diff --git a/Service/Security/SecurityContextInitializer.cs b/Service/Security/SecurityContextInitializer.cs
index eaac00332..fe38271fc 100644
--- a/Service/Security/SecurityContextInitializer.cs
+++ b/Service/Security/SecurityContextInitializer.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Linq;
 using System.Net;
+using System.Reflection;
 using System.Security;
 using System.ServiceModel;
 using System.ServiceModel.Channels;
@@ -11,7 +12,8 @@ using BeWo.Data;
 using BeWo.Data.Access;
 using BeWo.Data.Entities;
 using BeWo.Service.Core;
-
+using BeWo.Service.ServiceContracts;
+using BS.Shared.Attributes;
 using BS.Shared.Extensions;
 
 namespace BeWo.Service.Security
@@ -73,7 +75,7 @@ namespace BeWo.Service.Security
 
                     if (lUser != null && DAOFactory.UserDAO.CheckPassword(lUser, lPassword))
                     {
-                        if (!HasMethodAuthorization(lUser, lMethodName))
+                        if (!HasMethodAuthorization(lUser, lMethodName, lServiceInterface))
                         {
                             throw new SecurityException("Methode nicht autorisiert: " + lMethodName);
                         }
@@ -93,7 +95,7 @@ namespace BeWo.Service.Security
             }
         }
 
-        private bool HasMethodAuthorization(ApplicationUser lUser, string methodName)
+        private bool HasMethodAuthorization(ApplicationUser lUser, string methodName, string serviceInterface)
         {
             var alwaysAllowed = new string[]
             {
@@ -116,7 +118,26 @@ namespace BeWo.Service.Security
             }
 
             var rights = Utils.GetGrantedRights(lUser);
-            var dict = Method2Rights.GetAuthorizedMethodDictionary();
+
+			try
+			{
+				if (serviceInterface == "IGkvAccountingService" && methodName == "GetFilteredGkvAbrechnungen")
+				{
+					var t = typeof(IGkvAccountingService);
+					var methodInfo = t.GetMethod(methodName);
+					var attribute = methodInfo.GetCustomAttribute<RequirePermissionAttribute>();
+					if (attribute != null)
+					{
+						return attribute.HasPermission(rights);
+					}
+				}
+			}
+			catch (Exception e)
+			{
+
+			}
+
+			var dict = Method2Rights.GetAuthorizedMethodDictionary();
 
             if (dict.ContainsKey(methodName))
             {
diff --git a/Service/ServiceContracts/IGkvAccountingService.cs b/Service/ServiceContracts/IGkvAccountingService.cs
index b3e2b6285..c31877f33 100644
--- a/Service/ServiceContracts/IGkvAccountingService.cs
+++ b/Service/ServiceContracts/IGkvAccountingService.cs
@@ -1,8 +1,10 @@
 using BS.Shared;
+using BS.Shared.Attributes;
 using BS.Shared.DataContracts.GkvAbrechnung;
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Runtime.CompilerServices;
 using System.ServiceModel;
 using System.Text;
 using System.Threading.Tasks;
@@ -15,38 +17,47 @@ namespace BeWo.Service.ServiceContracts
 		
 		[FaultContract(typeof(BeWoFault))]
 		[OperationContract]
+		[RequirePermission(UserRightType.Finance_Gkv_View)]
 		GkvAbrechnungDC GetGkvAbrechnung(long oid);
 
 		[FaultContract(typeof(BeWoFault))]
 		[OperationContract]
+		[RequirePermission(UserRightType.Finance_Gkv_View)]
 		List<GkvAbrechnungDC> GetAllGkvAbrechnungen();
 
 		[FaultContract(typeof(BeWoFault))]
 		[OperationContract]
+		[RequirePermission(UserRightType.Finance_Gkv_View)]
 		List<GkvAbrechnungDC> GetFilteredGkvAbrechnungen(GkvAbrechnungViewFilterDC gkvAbrechnungViewFilter);
 
 		[FaultContract(typeof(BeWoFault))]
 		[OperationContract]
+		[RequirePermission(UserRightType.Finance_Gkv_View)]
 		string GetProtokollRawDataString(long oid, GkvRawDataType gkvRawData);
 
 		[FaultContract(typeof(BeWoFault))]
 		[OperationContract]
+		[RequirePermission(UserRightType.Finance_Gkv_Create)]
 		GkvAbrechnungCreateResponseDC CreateNewGkvAbrechnung(GkvAbrechnungCreateRequestDC request);
 
 		[FaultContract(typeof(BeWoFault))]
 		[OperationContract]
+		[RequirePermission(UserRightType.Finance_Gkv_Create)]
 		GkvAbrechnungDC UpdateGkvAbrechnung(GkvAbrechnungDC abrechnung);
 
 		[FaultContract(typeof(BeWoFault))]
 		[OperationContract]
+		[RequirePermission(UserRightType.Finance_Gkv_Delete)]
 		void DeleteGkvAbrechnung(GkvAbrechnungDC abrechnung);
 
 		[FaultContract(typeof(BeWoFault))]
 		[OperationContract]
+		[RequirePermission(UserRightType.Finance_Gkv_Send)]
 		GkvAbrechnungSendResponseDC SendNewGkvAbrechnung(GkvAbrechnungSendRequestDC req);
 
 		[FaultContract(typeof(BeWoFault))]
 		[OperationContract]
+		[RequirePermission(UserRightType.Finance_Gkv_View)]
 		GkvAbrechnungGetIKResponseDC SendGetIKRequest(GkvAbrechnungGetIKRequestDC req);
 	}
 }
diff --git a/Shared/Attributes/RequirePermissionAttribute.cs b/Shared/Attributes/RequirePermissionAttribute.cs
new file mode 100644
index 000000000..bf8407079
--- /dev/null
+++ b/Shared/Attributes/RequirePermissionAttribute.cs
@@ -0,0 +1,47 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace BS.Shared.Attributes
+{
+	[AttributeUsage(AttributeTargets.Method, Inherited = true)]
+	public class RequirePermissionAttribute : Attribute
+	{
+		public UserRightType[] Permissions { get; }
+
+		public RequirePermissionAttribute(params UserRightType[] permissions)
+		{
+			Permissions = permissions;
+		}
+
+		public bool HasPermission(IEnumerable<UserRightType> rights)
+		{
+			if (Permissions is null || Permissions.Length == 0)
+				return true;
+
+			foreach (var right in rights)
+			{
+				if (HasPermission(right))
+					return true;
+			}
+
+			return false;
+		}
+
+		public bool HasPermission(UserRightType right)
+		{
+			if (Permissions is null || Permissions.Length == 0)
+				return true;
+
+			for (var i = 0; i < Permissions.Length; i++)
+			{
+				var permission = Permissions[i];
+				if (right == permission) return true;
+			}
+
+			return false;
+		}
+	}
+}
diff --git a/Shared/Shared.csproj b/Shared/Shared.csproj
index d4f1b8aea..eea15e1fe 100644
--- a/Shared/Shared.csproj
+++ b/Shared/Shared.csproj
@@ -133,6 +133,7 @@
   </ItemGroup>
   <ItemGroup>
     <Compile Include="AppSender\GkvSender.cs" />
+    <Compile Include="Attributes\RequirePermissionAttribute.cs" />
     <Compile Include="BeWoEntityEnums.cs" />
     <Compile Include="Core\AppSettingReader.cs" />
     <Compile Include="Core\ComplexWohnheimbuchungsRelationHelper.cs" />
@@ -539,6 +540,7 @@
   <ItemGroup>
     <None Include="packages.config" />
   </ItemGroup>
+  <ItemGroup />
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.