diff --git a/controllers/controlGroups.go b/controllers/controlGroups.go
index 34191c9..b78c42f 100644
--- a/controllers/controlGroups.go
+++ b/controllers/controlGroups.go
@@ -81,7 +81,7 @@ func AddGroupHandler(c *gin.Context) {
 		return
 	}
 
-	c.JSON(http.StatusOK, gin.H{"message": "group creation success"})
+	c.JSON(http.StatusOK, gin.H{"message": "group creation success", "data": g})
 }
 
 func DeleteGroupHandler(c *gin.Context) {
diff --git a/controllers/controlPermissions.go b/controllers/controlPermissions.go
new file mode 100644
index 0000000..6c97b1a
--- /dev/null
+++ b/controllers/controlPermissions.go
@@ -0,0 +1,93 @@
+package controllers
+
+import (
+	"fmt"
+	"html"
+	"log"
+	"net/http"
+	"smt/models"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+type PermissionInput struct {
+	PermissionId int    `db:"PermissionId" json:"permissionId"`
+	Description  string `db:"Description" json:"description"`
+	ReadOnly     bool   `db:"ReadOnly" json:"readOnly"`
+	SafeId       int    `db:"SafeId" json:"safeId"`
+	UserId       int    `db:"UserId" json:"userId"`
+	GroupId      int    `db:"GroupId" json:"groupId"`
+}
+
+func GetPermissionsHandler(c *gin.Context) {
+	permissions, err := models.PermissionList()
+
+	if err != nil {
+		errString := fmt.Sprintf("error retrieving permissions : '%s'", err)
+		log.Printf("GetPermissionsHandler %s\n", errString)
+		c.JSON(http.StatusBadRequest, gin.H{"error": errString})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "success", "data": permissions})
+}
+
+func AddPermissionHandler(c *gin.Context) {
+	var input PermissionInput
+
+	if err := c.ShouldBindJSON(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Validate input
+	if len(input.Description) == 0 && input.PermissionId == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no permission id or description specified"})
+		return
+	}
+	if input.SafeId == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no safe id specified"})
+		return
+	}
+	if input.UserId == 0 && input.GroupId == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no user id or group id specified"})
+		return
+	}
+
+	p := models.Permission{
+		PermissionId: input.PermissionId,
+		Description:  input.Description,
+		ReadOnly:     input.ReadOnly,
+		SafeId:       input.SafeId,
+		UserId:       input.UserId,
+		GroupId:      input.GroupId,
+	}
+
+	//remove leading/trailing spaces in groupname
+	p.Description = html.EscapeString(strings.TrimSpace(p.Description))
+
+	// Check if role already exists
+	testPermission, _ := models.PermissionGetByDesc(p.Description)
+	log.Printf("AddPermissionHandler checking if permissions with description '%s' already exists\n", p.Description)
+
+	if (models.Permission{} == testPermission) {
+		log.Printf("AddPermissionHandler confirmed no permission with same description\n")
+	} else {
+		errorString := fmt.Sprintf("attempt to register permissions with description '%s' but id '%d' already exists", p.Description, testPermission.PermissionId)
+		log.Printf("Register error : '%s'\n", errorString)
+		c.JSON(http.StatusBadRequest, gin.H{"error": errorString})
+		return
+	}
+
+	_, err := p.PermissionAdd()
+
+	if err != nil {
+		errString := fmt.Sprintf("error creating permission : '%s'", err)
+		log.Printf("AddPermissionHandler %s\n", errString)
+		c.JSON(http.StatusBadRequest, gin.H{"error": errString})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "permission creation success", "data": p})
+}
diff --git a/main.go b/main.go
index 71ab0ef..fcfc5ec 100644
--- a/main.go
+++ b/main.go
@@ -257,6 +257,10 @@ func main() {
 	//adminOnly.POST("/group/update", controllers.UpdateGroup)
 	adminOnly.POST("/group/delete", controllers.DeleteGroupHandler)
 
+	// Permission functions for admin
+	adminOnly.GET("/permissions", controllers.GetPermissionsHandler)
+	adminOnly.POST("/permission/add", controllers.AddPermissionHandler)
+
 	// Safe functions for admin
 	adminOnly.GET("/safe/listall", controllers.GetAllSafesHandler)
 	adminOnly.POST("/safe/add", controllers.AddSafeHandler)
diff --git a/models/group.go b/models/group.go
index 6aaafa7..7954064 100644
--- a/models/group.go
+++ b/models/group.go
@@ -72,10 +72,13 @@ func (g *Group) GroupAdd() (*Group, error) {
 		} else {
 			affected, _ := result.RowsAffected()
 			id, _ := result.LastInsertId()
+			g.GroupId = int(id)
 			log.Printf("GroupAdd insert returned result id '%d' affecting %d row(s).\n", id, affected)
 		}
 	} else {
-		log.Printf("GroupAdd group name already exists : '%v'\n", err)
+		errString := "group with name already exists"
+		log.Printf("GroupAdd %s\n", errString)
+		return &Group{}, errors.New(errString)
 	}
 
 	return g, nil
diff --git a/models/permissions.go b/models/permissions.go
index 3077732..72dfbee 100644
--- a/models/permissions.go
+++ b/models/permissions.go
@@ -1,10 +1,102 @@
 package models
 
+import (
+	"errors"
+	"log"
+)
+
 type Permission struct {
-	PermissionId int    `db:"PermissionId"`
-	Description  string `db:"Description"`
-	ReadOnly     bool   `db:"ReadOnly"`
-	SafeId       int    `db:"SafeId"`
-	UserId       int    `db:"UserId"`
-	GroupId      int    `db:"GroupId"`
+	PermissionId int    `db:"PermissionId" json:"permissionId"`
+	Description  string `db:"Description" json:"description"`
+	ReadOnly     bool   `db:"ReadOnly" json:"readOnly"`
+	SafeId       int    `db:"SafeId" json:"safeId"`
+	UserId       int    `db:"UserId" json:"userId"`
+	GroupId      int    `db:"GroupId" json:"groupId"`
+}
+
+// PermissionGetByDesc queries the database for a permission record matching the specified description
+func PermissionGetByDesc(description string) (Permission, error) {
+	var p Permission
+
+	// Query database for matching group object
+	err := db.QueryRowx("SELECT * FROM permissions WHERE Description=?", description).StructScan(&p)
+	if err != nil {
+		return p, errors.New("permission not found")
+	}
+
+	return p, nil
+}
+
+// PermissionGetById queries the database for a permission record matching the specified permission id
+func PermissionGetById(id int) (Permission, error) {
+	var p Permission
+
+	// Query database for matching group object
+	err := db.QueryRowx("SELECT * FROM permissions WHERE PermissionId=?", id).StructScan(&p)
+	if err != nil {
+		return p, errors.New("permission not found")
+	}
+
+	return p, nil
+}
+
+// PermissionList returns a list of all permissions in database
+func PermissionList() ([]Permission, error) {
+	var results []Permission
+
+	// Query database for groups
+	rows, err := db.Queryx("SELECT * FROM permissions")
+
+	if err != nil {
+		log.Printf("PermissionList error executing sql record : '%s'\n", err)
+		return results, err
+	} else {
+		// parse all the results into a slice
+		for rows.Next() {
+			var p Permission
+			err = rows.StructScan(&p)
+			if err != nil {
+				log.Printf("PermissionList error parsing sql record : '%s'\n", err)
+				return results, err
+			}
+			results = append(results, p)
+
+		}
+		log.Printf("PermissionList retrieved '%d' results\n", len(results))
+	}
+
+	return results, nil
+}
+
+// PermissionAdd adds a new permission definition to the database
+func (p *Permission) PermissionAdd() (*Permission, error) {
+	var err error
+	//var check Permission
+	if len(p.Description) > 0 {
+		_, err = PermissionGetByDesc(p.Description)
+	} else {
+		return &Permission{}, errors.New("unable to identify permission with supplied parameters")
+	}
+
+	if err != nil && err.Error() == "permission not found" {
+		log.Printf("PermissionAdd confirmed no existing permission, continuing with creation of permission '%s'\n", p.Description)
+
+		result, err := db.NamedExec(("INSERT INTO permissions (Description, SafeId, UserId, GroupId, ReadOnly) VALUES (:Description, :SafeId, :UserId, :GroupId, :ReadOnly);"), p)
+
+		if err != nil {
+			log.Printf("PermissionAdd error executing sql record : '%s'\n", err)
+			return &Permission{}, err
+		} else {
+			affected, _ := result.RowsAffected()
+			id, _ := result.LastInsertId()
+			p.PermissionId = int(id)
+			log.Printf("PermissionAdd insert returned result id '%d' affecting %d row(s).\n", id, affected)
+		}
+	} else {
+		errString := "permission with identical description already exists"
+		log.Printf("PermissionAdd %s\n", errString)
+		return &Permission{}, errors.New(errString)
+	}
+
+	return p, nil
 }
diff --git a/models/safe.go b/models/safe.go
index 1f59f29..2bd3700 100644
--- a/models/safe.go
+++ b/models/safe.go
@@ -111,7 +111,9 @@ func (s *Safe) SafeAdd() (*Safe, error) {
 			log.Printf("safe: %v\n", s)
 		}
 	} else {
-		log.Printf("SafeAdd safe name already exists : '%v'\n", err)
+		errString := "safe with name already exists"
+		log.Printf("SafeAdd %s\n", errString)
+		return &Safe{}, errors.New(errString)
 	}
 
 	return s, nil