diff --git a/backend/v3/domain/command.go b/backend/v3/domain/command.go
index cd0da4d0d..8dd301f53 100644
--- a/backend/v3/domain/command.go
+++ b/backend/v3/domain/command.go
@@ -28,8 +28,9 @@ type Invoker interface {
 // CommandOpts are passed to each command
 // it provides common fields used by commands like the database client.
 type CommandOpts struct {
-	DB      database.QueryExecutor
-	Invoker Invoker
+	DB          database.QueryExecutor
+	Invoker     Invoker
+	Permissions PermissionChecker
 }
 
 type ensureTxOpts struct {
@@ -101,8 +102,9 @@ func DefaultOpts(invoker Invoker) *CommandOpts {
 		invoker = &noopInvoker{}
 	}
 	return &CommandOpts{
-		DB:      pool,
-		Invoker: invoker,
+		DB:          pool,
+		Invoker:     invoker,
+		Permissions: &noopPermissionChecker{}, // prevent panics for now
 	}
 }
 
diff --git a/backend/v3/domain/permission.go b/backend/v3/domain/permission.go
new file mode 100644
index 000000000..3484085fe
--- /dev/null
+++ b/backend/v3/domain/permission.go
@@ -0,0 +1,48 @@
+package domain
+
+import "context"
+
+// PermissionRepository is the interface that manages and checks Zitadel permissions.
+//
+// TODO(muhlemmer): This just defines the checker methods, rest to be done later.
+type PermissionRepository interface {
+	PermissionChecker
+}
+
+// PermissionChecker defines the methods needed to check permissions.
+type PermissionChecker interface {
+	// Check if the authenticated user has the given permission on instance level.
+	CheckInstancePermission(ctx context.Context, permission string) error
+
+	// Check if the authenticated user has the given permission on the given organization.
+	// A permission may be inherited from the instance level.
+	CheckOrganizationPermission(ctx context.Context, permission, orgID string) error
+
+	// Check if the authenticated user has the given permission on the given project.
+	// A permission may be inherited from the instance or organization level.
+	CheckProjectPermission(ctx context.Context, permission, projectID string) error
+
+	// Check if the authenticated user has the given permission on the given project grant.
+	// A permission may be inherited from the instance or granted organization level.
+	CheckProjectGrantPermission(ctx context.Context, permission, projectGrantID string) error
+}
+
+type noopPermissionChecker struct{}
+
+var _ PermissionChecker = (*noopPermissionChecker)(nil)
+
+func (*noopPermissionChecker) CheckInstancePermission(context.Context, string) error {
+	return nil
+}
+
+func (*noopPermissionChecker) CheckOrganizationPermission(context.Context, string, string) error {
+	return nil
+}
+
+func (*noopPermissionChecker) CheckProjectPermission(context.Context, string, string) error {
+	return nil
+}
+
+func (*noopPermissionChecker) CheckProjectGrantPermission(context.Context, string, string) error {
+	return nil
+}