diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/CodesApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/CodesApiResource.java
index 71ea8ad1a..b934565fa 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/api/CodesApiResource.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/CodesApiResource.java
@@ -23,6 +23,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService
 import org.mifosng.platform.infrastructure.api.ApiParameterHelper;
 import org.mifosng.platform.organisation.service.CodeWritePlatformService;
 import org.mifosng.platform.organisation.service.CodeReadPlatformService;
+import org.mifosng.platform.security.PlatformSecurityContext;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -43,12 +44,22 @@ public class CodesApiResource {
 	
 	@Autowired
 	private PortfolioApiJsonSerializerService apiJsonSerializerService;
+
+	private final String entityType = "CODE";
+	private final PlatformSecurityContext context;
+
+	@Autowired
+	public CodesApiResource(final PlatformSecurityContext context) {
+		this.context = context;
+	}
 	
 	@GET
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveCodes(@Context final UriInfo uriInfo) {
 
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
 		boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters());
 		
diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/ConfigurationApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/ConfigurationApiResource.java
index c81bd51b6..dc6a19202 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/api/ConfigurationApiResource.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/ConfigurationApiResource.java
@@ -21,6 +21,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService
 import org.mifosng.platform.configuration.service.ConfigurationReadPlatformService;
 import org.mifosng.platform.configuration.service.ConfigurationWritePlatformService;
 import org.mifosng.platform.infrastructure.api.ApiParameterHelper;
+import org.mifosng.platform.security.PlatformSecurityContext;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -41,12 +42,20 @@ public class ConfigurationApiResource {
 	
 	@Autowired
 	private PortfolioApiJsonSerializerService apiJsonSerializerService;
-	
+
+	private final PlatformSecurityContext context;
+
+	@Autowired
+	public ConfigurationApiResource(final PlatformSecurityContext context) {
+		this.context = context;
+	}
 	@GET
 	@Path("currency")
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveCurrencyDataForConfiguration(@Context final UriInfo uriInfo) {
+
+		context.authenticatedUser().validateHasReadPermission("CURRENCY");
 		
 		Set<String> typicalResponseParameters = new HashSet<String>(
 				Arrays.asList("selectedCurrencyOptions", "currencyOptions"));
diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/configuration/service/ConfigurationWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/configuration/service/ConfigurationWritePlatformService.java
index 988a671e7..fce25ad8a 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/configuration/service/ConfigurationWritePlatformService.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/configuration/service/ConfigurationWritePlatformService.java
@@ -1,9 +1,11 @@
 package org.mifosng.platform.configuration.service;
 
 import org.mifosng.platform.api.commands.OrganisationCurrencyCommand;
+import org.springframework.security.access.prepost.PreAuthorize;
 
 public interface ConfigurationWritePlatformService {
 
+	@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_CURRENCY')")
 	void updateOrganisationCurrencies(OrganisationCurrencyCommand command);
 	
 }
\ No newline at end of file
diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/CodeWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/CodeWritePlatformService.java
index e56f3071e..d36f52217 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/CodeWritePlatformService.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/CodeWritePlatformService.java
@@ -5,9 +5,9 @@ import org.springframework.security.access.prepost.PreAuthorize;
 
 public interface CodeWritePlatformService {
 
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_CODE')")
 	Long createCode(final CodeCommand command);
 	
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_CODE)")
 	Long updateCode(final CodeCommand command);
 }
\ No newline at end of file
diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java
index 440d6ef07..e219f3829 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java
@@ -327,8 +327,9 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
 				+ entityType.toLowerCase() + "s";
 		String matchPermission = "READ_" + entityType.toUpperCase();
 
-		if (hasNotPermissionForAnyOf("ALL_FUNCTIONS_READ", matchPermission))
-			throw new NoAuthorizationException(authorizationMessage);
+		if (!(hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ",
+				matchPermission)))
+			return;
 
 		String higherPermission = "";
 		if (entityType.equalsIgnoreCase("CHARGE")) {
@@ -341,6 +342,10 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
 			higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER";
 		} else if (entityType.equalsIgnoreCase("CLIENTIMAGE")) {
 			higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("CODE")) {
+			higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("CURRENCY")) {
+			higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
 		}
 
 		if (!(higherPermission.equals(""))) {