diff --git a/src/main/java/org/example/vet1177/controller/VetController.java b/src/main/java/org/example/vet1177/controller/VetController.java
index 7d039c05..b73aa76c 100644
--- a/src/main/java/org/example/vet1177/controller/VetController.java
+++ b/src/main/java/org/example/vet1177/controller/VetController.java
@@ -4,9 +4,12 @@
 import jakarta.validation.Valid;
 import org.example.vet1177.dto.request.vet.VetRequest;
 import org.example.vet1177.dto.response.vet.VetResponse;
+import org.example.vet1177.entities.User;
+import org.example.vet1177.policy.AdminPolicy;
 import org.example.vet1177.services.VetService;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
@@ -17,13 +20,18 @@
 public class VetController {
 
     private final VetService vetService;
+    private final AdminPolicy adminPolicy;
 
-    public VetController(VetService vetService) {
+    public VetController(VetService vetService, AdminPolicy adminPolicy) {
         this.vetService = vetService;
+        this.adminPolicy = adminPolicy;
     }
 
     @PostMapping
-    public ResponseEntity<VetResponse> createVet(@Valid @RequestBody VetRequest request) {
+    public ResponseEntity<VetResponse> createVet(
+            @AuthenticationPrincipal User user,
+            @Valid @RequestBody VetRequest request) {
+        adminPolicy.requireAdmin(user);
         VetResponse response = vetService.createVet(request);
         return new ResponseEntity<>(response, HttpStatus.CREATED);
     }
diff --git a/src/main/java/org/example/vet1177/policy/AdminPolicy.java b/src/main/java/org/example/vet1177/policy/AdminPolicy.java
new file mode 100644
index 00000000..2054f10b
--- /dev/null
+++ b/src/main/java/org/example/vet1177/policy/AdminPolicy.java
@@ -0,0 +1,15 @@
+package org.example.vet1177.policy;
+
+import org.example.vet1177.entities.Role;
+import org.example.vet1177.entities.User;
+import org.example.vet1177.exception.ForbiddenException;
+import org.springframework.stereotype.Component;
+
+@Component
+public class AdminPolicy {
+    public void requireAdmin(User user){
+        if (user == null || user.getRole() != Role.ADMIN){
+            throw new ForbiddenException("Åtkomst nekad: Endast administratörer har behörighet");
+        }
+    }
+}