diff --git a/src/ApiResource/Project/ProjectApiResource.php b/src/ApiResource/Project/ProjectApiResource.php
index 4e5d485..b95498b 100644
--- a/src/ApiResource/Project/ProjectApiResource.php
+++ b/src/ApiResource/Project/ProjectApiResource.php
@@ -25,8 +25,8 @@ use Symfony\Component\Validator\Constraints as Assert;
 #[API\GetCollection()]
 #[API\Post(security: 'is_granted("ROLE_USER")')]
 #[API\Get()]
-#[API\Patch(security: 'is_granted("PROJECT_EDIT")')]
-#[API\Delete(security: 'is_granted("PROJECT_EDIT")')]
+#[API\Patch(security: 'is_granted("PROJECT_EDIT", object)')]
+#[API\Delete(security: 'is_granted("PROJECT_EDIT", object)')]
 class ProjectApiResource
 {
     #[API\ApiProperty(identifier: true, writable: false)]
diff --git a/src/Security/Voter/ProjectVoter.php b/src/Security/Voter/ProjectVoter.php
new file mode 100644
index 0000000..b19abf6
--- /dev/null
+++ b/src/Security/Voter/ProjectVoter.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Security\Voter;
+
+use App\ApiResource\Project\ProjectApiResource;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
+
+final class ProjectVoter extends Voter
+{
+    use UserOwnedVoterTrait;
+
+    public const EDIT = 'PROJECT_EDIT';
+    public const VIEW = 'PROJECT_VIEW';
+
+    protected function supports(string $attribute, mixed $subject): bool
+    {
+        return in_array($attribute, [self::EDIT, self::VIEW])
+            && $subject instanceof ProjectApiResource;
+    }
+
+    /**
+     * @param ProjectApiResource $subject
+     */
+    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
+    {
+        $user = $token->getUser();
+
+        switch ($attribute) {
+            case self::EDIT:
+                return $this->isOwnerOf($user, $subject);
+            case self::VIEW:
+                return true;
+        }
+
+        return false;
+    }
+}