diff --git a/service/src/main/okapi/ModuleDescriptor-template.json b/service/src/main/okapi/ModuleDescriptor-template.json
index 35d7ddbc..b0caea59 100644
--- a/service/src/main/okapi/ModuleDescriptor-template.json
+++ b/service/src/main/okapi/ModuleDescriptor-template.json
@@ -346,7 +346,7 @@
           ],
           "pathPattern": "/erm/packages/{id}/content/*",
           "permissionsRequired": [
-            "erm.packages.item.content.get"
+            "erm.packages.item.content.subset.get"
           ]
         },
         {
@@ -355,7 +355,7 @@
           ],
           "pathPattern": "/erm/packages/sources",
           "permissionsRequired": [
-            "erm.packages.collection.get"
+            "erm.packages.sources.get"
           ]
         },
         {
@@ -1261,6 +1261,11 @@
       "displayName": "Packages collection get",
       "description": "Get a collection of package records"
     },
+    {
+      "permissionName": "erm.packages.sources.get",
+      "displayName": "Packages sources get",
+      "description": "Get sources for all package records"
+    },
     {
       "permissionName": "erm.packages.item.get",
       "displayName": "Package item get",
@@ -1271,12 +1276,19 @@
       "displayName": "Package item content get",
       "description": "Get package record's contents"
     },
+    {
+      "permissionName": "erm.packages.item.content.subset.get",
+      "displayName": "Package item content subset get",
+      "description": "Get a subset of a package record's contents"
+    },
     {
       "permissionName": "erm.packages.view",
       "subPermissions": [
         "erm.packages.collection.get",
+        "erm.packages.sources.get",
         "erm.packages.item.get",
-        "erm.packages.item.content.get"
+        "erm.packages.item.content.get",
+        "erm.packages.item.content.subset.get"
       ]
     },
     {