diff --git a/src/c3nav/editor/migrations/0019_permissions.py b/src/c3nav/editor/migrations/0019_permissions.py
new file mode 100644
index 00000000..97729c7a
--- /dev/null
+++ b/src/c3nav/editor/migrations/0019_permissions.py
@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.7 on 2017-12-07 23:45
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('editor', '0018_changeset_last_cleaned_with'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='changeset',
+            options={'permissions': (('review_changeset', 'Can review change sets'), ('direct_edit', 'Can use direct edit')), 'verbose_name': 'Change Set', 'verbose_name_plural': 'Change Sets'},
+        ),
+    ]
diff --git a/src/c3nav/editor/models/changeset.py b/src/c3nav/editor/models/changeset.py
index 847d0d05..51f59faf 100644
--- a/src/c3nav/editor/models/changeset.py
+++ b/src/c3nav/editor/models/changeset.py
@@ -56,6 +56,11 @@ class ChangeSet(models.Model):
         verbose_name_plural = _('Change Sets')
         default_related_name = 'changesets'
 
+        permissions = (
+            ('review_changeset', _('Can review change sets')),
+            ('direct_edit', _('Can use direct edit')),
+        )
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.changed_objects = None
@@ -486,13 +491,12 @@ class ChangeSet(models.Model):
         return self.author_id == request.user.pk and self.state in ('proposed', 'reproposed')
 
     def can_review(self, request):
-        # todo implement permissions
-        return request.user.is_superuser
+        return request.user.has_perm('editor.review_changeset')
 
     @classmethod
     def can_direct_edit(cls, request):
-        # todo implement permissions
-        return request.user.is_superuser
+        print(request.user.has_perm('editor.direct_edit'))
+        return request.user.has_perm('editor.direct_edit')
 
     def can_start_review(self, request):
         return self.can_review(request) and self.state in ('proposed', 'reproposed')