diff --git a/vorgang-manager-interface/src/main/protobuf/file.model.proto b/vorgang-manager-interface/src/main/protobuf/file.model.proto
index c78f2f8332f50132ac678dd60734fcf9e6efbe1e..87e77ff49658deaa2e9878436dfab7e8a5513662 100644
--- a/vorgang-manager-interface/src/main/protobuf/file.model.proto
+++ b/vorgang-manager-interface/src/main/protobuf/file.model.proto
@@ -32,7 +32,6 @@ option java_outer_classname = "FileModelProto";
 
 
 message GrpcGetAttachmentsRequest {
-	de.ozgcloud.vorgang.grpc.command.GrpcCallContext context = 1 [deprecated = true];
 	string eingangId = 2;
 	string vorgangId = 3;
 }
@@ -42,7 +41,6 @@ message GrpcGetAttachmentsResponse {
 }
 
 message GrpcGetRepresentationsRequest {
-	de.ozgcloud.vorgang.grpc.command.GrpcCallContext context = 1 [deprecated = true];
 	string eingangId = 2;
 	string vorgangId = 3;
 }
diff --git a/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/EingangFilesRepository.java b/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/EingangFilesRepository.java
index 59d74b21eb13b52448739efa9db3872f2d6100ac..fe8617aa2f26731c2ca781a843372f25a258552a 100644
--- a/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/EingangFilesRepository.java
+++ b/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/EingangFilesRepository.java
@@ -49,7 +49,7 @@ class EingangFilesRepository {
 	private static final String FIELD_ATTACHMENT_FILES = DB_FIELDNAME_EINGANGS + ".attachments." + DB_FIELDNAME_FILES;
 	private static final String FIELD_REPRESENTATION_FILES = DB_FIELDNAME_EINGANGS + ".representations";
 
-	public List<OzgFile> findAttachments(Optional<String> vorgangId, Optional<String> eingangId) {
+	public List<OzgFile> findAttachments(String vorgangId, Optional<String> eingangId) {
 		return findFiles(buildSearchCriteria(vorgangId, eingangId), buildExtractAttachmentsAggregation());
 	}
 
@@ -65,16 +65,12 @@ class EingangFilesRepository {
 		);
 	}
 
-	public List<OzgFile> findRepresentations(Optional<String> vorgangId, Optional<String> eingangId) {
+	public List<OzgFile> findRepresentations(String vorgangId, Optional<String> eingangId) {
 		return findFiles(buildSearchCriteria(vorgangId, eingangId), buildFindRepresentationsAggregation());
 	}
 
-	private Criteria buildSearchCriteria(Optional<String> vorgangId, Optional<String> eingangId) {
-		if (vorgangId.isEmpty()) {
-			return eingangId.map(this::buildIsEingangIdCriteria)
-					.orElseThrow(() -> new IllegalArgumentException("vorgangId or eingangId must be present"));
-		}
-		return eingangId.map(eid -> buildIsVorganIdAndEingangIdCriteria(vorgangId.get(), eid)).orElseGet(() -> CriteriaUtil.isId(vorgangId.get()));
+	private Criteria buildSearchCriteria(String vorgangId, Optional<String> eingangId) {
+		return eingangId.map(eid -> buildIsVorganIdAndEingangIdCriteria(vorgangId, eid)).orElseGet(() -> CriteriaUtil.isId(vorgangId));
 	}
 
 	private Criteria buildIsVorganIdAndEingangIdCriteria(String vorgangId, String eingangId) {
diff --git a/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/FileService.java b/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/FileService.java
index e25b2e81b6aa1069e098ff4351b344a460f8e8d6..23c035fba7d60990e12a2074d11c7dede7314fd0 100644
--- a/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/FileService.java
+++ b/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/FileService.java
@@ -31,32 +31,34 @@ import java.util.concurrent.CompletableFuture;
 import java.util.stream.Stream;
 import java.util.stream.StreamSupport;
 
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.scheduling.annotation.Async;
 import org.springframework.stereotype.Service;
 
 import com.mongodb.client.gridfs.model.GridFSFile;
 
 import de.ozgcloud.nachrichten.postfach.BinaryFileService;
+import de.ozgcloud.vorgang.common.security.PolicyService;
+import lombok.RequiredArgsConstructor;
 
 //TODO make service package protected, as soon PersistPostfachMailByCommandService and FileStreamService is gone
 @Service
+@RequiredArgsConstructor
 public class FileService implements BinaryFileService {
-	public static final int CHUNK_SIZE = 255 * 1024;
 
-	@Autowired
-	private EingangFilesRepository repository;
-	@Autowired
-	private BinaryFileRepository binaryFileRepository;
+	public static final int CHUNK_SIZE = 255 * 1024;
 
-	@Autowired
-	private FileIdMapper fileIdMapper;
+	private final PolicyService policyService;
+	private final EingangFilesRepository repository;
+	private final BinaryFileRepository binaryFileRepository;
+	private final FileIdMapper fileIdMapper;
 
-	public List<OzgFile> getAttachments(Optional<String> vorgangId, Optional<String> eingangId) {
+	public List<OzgFile> getAttachments(String vorgangId, Optional<String> eingangId) {
+		policyService.checkPermission(vorgangId);
 		return repository.findAttachments(vorgangId, eingangId);
 	}
 
-	public List<OzgFile> getRepresentations(Optional<String> vorgangId, Optional<String> eingangId) {
+	public List<OzgFile> getRepresentations(String vorgangId, Optional<String> eingangId) {
+		policyService.checkPermission(vorgangId);
 		return repository.findRepresentations(vorgangId, eingangId);
 	}
 
diff --git a/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/GrpcFileService.java b/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/GrpcFileService.java
index 6a37c045769c03c3520b0c0b4f043d22e64780d5..5893db90a94992b4211aa6c01c2f34f649a9ce40 100644
--- a/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/GrpcFileService.java
+++ b/vorgang-manager-server/src/main/java/de/ozgcloud/vorgang/files/GrpcFileService.java
@@ -29,6 +29,7 @@ import java.util.Optional;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 
+import de.ozgcloud.common.errorhandling.TechnicalException;
 import de.ozgcloud.vorgang.grpc.file.FileServiceGrpc.FileServiceImplBase;
 import de.ozgcloud.vorgang.grpc.file.GrpcGetAttachmentsRequest;
 import de.ozgcloud.vorgang.grpc.file.GrpcGetAttachmentsResponse;
@@ -54,8 +55,8 @@ public class GrpcFileService extends FileServiceImplBase {
 		responseObserver.onCompleted();
 	}
 
-	private Optional<String> getVorgangId(GrpcGetAttachmentsRequest request) {
-		return Optional.of(request.getVorgangId()).map(StringUtils::trimToNull);
+	private String getVorgangId(GrpcGetAttachmentsRequest request) {
+		return Optional.of(request.getVorgangId()).map(StringUtils::trimToNull).orElseThrow(this::createMissingVorgangIdException);
 	}
 
 	private Optional<String> getEingangId(GrpcGetAttachmentsRequest request) {
@@ -70,11 +71,15 @@ public class GrpcFileService extends FileServiceImplBase {
 		responseObserver.onCompleted();
 	}
 
-	private Optional<String> getVorgangId(GrpcGetRepresentationsRequest request) {
-		return Optional.of(request.getVorgangId()).map(StringUtils::trimToNull);
+	private String getVorgangId(GrpcGetRepresentationsRequest request) {
+		return Optional.of(request.getVorgangId()).map(StringUtils::trimToNull).orElseThrow(this::createMissingVorgangIdException);
 	}
 
 	private Optional<String> getEingangId(GrpcGetRepresentationsRequest request) {
 		return Optional.of(request.getEingangId()).map(StringUtils::trimToNull);
 	}
+
+	TechnicalException createMissingVorgangIdException() {
+		return new TechnicalException("VorgangId is required");
+	}
 }
diff --git a/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/EingangFilesRepositoryITCase.java b/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/EingangFilesRepositoryITCase.java
index de2c1ee0f64abd28e39b2953d9902692db1f84c1..8bfba0ec928f92e1a204483e01a9d7ecee706c2f 100644
--- a/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/EingangFilesRepositoryITCase.java
+++ b/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/EingangFilesRepositoryITCase.java
@@ -63,37 +63,6 @@ class EingangFilesRepositoryITCase {
 			mongoOperations.save(createVorgang());
 		}
 
-		@Nested
-		class TestByEingangId {
-
-			@Test
-			void shouldHaveTwoAttachments() {
-				var attachments = findAttachments();
-
-				assertThat(attachments).hasSize(2);
-			}
-
-			@Test
-			void validateFirstAttachment() {
-				OzgFile attachment = findAttachments().get(0);
-
-				assertThat(attachment.getId()).isEqualTo(IncomingFileTestFactory.ID);
-				assertThat(attachment.getName()).isEqualTo(IncomingFileTestFactory.NAME);
-				assertThat(attachment.getSize()).isEqualTo(IncomingFileTestFactory.SIZE);
-			}
-
-			@Test
-			void validateSecondAttachment() {
-				var attachment = findAttachments().get(1);
-
-				assertThat(attachment.getId()).isEqualTo(ID2);
-			}
-
-			private List<OzgFile> findAttachments() {
-				return repository.findAttachments(Optional.empty(), Optional.of(EingangTestFactory.ID));
-			}
-		}
-
 		@Nested
 		class TestByVorgangId {
 
@@ -135,7 +104,7 @@ class EingangFilesRepositoryITCase {
 			}
 
 			private List<OzgFile> findAttachments(String vorgangId) {
-				return repository.findAttachments(Optional.of(vorgangId), Optional.empty());
+				return repository.findAttachments(vorgangId, Optional.empty());
 			}
 		}
 
@@ -146,7 +115,7 @@ class EingangFilesRepositoryITCase {
 			void shouldReturnEmpty() {
 				var vorgang = mongoOperations.save(VorgangTestFactory.createBuilder().id(null).version(0L).build());
 
-				var result = repository.findAttachments(Optional.ofNullable(vorgang.getId()), Optional.of("not-existing"));
+				var result = repository.findAttachments(vorgang.getId(), Optional.of("not-existing"));
 
 				assertThat(result).isEmpty();
 			}
@@ -160,7 +129,7 @@ class EingangFilesRepositoryITCase {
 								.build())
 						.build());
 
-				var result = repository.findAttachments(Optional.ofNullable(vorgang.getId()), Optional.ofNullable(eingangId));
+				var result = repository.findAttachments(vorgang.getId(), Optional.of(eingangId));
 
 				assertThat(result).hasSize(3);
 			}
@@ -178,39 +147,6 @@ class EingangFilesRepositoryITCase {
 			mongoOperations.save(vorgangWithRepresentations);
 		}
 
-		@Nested
-		class TestByEingangId {
-
-			@Test
-			void shouldHaveTwoRepresentations() {
-				List<OzgFile> representations = findRepresentations();
-
-				assertThat(representations).hasSize(2);
-			}
-
-			@Test
-			void validateFirstRepresentation() {
-				OzgFile representation = findRepresentations().get(0);
-
-				assertThat(representation.getId()).isEqualTo(IncomingFileTestFactory.ID);
-				assertThat(representation.getName()).isEqualTo(IncomingFileTestFactory.NAME);
-				assertThat(representation.getSize()).isEqualTo(IncomingFileTestFactory.SIZE);
-			}
-
-			@Test
-			void validateSecondRepresentation() {
-				OzgFile representation = findRepresentations().get(1);
-
-				assertThat(representation.getId()).isEqualTo(ID2);
-				assertThat(representation.getName()).isEqualTo(IncomingFileTestFactory.NAME);
-				assertThat(representation.getSize()).isEqualTo(IncomingFileTestFactory.SIZE);
-			}
-
-			private List<OzgFile> findRepresentations() {
-				return repository.findRepresentations(Optional.empty(), Optional.of(EingangTestFactory.ID));
-			}
-		}
-
 		@Nested
 		class TestByVorgangId {
 
@@ -252,7 +188,7 @@ class EingangFilesRepositoryITCase {
 			}
 
 			private List<OzgFile> findRepresentations(String vorgangId) {
-				return repository.findRepresentations(Optional.of(vorgangId), Optional.empty());
+				return repository.findRepresentations(vorgangId, Optional.empty());
 			}
 		}
 
@@ -263,7 +199,7 @@ class EingangFilesRepositoryITCase {
 			void shouldReturnEmpty() {
 				var vorgang = mongoOperations.save(VorgangTestFactory.createBuilder().id(null).version(0L).build());
 
-				var result = repository.findAttachments(Optional.of(vorgang.getId()), Optional.of("not-existing"));
+				var result = repository.findAttachments(vorgang.getId(), Optional.of("not-existing"));
 
 				assertThat(result).isEmpty();
 			}
@@ -274,7 +210,7 @@ class EingangFilesRepositoryITCase {
 				var vorgang = mongoOperations.save(VorgangTestFactory.createBuilder().id(null).version(0L).clearEingangs()
 						.eingang(EingangTestFactory.createBuilder().id(eingangId).representation(IncomingFileTestFactory.create()).build()).build());
 
-				var result = repository.findRepresentations(Optional.ofNullable(vorgang.getId()), Optional.ofNullable(eingangId));
+				var result = repository.findRepresentations(vorgang.getId(), Optional.of(eingangId));
 
 				assertThat(result).hasSize(2);
 			}
diff --git a/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/FileITCase.java b/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/FileITCase.java
index 723386437a009867bf558656f2b9cf1c7d7bfc17..aa8433978aed9297c33d99d3f2185f6f1b8e53d0 100644
--- a/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/FileITCase.java
+++ b/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/FileITCase.java
@@ -91,7 +91,7 @@ class FileITCase {
 
 			@BeforeEach
 			void init() {
-				request = GrpcGetAttachmentsRequestTestFactory.createBuilder().clearVorgangId().build();
+				request = GrpcGetAttachmentsRequestTestFactory.create();
 			}
 
 			@Test
diff --git a/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/FileServiceTest.java b/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/FileServiceTest.java
index 345938ebf543117636cbcf9e28306daf1a29737f..34668b1e6d69728c7379009c5b25e5ac18cef6ac 100644
--- a/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/FileServiceTest.java
+++ b/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/FileServiceTest.java
@@ -42,6 +42,7 @@ import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.Spy;
 
+import de.ozgcloud.vorgang.common.security.PolicyService;
 import de.ozgcloud.vorgang.vorgang.EingangTestFactory;
 import de.ozgcloud.vorgang.vorgang.IncomingFileTestFactory;
 import de.ozgcloud.vorgang.vorgang.VorgangTestFactory;
@@ -52,6 +53,8 @@ class FileServiceTest {
 	@InjectMocks
 	private FileService service;
 
+	@Mock
+	private PolicyService policyService;
 	@Mock
 	private EingangFilesRepository repository;
 	@Mock
@@ -168,11 +171,18 @@ class FileServiceTest {
 	@Nested
 	class TestGetAttachments {
 
+		@Test
+		void shouldCallCheckPermission() {
+			getAttachments();
+
+			verify(policyService).checkPermission(VorgangTestFactory.ID);
+		}
+
 		@Test
 		void shouldCallFindAttachments() {
-			service.getAttachments(Optional.of(VorgangTestFactory.ID), Optional.ofNullable(EingangTestFactory.ID));
+			getAttachments();
 
-			verify(repository).findAttachments(Optional.of(VorgangTestFactory.ID), Optional.ofNullable(EingangTestFactory.ID));
+			verify(repository).findAttachments(VorgangTestFactory.ID, Optional.of(EingangTestFactory.ID));
 		}
 
 		@Test
@@ -180,20 +190,31 @@ class FileServiceTest {
 			var attachment = OzgFileTestFactory.create();
 			when(repository.findAttachments(any(), any())).thenReturn(List.of(attachment));
 
-			var result = service.getAttachments(Optional.of(VorgangTestFactory.ID), Optional.ofNullable(EingangTestFactory.ID));
+			var result = getAttachments();
 
 			assertThat(result).containsExactly(attachment);
 		}
+
+		private List<OzgFile> getAttachments() {
+			return service.getAttachments(VorgangTestFactory.ID, Optional.of(EingangTestFactory.ID));
+		}
 	}
 
 	@Nested
 	class TestGetRepresentations {
 
+		@Test
+		void shouldCallCheckPermission() {
+			getRepresentations();
+
+			verify(policyService).checkPermission(VorgangTestFactory.ID);
+		}
+
 		@Test
 		void shouldCallFindRepresentations() {
-			service.getRepresentations(Optional.of(VorgangTestFactory.ID), Optional.ofNullable(EingangTestFactory.ID));
+			getRepresentations();
 
-			verify(repository).findRepresentations(Optional.of(VorgangTestFactory.ID), Optional.ofNullable(EingangTestFactory.ID));
+			verify(repository).findRepresentations(VorgangTestFactory.ID, Optional.of(EingangTestFactory.ID));
 		}
 
 		@Test
@@ -201,9 +222,13 @@ class FileServiceTest {
 			var representation = OzgFileTestFactory.create();
 			when(repository.findRepresentations(any(), any())).thenReturn(List.of(representation));
 
-			var result = service.getRepresentations(Optional.of(VorgangTestFactory.ID), Optional.ofNullable(EingangTestFactory.ID));
+			var result = getRepresentations();
 
 			assertThat(result).containsExactly(representation);
 		}
+
+		private List<OzgFile> getRepresentations() {
+			return service.getRepresentations(VorgangTestFactory.ID, Optional.of(EingangTestFactory.ID));
+		}
 	}
 }
\ No newline at end of file
diff --git a/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/GrpcFileServiceTest.java b/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/GrpcFileServiceTest.java
index d4a0da11c1a296928eb79049b1c5e7023eecd256..abedba973a572b2661a4b6025ad1144821600f56 100644
--- a/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/GrpcFileServiceTest.java
+++ b/vorgang-manager-server/src/test/java/de/ozgcloud/vorgang/files/GrpcFileServiceTest.java
@@ -73,7 +73,7 @@ class GrpcFileServiceTest {
 		void shouldCallGetAttachments() {
 			getAttachments();
 
-			verify(fileService).getAttachments(Optional.ofNullable(GrpcGetAttachmentsRequestTestFactory.VORGANG_ID),
+			verify(fileService).getAttachments(GrpcGetAttachmentsRequestTestFactory.VORGANG_ID,
 					Optional.ofNullable(GrpcGetAttachmentsRequestTestFactory.EINGANG_ID));
 		}
 
@@ -120,7 +120,7 @@ class GrpcFileServiceTest {
 		void shouldCallGetRepresentations() {
 			getRepresentations();
 
-			verify(fileService).getRepresentations(Optional.of(GrpcGetRepresentationsRequestTestFactory.VORGANG_ID),
+			verify(fileService).getRepresentations(GrpcGetRepresentationsRequestTestFactory.VORGANG_ID,
 					Optional.of(GrpcGetRepresentationsRequestTestFactory.EINGANG_ID));
 		}