diff --git a/pkg/envoy/store/rbac_rule_marshal.go b/pkg/envoy/store/rbac_rule_marshal.go
index 4f720b902..de98b09df 100644
--- a/pkg/envoy/store/rbac_rule_marshal.go
+++ b/pkg/envoy/store/rbac_rule_marshal.go
@@ -199,24 +199,25 @@ func (n *rbacRule) Encode(ctx context.Context, pl *payload) (err error) {
 		res.Resource = composeTypes.RecordRbacResource(p0ID, p1ID, p2ID)
 
 	case composeTypes.ModuleFieldResourceType:
-		return fmt.Errorf("importing rbac rules on module field level is not supported")
-		//p0 := resource.FindComposeNamespace(pl.state.ParentResources, n.res.RefPath[0].Identifiers)
-		//if p0 == nil {
-		//	return resource.ComposeNamespaceErrUnresolved(n.res.RefPath[0].Identifiers)
-		//}
-		//
-		//p1 := resource.FindComposeModule(pl.state.ParentResources, n.res.RefPath[1].Identifiers)
-		//if p1 == nil {
-		//	return resource.ComposeNamespaceErrUnresolved(n.res.RefPath[1].Identifiers)
-		//}
+		if len(n.res.RefPath) > 0 {
+			p0 := resource.FindComposeNamespace(pl.state.ParentResources, n.res.RefPath[0].Identifiers)
+			if p0 == nil {
+				return resource.ComposeNamespaceErrUnresolved(n.res.RefPath[0].Identifiers)
+			}
+			p0ID = p0.ID
+		}
+		if len(n.res.RefPath) > 1 {
+			p1 := resource.FindComposeModule(pl.state.ParentResources, n.res.RefPath[1].Identifiers)
+			if p1 == nil {
+				return resource.ComposeModuleErrUnresolved(n.res.RefPath[1].Identifiers)
+			}
+			p1ID = p1.ID
+		}
+
+		// @todo specific ModuleField RBAC
+
+		res.Resource = composeTypes.ModuleFieldRbacResource(p0ID, p1ID, p2ID)
 
-		//p1.fields
-		//if p2 == nil {
-		//	return resource.ComposeNamespaceErrUnresolved(n.res.RefResource.Identifiers)
-		//}
-		//
-		//res.Resource = composeTypes.ModuleFieldRbacResource(p0.ID, p1.ID, p2.ID)
-		//return nil
 	case systemTypes.UserResourceType:
 		if n.res.RefResource != nil {
 			p1 := resource.FindUser(pl.state.ParentResources, n.res.RefResource.Identifiers)
diff --git a/pkg/envoy/yaml/rbac_rules_marshal.go b/pkg/envoy/yaml/rbac_rules_marshal.go
index 09109dd30..fc83c9acf 100644
--- a/pkg/envoy/yaml/rbac_rules_marshal.go
+++ b/pkg/envoy/yaml/rbac_rules_marshal.go
@@ -153,11 +153,26 @@ func (r *rbacRule) Encode(ctx context.Context, doc *Document, state *envoy.Resou
 		}
 
 		// @todo specific record RBAC
-
 		r.res.Resource = fmt.Sprintf(composeTypes.RecordRbacResourceTpl(), composeTypes.RecordResourceType, p0ID, p1ID, p2ID)
 
 	case composeTypes.ModuleFieldResourceType:
-		return fmt.Errorf("importing rbac rules on module field level is not supported")
+		if len(res.RefPath) > 0 {
+			p0 := resource.FindComposeNamespace(state.ParentResources, res.RefPath[0].Identifiers)
+			if p0 == nil {
+				return resource.ComposeNamespaceErrUnresolved(res.RefPath[0].Identifiers)
+			}
+			p0ID = p0.Slug
+		}
+		if len(res.RefPath) > 1 {
+			p1 := resource.FindComposeModule(state.ParentResources, res.RefPath[1].Identifiers)
+			if p1 == nil {
+				return resource.ComposeModuleErrUnresolved(res.RefPath[1].Identifiers)
+			}
+			p1ID = p1.Handle
+		}
+
+		// @todo specific module field RBAC
+		r.res.Resource = fmt.Sprintf(composeTypes.ModuleFieldRbacResourceTpl(), composeTypes.ModuleFieldResourceType, p0ID, p1ID, p2ID)
 	case systemTypes.UserResourceType:
 		if res.RefResource != nil {
 			p1 := resource.FindUser(state.ParentResources, res.RefResource.Identifiers)