diff --git a/server/policies/document.test.ts b/server/policies/document.test.ts
index 6eea166dc..360d6cb2f 100644
--- a/server/policies/document.test.ts
+++ b/server/policies/document.test.ts
@@ -34,6 +34,7 @@ describe("read_write collection", () => {
     expect(abilities.delete).toEqual(true);
     expect(abilities.share).toEqual(true);
     expect(abilities.move).toEqual(true);
+    expect(abilities.comment).toEqual(true);
   });
 
   it("should allow read permissions for viewer", async () => {
@@ -61,6 +62,7 @@ describe("read_write collection", () => {
     expect(abilities.move).toEqual(false);
     expect(abilities.subscribe).toEqual(true);
     expect(abilities.unsubscribe).toEqual(true);
+    expect(abilities.comment).toEqual(true);
   });
 });
 
@@ -89,6 +91,7 @@ describe("read collection", () => {
     expect(abilities.move).toEqual(false);
     expect(abilities.subscribe).toEqual(true);
     expect(abilities.unsubscribe).toEqual(true);
+    expect(abilities.comment).toEqual(true);
   });
 });
 
@@ -117,6 +120,7 @@ describe("private collection", () => {
     expect(abilities.move).toEqual(false);
     expect(abilities.subscribe).toEqual(false);
     expect(abilities.unsubscribe).toEqual(false);
+    expect(abilities.comment).toEqual(false);
   });
 });
 
@@ -149,5 +153,6 @@ describe("no collection", () => {
     expect(abilities.unstar).toEqual(true);
     expect(abilities.unsubscribe).toEqual(false);
     expect(abilities.update).toEqual(true);
+    expect(abilities.comment).toEqual(true);
   });
 });
diff --git a/server/policies/document.ts b/server/policies/document.ts
index 58b4841e7..6e962d1e4 100644
--- a/server/policies/document.ts
+++ b/server/policies/document.ts
@@ -10,7 +10,7 @@ allow(User, "createDocument", Team, (user, team) => {
   return true;
 });
 
-allow(User, "read", Document, (user, document) => {
+allow(User, ["read", "comment"], Document, (user, document) => {
   if (!document) {
     return false;
   }
diff --git a/server/routes/api/comments/comments.ts b/server/routes/api/comments/comments.ts
index 05a64ccc6..c62168cc0 100644
--- a/server/routes/api/comments/comments.ts
+++ b/server/routes/api/comments/comments.ts
@@ -29,7 +29,7 @@ router.post(
       userId: user.id,
       transaction,
     });
-    authorize(user, "read", document);
+    authorize(user, "comment", document);
 
     const comment = await commentCreator({
       id,