diff --git a/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java b/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java
index 814fc3b..36ab17c 100644
--- a/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java
+++ b/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java
@@ -64,6 +64,8 @@
 
     public static final String OPERATION_REPOSITORY_UPLOAD = "archiva-upload-repository";
 
+    public static final String OPERATION_FILE_UPLOAD = "archiva-upload-file";
+
     public static final String OPERATION_REPOSITORY_DELETE = "archiva-delete-artifact";
 
     public static final String OPERATION_MERGE_REPOSITORY = "archiva-merge-repository";
diff --git a/archiva-modules/archiva-base/archiva-security-common/src/main/resources/META-INF/redback/redback.xml b/archiva-modules/archiva-base/archiva-security-common/src/main/resources/META-INF/redback/redback.xml
index e771f16..3960314 100644
--- a/archiva-modules/archiva-base/archiva-security-common/src/main/resources/META-INF/redback/redback.xml
+++ b/archiva-modules/archiva-base/archiva-security-common/src/main/resources/META-INF/redback/redback.xml
@@ -84,6 +84,11 @@
           <description>Upload Archiva Repository</description>
         </operation>
         <operation>
+          <id>archiva-upload-file</id>
+          <name>archiva-upload-file</name>
+          <description>Upload File to Archiva</description>
+        </operation>
+        <operation>
           <id>archiva-access-repository</id>
           <name>archiva-access-repository</name>
           <description>Access Archiva Repository</description>
@@ -258,6 +263,12 @@
               <resource>${resource}</resource>
             </permission>
             <permission>
+              <id>archiva-upload-file</id>
+              <name>Archiva Upload File to Archiva</name>
+              <operation>archiva-upload-file</operation>
+              <resource>global</resource>
+            </permission>
+            <permission>
               <id>archiva-view-audit-logs</id>
               <name>Archiva View Audit Logs</name>
               <operation>archiva-view-audit-logs</operation>
diff --git a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/BrowseService.java b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/BrowseService.java
index c957c14..b59747c 100644
--- a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/BrowseService.java
+++ b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/BrowseService.java
@@ -149,7 +149,7 @@
     @Path("metadata/{g}/{a}/{v}/{key}/{value}")
     @PUT
     @Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
-    @RedbackAuthorization(noPermission = false, noRestriction = false, permissions = "archiva-add-metadata")
+    @RedbackAuthorization( permissions = "archiva-add-metadata", resource = "{repositoryId}")
     ActionStatus addMetadata( @PathParam("g") String groupId, @PathParam("a") String artifactId,
                               @PathParam("v") String version, @PathParam("key") String key, @PathParam("value") String value,
                               @QueryParam("repositoryId") String repositoryId )
@@ -158,7 +158,7 @@
     @Path("metadata/{g}/{a}/{v}/{key}")
     @DELETE
     @Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
-    @RedbackAuthorization(noPermission = false, noRestriction = false, permissions = "archiva-add-metadata")
+    @RedbackAuthorization( permissions = "archiva-add-metadata", resource = "{repositoryId}")
     ActionStatus deleteMetadata( @PathParam("g") String groupId, @PathParam("a") String artifactId,
                                  @PathParam("v") String version, @PathParam("key") String key,
                                  @QueryParam("repositoryId") String repositoryId )
@@ -166,7 +166,7 @@
 
     @Path("importMetadata")
     @POST
-    @RedbackAuthorization(noPermission = false, noRestriction = false, permissions = "archiva-add-metadata")
+    @RedbackAuthorization( permissions = "archiva-add-metadata", resource = "{repository}")
     ActionStatus importMetadata( MetadataAddRequest metadataAddRequest, @QueryParam("repository") String repository )
         throws ArchivaRestServiceException;
 
diff --git a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java
index 0d38133..9c83812 100644
--- a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java
+++ b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java
@@ -48,7 +48,7 @@
     @Path ("mergeConflictedArtifacts/{sourceRepositoryId}/{targetRepositoryId}")
     @GET
     @Produces ({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
-    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY)
+    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY, resource = "{sourceRepositoryId}")
     List<Artifact> getMergeConflictedArtifacts( @PathParam ("sourceRepositoryId") String sourceRepositoryId,
                                                 @PathParam ("targetRepositoryId") String targetRepositoryId )
         throws ArchivaRestServiceException;
@@ -59,7 +59,7 @@
      */
     @Path ("mergeRepositories/{sourceRepositoryId}/{targetRepositoryId}/{skipConflicts}")
     @GET
-    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY)
+    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY, resource = "{sourceRepositoryId}")
     void mergeRepositories( @PathParam ("sourceRepositoryId") String sourceRepositoryId,
                             @PathParam ("targetRepositoryId") String targetRepositoryId,
                             @PathParam ("skipConflicts") boolean skipConflicts )
diff --git a/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/FileUploadService.java b/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/FileUploadService.java
index a846381..215bda1 100644
--- a/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/FileUploadService.java
+++ b/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/FileUploadService.java
@@ -48,14 +48,14 @@
     @POST
     @Consumes( MediaType.MULTIPART_FORM_DATA )
     @Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
-    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
     FileMetadata post( MultipartBody multipartBody )
         throws ArchivaRestServiceException;
 
     @Path( "{fileName}" )
     @DELETE
     @Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
-    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
     Boolean deleteFile( @PathParam( "fileName" ) String fileName )
         throws ArchivaRestServiceException;
 
@@ -63,7 +63,7 @@
     @Path( "sessionFileMetadatas" )
     @GET
     @Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
-    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
     List<FileMetadata> getSessionFileMetadatas()
         throws ArchivaRestServiceException;
 
@@ -80,7 +80,7 @@
     @Path( "clearUploadedFiles" )
     @GET
     @Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
-    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
     Boolean clearUploadedFiles()
         throws ArchivaRestServiceException;