diff --git a/app/boot_levels.go b/app/boot_levels.go
index 898b0415b..e346c202b 100644
--- a/app/boot_levels.go
+++ b/app/boot_levels.go
@@ -17,6 +17,7 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/logger"
 	"github.com/cortezaproject/corteza-server/pkg/mail"
 	"github.com/cortezaproject/corteza-server/pkg/monitor"
+	"github.com/cortezaproject/corteza-server/pkg/permissions"
 	"github.com/cortezaproject/corteza-server/pkg/scheduler"
 	"github.com/cortezaproject/corteza-server/pkg/sentry"
 	"github.com/cortezaproject/corteza-server/provision/compose"
@@ -149,7 +150,6 @@ func (app *CortezaApp) InitServices(ctx context.Context) (err error) {
 		return nil
 	} else if err := app.InitStore(ctx); err != nil {
 		return err
-
 	}
 
 	ctx = actionlog.RequestOriginToContext(ctx, actionlog.RequestOrigin_APP_Init)
@@ -162,6 +162,17 @@ func (app *CortezaApp) InitServices(ctx context.Context) (err error) {
 	corredor.Service().SetUserFinder(sysService.DefaultUser)
 	corredor.Service().SetRoleFinder(sysService.DefaultRole)
 
+	{
+		// Initialize RBAC subsystem
+		// and (re)load rules from the storage backend
+		err = permissions.Initialize(app.Log, app.Store)
+		if err != nil {
+			return
+		}
+
+		permissions.Global().Reload(ctx)
+	}
+
 	// Initializes system services
 	//
 	// Note: this is a legacy approach, all services from all 3 apps
diff --git a/compose/service/service.go b/compose/service/service.go
index b54eb2b49..e44a6dcd4 100644
--- a/compose/service/service.go
+++ b/compose/service/service.go
@@ -113,7 +113,7 @@ func Initialize(ctx context.Context, log *zap.Logger, s store.Storer, c Config)
 	if DefaultPermissions == nil {
 		// Do not override permissions service stored under DefaultPermissions
 		// to allow integration tests to inject own permission service
-		DefaultPermissions = permissions.Service(ctx, DefaultLogger, s)
+		DefaultPermissions = permissions.Global()
 	}
 
 	DefaultAccessControl = AccessControl(DefaultPermissions)
diff --git a/messaging/service/service.go b/messaging/service/service.go
index a1d92c3f6..45e633757 100644
--- a/messaging/service/service.go
+++ b/messaging/service/service.go
@@ -93,7 +93,7 @@ func Initialize(ctx context.Context, log *zap.Logger, s store.Storer, c Config)
 	if DefaultPermissions == nil {
 		// Do not override permissions service stored under DefaultPermissions
 		// to allow integration tests to inject own permission service
-		DefaultPermissions = permissions.Service(ctx, DefaultLogger, s)
+		DefaultPermissions = permissions.Global()
 	}
 
 	DefaultAccessControl = AccessControl(DefaultPermissions)
diff --git a/pkg/permissions/service.go b/pkg/permissions/service.go
index d8f4a2490..6e3394549 100644
--- a/pkg/permissions/service.go
+++ b/pkg/permissions/service.go
@@ -26,24 +26,43 @@ type (
 	RuleFilter struct{}
 )
 
+var (
+	// Global permissioning service
+	gRBAC *service
+)
+
 const (
 	watchInterval = time.Hour
 )
 
-// Service initializes service{} struct
+// Global returns global RBAC service
+func Global() *service {
+	return gRBAC
+}
+
+func Initialize(logger *zap.Logger, s rbacRulesStore) error {
+	if gRBAC != nil {
+		// Prevent multiple initializations
+		return nil
+	}
+
+	gRBAC = NewService(logger, s)
+	return nil
+}
+
+// NewService initializes service{} struct
 //
 // service{} struct preloads, checks, grants and flushes privileges to and from store
 // It acts as a caching layer
-func Service(ctx context.Context, logger *zap.Logger, s rbacRulesStore) (svc *service) {
+func NewService(logger *zap.Logger, s rbacRulesStore) (svc *service) {
 	svc = &service{
 		l: &sync.Mutex{},
 		f: make(chan bool),
 
-		logger: logger.Named("permissions"),
+		logger: logger.Named("rbac"),
 		store:  s,
 	}
 
-	svc.Reload(ctx)
 	return
 }
 
diff --git a/system/service/service.go b/system/service/service.go
index 0aad457de..07db83a36 100644
--- a/system/service/service.go
+++ b/system/service/service.go
@@ -130,7 +130,7 @@ func Initialize(ctx context.Context, log *zap.Logger, s store.Storer, c Config)
 	if DefaultPermissions == nil {
 		// Do not override permissions service stored under DefaultPermissions
 		// to allow integration tests to inject own permission service
-		DefaultPermissions = permissions.Service(ctx, DefaultLogger, DefaultStore)
+		DefaultPermissions = permissions.Global()
 	}
 
 	DefaultAccessControl = AccessControl(DefaultPermissions)