diff --git a/src/Volo.Abp.Permissions.Application.Contracts/Volo.Abp.Permissions.Application.Contracts.csproj b/src/Volo.Abp.Permissions.Application.Contracts/Volo.Abp.Permissions.Application.Contracts.csproj
index e77e4c6bcd..4ecbbf92c1 100644
--- a/src/Volo.Abp.Permissions.Application.Contracts/Volo.Abp.Permissions.Application.Contracts.csproj
+++ b/src/Volo.Abp.Permissions.Application.Contracts/Volo.Abp.Permissions.Application.Contracts.csproj
@@ -14,6 +14,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <ProjectReference Include="..\Volo.Abp.Authorization\Volo.Abp.Authorization.csproj" />
     <ProjectReference Include="..\Volo.Abp.Ddd\Volo.Abp.Ddd.csproj" />
     <ProjectReference Include="..\Volo.Abp.Permissions.Domain.Shared\Volo.Abp.Permissions.Domain.Shared.csproj" />
   </ItemGroup>
diff --git a/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/AbpPermissionsDomainSharedModule.cs b/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/AbpPermissionsApplicationContractsModule.cs
similarity index 55%
rename from src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/AbpPermissionsDomainSharedModule.cs
rename to src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/AbpPermissionsApplicationContractsModule.cs
index 18cdb53190..4c49d556b2 100644
--- a/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/AbpPermissionsDomainSharedModule.cs
+++ b/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/AbpPermissionsApplicationContractsModule.cs
@@ -1,4 +1,5 @@
 using Microsoft.Extensions.DependencyInjection;
+using Volo.Abp.Authorization.Permissions;
 using Volo.Abp.Modularity;
 
 namespace Volo.Abp.Permissions
@@ -9,7 +10,12 @@ namespace Volo.Abp.Permissions
     {
         public override void ConfigureServices(IServiceCollection services)
         {
-            services.AddAssemblyOf<AbpPermissionsDomainSharedModule>();
+            services.Configure<PermissionOptions>(options =>
+            {
+                options.DefinitionProviders.Add<PermissionsPermissionDefinitionProvider>();
+            });
+
+            services.AddAssemblyOf<AbpPermissionsApplicationContractsModule>();
         }
     }
 }
diff --git a/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/IdentityPermissions.cs b/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/IdentityPermissions.cs
new file mode 100644
index 0000000000..cea8d7504f
--- /dev/null
+++ b/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/IdentityPermissions.cs
@@ -0,0 +1,13 @@
+namespace Volo.Abp.Permissions
+{
+    public static class PermissionPermissions
+    {
+        public const string GroupName = "AbpPermissions";
+
+        public static class Permissions
+        {
+            public const string Default = GroupName + ".Permissions";
+            public const string Update = Default + ".Update";
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/PermissionsPermissionDefinitionProvider.cs b/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/PermissionsPermissionDefinitionProvider.cs
new file mode 100644
index 0000000000..6391ae2087
--- /dev/null
+++ b/src/Volo.Abp.Permissions.Application.Contracts/Volo/Abp/Permissions/PermissionsPermissionDefinitionProvider.cs
@@ -0,0 +1,15 @@
+using Volo.Abp.Authorization.Permissions;
+
+namespace Volo.Abp.Permissions
+{
+    public class PermissionsPermissionDefinitionProvider : PermissionDefinitionProvider
+    {
+        public override void Define(IPermissionDefinitionContext context)
+        {
+            var group = context.AddGroup(PermissionPermissions.GroupName);
+
+            var permissions = group.AddPermission(PermissionPermissions.Permissions.Default);
+            permissions.AddChild(PermissionPermissions.Permissions.Update);
+        }
+    }
+}
diff --git a/src/Volo.Abp.Permissions.Application/Volo/Abp/Permissions/PermissionAppService.cs b/src/Volo.Abp.Permissions.Application/Volo/Abp/Permissions/PermissionAppService.cs
index dfadd3a946..5bce2fb17a 100644
--- a/src/Volo.Abp.Permissions.Application/Volo/Abp/Permissions/PermissionAppService.cs
+++ b/src/Volo.Abp.Permissions.Application/Volo/Abp/Permissions/PermissionAppService.cs
@@ -1,10 +1,12 @@
 using System.Collections.Generic;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authorization;
 using Volo.Abp.Application.Services;
 using Volo.Abp.Authorization.Permissions;
 
 namespace Volo.Abp.Permissions
 {
+    [Authorize(PermissionPermissions.Permissions.Default)]
     public class PermissionAppService : ApplicationService, IPermissionAppService
     {
         private readonly IPermissionManager _permissionManager;
@@ -66,6 +68,7 @@ namespace Volo.Abp.Permissions
             return result;
         }
 
+        [Authorize(PermissionPermissions.Permissions.Update)]
         public async Task UpdateAsync(string providerName, string providerKey, UpdatePermissionsDto input)
         {
             foreach (var permission in input.Permissions)