diff --git a/app/app.py b/app/app.py
index dd09336..1e157d6 100644
--- a/app/app.py
+++ b/app/app.py
@@ -186,6 +186,37 @@ def call_ollama_with_fallback(payload):
             continue
     raise Exception("All models failed")
 
+def corp_admin_required(f):
+    @wraps(f)
+    def wrapper(*args, **kwargs):
+        db = SessionLocal()
+
+        email = session["user"]["email"] if app.config["AUTH_MODE"] == "oauth" else session["db_user"]["email"]
+        u = db.query(User).filter_by(email=email).first()
+        db.close()
+
+        if not u or u.priority not in ["system_admin", "corp_admin"]:
+            return jsonify({"erro": "Acesso restrito ao administrador corporativo."}), 403
+
+        return f(*args, **kwargs)
+    return wrapper
+
+
+def system_admin_required(f):
+    @wraps(f)
+    def wrapper(*args, **kwargs):
+        db = SessionLocal()
+
+        email = session["user"]["email"] if app.config["AUTH_MODE"] == "oauth" else session["db_user"]["email"]
+        u = db.query(User).filter_by(email=email).first()
+        db.close()
+
+        if not u or u.priority != "system_admin":
+            return jsonify({"erro": "Acesso restrito ao administrador do sistema."}), 403
+
+        return f(*args, **kwargs)
+    return wrapper
+
 
 def admin_required(f):
     @wraps(f)