update

core/apps/accounts/views/permission.py

@@ -1,6 +1,6 @@
 from django_core.mixins import BaseViewSetMixin
 from drf_spectacular.utils import extend_schema
-from rest_framework.permissions import AllowAny, IsAdminUser
+from rest_framework.permissions import IsAdminUser
 from rest_framework.viewsets import ModelViewSet
 
 from core.apps.accounts.models.permission import PermissionToAction, PermissionToTab, Permission, Role
@@ -19,7 +19,7 @@ class PermissionToActionViewSet(BaseViewSetMixin, ModelViewSet):
     }
 
     action_permission_classes = {
-        'create': [AllowAny],
+        'create': [IsAdminUser],
         'destroy': [IsAdminUser],
     }