diff --git a/appview/db/repos.go b/appview/db/repos.go
index 9b9329c..4226bee 100644
--- a/appview/db/repos.go
+++ b/appview/db/repos.go
@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.sh/tangled.sh/core/api/tangled"
 )
 
@@ -29,6 +30,11 @@ func (r Repo) RepoAt() syntax.ATURI {
 	return syntax.ATURI(fmt.Sprintf("at://%s/%s/%s", r.Did, tangled.RepoNSID, r.Rkey))
 }
 
+func (r Repo) DidSlashRepo() string {
+	p, _ := securejoin.SecureJoin(r.Did, r.Name)
+	return p
+}
+
 func GetAllRepos(e Execer, limit int) ([]Repo, error) {
 	var repos []Repo
 
diff --git a/appview/ingester.go b/appview/ingester.go
index ad124a4..6537d2d 100644
--- a/appview/ingester.go
+++ b/appview/ingester.go
@@ -13,11 +13,12 @@ import (
 	"github.com/ipfs/go-cid"
 	"tangled.sh/tangled.sh/core/api/tangled"
 	"tangled.sh/tangled.sh/core/appview/db"
+	"tangled.sh/tangled.sh/core/rbac"
 )
 
 type Ingester func(ctx context.Context, e *models.Event) error
 
-func Ingest(d db.DbWrapper) Ingester {
+func Ingest(d db.DbWrapper, enforcer *rbac.Enforcer) Ingester {
 	return func(ctx context.Context, e *models.Event) error {
 		var err error
 		defer func() {
@@ -40,7 +41,7 @@ func Ingest(d db.DbWrapper) Ingester {
 		case tangled.PublicKeyNSID:
 			ingestPublicKey(&d, e)
 		case tangled.RepoArtifactNSID:
-			ingestArtifact(&d, e)
+			ingestArtifact(&d, e, enforcer)
 		case tangled.ActorProfileNSID:
 			ingestProfile(&d, e)
 		}
@@ -139,7 +140,7 @@ func ingestPublicKey(d *db.DbWrapper, e *models.Event) error {
 	return nil
 }
 
-func ingestArtifact(d *db.DbWrapper, e *models.Event) error {
+func ingestArtifact(d *db.DbWrapper, e *models.Event, enforcer *rbac.Enforcer) error {
 	did := e.Did
 	var err error
 
@@ -158,6 +159,16 @@ func ingestArtifact(d *db.DbWrapper, e *models.Event) error {
 			return err
 		}
 
+		repo, err := db.GetRepoByAtUri(d, repoAt.String())
+		if err != nil {
+			return err
+		}
+
+		ok, err := enforcer.E.Enforce(did, repo.Knot, repo.DidSlashRepo(), "repo:push")
+		if err != nil || !ok {
+			return err
+		}
+
 		createdAt, err := time.Parse(time.RFC3339, record.CreatedAt)
 		if err != nil {
 			createdAt = time.Now()
diff --git a/appview/state/state.go b/appview/state/state.go
index 61c5d0f..89b98dc 100644
--- a/appview/state/state.go
+++ b/appview/state/state.go
@@ -76,7 +76,7 @@ func Make(config *appview.Config) (*State, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to create jetstream client: %w", err)
 	}
-	err = jc.StartJetstream(context.Background(), appview.Ingest(wrapper))
+	err = jc.StartJetstream(context.Background(), appview.Ingest(wrapper, enforcer))
 	if err != nil {
 		return nil, fmt.Errorf("failed to start jetstream watcher: %w", err)
 	}