diff --git a/src/main/java/com/facadecode/spring/security/config/ApiSecurityConfig.java b/src/main/java/com/facadecode/spring/security/config/ApiSecurityConfig.java
index 4300400..1b78df6 100644
--- a/src/main/java/com/facadecode/spring/security/config/ApiSecurityConfig.java
+++ b/src/main/java/com/facadecode/spring/security/config/ApiSecurityConfig.java
@@ -2,14 +2,15 @@ package com.facadecode.spring.security.config;
 
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.web.SecurityFilterChain;
 
-import static com.facadecode.spring.security.constant.SecurityConstants.*;
-import static com.facadecode.spring.security.enums.PermissionEnum.*;
-import static org.springframework.http.HttpMethod.*;
+import static com.facadecode.spring.security.constant.SecurityConstants.PUBLIC_API_LIST;
+import static org.springframework.http.HttpMethod.GET;
 
 @Configuration
+@EnableGlobalMethodSecurity(prePostEnabled = true)
 public class ApiSecurityConfig {
     @Bean
     public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
@@ -17,12 +18,6 @@ public class ApiSecurityConfig {
                 .csrf().disable()
                 .authorizeRequests(auth -> auth
                         .antMatchers(GET, PUBLIC_API_LIST).permitAll()
-                        .antMatchers(API_LIST_STUDENTS).hasAuthority(LIST_STUDENTS.name())
-                        .antMatchers(API_LIST_INSTRUCTORS).hasAuthority(LIST_INSTRUCTORS.name())
-                        .antMatchers(API_VIEW_PROFILE).hasAuthority(VIEW_PROFILE.name())
-                        .antMatchers(POST, API_CREATE_COURSES).hasAuthority(CREATE_COURSE.name())
-                        .antMatchers(PUT, API_UPDATE_COURSES).hasAuthority(UPDATE_COURSE.name())
-                        .antMatchers(API_PLAY_COURSE).hasAuthority(PLAY_COURSE.name())
                         .anyRequest().authenticated()
                 )
                 .httpBasic();
diff --git a/src/main/java/com/facadecode/spring/security/constant/SecurityConstants.java b/src/main/java/com/facadecode/spring/security/constant/SecurityConstants.java
index cae7dde..0042488 100644
--- a/src/main/java/com/facadecode/spring/security/constant/SecurityConstants.java
+++ b/src/main/java/com/facadecode/spring/security/constant/SecurityConstants.java
@@ -1,20 +1,21 @@
 package com.facadecode.spring.security.constant;
 
 public class SecurityConstants {
-    /* Course API URLs */
-    public static final String API_CREATE_COURSES = "/api/v1/courses";
-    public static final String API_UPDATE_COURSES = "/api/v1/courses/*";
     public static final String API_LIST_COURSES = "/api/v1/courses";
     public static final String API_GET_COURSE = "/api/v1/courses/*";
-    public static final String API_PLAY_COURSE = "/api/v1/courses/play/*";
-
-    /* User API URLs */
-    public static final String API_LIST_STUDENTS = "/api/v1/users/students";
-    public static final String API_LIST_INSTRUCTORS = "/api/v1/users/instructors";
-    public static final String API_VIEW_PROFILE = "/api/v1/users/*";
 
     public static final String[] PUBLIC_API_LIST = new String[] {
             API_LIST_COURSES,
             API_GET_COURSE
     };
+
+    public static class Authority {
+        public static final String LIST_STUDENTS = "hasAuthority(T(com.facadecode.spring.security.enums.PermissionEnum).LIST_STUDENTS.name())";
+        public static final String LIST_INSTRUCTORS = "hasAuthority(T(com.facadecode.spring.security.enums.PermissionEnum).LIST_INSTRUCTORS.name())";
+        public static final String VIEW_PROFILE = "hasAuthority(T(com.facadecode.spring.security.enums.PermissionEnum).VIEW_PROFILE.name())";
+        public static final String CREATE_COURSE = "hasAuthority(T(com.facadecode.spring.security.enums.PermissionEnum).CREATE_COURSE.name())";
+        public static final String UPDATE_COURSE = "hasAuthority(T(com.facadecode.spring.security.enums.PermissionEnum).UPDATE_COURSE.name())";
+        public static final String PLAY_COURSE = "hasAuthority(T(com.facadecode.spring.security.enums.PermissionEnum).PLAY_COURSE.name())";
+
+    }
 }
diff --git a/src/main/java/com/facadecode/spring/security/service/CourseService.java b/src/main/java/com/facadecode/spring/security/service/CourseService.java
index 9c6101a..1ae9d7f 100644
--- a/src/main/java/com/facadecode/spring/security/service/CourseService.java
+++ b/src/main/java/com/facadecode/spring/security/service/CourseService.java
@@ -6,10 +6,13 @@ import com.facadecode.spring.security.repo.CourseRepository;
 import com.facadecode.spring.security.security.AuthenticationFacade;
 import org.springframework.beans.BeanUtils;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Service;
 
 import java.util.List;
 
+import static com.facadecode.spring.security.constant.SecurityConstants.Authority;
+
 @Service
 public class CourseService {
     @Autowired
@@ -21,6 +24,7 @@ public class CourseService {
     @Autowired
     private AuthenticationFacade authenticationFacade;
 
+    @PreAuthorize(Authority.CREATE_COURSE)
     public Course create(Course newCourse) {
         String username = authenticationFacade.getAuthentication().getName();
         AppUser currentUser = userService.get(username);
@@ -28,6 +32,7 @@ public class CourseService {
         return courseRepo.save(newCourse);
     }
 
+    @PreAuthorize(Authority.UPDATE_COURSE)
     public Course update(Long courseId, Course course) {
         Course updatedCourse = null;
         Course existingCourse = courseRepo.findById(courseId).orElse(null);
@@ -47,6 +52,7 @@ public class CourseService {
                 .orElse(null);
     }
 
+    @PreAuthorize(Authority.PLAY_COURSE)
     public Course play(Long courseId) {
         return courseRepo.findById(courseId)
                 .orElse(null);
diff --git a/src/main/java/com/facadecode/spring/security/service/UserService.java b/src/main/java/com/facadecode/spring/security/service/UserService.java
index 369ee6d..ac2a4af 100644
--- a/src/main/java/com/facadecode/spring/security/service/UserService.java
+++ b/src/main/java/com/facadecode/spring/security/service/UserService.java
@@ -1,16 +1,18 @@
 package com.facadecode.spring.security.service;
 
-import com.facadecode.spring.security.domain.AppUser;
 import com.facadecode.spring.security.domain.AppRole;
+import com.facadecode.spring.security.domain.AppUser;
 import com.facadecode.spring.security.enums.RoleEnum;
 import com.facadecode.spring.security.repo.AppRoleRepository;
 import com.facadecode.spring.security.repo.AppUserRepository;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Service;
 
 import java.util.List;
 import java.util.stream.Collectors;
 
+import static com.facadecode.spring.security.constant.SecurityConstants.Authority;
 import static com.facadecode.spring.security.enums.RoleEnum.INSTRUCTOR;
 import static com.facadecode.spring.security.enums.RoleEnum.STUDENT;
 
@@ -22,10 +24,12 @@ public class UserService {
     @Autowired
     private AppRoleRepository appRoleRepository;
 
+    @PreAuthorize(Authority.LIST_STUDENTS)
     public List<AppUser> listStudents() {
         return this.listByRoleName(STUDENT);
     }
 
+    @PreAuthorize(Authority.LIST_INSTRUCTORS)
     public List<AppUser> listInstructors() {
         return this.listByRoleName(INSTRUCTOR);
     }
@@ -40,11 +44,13 @@ public class UserService {
                 .collect(Collectors.toList());
     }
 
+    @PreAuthorize(Authority.VIEW_PROFILE)
     public AppUser get(Long userId) {
         return appUserRepository.findById(userId)
                 .orElse(null);
     }
 
+    @PreAuthorize(Authority.VIEW_PROFILE)
     public AppUser get(String username) {
         return appUserRepository.findByUsername(username)
                 .orElse(null);
