diff --git a/plugins/permission-backend/src/service/router.ts b/plugins/permission-backend/src/service/router.ts
index c624947375..dd152d66aa 100644
--- a/plugins/permission-backend/src/service/router.ts
+++ b/plugins/permission-backend/src/service/router.ts
@@ -235,6 +235,18 @@ export async function createRouter(
 
       const body = parseResult.data;
 
+      if (
+        !(credentials.principal as BackstageUserPrincipal).issuedBy &&
+        body.items.some(
+          r =>
+            isResourcePermission(r.permission) && r.resourceRef === undefined,
+        )
+      ) {
+        throw new InputError(
+          'Resource permissions require a resourceRef to be set',
+        );
+      }
+
       res.json({
         items: await handleRequest(
           body.items,