diff --git a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/CMakeLists.txt b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/CMakeLists.txt
index 8f21d3c956f637dd42e50f3676699db3b5bd8139..186d29924f2c1706f57804848474f1a74bfeebb8 100644
--- a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/CMakeLists.txt
+++ b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/CMakeLists.txt
@@ -7,6 +7,7 @@ set(_py_files
     specification.py
     scheduling.py
     permissions.py
+    project_permissions.py
     )
 
 python_install(${_py_files}
diff --git a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/__init__.py b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/__init__.py
index 767fdee003df98d3837ee05217cf3e8de1ab9846..0f7980fabfd9022b1389bf2ac72a975f9d2fb1e8 100644
--- a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/__init__.py
+++ b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/__init__.py
@@ -1,3 +1,4 @@
 from .specification import *
 from .scheduling import *
-from .permissions import *
\ No newline at end of file
+from .permissions import *
+from .project_permissions import *
\ No newline at end of file
diff --git a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/lofar_viewset.py b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/lofar_viewset.py
index b30fe6463f3e2d652f1b53db5c818c999aa3bfee..6e8807ec170b99044936ac30b9ac7c4509564143 100644
--- a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/lofar_viewset.py
+++ b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/lofar_viewset.py
@@ -17,12 +17,16 @@ from django.http import JsonResponse
 from django.urls import reverse as revese_url
 from rest_framework.decorators import action
 from lofar.common import json_utils
+from lofar.sas.tmss.tmss.tmssapp.viewsets.permissions import TMSSPermissions, IsProjectMemberFilterBackend
 
 class LOFARViewSet(viewsets.ModelViewSet):
     """
     If you're using format suffixes, make sure to also include
     the `format=None` keyword argument for each action.
     """
+    permission_classes = (TMSSPermissions,)
+    filter_backends = (IsProjectMemberFilterBackend,)
+
 
     @swagger_auto_schema(responses={403: 'forbidden'})
     def list(self, request, **kwargs):
@@ -52,7 +56,10 @@ class LOFARNestedViewSet(mixins.CreateModelMixin,
                                 mixins.ListModelMixin,
                                 #mixins.RetrieveModelMixin,
                                 viewsets.GenericViewSet):
-    
+
+    permission_classes = (TMSSPermissions,)
+    filter_backends = (IsProjectMemberFilterBackend,)
+
     @swagger_auto_schema(responses={403: 'forbidden'})
     def list(self, request, **kwargs):
         return super(LOFARNestedViewSet, self).list(request, **kwargs)
@@ -70,6 +77,10 @@ class LOFARCopyViewSet(mixins.CreateModelMixin, viewsets.GenericViewSet):
     def list(self, request, **kwargs):
         return super(LOFARCopyViewSet, self).list(request, **kwargs)
     """
+
+    permission_classes = (TMSSPermissions,)
+    filter_backends = (IsProjectMemberFilterBackend,)
+
     @swagger_auto_schema(responses={400: 'invalid specification', 403: 'forbidden'})
     def create(self, request, **kwargs):
         return super(LOFARCopyViewSet, self).create(request, **kwargs)
diff --git a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/permissions.py b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/permissions.py
index 3e68aeba65f43de96852b093d3c05f289fb4329f..dd702ea2c2bcc2483f181181c3b9633f951556ef 100644
--- a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/permissions.py
+++ b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/permissions.py
@@ -4,8 +4,6 @@ This file contains permissions and filters that are used in the viewsets
 
 from rest_framework import permissions as drf_permissions, filters as drf_filters
 from .. import models
-from .. import serializers
-from .lofar_viewset import LOFARViewSet
 from lofar.sas.tmss.tmss.exceptions import *
 from django.core.exceptions import ObjectDoesNotExist
 import logging
@@ -13,18 +11,6 @@ logger = logging.getLogger(__name__)
 logging.basicConfig(format='%(asctime)s %(levelname)s %(message)s', level=logging.INFO)
 from django.urls import resolve
 import urllib.parse
-#
-# ViewSets
-#
-
-class ProjectRoleViewSet(LOFARViewSet):
-    queryset = models.ProjectRole.objects.all()
-    serializer_class = serializers.ProjectRoleSerializer
-
-
-class ProjectPermissionViewSet(LOFARViewSet):
-    queryset = models.ProjectPermission.objects.all()
-    serializer_class = serializers.ProjectPermissionSerializer
 
 
 #
diff --git a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/project_permissions.py b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/project_permissions.py
new file mode 100644
index 0000000000000000000000000000000000000000..cf7fc57258e0c4fcf45e419e2107998a9969b10a
--- /dev/null
+++ b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/project_permissions.py
@@ -0,0 +1,17 @@
+from .. import models
+from .. import serializers
+from .lofar_viewset import LOFARViewSet
+
+
+#
+# Project Permission ViewSets
+#
+
+class ProjectRoleViewSet(LOFARViewSet):
+    queryset = models.ProjectRole.objects.all()
+    serializer_class = serializers.ProjectRoleSerializer
+
+
+class ProjectPermissionViewSet(LOFARViewSet):
+    queryset = models.ProjectPermission.objects.all()
+    serializer_class = serializers.ProjectPermissionSerializer
diff --git a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/specification.py b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/specification.py
index 506b44b8b18dc9b3969305d0c3ac1c326da23f54..e77738e5735924f1f0a8301ce9b514209b0ef734 100644
--- a/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/specification.py
+++ b/SAS/TMSS/backend/src/tmss/tmssapp/viewsets/specification.py
@@ -20,7 +20,6 @@ from drf_yasg.utils import swagger_auto_schema
 from drf_yasg.openapi import Parameter
 
 from lofar.sas.tmss.tmss.tmssapp.viewsets.lofar_viewset import LOFARViewSet, LOFARNestedViewSet, AbstractTemplateViewSet, LOFARCopyViewSet
-from lofar.sas.tmss.tmss.tmssapp.viewsets.permissions import IsProjectMemberFilterBackend, IsProjectMember, IsProjectMemberOrReadOnly, TMSSDjangoModelPermissions, TMSSPermissions
 from lofar.sas.tmss.tmss.tmssapp import models
 from lofar.sas.tmss.tmss.tmssapp import serializers
 from django.http import JsonResponse
@@ -231,7 +230,6 @@ class TaskConnectorTypeViewSet(LOFARViewSet):
     serializer_class = serializers.TaskConnectorTypeSerializer
 
 
-@permission_classes((TMSSDjangoModelPermissions,))
 class CycleViewSet(LOFARViewSet):
     queryset = models.Cycle.objects.all()
     serializer_class = serializers.CycleSerializer
@@ -253,7 +251,6 @@ class CycleQuotaViewSet(LOFARViewSet):
         return queryset
 
 
-@permission_classes((TMSSDjangoModelPermissions,))
 class ProjectViewSet(LOFARViewSet):
     queryset = models.Project.objects.all()
     serializer_class = serializers.ProjectSerializer
@@ -270,7 +267,6 @@ class ProjectViewSet(LOFARViewSet):
         return queryset
 
 
-@permission_classes((TMSSDjangoModelPermissions,))
 class ProjectNestedViewSet(LOFARNestedViewSet):
     queryset = models.Project.objects.all()
     serializer_class = serializers.ProjectSerializer
@@ -739,8 +735,8 @@ class SchedulingUnitBlueprintNestedViewSet(LOFARNestedViewSet):
 class TaskDraftViewSet(LOFARViewSet):
     queryset = models.TaskDraft.objects.all()
     serializer_class = serializers.TaskDraftSerializer
-    permission_classes = (TMSSPermissions,) # todo: move to LOFARViewSet eventually?  # Note: this should work the same, but something funny is going on: [IsProjectMember | TMSSDjangoModelPermissions]
-    filter_backends = (IsProjectMemberFilterBackend,) # todo: move to LOFARViewSet eventually?
+    #permission_classes = (TMSSPermissions,) # todo: move to LOFARViewSet eventually?  # Note: this should work the same, but something funny is going on: [IsProjectMember | TMSSDjangoModelPermissions]
+    #filter_backends = (IsProjectMemberFilterBackend,) # todo: move to LOFARViewSet eventually?
 
     # prefetch all reverse related references from other models on their related_name to avoid a ton of duplicate queries
     queryset = queryset.prefetch_related('first_scheduling_relation') \