diff --git a/main.go b/main.go
index 0c778cd..1ac03e2 100644
--- a/main.go
+++ b/main.go
@@ -4,6 +4,7 @@ import (
 	"astra-users/config"
 	"astra-users/handler"
 	"astra-users/model"
+	"astra-users/mw"
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
 	"gorm.io/driver/sqlite"
@@ -49,11 +50,11 @@ func main() {
 	e.DELETE("/:id", h.DeleteUser)
 	e.GET("/health", h.Health)
 
-	e.GET("/positions/:id", h.GetPositionHandler)
-	e.POST("/positions", h.CreatePosition)
+	e.GET("/positions/:id", h.GetPositionHandler, mw.CheckAdminRole)
+	e.POST("/positions", h.CreatePosition, mw.CheckAdminRole)
 
-	e.GET("/organizations", h.GetOrganizations)
-	e.POST("/organizations", h.CreateOrganization)
+	e.GET("/organizations", h.GetOrganizations, mw.CheckAdminRole)
+	e.POST("/organizations", h.CreateOrganization, mw.CheckAdminRole)
 
 	e.Logger.Fatal(e.Start(":" + config.Env.Server.Port))
 }
diff --git a/model/organization.go b/model/organization.go
index 74e9fdf..61c4231 100644
--- a/model/organization.go
+++ b/model/organization.go
@@ -4,7 +4,7 @@ import "gorm.io/gorm"
 
 type Organization struct {
 	gorm.Model
-	Name      string     `gorm:"unique;index"`
+	Name      string     `json:"name" gorm:"unique;index"`
 	ParentID  uint       `json:"parent_id"`
 	Positions []Position `json:"positions,omitempty"`
 }
diff --git a/model/position.go b/model/position.go
index 368e746..bc79ca0 100644
--- a/model/position.go
+++ b/model/position.go
@@ -4,7 +4,7 @@ import "gorm.io/gorm"
 
 type Position struct {
 	gorm.Model
-	Name           string `gorm:"unique;index"`
+	Name           string `json:"name" gorm:"unique;index"`
 	RightMask      int    `json:"right_mask"`
 	OrganizationID uint   `json:"organization_id" gorm:"index;not null"`
 	Users          []User `json:"users,omitempty"`
diff --git a/mw/check_admin_role.go b/mw/check_admin_role.go
new file mode 100644
index 0000000..a505fc0
--- /dev/null
+++ b/mw/check_admin_role.go
@@ -0,0 +1,17 @@
+package mw
+
+import (
+	"github.com/labstack/echo/v4"
+	"net/http"
+)
+
+func CheckAdminRole(next echo.HandlerFunc) echo.HandlerFunc {
+	return func(c echo.Context) error {
+		role := c.Request().Header.Get("UserRole")
+		if role != "admin" {
+			return c.NoContent(http.StatusUnauthorized)
+		}
+
+		return next(c)
+	}
+}
diff --git a/test.db b/test.db
index 5ba84c9..7cd6d27 100644
Binary files a/test.db and b/test.db differ