diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/IRelationshipService.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/IRelationshipService.java
index 0a9a659db5dfabd782a732b1b382555b6114c632..907b5ce656d299cc6293973b4acf5b5823a58da1 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/IRelationshipService.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/business/IRelationshipService.java
@@ -139,7 +139,8 @@ public interface IRelationshipService
     @Capability("ADD_PARENT_TO_SAMPLE")
     public void addParentToSample(IAuthSession session,
             @AuthorizationGuard(name = "SAMPLE", guardClass = SamplePEPredicate.class)
-            SamplePE sample, @AuthorizationGuard(name = "PARENT", guardClass = SamplePEPredicate.class)
+            SamplePE sample, @AuthorizationGuard(name = "PARENT", guardClass = SamplePEPredicate.class,
+                    rolesAllowed = { RoleWithHierarchy.SPACE_ETL_SERVER, RoleWithHierarchy.SPACE_USER })
             SamplePE parent);
 
     @Transactional(propagation = Propagation.MANDATORY)
@@ -148,7 +149,8 @@ public interface IRelationshipService
     @Capability("REMOVE_PARENT_FROM_SAMPLE")
     public void removeParentFromSample(IAuthSession session,
             @AuthorizationGuard(name = "SAMPLE", guardClass = SamplePEPredicate.class)
-            SamplePE sample, @AuthorizationGuard(name = "PARENT", guardClass = SamplePEPredicate.class)
+            SamplePE sample, @AuthorizationGuard(name = "PARENT", guardClass = SamplePEPredicate.class,
+                    rolesAllowed = { RoleWithHierarchy.SPACE_ETL_SERVER, RoleWithHierarchy.SPACE_USER })
             SamplePE parent);
 
     @Transactional(propagation = Propagation.MANDATORY)