diff --git a/src/main/java/com/facadecode/spring/security/config/ApiSecurityConfig.java b/src/main/java/com/facadecode/spring/security/config/ApiSecurityConfig.java
index 6296bf3..4300400 100644
--- a/src/main/java/com/facadecode/spring/security/config/ApiSecurityConfig.java
+++ b/src/main/java/com/facadecode/spring/security/config/ApiSecurityConfig.java
@@ -7,10 +7,7 @@ import org.springframework.security.web.SecurityFilterChain;
 
 import static com.facadecode.spring.security.constant.SecurityConstants.*;
 import static com.facadecode.spring.security.enums.PermissionEnum.*;
-import static com.facadecode.spring.security.enums.RoleEnum.ADMIN;
-import static com.facadecode.spring.security.enums.RoleEnum.INSTRUCTOR;
-import static org.springframework.http.HttpMethod.GET;
-import static org.springframework.http.HttpMethod.POST;
+import static org.springframework.http.HttpMethod.*;
 
 @Configuration
 public class ApiSecurityConfig {
@@ -20,13 +17,12 @@ public class ApiSecurityConfig {
                 .csrf().disable()
                 .authorizeRequests(auth -> auth
                         .antMatchers(GET, PUBLIC_API_LIST).permitAll()
-                        // Role based access restrictions
-                        .antMatchers(API_LIST_STUDENTS, API_LIST_INSTRUCTORS).hasRole(ADMIN.name())
-                        .antMatchers(POST, API_CREATE_COURSES).hasRole(INSTRUCTOR.name())
-                        // Permission based access restrictions
-                        .antMatchers(API_UPDATE_COURSES).hasAuthority(UPDATE_COURSE.name())
-                        .antMatchers(API_PLAY_COURSE).hasAuthority(PLAY_COURSE.name())
+                        .antMatchers(API_LIST_STUDENTS).hasAuthority(LIST_STUDENTS.name())
+                        .antMatchers(API_LIST_INSTRUCTORS).hasAuthority(LIST_INSTRUCTORS.name())
                         .antMatchers(API_VIEW_PROFILE).hasAuthority(VIEW_PROFILE.name())
+                        .antMatchers(POST, API_CREATE_COURSES).hasAuthority(CREATE_COURSE.name())
+                        .antMatchers(PUT, API_UPDATE_COURSES).hasAuthority(UPDATE_COURSE.name())
+                        .antMatchers(API_PLAY_COURSE).hasAuthority(PLAY_COURSE.name())
                         .anyRequest().authenticated()
                 )
                 .httpBasic();
diff --git a/src/main/java/com/facadecode/spring/security/service/DbUserDetailsService.java b/src/main/java/com/facadecode/spring/security/service/DbUserDetailsService.java
index 7f720d9..91d2c90 100644
--- a/src/main/java/com/facadecode/spring/security/service/DbUserDetailsService.java
+++ b/src/main/java/com/facadecode/spring/security/service/DbUserDetailsService.java
@@ -7,7 +7,6 @@ import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.stereotype.Service;
 
-import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
@@ -23,34 +22,18 @@ public class DbUserDetailsService {
                 .map(appUser -> User.builder()
                         .username(appUser.getUsername())
                         .password(appUser.getPassword())
-                        .authorities(this.getRolesAndPermissions(appUser.getRoles()))
+                        .authorities(this.getPermissions(appUser.getRoles()))
                         .build()
                 )
                 .collect(Collectors.toList());
     }
 
-    private Set<String> getRoles(Set<AppRole> roles) {
-        return roles.stream()
-                .map(role -> String.format("ROLE_%s", role.getName().name()))
-                .collect(Collectors.toSet());
-    }
-
-    private Set<String> getPermissions(Set<AppRole> roles) {
+    private String[] getPermissions(Set<AppRole> roles) {
         return roles.stream()
                 .flatMap(role -> role.getPermissions().stream())
                 .map(permission -> permission.getName().name())
-                .collect(Collectors.toSet());
-    }
-
-    private String[] getRolesAndPermissions(Set<AppRole> appRoles) {
-        Set<String> roles = this.getRoles(appRoles);
-        Set<String> permissions = this.getPermissions(appRoles);
-        return new HashSet<String>() {
-            {
-                addAll(roles);
-                addAll(permissions);
-            }
-        }.toArray(new String[0]);
+                .collect(Collectors.toSet())
+                .toArray(new String[0]);
     }
 
 }
