diff --git a/plugins/catalog-backend/api-report.md b/plugins/catalog-backend/api-report.md
index 6d7834001a..33f0fab18e 100644
--- a/plugins/catalog-backend/api-report.md
+++ b/plugins/catalog-backend/api-report.md
@@ -307,9 +307,10 @@ export type CatalogEnvironment = {
 };
 
 // @public
-export type CatalogPermissionRule = PermissionRule<
+export type CatalogPermissionRule<TParams extends unknown[]> = PermissionRule<
   Entity,
-  EntitiesSearchFilter
+  EntitiesSearchFilter,
+  TParams
 >;
 
 // Warning: (ae-missing-release-tag) "CatalogProcessingEngine" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -1311,7 +1312,9 @@ export class NextCatalogBuilder {
   addEntityPolicy(...policies: EntityPolicy[]): NextCatalogBuilder;
   // Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
   addEntityProvider(...providers: EntityProvider[]): NextCatalogBuilder;
-  addPermissionRules(...permissionRules: CatalogPermissionRule[]): void;
+  addPermissionRules(
+    ...permissionRules: CatalogPermissionRule<unknown[]>[]
+  ): void;
   // Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
   addProcessor(...processors: CatalogProcessor[]): NextCatalogBuilder;
   build(): Promise<{
@@ -1359,7 +1362,7 @@ export interface NextRouterOptions {
   // (undocumented)
   logger: Logger_2;
   // (undocumented)
-  permissionRules?: CatalogPermissionRule[];
+  permissionRules?: CatalogPermissionRule<unknown[]>[];
   // (undocumented)
   refreshService?: RefreshService;
 }
@@ -1394,12 +1397,12 @@ export function parseEntityYaml(
 
 // @public
 export const permissionRules: {
-  hasAnnotation: CatalogPermissionRule;
-  hasLabel: CatalogPermissionRule;
-  hasMetadata: CatalogPermissionRule;
-  hasSpec: CatalogPermissionRule;
-  isEntityKind: CatalogPermissionRule;
-  isEntityOwner: CatalogPermissionRule;
+  hasAnnotation: CatalogPermissionRule<[annotation: string]>;
+  hasLabel: CatalogPermissionRule<[label: string]>;
+  hasMetadata: CatalogPermissionRule<[key: string, value?: string | undefined]>;
+  hasSpec: CatalogPermissionRule<[key: string, value?: string | undefined]>;
+  isEntityKind: CatalogPermissionRule<[kinds: string[]]>;
+  isEntityOwner: CatalogPermissionRule<[claims: string[]]>;
 };
 
 // Warning: (ae-missing-release-tag) "PlaceholderProcessor" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
diff --git a/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts b/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts
index 92e53f930f..254eb164da 100644
--- a/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts
+++ b/plugins/catalog-backend/src/permissions/rules/createPropertyRule.ts
@@ -21,7 +21,7 @@ import { get } from 'lodash';
 
 export function createPropertyRule(
   propertyType: 'metadata' | 'spec',
-): CatalogPermissionRule {
+): CatalogPermissionRule<[key: string, value?: string]> {
   return {
     name: `HAS_${propertyType.toUpperCase()}`,
     description: `Allow entities which have the specified ${propertyType} subfield.`,
diff --git a/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts b/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts
index 57ded3d779..baab28d838 100644
--- a/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts
+++ b/plugins/catalog-backend/src/permissions/rules/hasAnnotation.ts
@@ -23,7 +23,7 @@ import { CatalogPermissionRule } from '../types';
  * annotation on a given entity.
  * @public
  */
-export const hasAnnotation: CatalogPermissionRule = {
+export const hasAnnotation: CatalogPermissionRule<[annotation: string]> = {
   name: 'HAS_ANNOTATION',
   description:
     'Allow entities which are annotated with the specified annotation',
diff --git a/plugins/catalog-backend/src/permissions/rules/hasLabel.ts b/plugins/catalog-backend/src/permissions/rules/hasLabel.ts
index f93c5aeae6..a790f1441f 100644
--- a/plugins/catalog-backend/src/permissions/rules/hasLabel.ts
+++ b/plugins/catalog-backend/src/permissions/rules/hasLabel.ts
@@ -23,7 +23,7 @@ import { CatalogPermissionRule } from '../types';
  * label in its metadata.
  * @public
  */
-export const hasLabel: CatalogPermissionRule = {
+export const hasLabel: CatalogPermissionRule<[label: string]> = {
   name: 'HAS_LABEL',
   description: 'Allow entities which have the specified label metadata.',
   apply: (resource: Entity, label: string) =>
diff --git a/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts b/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts
index 64fcf7482d..024188939f 100644
--- a/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts
+++ b/plugins/catalog-backend/src/permissions/rules/isEntityKind.ts
@@ -22,7 +22,7 @@ import { CatalogPermissionRule } from '../types';
  * kind.
  * @public
  */
-export const isEntityKind: CatalogPermissionRule = {
+export const isEntityKind: CatalogPermissionRule<[kinds: string[]]> = {
   name: 'IS_ENTITY_KIND',
   description: 'Allow entities with the specified kind',
   apply(resource: Entity, kinds: string[]) {
diff --git a/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts b/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts
index e89159e6b4..e450cdf721 100644
--- a/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts
+++ b/plugins/catalog-backend/src/permissions/rules/isEntityOwner.ts
@@ -27,7 +27,7 @@ import { CatalogPermissionRule } from '../types';
  * owner.
  * @public
  */
-export const isEntityOwner: CatalogPermissionRule = {
+export const isEntityOwner: CatalogPermissionRule<[claims: string[]]> = {
   name: 'IS_ENTITY_OWNER',
   description: 'Allow entities owned by the current user',
   apply: (resource: Entity, claims: string[]) => {
diff --git a/plugins/catalog-backend/src/permissions/types.ts b/plugins/catalog-backend/src/permissions/types.ts
index cc2b8f4d45..4a0d9dc1fc 100644
--- a/plugins/catalog-backend/src/permissions/types.ts
+++ b/plugins/catalog-backend/src/permissions/types.ts
@@ -24,7 +24,8 @@ import { EntitiesSearchFilter } from '../catalog/types';
  *
  * @public
  */
-export type CatalogPermissionRule = PermissionRule<
+export type CatalogPermissionRule<TParams extends unknown[]> = PermissionRule<
   Entity,
-  EntitiesSearchFilter
+  EntitiesSearchFilter,
+  TParams
 >;
diff --git a/plugins/catalog-backend/src/service/NextCatalogBuilder.ts b/plugins/catalog-backend/src/service/NextCatalogBuilder.ts
index 1dcb632e64..e707423670 100644
--- a/plugins/catalog-backend/src/service/NextCatalogBuilder.ts
+++ b/plugins/catalog-backend/src/service/NextCatalogBuilder.ts
@@ -130,7 +130,7 @@ export class NextCatalogBuilder {
       maxSeconds: 150,
     });
   private locationAnalyzer: LocationAnalyzer | undefined = undefined;
-  private permissionRules: CatalogPermissionRule[];
+  private permissionRules: CatalogPermissionRule<unknown[]>[];
 
   constructor(env: CatalogEnvironment) {
     this.env = env;
@@ -331,7 +331,7 @@ export class NextCatalogBuilder {
    *
    * @param permissionRules - Additional permission rules
    */
-  addPermissionRules(...permissionRules: CatalogPermissionRule[]) {
+  addPermissionRules(...permissionRules: CatalogPermissionRule<unknown[]>[]) {
     this.permissionRules.push(...permissionRules);
   }
 
diff --git a/plugins/catalog-backend/src/service/NextRouter.ts b/plugins/catalog-backend/src/service/NextRouter.ts
index 7aae564a45..948424ec88 100644
--- a/plugins/catalog-backend/src/service/NextRouter.ts
+++ b/plugins/catalog-backend/src/service/NextRouter.ts
@@ -49,7 +49,7 @@ export interface NextRouterOptions {
   refreshService?: RefreshService;
   logger: Logger;
   config: Config;
-  permissionRules?: CatalogPermissionRule[];
+  permissionRules?: CatalogPermissionRule<unknown[]>[];
 }
 
 export async function createNextRouter(