diff --git a/cdap-app-templates/cdap-etl/cdap-data-pipeline-base/src/main/java/io/cdap/cdap/datapipeline/service/DraftHandler.java b/cdap-app-templates/cdap-etl/cdap-data-pipeline-base/src/main/java/io/cdap/cdap/datapipeline/service/DraftHandler.java
index f130b7b7e192..17f3792afc79 100644
--- a/cdap-app-templates/cdap-etl/cdap-data-pipeline-base/src/main/java/io/cdap/cdap/datapipeline/service/DraftHandler.java
+++ b/cdap-app-templates/cdap-etl/cdap-data-pipeline-base/src/main/java/io/cdap/cdap/datapipeline/service/DraftHandler.java
@@ -83,6 +83,7 @@ public void listDrafts(HttpServiceRequest request, HttpServiceResponder responde
                          @QueryParam("sortOrder") @DefaultValue("ASC") String sortOrder,
                          @QueryParam("filter") @Nullable String filter) {
 
+    contextAccessEnforcer.enforce(new NamespaceId(namespaceName), StandardPermission.LIST);
     respond(namespaceName, responder, (namespace) -> {
       if (!draftService.fieldExists(sortBy)) {
         throw new IllegalArgumentException(String.format(
@@ -103,6 +104,7 @@ public void listDrafts(HttpServiceRequest request, HttpServiceResponder responde
   public void getDraft(HttpServiceRequest request, HttpServiceResponder responder,
                        @PathParam("context") String namespaceName,
                        @PathParam("draft") String draftId) {
+    contextAccessEnforcer.enforce(new NamespaceId(namespaceName), StandardPermission.GET);
     respond(namespaceName, responder, (namespace) -> {
       String userId = "";
       DraftId id = new DraftId(namespace, draftId, userId);