diff --git a/appview/issues/issues.go b/appview/issues/issues.go
--- a/appview/issues/issues.go
+++ b/appview/issues/issues.go
@@ -24,16 +24,19 @@ "tangled.org/core/appview/notify"
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/pages/markup"
+	"tangled.org/core/appview/pages/repoinfo"
 	"tangled.org/core/appview/pagination"
 	"tangled.org/core/appview/reporesolver"
 	"tangled.org/core/appview/validator"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
 )
 
 type Issues struct {
 	oauth        *oauth.OAuth
 	repoResolver *reporesolver.RepoResolver
+	enforcer     *rbac.Enforcer
 	pages        *pages.Pages
 	idResolver   *idresolver.Resolver
 	db           *db.DB
@@ -47,6 +50,7 @@
 func New(
 	oauth *oauth.OAuth,
 	repoResolver *reporesolver.RepoResolver,
+	enforcer *rbac.Enforcer,
 	pages *pages.Pages,
 	idResolver *idresolver.Resolver,
 	db *db.DB,
@@ -59,6 +63,7 @@ ) *Issues {
 	return &Issues{
 		oauth:        oauth,
 		repoResolver: repoResolver,
+		enforcer:     enforcer,
 		pages:        pages,
 		idResolver:   idResolver,
 		db:           db,
@@ -285,7 +290,7 @@ rp.pages.Error404(w)
 		return
 	}
 
-	roles := f.RolesInRepo(user)
+	roles := repoinfo.RolesInRepo{Roles: rp.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.DidSlashRepo())}
 	isRepoOwner := roles.IsOwner()
 	isCollaborator := roles.IsCollaborator()
 	isIssueOwner := user.Did == issue.Did
@@ -333,7 +338,7 @@ rp.pages.Error404(w)
 		return
 	}
 
-	roles := f.RolesInRepo(user)
+	roles := repoinfo.RolesInRepo{Roles: rp.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.DidSlashRepo())}
 	isRepoOwner := roles.IsOwner()
 	isCollaborator := roles.IsCollaborator()
 	isIssueOwner := user.Did == issue.Did
diff --git a/appview/pulls/pulls.go b/appview/pulls/pulls.go
--- a/appview/pulls/pulls.go
+++ b/appview/pulls/pulls.go
@@ -23,6 +23,7 @@ "tangled.org/core/appview/notify"
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/pages/markup"
+	"tangled.org/core/appview/pages/repoinfo"
 	"tangled.org/core/appview/reporesolver"
 	"tangled.org/core/appview/validator"
 	"tangled.org/core/appview/xrpcclient"
@@ -877,7 +878,7 @@ return
 		}
 
 		// Determine PR type based on input parameters
-		roles := f.RolesInRepo(user)
+		roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.DidSlashRepo())}
 		isPushAllowed := roles.IsPushAllowed()
 		isBranchBased := isPushAllowed && sourceBranch != "" && fromFork == ""
 		isForkBased := fromFork != "" && sourceBranch != ""
@@ -1674,7 +1675,7 @@ w.WriteHeader(http.StatusUnauthorized)
 		return
 	}
 
-	roles := f.RolesInRepo(user)
+	roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.DidSlashRepo())}
 	if !roles.IsPushAllowed() {
 		log.Println("unauthorized user")
 		w.WriteHeader(http.StatusUnauthorized)
@@ -2261,7 +2262,7 @@ return
 	}
 
 	// auth filter: only owner or collaborators can close
-	roles := f.RolesInRepo(user)
+	roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.DidSlashRepo())}
 	isOwner := roles.IsOwner()
 	isCollaborator := roles.IsCollaborator()
 	isPullAuthor := user.Did == pull.OwnerDid
@@ -2335,7 +2336,7 @@ return
 	}
 
 	// auth filter: only owner or collaborators can close
-	roles := f.RolesInRepo(user)
+	roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.DidSlashRepo())}
 	isOwner := roles.IsOwner()
 	isCollaborator := roles.IsCollaborator()
 	isPullAuthor := user.Did == pull.OwnerDid
diff --git a/appview/reporesolver/resolver.go b/appview/reporesolver/resolver.go
--- a/appview/reporesolver/resolver.go
+++ b/appview/reporesolver/resolver.go
@@ -79,8 +79,10 @@ // package. we should refactor this or get rid of RepoInfo entirely.
 func (f *ResolvedRepo) RepoInfo(user *oauth.User) repoinfo.RepoInfo {
 	repoAt := f.RepoAt()
 	isStarred := false
+	roles := repoinfo.RolesInRepo{}
 	if user != nil {
 		isStarred = db.GetStarStatus(f.rr.execer, user.Did, repoAt)
+		roles.Roles = f.rr.enforcer.GetPermissionsInRepo(user.Did, f.Knot, f.DidSlashRepo())
 	}
 
 	stats := f.RepoStats
@@ -130,19 +132,10 @@ Ref:        f.Ref,
 
 		// info related to the session
 		IsStarred: isStarred,
-		Roles:     f.RolesInRepo(user),
+		Roles:     roles,
 	}
 
 	return repoInfo
-}
-
-func (f *ResolvedRepo) RolesInRepo(u *oauth.User) repoinfo.RolesInRepo {
-	if u != nil {
-		r := f.rr.enforcer.GetPermissionsInRepo(u.Did, f.Knot, f.DidSlashRepo())
-		return repoinfo.RolesInRepo{Roles: r}
-	} else {
-		return repoinfo.RolesInRepo{}
-	}
 }
 
 // extractPathAfterRef gets the actual repository path
diff --git a/appview/state/router.go b/appview/state/router.go
--- a/appview/state/router.go
+++ b/appview/state/router.go
@@ -263,6 +263,7 @@ func (s *State) IssuesRouter(mw *middleware.Middleware) http.Handler {
 	issues := issues.New(
 		s.oauth,
 		s.repoResolver,
+		s.enforcer,
 		s.pages,
 		s.idResolver,
 		s.db,