diff --git a/front50-web/src/main/groovy/com/netflix/spinnaker/front50/controllers/v2/ApplicationsController.groovy b/front50-web/src/main/groovy/com/netflix/spinnaker/front50/controllers/v2/ApplicationsController.groovy
index 393ab9112..cb70e95eb 100644
--- a/front50-web/src/main/groovy/com/netflix/spinnaker/front50/controllers/v2/ApplicationsController.groovy
+++ b/front50-web/src/main/groovy/com/netflix/spinnaker/front50/controllers/v2/ApplicationsController.groovy
@@ -94,7 +94,7 @@ public class ApplicationsController {
     return results
   }
 
-  @PreAuthorize("@fiatPermissionEvaluator.canCreate('APPLICATION', app)")
+  @PreAuthorize("@fiatPermissionEvaluator.canCreate('APPLICATION', #app)")
   @ApiOperation(value = "", notes = "Create an application")
   @RequestMapping(method = RequestMethod.POST)
   Application create(@RequestBody final Application app) {