diff --git a/cloudesire-api-client-dto/src/main/java/com/cloudesire/platform/apiclient/dto/model/dto/EnvironmentDTO.java b/cloudesire-api-client-dto/src/main/java/com/cloudesire/platform/apiclient/dto/model/dto/EnvironmentDTO.java
index 70d65ef30..ec91b8033 100644
--- a/cloudesire-api-client-dto/src/main/java/com/cloudesire/platform/apiclient/dto/model/dto/EnvironmentDTO.java
+++ b/cloudesire-api-client-dto/src/main/java/com/cloudesire/platform/apiclient/dto/model/dto/EnvironmentDTO.java
@@ -1962,7 +1962,7 @@ public void setAlterSubscriptionBillingDates( boolean alterSubscriptionBillingDa
         //endregion
     }
 
-    @ApiModel( description = "Frontend features that can be toggled globally at runtime and overridden on per-user basis" )
+    @ApiModel( description = "Frontend features that can be toggled globally at runtime and overridden on per-environment basis" )
     public static class FrontendFeaturesEnvironment implements DTO
     {
         @ApiModelProperty( "Access to invoice section in navbar" )
@@ -1979,6 +1979,10 @@ public static class FrontendFeaturesEnvironment implements DTO
         @ApiModelProperty( "Enable postponed subscription upgrades" )
         private boolean postponedUpgrades;
 
+        @Valid
+        private List<RouteAuthorizationDTO> routeAuthorizations;
+
+        // region enums
         public enum InvoiceSectionEnum
         {
             INVOICE, CONSUMPTION_SUMMARY, DISABLED
@@ -1988,7 +1992,9 @@ public enum EnabledApplications
         {
             MARKETPLACE, CLASSIC_CP, VUE_CP
         }
+        // endregion
 
+        // region accessors
         public InvoiceSectionEnum getInvoiceSection()
         {
             return invoiceSection;
@@ -2028,6 +2034,17 @@ public void setPostponedUpgrades( boolean postponedUpgrades )
         {
             this.postponedUpgrades = postponedUpgrades;
         }
+
+        public List<RouteAuthorizationDTO> getRouteAuthorizations()
+        {
+            return routeAuthorizations;
+        }
+
+        public void setRouteAuthorizations( List<RouteAuthorizationDTO> routeAuthorizations )
+        {
+            this.routeAuthorizations = routeAuthorizations;
+        }
+        // endregion
     }
 
     @ApiModel( description = "General configuration of the platform" )
diff --git a/cloudesire-api-client-dto/src/main/java/com/cloudesire/platform/apiclient/dto/model/dto/RouteAuthorizationDTO.java b/cloudesire-api-client-dto/src/main/java/com/cloudesire/platform/apiclient/dto/model/dto/RouteAuthorizationDTO.java
new file mode 100644
index 000000000..4e36836d9
--- /dev/null
+++ b/cloudesire-api-client-dto/src/main/java/com/cloudesire/platform/apiclient/dto/model/dto/RouteAuthorizationDTO.java
@@ -0,0 +1,117 @@
+package com.cloudesire.platform.apiclient.dto.model.dto;
+
+import com.cloudesire.platform.apiclient.dto.model.enums.UserGroup;
+import com.cloudesire.platform.apiclient.dto.model.enums.UserRole;
+import io.swagger.annotations.ApiModel;
+
+import javax.validation.constraints.NotEmpty;
+import java.util.Objects;
+import java.util.Set;
+
+@ApiModel( description = "RBAC for frontend routes" )
+public class RouteAuthorizationDTO implements DTO
+{
+    @NotEmpty
+    private String route;
+
+    private Set<UserRole> roles;
+
+    private Set<UserGroup> userGroups;
+
+    private RouteAuthorizationDTO( String route, Set<UserRole> roles, Set<UserGroup> userGroups )
+    {
+        this.route = route;
+        this.roles = roles;
+        this.userGroups = userGroups;
+    }
+
+    public RouteAuthorizationDTO()
+    {
+    }
+
+    public static Builder builder( String route )
+    {
+        return new Builder( route );
+    }
+
+    public String getRoute()
+    {
+        return route;
+    }
+
+    public void setRoute( String route )
+    {
+        this.route = route;
+    }
+
+    public Set<UserRole> getRoles()
+    {
+        return roles;
+    }
+
+    public void setRoles( Set<UserRole> roles )
+    {
+        this.roles = roles;
+    }
+
+    public Set<UserGroup> getUserGroups()
+    {
+        return userGroups;
+    }
+
+    public void setUserGroups( Set<UserGroup> userGroups )
+    {
+        this.userGroups = userGroups;
+    }
+
+    @Override
+    public boolean equals( Object o )
+    {
+        if ( this == o ) return true;
+        if ( o == null || getClass() != o.getClass() ) return false;
+        RouteAuthorizationDTO that = (RouteAuthorizationDTO) o;
+        return Objects.equals( route, that.route ) && Objects.equals( roles, that.roles )
+                && Objects.equals( userGroups, that.userGroups );
+    }
+
+    @Override
+    public int hashCode()
+    {
+        return Objects.hash( route, roles, userGroups );
+    }
+
+    @Override
+    public String toString()
+    {
+        return String.format( "RouteAuthorizationDTO{route='%s', roles=%s, userGroups=%s}", route, roles, userGroups );
+    }
+
+    public static final class Builder
+    {
+        private final String route;
+        private Set<UserRole> roles;
+        private Set<UserGroup> userGroups;
+
+        private Builder( String route )
+        {
+            this.route = route;
+        }
+
+        public Builder withRoles( Set<UserRole> roles )
+        {
+            this.roles = roles;
+            return this;
+        }
+
+        public Builder withUserGroups( Set<UserGroup> userGroups )
+        {
+            this.userGroups = userGroups;
+            return this;
+        }
+
+        public RouteAuthorizationDTO build()
+        {
+            return new RouteAuthorizationDTO( route, roles, userGroups );
+        }
+    }
+}