diff --git a/backend/src/modules/permissions/permission.controller.ts b/backend/src/modules/permissions/permission.controller.ts
index 51201ed..c8effde 100644
--- a/backend/src/modules/permissions/permission.controller.ts
+++ b/backend/src/modules/permissions/permission.controller.ts
@@ -159,7 +159,5 @@ export class PermissionController{
                 message:"Error al eliminar permiso"
             });
         }
-    }
-
-    
+    } 
 }
\ No newline at end of file
diff --git a/backend/src/modules/permissions/permission.model.ts b/backend/src/modules/permissions/permission.model.ts
index 046de20..d5c94fa 100644
--- a/backend/src/modules/permissions/permission.model.ts
+++ b/backend/src/modules/permissions/permission.model.ts
@@ -13,11 +13,13 @@ const permissionSchema = new mongoose.Schema({
     module:{
         type:String,
         required:true,
+        trim:true
     },
 
     action:{
         type:String,
-        required:true
+        required:true,
+        trim:true
     },
 
     description:{
diff --git a/backend/src/modules/permissions/permission.routes.ts b/backend/src/modules/permissions/permission.routes.ts
index d46283a..672f6bd 100644
--- a/backend/src/modules/permissions/permission.routes.ts
+++ b/backend/src/modules/permissions/permission.routes.ts
@@ -1,23 +1,26 @@
 import { Router } from "express";
+
 import { PermissionController } from "./permission.controller";
+
 import { authMiddleware } from "../auth/auth.middleware";
+import { permissionMiddleware } from "../auth/permission.middleware";
 
 const permissionRouter = Router();
 
 const controller = new PermissionController();
 
-permissionRouter.get("/", authMiddleware, controller.getAll);
+permissionRouter.get("/", authMiddleware, permissionMiddleware("permissions", "read"), controller.getAll);
 
-permissionRouter.get("/module/:module", authMiddleware, controller.getByModule);
+permissionRouter.get("/module/:module", authMiddleware, permissionMiddleware("permissions", "read"), controller.getByModule);
 
-permissionRouter.get("/module/:module/action/:action", authMiddleware, controller.getByModule);
+permissionRouter.get("/module/:module/action/:action", authMiddleware, permissionMiddleware("permissions", "read"),  controller.getByModuleandAction);
 
-permissionRouter.get("/:id", authMiddleware, controller.getById);
+permissionRouter.get("/:id", authMiddleware, permissionMiddleware("permissions", "read"), controller.getById);
 
-permissionRouter.post("/", authMiddleware, controller.create);
+permissionRouter.post("/", authMiddleware, /*permissionMiddleware("permissions", "create"),*/ controller.create);
 
-permissionRouter.put("/:id", authMiddleware, controller.update);
+permissionRouter.put("/:id", authMiddleware, permissionMiddleware("permissions", "update"), controller.update);
 
-permissionRouter.delete("/:id", authMiddleware, controller.delete);
+permissionRouter.delete("/:id", authMiddleware, permissionMiddleware("permissions", "delete"), controller.delete);
 
 export default permissionRouter;
\ No newline at end of file
diff --git a/backend/src/modules/permissions/permission.service.ts b/backend/src/modules/permissions/permission.service.ts
index 9ecd99c..90e0742 100644
--- a/backend/src/modules/permissions/permission.service.ts
+++ b/backend/src/modules/permissions/permission.service.ts
@@ -27,10 +27,7 @@ export class PermissionService{
         .populate(
             "createdBy",
             "userName"
-        ).sort({
-            module:1,
-            action:1
-        });   
+        );   
     }
 
     async create(
@@ -55,6 +52,15 @@ export class PermissionService{
         id:string,
         data:Partial<IPermission>
     ){
+
+        const permission = await permissionModel.findById(id);
+
+        if(!permission){
+
+            return null;
+
+        }
+
         if(
             data.module &&
             data.action
@@ -89,7 +95,7 @@ export class PermissionService{
         
     ){
         return await permissionModel
-        .findOne({
+        .find({
             module,
             active:true
         })
@@ -122,6 +128,22 @@ export class PermissionService{
     async delete(
         id:string
     ){
+        const role = await permissionModel.findById(id);
+        
+        if (!role) {
+            return null;
+        }
+        
+        // Verificar si el rol está asignado a usuarios
+        const usersWithRole = await permissionModel.countDocuments({
+            roleId: id
+        });
+        
+        if (usersWithRole > 0) {
+            throw new Error(
+                "No se puede eliminar el permiso porque está asignado a uno o más roles."
+            );
+        }
         return await permissionModel.findByIdAndDelete(
             id
         );