diff --git a/services/nginx/app/classes/auth/scope.php b/services/nginx/app/classes/auth/scope.php
index 5c991bc1..f63007fd 100644
--- a/services/nginx/app/classes/auth/scope.php
+++ b/services/nginx/app/classes/auth/scope.php
@@ -59,9 +59,17 @@ class Scope
                     self::INVOICE_READ, self::INVOICE_WRITE,
                 ];
             case 'customer':
+                // TRU-149 (fix): customers get WRITE on their own data so
+                // self-service endpoints (own vehicles, own subusers, own
+                // discount / security / notification settings, own bookings)
+                // work end-to-end. The existing fine-grained
+                // requirePermission() calls in each route still gate which
+                // specific actions are allowed — scope here only answers
+                // "can this caller write customer data at all".
                 return [
-                    self::CUSTOMER_READ,
-                    self::BOOKING_READ,
+                    self::CUSTOMER_READ,  self::CUSTOMER_WRITE,
+                    self::BOOKING_READ,   self::BOOKING_WRITE,
+                    self::SUBUSER_READ,   self::SUBUSER_WRITE,
                     self::INVOICE_READ,
                 ];
             case 'subuser':