-        // RegionalManager (50): + P29-P36
-        var regionalManagerExtra = new[] { P29, P30, P31, P32, P33, P34, P35, P36 };
-        foreach (var (p, i) in regionalManagerExtra.Select((p, i) => (p, i + 1)))
-            rp.Add(Rp(new Guid($"30000000-0005-0000-0000-{i:D12}"), RegionalManagerId, p));
-
-        // RegionalAgency (60): + P37-P54
-        var regionalAgencyExtra = new[] { P37, P38, P39, P40, P41, P42, P43, P44, P45, P46, P47, P48, P49, P50, P51, P52, P53, P54 };
-        foreach (var (p, i) in regionalAgencyExtra.Select((p, i) => (p, i + 1)))
-            rp.Add(Rp(new Guid($"30000000-0006-0000-0000-{i:D12}"), RegionalAgencyId, p));
-
-        modelBuilder.Entity<RolePermission>().HasData(rp);
     }
-
-    private static RolePermission Rp(Guid id, Guid roleId, Guid permissionId) =>
-        new() { Id = id, FK_RoleId = roleId, FK_PermissionId = permissionId, CreatedAt = SeedDate, IsActive = true };
 }
diff --git a/Distribution/Features/Auth/AuthController.cs b/Distribution/Features/Auth/AuthController.cs
index 8521dd0..385c9b7 100644
--- a/Distribution/Features/Auth/AuthController.cs
+++ b/Distribution/Features/Auth/AuthController.cs
@@ -12,12 +12,10 @@ public class AuthController(AuthService service, ICurrentUserService currentUser
         result.Success ? new OkObjectResult(result) : new ObjectResult(result) { StatusCode = result.StatusCode is >= 400 and < 600 ? result.StatusCode : 401 };
 
     [HttpPost("login")]
-    [AllowAnonymous]
     public async Task<IActionResult> Login(LoginRequest request, CancellationToken ct) =>
         ToActionResult(await service.LoginAsync(request, ct));
 
     [HttpPost("register")]
-    [AllowAnonymous]
     public async Task<IActionResult> Register(RegisterRequest request, CancellationToken ct) =>
         ToActionResult(await service.RegisterAsync(request, ct));
 
diff --git a/Distribution/Features/Brand/BrandController.cs b/Distribution/Features/Brand/BrandController.cs
index 780c11b..7bf17c2 100644
--- a/Distribution/Features/Brand/BrandController.cs
+++ b/Distribution/Features/Brand/BrandController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Brand;
 
@@ -8,12 +7,10 @@ namespace Distribution.Features.Brand;
 public class BrandController(BrandService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("brand.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
-    [Authorize("brand.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,7 +18,6 @@ public class BrandController(BrandService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("brand.manage")]
     public async Task<IActionResult> Create(CreateBrandRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -29,7 +25,6 @@ public class BrandController(BrandService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
-    [Authorize("brand.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateBrandRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -37,7 +32,6 @@ public class BrandController(BrandService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
-    [Authorize("brand.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
diff --git a/Distribution/Features/Category/CategoryController.cs b/Distribution/Features/Category/CategoryController.cs
index c69297f..c3e4635 100644
--- a/Distribution/Features/Category/CategoryController.cs
+++ b/Distribution/Features/Category/CategoryController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Category;
 
@@ -7,12 +6,10 @@ namespace Distribution.Features.Category;
 public class CategoryController(CategoryService service) : ControllerBase
 {
     [HttpGet("api/categories")]
-    [Authorize("category.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("api/categories/{id:guid}")]
-    [Authorize("category.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -20,7 +17,6 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpPost("api/categories")]
-    [Authorize("category.manage")]
     public async Task<IActionResult> Create(CreateCategoryRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -28,7 +24,6 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpPut("api/categories/{id:guid}")]
-    [Authorize("category.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateCategoryRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -36,7 +31,6 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpDelete("api/categories/{id:guid}")]
-    [Authorize("category.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -44,7 +38,6 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpPost("api/categories/{categoryId:guid}/subcategories")]
-    [Authorize("category.manage")]
     public async Task<IActionResult> CreateSubCategory(Guid categoryId, CreateSubCategoryRequest request, CancellationToken ct)
     {
         var result = await service.CreateSubCategoryAsync(categoryId, request, ct);
@@ -52,7 +45,6 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpPut("api/subcategories/{id:guid}")]
-    [Authorize("category.manage")]
     public async Task<IActionResult> UpdateSubCategory(Guid id, UpdateSubCategoryRequest request, CancellationToken ct)
     {
         var result = await service.UpdateSubCategoryAsync(id, request, ct);
@@ -60,7 +52,6 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpDelete("api/subcategories/{id:guid}")]
-    [Authorize("category.manage")]
     public async Task<IActionResult> DeleteSubCategory(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteSubCategoryAsync(id, ct);
diff --git a/Distribution/Features/Claims/ClaimController.cs b/Distribution/Features/Claims/ClaimController.cs
index d108b9a..922835f 100644
--- a/Distribution/Features/Claims/ClaimController.cs
+++ b/Distribution/Features/Claims/ClaimController.cs
@@ -1,5 +1,4 @@
-using Distribution.Infra.Authorization;
-using Microsoft.AspNetCore.Authorization;
+using Distribution.Infra.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Claims;
@@ -8,12 +7,10 @@ namespace Distribution.Features.Claims;
 public class ClaimController(ClaimService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet("api/claims")]
-    [Authorize("claim.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("api/claims/{id:guid}")]
-    [Authorize("claim.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,7 +18,6 @@ public class ClaimController(ClaimService service, ICurrentUserService currentUs
     }
 
     [HttpPost("api/claims")]
-    [Authorize("claim.manage")]
     public async Task<IActionResult> Create(CreateClaimRequest request, CancellationToken ct)
     {
         try
@@ -33,7 +29,6 @@ public class ClaimController(ClaimService service, ICurrentUserService currentUs
     }
 
     [HttpPut("api/claims/{id:guid}")]
-    [Authorize("claim.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateClaimRequest request, CancellationToken ct)
     {
         try
@@ -45,7 +40,6 @@ public class ClaimController(ClaimService service, ICurrentUserService currentUs
     }
 
     [HttpPost("api/claims/{id:guid}/settle")]
-    [Authorize("claim.manage")]
     public async Task<IActionResult> Settle(Guid id, SettleClaimRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.SettledByUserId;
diff --git a/Distribution/Features/DeliveryRide/DeliveryTaskController.cs b/Distribution/Features/DeliveryRide/DeliveryTaskController.cs
index 83b883e..919155e 100644
--- a/Distribution/Features/DeliveryRide/DeliveryTaskController.cs
+++ b/Distribution/Features/DeliveryRide/DeliveryTaskController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.DeliveryRide;
 
@@ -8,7 +7,6 @@ namespace Distribution.Features.DeliveryRide;
 public class DeliveryTaskController(DeliveryTaskService service) : ControllerBase
 {
     [HttpPost("rides/{rideId:guid}/tasks/generate")]
-    [Authorize("delivery-task.manage")]
     public async Task<IActionResult> Generate(Guid rideId, CancellationToken ct)
     {
         try
@@ -22,7 +20,6 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
 
     [HttpGet("rides/{rideId:guid}/tasks")]
     [HttpGet("rides/{rideId:guid}/delivery-tasks")]
-    [Authorize("delivery-task.view")]
     public async Task<IActionResult> GetByRide(Guid rideId)
     {
         var result = await service.GetByRideIdAsync(rideId);
@@ -30,7 +27,6 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
     }
 
     [HttpGet("delivery-tasks/{id:guid}")]
-    [Authorize("delivery-task.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -38,7 +34,6 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
     }
 
     [HttpPut("delivery-tasks/{id:guid}/quantities")]
-    [Authorize("delivery-task.manage")]
     public async Task<IActionResult> SetQuantities(Guid id, SetQuantitiesRequest request, CancellationToken ct)
     {
         try
@@ -51,7 +46,6 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
     }
 
     [HttpPost("delivery-tasks/{id:guid}/confirm")]
-    [Authorize("delivery-task.manage")]
     public async Task<IActionResult> Confirm(Guid id, CancellationToken ct)
     {
         try
@@ -64,7 +58,6 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
     }
 
     [HttpPost("delivery-tasks/{id:guid}/fail")]
-    [Authorize("delivery-task.manage")]
     public async Task<IActionResult> Fail(Guid id, FailTaskRequest request, CancellationToken ct)
     {
         try
diff --git a/Distribution/Features/Grn/GrnController.cs b/Distribution/Features/Grn/GrnController.cs
index cf5aa31..f87f56a 100644
--- a/Distribution/Features/Grn/GrnController.cs
+++ b/Distribution/Features/Grn/GrnController.cs
@@ -1,5 +1,4 @@
-using Distribution.Infra.Authorization;
-using Microsoft.AspNetCore.Authorization;
+using Distribution.Infra.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Grn;
@@ -8,7 +7,6 @@ namespace Distribution.Features.Grn;
 public class GrnController(GrnService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet("api/goods-receipts")]
-    [Authorize("grn.view")]
     public async Task<IActionResult> GetAll(
         [FromQuery] Guid? purchaseOrderId,
         [FromQuery] int page = 1,
@@ -19,7 +17,6 @@ public class GrnController(GrnService service, ICurrentUserService currentUser)
     }
 
     [HttpGet("api/goods-receipts/{id:guid}")]
-    [Authorize("grn.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -27,7 +24,6 @@ public class GrnController(GrnService service, ICurrentUserService currentUser)
     }
 
     [HttpPost("api/goods-receipts")]
-    [Authorize("grn.manage")]
     public async Task<IActionResult> CreateFlat(CreateFlatGrnRequest request, CancellationToken ct)
     {
         // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
@@ -44,12 +40,10 @@ public class GrnController(GrnService service, ICurrentUserService currentUser)
     }
 
     [HttpGet("api/purchase-orders/{id:guid}/goods-receipts")]
-    [Authorize("grn.view")]
     public async Task<IActionResult> GetByPurchaseOrder(Guid id) =>
         Ok(await service.GetByPurchaseOrderIdAsync(id));
 
     [HttpPost("api/purchase-orders/{id:guid}/goods-receipts")]
-    [Authorize("grn.manage")]
     public async Task<IActionResult> Create(Guid id, CreateGrnRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.ReceivedByUserId;
diff --git a/Distribution/Features/Invoice/InvoiceController.cs b/Distribution/Features/Invoice/InvoiceController.cs
index 7ca7be8..5060dcf 100644
--- a/Distribution/Features/Invoice/InvoiceController.cs
+++ b/Distribution/Features/Invoice/InvoiceController.cs
@@ -1,12 +1,10 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Distribution.Models;
 
 namespace Distribution.Features.Invoice;
 
 [ApiController]
 [Route("api/invoices")]
-[Authorize("invoice.view")]
 public class InvoiceController(InvoiceService service) : ControllerBase
 {
     [HttpGet]
diff --git a/Distribution/Features/Item/ItemController.cs b/Distribution/Features/Item/ItemController.cs
index 215ead8..d497152 100644
--- a/Distribution/Features/Item/ItemController.cs
+++ b/Distribution/Features/Item/ItemController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Item;
 
@@ -8,7 +7,6 @@ namespace Distribution.Features.Item;
 public class ItemController(ItemService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("item.view")]
     public async Task<IActionResult> GetAll(
         [FromQuery] Guid? categoryId,
         [FromQuery] Guid? subCategoryId,
@@ -16,7 +14,6 @@ public class ItemController(ItemService service) : ControllerBase
         Ok(await service.GetAllAsync(categoryId, subCategoryId, brandId));
 
     [HttpGet("{id:guid}")]
-    [Authorize("item.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -24,7 +21,6 @@ public class ItemController(ItemService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("item.manage")]
     public async Task<IActionResult> Create(CreateItemRequest request, CancellationToken ct)
     {
         try
@@ -39,7 +35,6 @@ public class ItemController(ItemService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
-    [Authorize("item.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateItemRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -47,7 +42,6 @@ public class ItemController(ItemService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
-    [Authorize("item.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -55,7 +49,6 @@ public class ItemController(ItemService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/uom-conversions")]
-    [Authorize("item.manage")]
     public async Task<IActionResult> ReplaceConversions(Guid id, ReplaceConversionsRequest request, CancellationToken ct)
     {
         var result = await service.ReplaceConversionsAsync(id, request, ct);
diff --git a/Distribution/Features/Payment/PaymentController.cs b/Distribution/Features/Payment/PaymentController.cs
index d93f63d..d3e6e91 100644
--- a/Distribution/Features/Payment/PaymentController.cs
+++ b/Distribution/Features/Payment/PaymentController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Payment;
 
@@ -8,7 +7,6 @@ namespace Distribution.Features.Payment;
 public class PaymentController(PaymentService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("invoice.view")]
     public async Task<IActionResult> GetByInvoice(Guid invoiceId)
     {
         var result = await service.GetByInvoiceIdAsync(invoiceId);
@@ -16,7 +14,6 @@ public class PaymentController(PaymentService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("payment.manage")]
     public async Task<IActionResult> Create(Guid invoiceId, CreatePaymentRequest request, CancellationToken ct)
     {
         try
diff --git a/Distribution/Features/Ride/RideController.cs b/Distribution/Features/Ride/RideController.cs
index 4f51156..ec0086d 100644
--- a/Distribution/Features/Ride/RideController.cs
+++ b/Distribution/Features/Ride/RideController.cs
@@ -1,6 +1,5 @@
-using Microsoft.AspNetCore.Authorization;
+using Distribution.Models;
 using Microsoft.AspNetCore.Mvc;
-using Distribution.Models;
 
 namespace Distribution.Features.Ride;
 
@@ -9,7 +8,6 @@ namespace Distribution.Features.Ride;
 public class RideController(RideService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("ride.view")]
     public async Task<IActionResult> GetAll(
         [FromQuery] RideStatus? status,
         [FromQuery] Guid? driverProfileId,
@@ -22,7 +20,6 @@ public class RideController(RideService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}")]
-    [Authorize("ride.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -30,7 +27,6 @@ public class RideController(RideService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("ride.manage")]
     public async Task<IActionResult> Create(CreateRideRequest request, CancellationToken ct)
     {
         try
@@ -42,7 +38,6 @@ public class RideController(RideService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/driver")]
-    [Authorize("ride.manage")]
     public async Task<IActionResult> AssignDriver(Guid id, AssignRideDriverRequest request, CancellationToken ct)
     {
         try
@@ -55,7 +50,6 @@ public class RideController(RideService service) : ControllerBase
     }
 
     [HttpPost("{id:guid}/close")]
-    [Authorize("ride.manage")]
     public async Task<IActionResult> Close(Guid id, CloseRideRequest request, CancellationToken ct)
     {
         try
@@ -68,7 +62,6 @@ public class RideController(RideService service) : ControllerBase
     }
 
     [HttpPost("{id:guid}/cancel")]
-    [Authorize("ride.manage")]
     public async Task<IActionResult> Cancel(Guid id, CancelRideRequest request, CancellationToken ct)
     {
         try
diff --git a/Distribution/Features/Role/RoleController.cs b/Distribution/Features/Role/RoleController.cs
index 2af2155..5c872f9 100644
--- a/Distribution/Features/Role/RoleController.cs
+++ b/Distribution/Features/Role/RoleController.cs
@@ -1,11 +1,9 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Role;
 
 [ApiController]
 [Route("api/roles")]
-[Authorize("role.view")]
 public class RoleController(RoleService service) : ControllerBase
 {
     [HttpGet]
diff --git a/Distribution/Features/Scheme/SchemeController.cs b/Distribution/Features/Scheme/SchemeController.cs
index 6858999..7cb79b3 100644
--- a/Distribution/Features/Scheme/SchemeController.cs
+++ b/Distribution/Features/Scheme/SchemeController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Scheme;
 
@@ -8,12 +7,10 @@ namespace Distribution.Features.Scheme;
 public class SchemeController(SchemeService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("scheme.view")]
     public async Task<IActionResult> GetAll([FromQuery] Guid? regionId) =>
         Ok(await service.GetAllAsync(regionId));
 
     [HttpGet("{id:guid}")]
-    [Authorize("scheme.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,7 +18,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("scheme.manage")]
     public async Task<IActionResult> Create(CreateSchemeRequest request, CancellationToken ct)
     {
         try
@@ -36,7 +32,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
-    [Authorize("scheme.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateSchemeRequest request, CancellationToken ct)
     {
         try
@@ -51,7 +46,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
-    [Authorize("scheme.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -59,7 +53,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/free-goods-rule")]
-    [Authorize("scheme.manage")]
     public async Task<IActionResult> SetFreeGoodsRule(Guid id, SetFreeGoodsRuleRequest request, CancellationToken ct)
     {
         try
@@ -74,7 +67,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}/free-goods-rule")]
-    [Authorize("scheme.manage")]
     public async Task<IActionResult> ClearFreeGoodsRule(Guid id, CancellationToken ct)
     {
         var result = await service.ClearFreeGoodsRuleAsync(id, ct);
@@ -82,7 +74,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/bundle-components/{itemId:guid}")]
-    [Authorize("scheme.manage")]
     public async Task<IActionResult> UpsertBundleComponent(Guid id, Guid itemId, UpsertBundleComponentRequest request, CancellationToken ct)
     {
         try
@@ -97,7 +88,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}/bundle-components/{itemId:guid}")]
-    [Authorize("scheme.manage")]
     public async Task<IActionResult> RemoveBundleComponent(Guid id, Guid itemId, CancellationToken ct)
     {
         var result = await service.RemoveBundleComponentAsync(id, itemId, ct);
@@ -105,7 +95,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpGet("eligible")]
-    [Authorize("scheme.view")]
     public async Task<IActionResult> GetEligible([FromQuery] Guid storeId, [FromQuery] Guid orderId)
     {
         var result = await service.EvaluateEligibilityAsync(storeId, orderId);
@@ -113,7 +102,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/spend")]
-    [Authorize("scheme.view")]
     public async Task<IActionResult> GetSpend(Guid id)
     {
         var result = await service.GetSpendAsync(id);
@@ -121,7 +109,6 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/roi")]
-    [Authorize("scheme.view")]
     public async Task<IActionResult> GetROI(Guid id)
     {
         var result = await service.GetROIAsync(id);
@@ -134,7 +121,6 @@ public class SchemeController(SchemeService service) : ControllerBase
 public class SchemeOrderController(SchemeService service) : ControllerBase
 {
     [HttpPost("{id:guid}/apply-scheme")]
-    [Authorize("scheme.manage")]
     public async Task<IActionResult> ApplyScheme(Guid id, ApplySchemeRequest request, CancellationToken ct)
     {
         try
diff --git a/Distribution/Features/ShopPO/ShopPOController.cs b/Distribution/Features/ShopPO/ShopPOController.cs
index e759e9a..a7fb4c7 100644
--- a/Distribution/Features/ShopPO/ShopPOController.cs
+++ b/Distribution/Features/ShopPO/ShopPOController.cs
@@ -1,11 +1,9 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.ShopPO;
 
 [ApiController]
 [Route("api/shop-pos")]
-[Authorize("shop-po.view")]
 public class ShopPOController(ShopPOService service) : ControllerBase
 {
     [HttpGet]
diff --git a/Distribution/Features/Supplier/SupplierController.cs b/Distribution/Features/Supplier/SupplierController.cs
index e323000..65210d7 100644
--- a/Distribution/Features/Supplier/SupplierController.cs
+++ b/Distribution/Features/Supplier/SupplierController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Supplier;
 
@@ -8,12 +7,10 @@ namespace Distribution.Features.Supplier;
 public class SupplierController(SupplierService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("supplier.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
-    [Authorize("supplier.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,7 +18,6 @@ public class SupplierController(SupplierService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("supplier.manage")]
     public async Task<IActionResult> Create(CreateSupplierRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -29,7 +25,6 @@ public class SupplierController(SupplierService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
-    [Authorize("supplier.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateSupplierRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -37,7 +32,6 @@ public class SupplierController(SupplierService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
-    [Authorize("supplier.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         try
@@ -49,7 +43,6 @@ public class SupplierController(SupplierService service) : ControllerBase
     }
 
     [HttpPost("{id:guid}/evaluate")]
-    [Authorize("supplier.view")]
     public async Task<IActionResult> Evaluate(Guid id, CancellationToken ct)
     {
         var result = await service.EvaluateAsync(id, ct);
diff --git a/Distribution/Features/SupplierClaims/SupplierClaimController.cs b/Distribution/Features/SupplierClaims/SupplierClaimController.cs
index f43ba1f..d678f42 100644
--- a/Distribution/Features/SupplierClaims/SupplierClaimController.cs
+++ b/Distribution/Features/SupplierClaims/SupplierClaimController.cs
@@ -1,5 +1,4 @@
-using Distribution.Infra.Authorization;
-using Microsoft.AspNetCore.Authorization;
+using Distribution.Infra.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.SupplierClaims;
@@ -8,12 +7,10 @@ namespace Distribution.Features.SupplierClaims;
 public class SupplierClaimController(SupplierClaimService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet("api/supplier-claims")]
-    [Authorize("supplier-claim.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("api/supplier-claims/{id:guid}")]
-    [Authorize("supplier-claim.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,12 +18,10 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     }
 
     [HttpGet("api/purchase-orders/{id:guid}/claims")]
-    [Authorize("supplier-claim.view")]
     public async Task<IActionResult> GetByPurchaseOrder(Guid id) =>
         Ok(await service.GetByPurchaseOrderIdAsync(id));
 
     [HttpPost("api/purchase-orders/{id:guid}/claims")]
-    [Authorize("supplier-claim.manage")]
     public async Task<IActionResult> Create(Guid id, CreateSupplierClaimRequest request, CancellationToken ct)
     {
         // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
@@ -42,7 +37,6 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     }
 
     [HttpPut("api/supplier-claims/{id:guid}")]
-    [Authorize("supplier-claim.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateSupplierClaimRequest request, CancellationToken ct)
     {
         try
@@ -54,7 +48,6 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     }
 
     [HttpPost("api/supplier-claims/{id:guid}/approve")]
-    [Authorize("supplier-claim.manage")]
     public async Task<IActionResult> Approve(Guid id, ApproveSupplierClaimRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.ApprovedByUserId;
@@ -69,7 +62,6 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     }
 
     [HttpPost("api/supplier-claims/{id:guid}/reject")]
-    [Authorize("supplier-claim.manage")]
     public async Task<IActionResult> Reject(Guid id, RejectSupplierClaimRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.RejectedByUserId;
diff --git a/Distribution/Features/Sync/SyncController.cs b/Distribution/Features/Sync/SyncController.cs
index ff40520..2708196 100644
--- a/Distribution/Features/Sync/SyncController.cs
+++ b/Distribution/Features/Sync/SyncController.cs
@@ -1,11 +1,9 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Sync;
 
 [ApiController]
 [Route("api/sync")]
-[Authorize("sync.manage")]
 public class SyncController(SyncService service) : ControllerBase
 {
     [HttpPost("uoms")]
diff --git a/Distribution/Features/Uom/UomController.cs b/Distribution/Features/Uom/UomController.cs
index d7351d5..da1ea22 100644
--- a/Distribution/Features/Uom/UomController.cs
+++ b/Distribution/Features/Uom/UomController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Uom;
 
@@ -8,12 +7,10 @@ namespace Distribution.Features.Uom;
 public class UomController(UomService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("uom.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
-    [Authorize("uom.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,7 +18,6 @@ public class UomController(UomService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("uom.manage")]
     public async Task<IActionResult> Create(CreateUomRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -29,7 +25,6 @@ public class UomController(UomService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
-    [Authorize("uom.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateUomRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -37,7 +32,6 @@ public class UomController(UomService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
-    [Authorize("uom.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
diff --git a/Distribution/Features/User/UserController.cs b/Distribution/Features/User/UserController.cs
index 03ffbd1..09db811 100644
--- a/Distribution/Features/User/UserController.cs
+++ b/Distribution/Features/User/UserController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.User;
 
@@ -8,12 +7,10 @@ namespace Distribution.Features.User;
 public class UserController(UserService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("user.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
-    [Authorize("user.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,7 +18,6 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("user.manage")]
     public async Task<IActionResult> Create(CreateUserRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -29,7 +25,6 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
-    [Authorize("user.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateUserRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -37,7 +32,6 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/role")]
-    [Authorize("user.manage")]
     public async Task<IActionResult> AssignRole(Guid id, AssignUserRoleRequest request, CancellationToken ct)
     {
         var result = await service.AssignRoleAsync(id, request, ct);
@@ -45,7 +39,6 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/scope")]
-    [Authorize("user.manage")]
     public async Task<IActionResult> AssignScope(Guid id, AssignUserScopeRequest request, CancellationToken ct)
     {
         var updated = await service.AssignScopeAsync(id, request, ct);
@@ -53,7 +46,6 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
-    [Authorize("user.manage")]
     public async Task<IActionResult> Deactivate(Guid id, CancellationToken ct)
     {
         var deactivated = await service.DeactivateAsync(id, ct);
diff --git a/Distribution/Features/Vehicle/VehicleController.cs b/Distribution/Features/Vehicle/VehicleController.cs
index 9ff2797..d19dd1a 100644
--- a/Distribution/Features/Vehicle/VehicleController.cs
+++ b/Distribution/Features/Vehicle/VehicleController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Vehicle;
 
@@ -8,12 +7,10 @@ namespace Distribution.Features.Vehicle;
 public class VehicleController(VehicleService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("vehicle.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
-    [Authorize("vehicle.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,7 +18,6 @@ public class VehicleController(VehicleService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("vehicle.manage")]
     public async Task<IActionResult> Create(CreateVehicleRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -29,7 +25,6 @@ public class VehicleController(VehicleService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
-    [Authorize("vehicle.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateVehicleRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -37,7 +32,6 @@ public class VehicleController(VehicleService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
-    [Authorize("vehicle.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
diff --git a/Distribution/Features/Warehouse/WarehouseController.cs b/Distribution/Features/Warehouse/WarehouseController.cs
index b9afc59..043dfbd 100644
--- a/Distribution/Features/Warehouse/WarehouseController.cs
+++ b/Distribution/Features/Warehouse/WarehouseController.cs
@@ -1,5 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Warehouse;
 
@@ -8,12 +7,10 @@ namespace Distribution.Features.Warehouse;
 public class WarehouseController(WarehouseService service) : ControllerBase
 {
     [HttpGet]
-    [Authorize("warehouse.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
-    [Authorize("warehouse.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,7 +18,6 @@ public class WarehouseController(WarehouseService service) : ControllerBase
     }
 
     [HttpPost]
-    [Authorize("warehouse.manage")]
     public async Task<IActionResult> Create(CreateWarehouseRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -29,7 +25,6 @@ public class WarehouseController(WarehouseService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
-    [Authorize("warehouse.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateWarehouseRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -37,7 +32,6 @@ public class WarehouseController(WarehouseService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
-    [Authorize("warehouse.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
diff --git a/Distribution/Infra/Authorization/PermissionAuthorizationHandler.cs b/Distribution/Infra/Authorization/PermissionAuthorizationHandler.cs
index edcc4b3..77b0e72 100644
--- a/Distribution/Infra/Authorization/PermissionAuthorizationHandler.cs
+++ b/Distribution/Infra/Authorization/PermissionAuthorizationHandler.cs
@@ -1,24 +1,23 @@
-using Microsoft.AspNetCore.Authorization;
+
+//namespace Distribution.Infra.Authorization;
 
-namespace Distribution.Infra.Authorization;
+//public class PermissionAuthorizationHandler : AuthorizationHandler<PermissionRequirement>
+//{
+//    private readonly IPermissionService _permissionService;
 
-public class PermissionAuthorizationHandler : AuthorizationHandler<PermissionRequirement>
-{
-    private readonly IPermissionService _permissionService;
+//    public PermissionAuthorizationHandler(IPermissionService permissionService)
+//    {
+//        _permissionService = permissionService;
+//    }
 
-    public PermissionAuthorizationHandler(IPermissionService permissionService)
-    {
-        _permissionService = permissionService;
-    }
+//    protected override async Task HandleRequirementAsync(
+//        AuthorizationHandlerContext context, PermissionRequirement requirement)
+//    {
+//        var roleIdClaim = context.User.FindFirst("role_id")?.Value;
+//        if (!Guid.TryParse(roleIdClaim, out var roleId))
+//            return;
 
-    protected override async Task HandleRequirementAsync(
-        AuthorizationHandlerContext context, PermissionRequirement requirement)
-    {
-        var roleIdClaim = context.User.FindFirst("role_id")?.Value;
-        if (!Guid.TryParse(roleIdClaim, out var roleId))
-            return;
-
-        if (await _permissionService.HasPermissionAsync(roleId, requirement.PermissionCode))
-            context.Succeed(requirement);
-    }
-}
+//        if (await _permissionService.HasPermissionAsync(roleId, requirement.PermissionCode))
+//            context.Succeed(requirement);
+//    }
+//}
diff --git a/Distribution/Infra/Authorization/PermissionPolicyProvider.cs b/Distribution/Infra/Authorization/PermissionPolicyProvider.cs
index 9ee8ef9..a27cb7d 100644
--- a/Distribution/Infra/Authorization/PermissionPolicyProvider.cs
+++ b/Distribution/Infra/Authorization/PermissionPolicyProvider.cs
@@ -1,32 +1,31 @@
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.Extensions.Options;
+//using Microsoft.Extensions.Options;
 
-namespace Distribution.Infra.Authorization;
+//namespace Distribution.Infra.Authorization;
 
-public class PermissionPolicyProvider : IAuthorizationPolicyProvider
-{
-    private readonly DefaultAuthorizationPolicyProvider _fallback;
+//public class PermissionPolicyProvider : IAuthorizationPolicyProvider
+//{
+//    private readonly DefaultAuthorizationPolicyProvider _fallback;
 
-    public PermissionPolicyProvider(IOptions<AuthorizationOptions> options)
-    {
-        _fallback = new DefaultAuthorizationPolicyProvider(options);
-    }
+//    public PermissionPolicyProvider(IOptions<AuthorizationOptions> options)
+//    {
+//        _fallback = new DefaultAuthorizationPolicyProvider(options);
+//    }
 
-    public Task<AuthorizationPolicy> GetDefaultPolicyAsync() => _fallback.GetDefaultPolicyAsync();
+//    public Task<AuthorizationPolicy> GetDefaultPolicyAsync() => _fallback.GetDefaultPolicyAsync();
 
-    public Task<AuthorizationPolicy?> GetFallbackPolicyAsync() => _fallback.GetFallbackPolicyAsync();
+//    public Task<AuthorizationPolicy?> GetFallbackPolicyAsync() => _fallback.GetFallbackPolicyAsync();
 
-    public Task<AuthorizationPolicy?> GetPolicyAsync(string policyName)
-    {
-        if (policyName.Contains('.'))
-        {
-            var policy = new AuthorizationPolicyBuilder()
-                .RequireAuthenticatedUser()
-                .AddRequirements(new PermissionRequirement(policyName))
-                .Build();
-            return Task.FromResult<AuthorizationPolicy?>(policy);
-        }
+//    public Task<AuthorizationPolicy?> GetPolicyAsync(string policyName)
+//    {
+//        if (policyName.Contains('.'))
+//        {
+//            var policy = new AuthorizationPolicyBuilder()
+//                .RequireAuthenticatedUser()
+//                .AddRequirements(new PermissionRequirement(policyName))
+//                .Build();
+//            return Task.FromResult<AuthorizationPolicy?>(policy);
+//        }
 
-        return _fallback.GetPolicyAsync(policyName);
-    }
-}
+//        return _fallback.GetPolicyAsync(policyName);
+//    }
+//}
diff --git a/Distribution/Infra/Authorization/PermissionRequirement.cs b/Distribution/Infra/Authorization/PermissionRequirement.cs
index a25e8f6..dacd23b 100644
--- a/Distribution/Infra/Authorization/PermissionRequirement.cs
+++ b/Distribution/Infra/Authorization/PermissionRequirement.cs
@@ -1,13 +1,12 @@
-using Microsoft.AspNetCore.Authorization;
+
+//namespace Distribution.Infra.Authorization;
 
-namespace Distribution.Infra.Authorization;
+//public class PermissionRequirement : IAuthorizationRequirement
+//{
+//    public string PermissionCode { get; }
 
-public class PermissionRequirement : IAuthorizationRequirement
-{
-    public string PermissionCode { get; }
-
-    public PermissionRequirement(string permissionCode)
-    {
-        PermissionCode = permissionCode;
-    }
-}
+//    public PermissionRequirement(string permissionCode)
+//    {
+//        PermissionCode = permissionCode;
+//    }
+//}
diff --git a/Distribution/Program.cs b/Distribution/Program.cs
index f3dde1e..7308d1a 100644
--- a/Distribution/Program.cs
+++ b/Distribution/Program.cs
@@ -1,8 +1,6 @@
 using System.Text.Json.Serialization;
 using Distribution.Data;
 using Distribution.Features.Auth;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Mvc.Authorization;
 using Distribution.Middleware;
 using Distribution.Features.Brand;
 using Distribution.Features.Category;
@@ -126,9 +124,6 @@ builder.Services.AddScoped<IPermissionRepository, PermissionRepository>();
 builder.Services.AddScoped<IScopeRepository, ScopeRepository>();
 builder.Services.AddScoped<IPermissionService, PermissionService>();
 builder.Services.AddScoped<IScopeAccessService, ScopeAccessService>();
-builder.Services.AddAuthorization();
-builder.Services.AddSingleton<IAuthorizationPolicyProvider, PermissionPolicyProvider>();
-builder.Services.AddScoped<IAuthorizationHandler, PermissionAuthorizationHandler>();
 // ── Auth Service connector ───────────────────────────────────────────────────
 builder.Services.Configure<AuthServiceOptions>(
     builder.Configuration.GetSection(AuthServiceOptions.SectionName));
@@ -150,12 +145,8 @@ builder.Services.AddCors(options =>
               .AllowAnyHeader()
               .AllowAnyMethod()));
 
-builder.Services.AddControllers(options =>
-{
-    var policy = new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build();
-    options.Filters.Add(new AuthorizeFilter(policy));
-})
-.AddJsonOptions(options => options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter()));
+builder.Services.AddControllers()
+    .AddJsonOptions(options => options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter()));
 builder.Services.AddEndpointsApiExplorer();
 builder.Services.AddOpenApi();
 builder.Services.AddSwaggerGen();
@@ -171,8 +162,6 @@ if (app.Environment.IsDevelopment())
 
 //app.UseHttpsRedirection();
 app.UseCors();
-app.UseAuthentication();
-app.UseAuthorization();
 app.UseMiddleware<AuthMiddleware>();
 app.MapControllers();