diff --git a/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissionDefinitionProvider.cs b/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissionDefinitionProvider.cs
index 35d3e967a0..f86ee6e536 100644
--- a/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissionDefinitionProvider.cs
+++ b/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissionDefinitionProvider.cs
@@ -12,11 +12,13 @@ namespace Volo.Abp.Identity
             rolesPermission.AddChild(IdentityPermissions.Roles.Create);
             rolesPermission.AddChild(IdentityPermissions.Roles.Update);
             rolesPermission.AddChild(IdentityPermissions.Roles.Delete);
+            rolesPermission.AddChild(IdentityPermissions.Roles.ManagePermissions);
 
             var usersPermission = identityGroup.AddPermission(IdentityPermissions.Users.Default);
             usersPermission.AddChild(IdentityPermissions.Users.Create);
             usersPermission.AddChild(IdentityPermissions.Users.Update);
             usersPermission.AddChild(IdentityPermissions.Users.Delete);
+            rolesPermission.AddChild(IdentityPermissions.Users.ManagePermissions);
         }
     }
 }
diff --git a/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissions.cs b/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissions.cs
index ea6588073a..0ab82132ff 100644
--- a/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissions.cs
+++ b/src/Volo.Abp.Identity.Application.Contracts/Volo/Abp/Identity/IdentityPermissions.cs
@@ -10,6 +10,7 @@
             public const string Create = Default + ".Create";
             public const string Update = Default + ".Update";
             public const string Delete = Default + ".Delete";
+            public const string ManagePermissions = Default + ".ManagePermissions";
         }
 
         public static class Users
@@ -18,6 +19,7 @@
             public const string Create = Default + ".Create";
             public const string Update = Default + ".Update";
             public const string Delete = Default + ".Delete";
+            public const string ManagePermissions = Default + ".ManagePermissions";
         }
     }
 }
\ No newline at end of file
diff --git a/src/Volo.Abp.Identity.Application/Volo/Abp/Identity/IdentityRoleAppService.cs b/src/Volo.Abp.Identity.Application/Volo/Abp/Identity/IdentityRoleAppService.cs
index 5509ad1158..68e2280e14 100644
--- a/src/Volo.Abp.Identity.Application/Volo/Abp/Identity/IdentityRoleAppService.cs
+++ b/src/Volo.Abp.Identity.Application/Volo/Abp/Identity/IdentityRoleAppService.cs
@@ -51,12 +51,14 @@ namespace Volo.Abp.Identity
             return ObjectMapper.Map<List<IdentityRole>, List<IdentityRoleDto>>(list);
         }
 
+        [Authorize(IdentityPermissions.Users.ManagePermissions)]
         public async Task<GetPermissionListResultDto> GetPermissionsAsync(Guid id)
         {
             var role = await _roleRepository.GetAsync(id);
             return await _permissionAppServiceHelper.GetAsync(RolePermissionValueProvider.ProviderName, role.Name); //TODO: User normalized role name instad of name?
         }
 
+        [Authorize(IdentityPermissions.Users.ManagePermissions)]
         public async Task UpdatePermissionsAsync(Guid id, UpdatePermissionsDto input)
         {
             var role = await _roleRepository.GetAsync(id);
diff --git a/src/Volo.Abp.Identity.Application/Volo/Abp/Identity/IdentityUserAppService.cs b/src/Volo.Abp.Identity.Application/Volo/Abp/Identity/IdentityUserAppService.cs
index 76d7137657..9feb57504f 100644
--- a/src/Volo.Abp.Identity.Application/Volo/Abp/Identity/IdentityUserAppService.cs
+++ b/src/Volo.Abp.Identity.Application/Volo/Abp/Identity/IdentityUserAppService.cs
@@ -96,11 +96,13 @@ namespace Volo.Abp.Identity
             CheckIdentityErrors(await _userManager.SetRolesAsync(user, input.RoleNames));
         }
 
+        [Authorize(IdentityPermissions.Users.ManagePermissions)]
         public async Task<GetPermissionListResultDto> GetPermissionsAsync(Guid id)
         {
             return await _permissionAppServiceHelper.GetAsync(UserPermissionValueProvider.ProviderName, id.ToString());
         }
 
+        [Authorize(IdentityPermissions.Users.ManagePermissions)]
         public async Task UpdatePermissionsAsync(Guid id, UpdatePermissionsDto input)
         {
             await _permissionAppServiceHelper.UpdateAsync(UserPermissionValueProvider.ProviderName, id.ToString(), input);
diff --git a/src/Volo.Abp.Identity.Web/Permissions/IdentityPermissionAppServiceGateway.cs b/src/Volo.Abp.Identity.Web/Permissions/IdentityPermissionAppServiceGateway.cs
index 512f994a6b..8fd683d77b 100644
--- a/src/Volo.Abp.Identity.Web/Permissions/IdentityPermissionAppServiceGateway.cs
+++ b/src/Volo.Abp.Identity.Web/Permissions/IdentityPermissionAppServiceGateway.cs
@@ -20,7 +20,7 @@ namespace Volo.Abp.Identity.Web.Permissions
             _roleAppService = roleAppService;
         }
 
-        public async Task<GetPermissionListResultDto> GetAsync(string providerName, string providerKey)
+        public virtual async Task<GetPermissionListResultDto> GetAsync(string providerName, string providerKey)
         {
             switch (providerName)
             {
@@ -33,7 +33,7 @@ namespace Volo.Abp.Identity.Web.Permissions
             }
         }
 
-        public async Task UpdateAsync(string providerName, string providerKey, UpdatePermissionsDto input)
+        public virtual async Task UpdateAsync(string providerName, string providerKey, UpdatePermissionsDto input)
         {
             switch (providerName)
             {