diff --git a/services/web/modules/track-changes/app/src/TrackChangesRouter.mjs b/services/web/modules/track-changes/app/src/TrackChangesRouter.mjs
index 37eea36e0a..f08c9d2d29 100644
--- a/services/web/modules/track-changes/app/src/TrackChangesRouter.mjs
+++ b/services/web/modules/track-changes/app/src/TrackChangesRouter.mjs
@@ -9,13 +9,13 @@ export default {
     webRouter.post(
       '/project/:project_id/track_changes',
       AuthorizationMiddleware.blockRestrictedUserFromProject,
-      AuthorizationMiddleware.ensureUserCanReadProject,
+      AuthorizationMiddleware.ensureUserCanWriteProjectContent,
       TrackChangesController.trackChanges
     )
     webRouter.post(
       '/project/:project_id/doc/:doc_id/changes/accept',
       AuthorizationMiddleware.blockRestrictedUserFromProject,
-      AuthorizationMiddleware.ensureUserCanReadProject,
+      AuthorizationMiddleware.ensureUserCanWriteProjectContent,
       TrackChangesController.acceptChanges
     )
     webRouter.get(
@@ -51,25 +51,25 @@ export default {
     webRouter.delete(
       '/project/:project_id/thread/:thread_id/messages/:message_id',
       AuthorizationMiddleware.blockRestrictedUserFromProject,
-      AuthorizationMiddleware.ensureUserCanReadProject,
+      AuthorizationMiddleware.ensureUserCanWriteOrReviewProjectContent,
       TrackChangesController.deleteMessage
     )
     webRouter.post(
       '/project/:project_id/doc/:doc_id/thread/:thread_id/resolve',
       AuthorizationMiddleware.blockRestrictedUserFromProject,
-      AuthorizationMiddleware.ensureUserCanReadProject,
+      AuthorizationMiddleware.ensureUserCanDeleteOrResolveThread,
       TrackChangesController.resolveThread
     )
     webRouter.post(
       '/project/:project_id/doc/:doc_id/thread/:thread_id/reopen',
       AuthorizationMiddleware.blockRestrictedUserFromProject,
-      AuthorizationMiddleware.ensureUserCanReadProject,
+      AuthorizationMiddleware.ensureUserCanDeleteOrResolveThread,
       TrackChangesController.reopenThread
     )
     webRouter.delete(
       '/project/:project_id/doc/:doc_id/thread/:thread_id',
       AuthorizationMiddleware.blockRestrictedUserFromProject,
-      AuthorizationMiddleware.ensureUserCanReadProject,
+      AuthorizationMiddleware.ensureUserCanDeleteOrResolveThread,
       TrackChangesController.deleteThread
     )
   }