diff --git a/services/nginx/app/routes/subusersRoute.php b/services/nginx/app/routes/subusersRoute.php
index 2c272bb7..f0afcc6e 100644
--- a/services/nginx/app/routes/subusersRoute.php
+++ b/services/nginx/app/routes/subusersRoute.php
@@ -504,13 +504,9 @@ class subusersRoute
                 $response->error('Unauthorized', 401);
             }
 
-            // Link route permission to Subusers node so subusers can be constrained by grants.
-            // For classic users we keep current behavior (no extra user permission enforced here).
+            // Link route permission to Subusers node for all authenticated principals.
             $permission_list = self::definePermission('list_own_subusers', subusers_permission_node_key::SUBUSERS_LIST);
-            if ($subuser !== false) {
-                // Only enforce for subuser principals; classic users are governed by existing user ACLs elsewhere.
-                self::requirePermission($permission_list);
-            }
+            self::requirePermission($permission_list);
 
             // Determine effective customer number (user's customer number or subuser's target header)
             if ($user !== false) {
@@ -673,4 +669,4 @@ class subusersRoute
             $response->success(['cvr' => $cvr, 'customer_number' => $results[0]->customerNumber]);
         });
     }
-}
\ No newline at end of file
+}