diff --git a/functions/api/events-team/events/_middleware.ts b/functions/api/events-team/events/_middleware.ts
new file mode 100644
index 0000000..79e2ab5
--- /dev/null
+++ b/functions/api/events-team/events/_middleware.ts
@@ -0,0 +1,15 @@
+export async function onRequest(context: RequestContext) {
+  if (
+    ![1 << 3, 1 << 4, 1 << 12].find(
+      (int) => context.data.current_user?.permissions & int,
+    )
+  )
+    return new Response('{"error":"Forbidden"}', {
+      headers: {
+        "content-type": "application/json",
+      },
+      status: 401,
+    });
+
+  return await context.next();
+}