diff --git a/relengapi/blueprints/clobberer/__init__.py b/relengapi/blueprints/clobberer/__init__.py
index d5f43ff..bf27b21 100644
--- a/relengapi/blueprints/clobberer/__init__.py
+++ b/relengapi/blueprints/clobberer/__init__.py
@@ -27,6 +27,7 @@
 from models import DB_DECLARATIVE_BASE
 
 from relengapi import apimethod
+from relengapi import p
 from relengapi.lib import angular
 from relengapi.lib import api
 
@@ -39,6 +40,8 @@
     static_folder='static'
 )
 
+p.clobberer.clobber.doc('Submit clobber requests')
+
 bp.root_widget_template('clobberer_root_widget.html', priority=100)
 
 # prefix which denotes release builddirs
@@ -85,6 +88,7 @@ def _add_clobber(session, branch, builddir, slave=None):
 
 @bp.route('/clobber', methods=['POST'])
 @apimethod(None, body=[rest.ClobberRequest])
+@p.clobberer.clobber.require()
 def clobber(body):
     "Request clobbers for particular branches and builddirs."
     session = g.db.session(DB_DECLARATIVE_BASE)
@@ -101,6 +105,7 @@ def clobber(body):
 
 @bp.route('/clobber/by-builder', methods=['POST'])
 @apimethod(None, body=[rest.ClobberRequestByBuilder])
+@p.clobberer.clobber.require()
 def clobber_by_builder(body):
     """
     Request clobbers for app builddirs associated with a particular buildername.
diff --git a/relengapi/blueprints/clobberer/test_api.py b/relengapi/blueprints/clobberer/test_api.py
index c2dd425..517d497 100644
--- a/relengapi/blueprints/clobberer/test_api.py
+++ b/relengapi/blueprints/clobberer/test_api.py
@@ -9,6 +9,8 @@
 from nose.tools import assert_greater
 from nose.tools import eq_
 
+from relengapi import p
+from relengapi.lib import auth
 from relengapi.lib.testing.context import TestContext
 
 from . import BUILDDIR_REL_PREFIX
@@ -29,7 +31,9 @@
     'slave': 'specific_slave',
 }
 
-test_context = TestContext(databases=[DB_DECLARATIVE_BASE], reuse_app=True)
+auth_user = auth.HumanUser('winter2718@gmail.com')
+auth_user._permissions = set([p.clobberer.clobber])
+test_context = TestContext(databases=[DB_DECLARATIVE_BASE], reuse_app=True, user=auth_user)
 
 _last_clobber_args = deepcopy(_clobber_args)
 _last_clobber_args['buildername'] = 'buildername'
@@ -103,7 +107,7 @@ def test_lastclobber(client):
     eq_(lastclobber_data[0], _last_clobber_args['builddir'])
     eq_(lastclobber_data[1].isdigit(), True,
         'lastclobber did not return a valid timestamp => {}'.format(lastclobber_data[1]))
-    eq_(lastclobber_data[2], 'anonymous',
+    eq_(lastclobber_data[2], 'winter2718@gmail.com',
         'lastclobber did not return a valid username')
 
     # Ensure a new build has been recorded matching the request args