diff --git a/atst/routes/applications/new.py b/atst/routes/applications/new.py
index 05893ed0..40477666 100644
--- a/atst/routes/applications/new.py
+++ b/atst/routes/applications/new.py
@@ -34,6 +34,7 @@ def render_new_application_form(
 @applications_bp.route(
     "/portfolios/<portfolio_id>/applications/<application_id>/step_1"
 )
+@user_can(Permissions.CREATE_APPLICATION, message="view create new application form")
 def view_new_application_step_1(portfolio_id, application_id=None):
     return render_new_application_form(
         "portfolios/applications/new/step_1.html",
@@ -90,6 +91,7 @@ def create_or_update_new_application_step_1(portfolio_id, application_id=None):
 @applications_bp.route(
     "/portfolios/<portfolio_id>/applications/<application_id>/step_2"
 )
+@user_can(Permissions.CREATE_APPLICATION, message="view create new application form")
 def view_new_application_step_2(portfolio_id, application_id):
     return render_new_application_form(
         "portfolios/applications/new/step_2.html",