diff --git a/.golangci.yml b/.golangci.yml
index 304e41de1..4800096d9 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -139,7 +139,7 @@ linters:
         text: 'G115: integer overflow conversion int -> uint64'
       - linters:
           - recvcheck
-        text: the methods of "Right" use pointer receiver and non-pointer receiver.
+        text: the methods of "Permission" use pointer receiver and non-pointer receiver.
       - linters:
           - recvcheck
         text: the methods of "SubscriptionEntityType" use pointer receiver and non-pointer receiver.
diff --git a/AGENTS.md b/AGENTS.md
index 54b4ba1ca..18025e6ce 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -73,7 +73,7 @@ The Go backend follows a layered architecture with clear separation of concerns:
 
 **Key Patterns:**
 - **Generic CRUD**: Models implement `CRUDable` interface for standardized database operations
-- **Rights System**: Three-tier permissions (Read/Write/Admin) enforced across all operations
+- **Permissions System**: Three-tier permissions (Read/Write/Admin) enforced across all operations
 - **Event-Driven**: Event system for notifications, webhooks, and cross-cutting concerns
 - **Modular Design**: Pluggable authentication, avatar providers, migration tools
 
@@ -115,7 +115,7 @@ Modern Vue 3 composition API application with TypeScript:
 ### Adding New Features
 
 **Backend Changes:**
-1. Create/modify models in `pkg/models/` with proper CRUD and Rights interfaces as required
+1. Create/modify models in `pkg/models/` with proper CRUD and Permissions interfaces as required
 2. Add database migration if needed: `mage dev:make-migration <StructName>`
 3. Create/update services in `pkg/services/` for complex business logic
 4. Add API routes in `pkg/routes/api/v1/` following existing patterns
@@ -137,7 +137,7 @@ Modern Vue 3 composition API application with TypeScript:
 ### API Development
 - All API endpoints follow RESTful conventions under `/api/v1/`
 - Use generic web handlers in `pkg/web/handler/` for standard CRUD operations
-- Implement proper rights checking using the Rights interface
+- Implement proper permissions checking using the Permissions interface
 - Add Swagger annotations for automatic documentation generation
 
 ### Testing
@@ -175,7 +175,7 @@ After adjusting the source string, you need to call the respective translation l
 - Use `pkg/config/` for configuration management
 
 **Code Style:**
-- Go: golangci-lint per `.golangci.yml`; use goimports; wrap errors with `fmt.Errorf("...: %w", err)`; enforce rights checks in models; never log secrets; do not edit generated `pkg/swagger/*`
+- Go: golangci-lint per `.golangci.yml`; use goimports; wrap errors with `fmt.Errorf("...: %w", err)`; enforce permissions checks in models; never log secrets; do not edit generated `pkg/swagger/*`
 - Vue: ESLint + TS; single quotes, trailing commas, no semicolons, tab indent; script setup + lang ts; keep services/models in sync with backend
 - Follow existing patterns for consistency
 
@@ -184,16 +184,16 @@ After adjusting the source string, you need to call the respective translation l
 - Vue: PascalCase for components, camelCase for composables
 - API endpoints: kebab-case in URLs, camelCase in JSON
 
-**Rights and Permissions:**
-- Always implement Rights interface for new models
+**Permissions and Permissions:**
+- Always implement Permissions interface for new models
 - Use `CanRead`, `CanWrite`, `CanCreate`, `CanDelete` methods
-- Rights are enforced at the model level, not just routes
+- Permissions are enforced at the model level, not just routes
 
 ## Common Gotchas
 
 - Database migrations are irreversible in production - test thoroughly
 - Frontend services must match backend model structure exactly
-- Rights checking is mandatory for all CRUD operations
+- Permissions checking is mandatory for all CRUD operations
 - Event listeners in `pkg/*/listeners.go` must be registered properly
 - CORS settings in backend must allow frontend domain
 - API tokens have different scopes - check permissions carefully
diff --git a/frontend/cypress/e2e/project/project-view-list.spec.ts b/frontend/cypress/e2e/project/project-view-list.spec.ts
index a6414621d..482fcce98 100644
--- a/frontend/cypress/e2e/project/project-view-list.spec.ts
+++ b/frontend/cypress/e2e/project/project-view-list.spec.ts
@@ -59,7 +59,7 @@ describe('Project View List', () => {
 		UserProjectFactory.create(1, {
 			project_id: 2,
 			user_id: 1,
-			right: 0,
+			permission: 0,
 		})
 		const projects = ProjectFactory.create(2, {
 			owner_id: '{increment}',
diff --git a/frontend/cypress/e2e/sharing/linkShare.spec.ts b/frontend/cypress/e2e/sharing/linkShare.spec.ts
index 37b5b8cc3..0792948f7 100644
--- a/frontend/cypress/e2e/sharing/linkShare.spec.ts
+++ b/frontend/cypress/e2e/sharing/linkShare.spec.ts
@@ -11,7 +11,7 @@ function prepareLinkShare() {
 	})
 	const linkShares = LinkShareFactory.create(1, {
 		project_id: projects[0].id,
-		right: 0,
+		permission: 0,
 	})
 	
 	return {
diff --git a/frontend/cypress/factories/link_sharing.ts b/frontend/cypress/factories/link_sharing.ts
index c420e6297..b09ddfca2 100644
--- a/frontend/cypress/factories/link_sharing.ts
+++ b/frontend/cypress/factories/link_sharing.ts
@@ -11,7 +11,7 @@ export class LinkShareFactory extends Factory {
 			id: '{increment}',
 			hash: faker.lorem.word(32),
 			project_id: 1,
-			right: 0,
+			permission: 0,
 			sharing_type: 0,
 			shared_by_id: 1,
 			created: now.toISOString(),
diff --git a/frontend/cypress/factories/users_project.ts b/frontend/cypress/factories/users_project.ts
index c85ed2371..b6bdde356 100644
--- a/frontend/cypress/factories/users_project.ts
+++ b/frontend/cypress/factories/users_project.ts
@@ -10,7 +10,7 @@ export class UserProjectFactory extends Factory {
 			id: '{increment}',
 			project_id: 1,
 			user_id: 1,
-			right: 0,
+			permission: 0,
 			created: now.toISOString(),
 			updated: now.toISOString(),
 		}
diff --git a/frontend/src/components/home/AppHeader.vue b/frontend/src/components/home/AppHeader.vue
index e5dd2aa9b..14056f3a4 100644
--- a/frontend/src/components/home/AppHeader.vue
+++ b/frontend/src/components/home/AppHeader.vue
@@ -116,7 +116,7 @@
 <script setup lang="ts">
 import { computed } from 'vue'
 
-import { RIGHTS as Rights } from '@/constants/rights'
+import { PERMISSIONS as Permissions } from '@/constants/permissions'
 
 import ProjectSettingsDropdown from '@/components/project/ProjectSettingsDropdown.vue'
 import Dropdown from '@/components/misc/Dropdown.vue'
@@ -137,7 +137,7 @@ import { useAuthStore } from '@/stores/auth'
 const baseStore = useBaseStore()
 const currentProject = computed(() => baseStore.currentProject)
 const background = computed(() => baseStore.background)
-const canWriteCurrentProject = computed(() => baseStore.currentProject?.maxRight > Rights.READ)
+const canWriteCurrentProject = computed(() => baseStore.currentProject?.maxPermission > Permissions.READ)
 const menuActive = computed(() => baseStore.menuActive)
 
 const authStore = useAuthStore()
diff --git a/frontend/src/components/home/ProjectsNavigationItem.vue b/frontend/src/components/home/ProjectsNavigationItem.vue
index 13273968d..eb4aec3ba 100644
--- a/frontend/src/components/home/ProjectsNavigationItem.vue
+++ b/frontend/src/components/home/ProjectsNavigationItem.vue
@@ -15,7 +15,7 @@
 				/>
 			</BaseButton>
 			<span
-				v-if="project.id > 0 && project.maxRight > RIGHTS.READ"
+				v-if="project.id > 0 && project.maxPermission > PERMISSIONS.READ"
 				class="icon menu-item-icon handle drag-handle-standalone"
 				@mousedown.stop
 				@click.stop.prevent
@@ -48,7 +48,7 @@
 				<span class="project-menu-title">{{ getProjectTitle(project) }}</span>
 			</BaseButton>
 			<BaseButton
-				v-if="project.id > 0 && project.maxRight > RIGHTS.READ"
+				v-if="project.id > 0 && project.maxPermission > PERMISSIONS.READ"
 				class="favorite"
 				:class="{'is-favorite': project.isFavorite}"
 				@click="projectStore.toggleProjectFavorite(project)"
@@ -57,7 +57,7 @@
 				<Icon :icon="project.isFavorite ? 'star' : ['far', 'star']" />
 			</BaseButton>
 			<ProjectSettingsDropdown
-				v-if="project.maxRight > RIGHTS.READ"
+				v-if="project.maxPermission > PERMISSIONS.READ"
 				class="menu-list-dropdown"
 				:project="project"
 			>
@@ -97,7 +97,7 @@ import ProjectSettingsDropdown from '@/components/project/ProjectSettingsDropdow
 import {getProjectTitle} from '@/helpers/getProjectTitle'
 import ColorBubble from '@/components/misc/ColorBubble.vue'
 import ProjectsNavigation from '@/components/home/ProjectsNavigation.vue'
-import {RIGHTS} from '@/constants/rights'
+import {PERMISSIONS} from '@/constants/permissions'
 
 const props = defineProps<{
 	project: IProject,
diff --git a/frontend/src/components/project/ProjectSettingsDropdown.vue b/frontend/src/components/project/ProjectSettingsDropdown.vue
index 96a18bbb0..fbb4035b3 100644
--- a/frontend/src/components/project/ProjectSettingsDropdown.vue
+++ b/frontend/src/components/project/ProjectSettingsDropdown.vue
@@ -110,7 +110,7 @@
 				{{ $t('menu.createProject') }}
 			</DropdownItem>
 			<DropdownItem
-				v-if="project.maxRight === RIGHTS.ADMIN"
+				v-if="project.maxPermission === PERMISSIONS.ADMIN"
 				v-tooltip="isDefaultProject ? $t('menu.cantDeleteIsDefault') : ''"
 				:to="{ name: 'project.settings.delete', params: { projectId: project.id } }"
 				icon="trash-alt"
@@ -137,7 +137,7 @@ import {isSavedFilter} from '@/services/savedFilter'
 import {useConfigStore} from '@/stores/config'
 import {useProjectStore} from '@/stores/projects'
 import {useAuthStore} from '@/stores/auth'
-import {RIGHTS} from '@/constants/rights'
+import {PERMISSIONS} from '@/constants/permissions'
 
 const props = defineProps<{
 	project: IProject
diff --git a/frontend/src/components/project/ProjectWrapper.vue b/frontend/src/components/project/ProjectWrapper.vue
index b968102f0..44001db9b 100644
--- a/frontend/src/components/project/ProjectWrapper.vue
+++ b/frontend/src/components/project/ProjectWrapper.vue
@@ -77,7 +77,7 @@ const currentProject = computed<IProject>(() => {
 		id: 0,
 		title: '',
 		isArchived: false,
-		maxRight: null,
+		maxPermission: null,
 	} : baseStore.currentProject
 })
 useTitle(() => currentProject.value?.id ? getProjectTitle(currentProject.value) : '')
diff --git a/frontend/src/components/project/views/ProjectGantt.vue b/frontend/src/components/project/views/ProjectGantt.vue
index 5d997e58e..578664a35 100644
--- a/frontend/src/components/project/views/ProjectGantt.vue
+++ b/frontend/src/components/project/views/ProjectGantt.vue
@@ -87,7 +87,7 @@ import TaskForm from '@/components/tasks/TaskForm.vue'
 
 import GanttChart from '@/components/gantt/GanttChart.vue'
 import {useGanttFilters} from '../../../views/project/helpers/useGanttFilters'
-import {RIGHTS} from '@/constants/rights'
+import {PERMISSIONS} from '@/constants/permissions'
 
 import type {DateISO} from '@/types/DateISO'
 import type {ITask} from '@/modelTypes/ITask'
@@ -103,7 +103,7 @@ const props = defineProps<{
 
 
 const baseStore = useBaseStore()
-const canWrite = computed(() => baseStore.currentProject?.maxRight > RIGHTS.READ)
+const canWrite = computed(() => baseStore.currentProject?.maxPermission > PERMISSIONS.READ)
 
 const {route, viewId} = toRefs(props)
 const {
diff --git a/frontend/src/components/project/views/ProjectKanban.vue b/frontend/src/components/project/views/ProjectKanban.vue
index 71c96c213..769978754 100644
--- a/frontend/src/components/project/views/ProjectKanban.vue
+++ b/frontend/src/components/project/views/ProjectKanban.vue
@@ -279,7 +279,7 @@ import {useI18n} from 'vue-i18n'
 import draggable from 'zhyswan-vuedraggable'
 import {klona} from 'klona/lite'
 
-import {RIGHTS as Rights} from '@/constants/rights'
+import {PERMISSIONS as Permissions} from '@/constants/permissions'
 import BucketModel from '@/models/bucket'
 
 import type {IBucket} from '@/modelTypes/IBucket'
@@ -398,7 +398,7 @@ const bucketDraggableComponentData = computed(() => ({
 }))
 const project = computed(() => props.projectId ? projectStore.projects[props.projectId] : null)
 const view = computed(() => project.value?.views.find(v => v.id === props.viewId) as IProjectView || null)
-const canWrite = computed(() => baseStore.currentProject?.maxRight > Rights.READ && view.value.bucketConfigurationMode === 'manual')
+const canWrite = computed(() => baseStore.currentProject?.maxPermission > Permissions.READ && view.value.bucketConfigurationMode === 'manual')
 const canCreateTasks = computed(() => canWrite.value && props.projectId > 0)
 const buckets = computed(() => kanbanStore.buckets)
 const loading = computed(() => kanbanStore.isLoading)
diff --git a/frontend/src/components/project/views/ProjectList.vue b/frontend/src/components/project/views/ProjectList.vue
index bb4d7d0dd..28a046756 100644
--- a/frontend/src/components/project/views/ProjectList.vue
+++ b/frontend/src/components/project/views/ProjectList.vue
@@ -109,7 +109,7 @@ import Pagination from '@/components/misc/Pagination.vue'
 import {ALPHABETICAL_SORT} from '@/components/project/partials/Filters.vue'
 
 import {useTaskList} from '@/composables/useTaskList'
-import {RIGHTS as Rights} from '@/constants/rights'
+import {PERMISSIONS as Permissions} from '@/constants/permissions'
 import {calculateItemPosition} from '@/helpers/calculateItemPosition'
 import type {ITask} from '@/modelTypes/ITask'
 import {isSavedFilter} from '@/services/savedFilter'
@@ -182,7 +182,7 @@ const baseStore = useBaseStore()
 const project = computed(() => baseStore.currentProject)
 
 const canWrite = computed(() => {
-	return project.value.maxRight > Rights.READ && project.value.id > 0
+	return project.value.maxPermission > Permissions.READ && project.value.id > 0
 })
 
 const isPseudoProject = computed(() => (project.value && isSavedFilter(project.value)) || project.value?.id === -1)
diff --git a/frontend/src/components/sharing/LinkSharing.vue b/frontend/src/components/sharing/LinkSharing.vue
index 11c183d6b..acb3d52c5 100644
--- a/frontend/src/components/sharing/LinkSharing.vue
+++ b/frontend/src/components/sharing/LinkSharing.vue
@@ -29,22 +29,22 @@
 						class="label"
 						for="linkShareRight"
 					>
-						{{ $t('project.share.right.title') }}
+						{{ $t('project.share.permission.title') }}
 					</label>
 					<div class="control">
 						<div class="select">
 							<select
 								id="linkShareRight"
-								v-model="selectedRight"
+								v-model="selectedPermission"
 							>
-								<option :value="RIGHTS.READ">
-									{{ $t('project.share.right.read') }}
+								<option :value="PERMISSIONS.READ">
+									{{ $t('project.share.permission.read') }}
 								</option>
-								<option :value="RIGHTS.READ_WRITE">
-									{{ $t('project.share.right.readWrite') }}
+								<option :value="PERMISSIONS.READ_WRITE">
+									{{ $t('project.share.permission.readWrite') }}
 								</option>
-								<option :value="RIGHTS.ADMIN">
-									{{ $t('project.share.right.admin') }}
+								<option :value="PERMISSIONS.ADMIN">
+									{{ $t('project.share.permission.admin') }}
 								</option>
 							</select>
 						</div>
@@ -129,23 +129,23 @@
 							</p>
 
 							<p class="mbe-2">
-								<template v-if="s.right === RIGHTS.ADMIN">
+								<template v-if="s.permission === PERMISSIONS.ADMIN">
 									<span class="icon is-small">
 										<Icon icon="lock" />
 									</span>&nbsp;
-									{{ $t('project.share.right.admin') }}
+									{{ $t('project.share.permission.admin') }}
 								</template>
-								<template v-else-if="s.right === RIGHTS.READ_WRITE">
+								<template v-else-if="s.permission === PERMISSIONS.READ_WRITE">
 									<span class="icon is-small">
 										<Icon icon="pen" />
 									</span>&nbsp;
-									{{ $t('project.share.right.readWrite') }}
+									{{ $t('project.share.permission.readWrite') }}
 								</template>
 								<template v-else>
 									<span class="icon is-small">
 										<Icon icon="users" />
 									</span>&nbsp;
-									{{ $t('project.share.right.read') }}
+									{{ $t('project.share.permission.read') }}
 								</template>
 							</p>
 						
@@ -221,7 +221,7 @@
 import {ref, watch, computed, shallowReactive} from 'vue'
 import {useI18n} from 'vue-i18n'
 
-import {RIGHTS} from '@/constants/rights'
+import {PERMISSIONS} from '@/constants/permissions'
 import LinkShareModel from '@/models/linkShare'
 
 import type {ILinkShare} from '@/modelTypes/ILinkShare'
@@ -246,7 +246,7 @@ const {t} = useI18n({useScope: 'global'})
 
 const linkShares = ref<ILinkShare[]>([])
 const linkShareService = shallowReactive(new LinkShareService())
-const selectedRight = ref(RIGHTS.READ)
+const selectedPermission = ref(PERMISSIONS.READ)
 const name = ref('')
 const password = ref('')
 const showDeleteModal = ref(false)
@@ -296,13 +296,13 @@ watch(() => ([linkShares.value, availableViews.value]), ([newLinkShares, newProj
 
 async function add(projectId: IProject['id']) {
 	const newLinkShare = new LinkShareModel({
-		right: selectedRight.value,
+		permission: selectedPermission.value,
 		projectId,
 		name: name.value,
 		password: password.value,
 	})
 	await linkShareService.create(newLinkShare)
-	selectedRight.value = RIGHTS.READ
+	selectedPermission.value = PERMISSIONS.READ
 	name.value = ''
 	password.value = ''
 	showNewForm.value = false
diff --git a/frontend/src/components/sharing/UserTeam.vue b/frontend/src/components/sharing/UserTeam.vue
index 63c0b3460..2c2fbe83a 100644
--- a/frontend/src/components/sharing/UserTeam.vue
+++ b/frontend/src/components/sharing/UserTeam.vue
@@ -71,23 +71,23 @@
 						</td>
 					</template>
 					<td class="type">
-						<template v-if="s.right === RIGHTS.ADMIN">
+						<template v-if="s.permission === PERMISSIONS.ADMIN">
 							<span class="icon is-small">
 								<Icon icon="lock" />
 							</span>
-							{{ $t('project.share.right.admin') }}
+							{{ $t('project.share.permission.admin') }}
 						</template>
-						<template v-else-if="s.right === RIGHTS.READ_WRITE">
+						<template v-else-if="s.permission === PERMISSIONS.READ_WRITE">
 							<span class="icon is-small">
 								<Icon icon="pen" />
 							</span>
-							{{ $t('project.share.right.readWrite') }}
+							{{ $t('project.share.permission.readWrite') }}
 						</template>
 						<template v-else>
 							<span class="icon is-small">
 								<Icon icon="users" />
 							</span>
-							{{ $t('project.share.right.read') }}
+							{{ $t('project.share.permission.read') }}
 						</template>
 					</td>
 					<td
@@ -96,27 +96,27 @@
 					>
 						<div class="select">
 							<select
-								v-model="selectedRight[s.id]"
+								v-model="selectedPermission[s.id]"
 								class="mie-2"
 								@change="toggleType(s)"
 							>
 								<option
-									:selected="s.right === RIGHTS.READ"
-									:value="RIGHTS.READ"
+									:selected="s.permission === PERMISSIONS.READ"
+									:value="PERMISSIONS.READ"
 								>
-									{{ $t('project.share.right.read') }}
+									{{ $t('project.share.permission.read') }}
 								</option>
 								<option
-									:selected="s.right === RIGHTS.READ_WRITE"
-									:value="RIGHTS.READ_WRITE"
+									:selected="s.permission === PERMISSIONS.READ_WRITE"
+									:value="PERMISSIONS.READ_WRITE"
 								>
-									{{ $t('project.share.right.readWrite') }}
+									{{ $t('project.share.permission.readWrite') }}
 								</option>
 								<option
-									:selected="s.right === RIGHTS.ADMIN"
-									:value="RIGHTS.ADMIN"
+									:selected="s.permission === PERMISSIONS.ADMIN"
+									:value="PERMISSIONS.ADMIN"
 								>
-									{{ $t('project.share.right.admin') }}
+									{{ $t('project.share.permission.admin') }}
 								</option>
 							</select>
 						</div>
@@ -178,7 +178,7 @@ import TeamModel from '@/models/team'
 import type {ITeam} from '@/modelTypes/ITeam'
 
 
-import {RIGHTS} from '@/constants/rights'
+import {PERMISSIONS} from '@/constants/permissions'
 import Multiselect from '@/components/input/Multiselect.vue'
 import Nothing from '@/components/misc/Nothing.vue'
 import {success} from '@/message'
@@ -209,7 +209,7 @@ let searchService: UserService | TeamService
 let sharable: Ref<IUser | ITeam>
 
 const searchLabel = ref('')
-const selectedRight = ref({})
+const selectedPermission = ref({})
 
 
 // This holds either teams or users who this namepace or project is shared with
@@ -275,8 +275,8 @@ load()
 
 async function load() {
 	sharables.value = await stuffService.getAll(stuffModel)
-	sharables.value.forEach(({id, right}) =>
-		selectedRight.value[id] = right,
+	sharables.value.forEach(({id, permission}) =>
+		selectedPermission.value[id] = permission,
 	)
 }
 
@@ -309,9 +309,9 @@ async function add(admin) {
 	if (admin === null) {
 		admin = false
 	}
-	stuffModel.right = RIGHTS.READ
+	stuffModel.permission = PERMISSIONS.READ
 	if (admin) {
-		stuffModel.right = RIGHTS.ADMIN
+		stuffModel.permission = PERMISSIONS.ADMIN
 	}
 
 	if (props.shareType === 'user') {
@@ -327,13 +327,13 @@ async function add(admin) {
 
 async function toggleType(sharable) {
 	if (
-		selectedRight.value[sharable.id] !== RIGHTS.ADMIN &&
-		selectedRight.value[sharable.id] !== RIGHTS.READ &&
-		selectedRight.value[sharable.id] !== RIGHTS.READ_WRITE
+		selectedPermission.value[sharable.id] !== PERMISSIONS.ADMIN &&
+		selectedPermission.value[sharable.id] !== PERMISSIONS.READ &&
+		selectedPermission.value[sharable.id] !== PERMISSIONS.READ_WRITE
 	) {
-		selectedRight.value[sharable.id] = RIGHTS.READ
+		selectedPermission.value[sharable.id] = PERMISSIONS.READ
 	}
-	stuffModel.right = selectedRight.value[sharable.id]
+	stuffModel.permission = selectedPermission.value[sharable.id]
 
 	if (props.shareType === 'user') {
 		stuffModel.username = sharable.username
@@ -350,7 +350,7 @@ async function toggleType(sharable) {
 			(sharables.value[i].id === stuffModel.teamId &&
 				props.shareType === 'team')
 		) {
-			sharables.value[i].right = r.right
+			sharables.value[i].permission = r.permission
 		}
 	}
 	success({message: t('project.share.userTeam.updatedSuccess', {type: shareTypeName.value})})
diff --git a/frontend/src/constants/permissions.ts b/frontend/src/constants/permissions.ts
new file mode 100644
index 000000000..dc2cb076c
--- /dev/null
+++ b/frontend/src/constants/permissions.ts
@@ -0,0 +1,7 @@
+export const PERMISSIONS = {
+	'READ': 0,
+	'READ_WRITE': 1,
+	'ADMIN': 2,
+} as const
+
+export type Permission = typeof PERMISSIONS[keyof typeof PERMISSIONS]
diff --git a/frontend/src/constants/rights.ts b/frontend/src/constants/rights.ts
deleted file mode 100644
index 2f82d07cb..000000000
--- a/frontend/src/constants/rights.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-export const RIGHTS = {
-	'READ': 0,
-	'READ_WRITE': 1,
-	'ADMIN': 2,
-} as const
-
-export type Right = typeof RIGHTS[keyof typeof RIGHTS]
diff --git a/frontend/src/modelTypes/IAbstract.ts b/frontend/src/modelTypes/IAbstract.ts
index 03bf58be3..2d178c2cc 100644
--- a/frontend/src/modelTypes/IAbstract.ts
+++ b/frontend/src/modelTypes/IAbstract.ts
@@ -1,5 +1,5 @@
-import type {Right} from '@/constants/rights'
+import type {Permission} from '@/constants/permissions'
 
 export interface IAbstract {
-	maxRight: Right | null // FIXME: should this be readonly?
+	maxPermission: Permission | null // FIXME: should this be readonly?
 }
diff --git a/frontend/src/modelTypes/ILinkShare.ts b/frontend/src/modelTypes/ILinkShare.ts
index aa62b9c29..a886ac0f8 100644
--- a/frontend/src/modelTypes/ILinkShare.ts
+++ b/frontend/src/modelTypes/ILinkShare.ts
@@ -1,11 +1,11 @@
 import type {IAbstract} from './IAbstract'
 import type {IUser} from './IUser'
-import type { Right } from '@/constants/rights'
+import type { Permission } from '@/constants/permissions'
 
 export interface ILinkShare extends IAbstract {
 	id: number
 	hash: string
-	right: Right
+	permission: Permission
 	sharedBy: IUser
 	sharingType: number // FIXME: use correct numbers
 	projectId: number
diff --git a/frontend/src/modelTypes/ITeam.ts b/frontend/src/modelTypes/ITeam.ts
index ccfd33b84..eb70d4f38 100644
--- a/frontend/src/modelTypes/ITeam.ts
+++ b/frontend/src/modelTypes/ITeam.ts
@@ -1,14 +1,14 @@
 import type {IAbstract} from './IAbstract'
 import type {IUser} from './IUser'
 import type {ITeamMember} from './ITeamMember'
-import type {Right} from '@/constants/rights'
+import type {Permission} from '@/constants/permissions'
 
 export interface ITeam extends IAbstract {
 	id: number
 	name: string
 	description: string
 	members: ITeamMember[]
-	right: Right
+	permission: Permission
 	externalId: string
 	isPublic: boolean
 
diff --git a/frontend/src/modelTypes/ITeamShareBase.ts b/frontend/src/modelTypes/ITeamShareBase.ts
index 5371c47b9..0379e04d9 100644
--- a/frontend/src/modelTypes/ITeamShareBase.ts
+++ b/frontend/src/modelTypes/ITeamShareBase.ts
@@ -1,10 +1,10 @@
 import type {IAbstract} from './IAbstract'
 import type {ITeam} from './ITeam'
-import type {Right} from '@/constants/rights'
+import type {Permission} from '@/constants/permissions'
 
 export interface ITeamShareBase extends IAbstract {
 	teamId: ITeam['id']
-	right: Right
+	permission: Permission
 
 	created: Date
 	updated: Date
diff --git a/frontend/src/modelTypes/IUserShareBase.ts b/frontend/src/modelTypes/IUserShareBase.ts
index 2a9f384bc..822507328 100644
--- a/frontend/src/modelTypes/IUserShareBase.ts
+++ b/frontend/src/modelTypes/IUserShareBase.ts
@@ -1,10 +1,10 @@
 import type {IAbstract} from './IAbstract'
 import type {IUser} from './IUser'
-import type {Right} from '@/constants/rights'
+import type {Permission} from '@/constants/permissions'
 
 export interface IUserShareBase extends IAbstract {
 	username: IUser['username']
-	right: Right
+	permission: Permission
 
 	created: Date
 	updated: Date
diff --git a/frontend/src/models/abstractModel.ts b/frontend/src/models/abstractModel.ts
index de27e16e5..16b0785c1 100644
--- a/frontend/src/models/abstractModel.ts
+++ b/frontend/src/models/abstractModel.ts
@@ -1,15 +1,15 @@
 import {objectToCamelCase} from '@/helpers/case'
 import {omitBy, isNil} from '@/helpers/utils'
-import type {Right} from '@/constants/rights'
+import type {Permission} from '@/constants/permissions'
 import type {IAbstract} from '@/modelTypes/IAbstract'
 
 export default abstract class AbstractModel<Model extends IAbstract = IAbstract> implements IAbstract {
 
 
 	/**
-	 * The max right the user has on this object, as returned by the x-max-right header from the api.
+	 * The max permission the user has on this object, as returned by the x-max-permission header from the api.
 	 */
-	maxRight: Right | null = null
+	maxPermission: Permission | null = null
 	
 	/**
 	* Takes an object and merges its data with the default data of this model.
diff --git a/frontend/src/models/linkShare.ts b/frontend/src/models/linkShare.ts
index 884e7a969..3656df932 100644
--- a/frontend/src/models/linkShare.ts
+++ b/frontend/src/models/linkShare.ts
@@ -1,14 +1,14 @@
 import AbstractModel from './abstractModel'
 import UserModel from './user'
 
-import {RIGHTS, type Right} from '@/constants/rights'
+import {PERMISSIONS, type Permission} from '@/constants/permissions'
 import type {ILinkShare} from '@/modelTypes/ILinkShare'
 import type {IUser} from '@/modelTypes/IUser'
 
 export default class LinkShareModel extends AbstractModel<ILinkShare> implements ILinkShare {
 	id = 0
 	hash = ''
-	right: Right = RIGHTS.READ
+	permission: Permission = PERMISSIONS.READ
 	sharedBy: IUser = UserModel
 	sharingType = 0 // FIXME: use correct numbers
 	projectId = 0
diff --git a/frontend/src/models/team.ts b/frontend/src/models/team.ts
index 890ebc2a1..fef9ae2a1 100644
--- a/frontend/src/models/team.ts
+++ b/frontend/src/models/team.ts
@@ -2,7 +2,7 @@ import AbstractModel from './abstractModel'
 import UserModel from './user'
 import TeamMemberModel from './teamMember'
 
-import {RIGHTS, type Right} from '@/constants/rights'
+import {PERMISSIONS, type Permission} from '@/constants/permissions'
 import type {ITeam} from '@/modelTypes/ITeam'
 import type {ITeamMember} from '@/modelTypes/ITeamMember'
 import type {IUser} from '@/modelTypes/IUser'
@@ -12,7 +12,7 @@ export default class TeamModel extends AbstractModel<ITeam> implements ITeam {
 	name = ''
 	description = ''
 	members: ITeamMember[] = []
-	right: Right = RIGHTS.READ
+	permission: Permission = PERMISSIONS.READ
 	externalId = ''
 	isPublic: boolean = false
 
diff --git a/frontend/src/models/teamShareBase.ts b/frontend/src/models/teamShareBase.ts
index cef682cb4..037c56184 100644
--- a/frontend/src/models/teamShareBase.ts
+++ b/frontend/src/models/teamShareBase.ts
@@ -1,6 +1,6 @@
 import AbstractModel from './abstractModel'
 
-import {RIGHTS, type Right} from '@/constants/rights'
+import {PERMISSIONS, type Permission} from '@/constants/permissions'
 import type {ITeamShareBase} from '@/modelTypes/ITeamShareBase'
 import type {ITeam} from '@/modelTypes/ITeam'
 
@@ -10,7 +10,7 @@ import type {ITeam} from '@/modelTypes/ITeam'
  */
 export default class TeamShareBaseModel extends AbstractModel<ITeamShareBase> implements ITeamShareBase {
 	teamId: ITeam['id'] = 0
-	right: Right = RIGHTS.READ
+	permission: Permission = PERMISSIONS.READ
 
 	created: Date = null
 	updated: Date = null
diff --git a/frontend/src/models/userProject.ts b/frontend/src/models/userProject.ts
index 3be6b9d2d..50f804dda 100644
--- a/frontend/src/models/userProject.ts
+++ b/frontend/src/models/userProject.ts
@@ -3,7 +3,7 @@ import UserShareBaseModel from './userShareBase'
 import type {IUserProject} from '@/modelTypes/IUserProject'
 import type {IProject} from '@/modelTypes/IProject'
 
-// This class extends the user share model with a 'rights' parameter which is used in sharing
+// This class extends the user share model with a 'permissions' parameter which is used in sharing
 export default class UserProjectModel extends UserShareBaseModel implements IUserProject {
 	projectId: IProject['id'] = 0
 
diff --git a/frontend/src/models/userShareBase.ts b/frontend/src/models/userShareBase.ts
index 376af8508..6164f84a3 100644
--- a/frontend/src/models/userShareBase.ts
+++ b/frontend/src/models/userShareBase.ts
@@ -1,12 +1,12 @@
 import AbstractModel from './abstractModel'
 
-import {RIGHTS, type Right} from '@/constants/rights'
+import {PERMISSIONS, type Permission} from '@/constants/permissions'
 import type {IUserShareBase} from '@/modelTypes/IUserShareBase'
 import type {IUser} from '@/modelTypes/IUser'
 
 export default class UserShareBaseModel extends AbstractModel<IUserShareBase> implements IUserShareBase {
 	username: IUser['username'] = ''
-	right: Right = RIGHTS.READ
+	permission: Permission = PERMISSIONS.READ
 
 	created: Date = null
 	updated: Date = null
diff --git a/frontend/src/services/abstractService.ts b/frontend/src/services/abstractService.ts
index a09507101..347719eb6 100644
--- a/frontend/src/services/abstractService.ts
+++ b/frontend/src/services/abstractService.ts
@@ -4,7 +4,7 @@ import type {Method} from 'axios'
 import {objectToSnakeCase} from '@/helpers/case'
 import AbstractModel from '@/models/abstractModel'
 import type {IAbstract} from '@/modelTypes/IAbstract'
-import type {Right} from '@/constants/rights'
+import type {Permission} from '@/constants/permissions'
 
 interface Paths {
 	create : string
@@ -310,7 +310,7 @@ export default abstract class AbstractService<Model extends IAbstract = IAbstrac
 		try {
 			const response = await this.http.get(finalUrl, {params: prepareParams(params)})
 			const result = this.modelGetFactory(response.data)
-			result.maxRight = Number(response.headers['x-max-right']) as Right
+			result.maxPermission = Number(response.headers['x-max-permission']) as Permission
 			return result
 		} finally {
 			cancel()
@@ -386,8 +386,8 @@ export default abstract class AbstractService<Model extends IAbstract = IAbstrac
 		try {
 			const response = await this.http.put(finalUrl, model)
 			const result = this.modelCreateFactory(response.data)
-			if (typeof model.maxRight !== 'undefined') {
-				result.maxRight = model.maxRight
+			if (typeof model.maxPermission !== 'undefined') {
+				result.maxPermission = model.maxPermission
 			}
 			return result
 		} finally {
@@ -405,8 +405,8 @@ export default abstract class AbstractService<Model extends IAbstract = IAbstrac
 		try {
 			const response = await this.http.post(url, model)
 			const result = this.modelUpdateFactory(response.data)
-			if (typeof model.maxRight !== 'undefined') {
-				result.maxRight = model.maxRight
+			if (typeof model.maxPermission !== 'undefined') {
+				result.maxPermission = model.maxPermission
 			}
 			return result
 		} finally {
diff --git a/frontend/src/stores/base.ts b/frontend/src/stores/base.ts
index eb15f376e..052fdacdf 100644
--- a/frontend/src/stores/base.ts
+++ b/frontend/src/stores/base.ts
@@ -12,7 +12,7 @@ import {useMenuActive} from '@/composables/useMenuActive'
 
 import {useAuthStore} from '@/stores/auth'
 import type {IProject} from '@/modelTypes/IProject'
-import type {Right} from '@/constants/rights'
+import type {Permission} from '@/constants/permissions'
 import type {IProjectView} from '@/modelTypes/IProjectView'
 
 export const useBaseStore = defineStore('base', () => {
@@ -40,19 +40,19 @@ export const useBaseStore = defineStore('base', () => {
 	const updateAvailable = ref(false)
 
 	function setCurrentProject(newCurrentProject: IProject | null, currentViewId?: IProjectView['id']) {
-		// Server updates don't return the right. Therefore, the right is reset after updating the project which is
-		// confusing because all the buttons will disappear in that case. To prevent this, we're keeping the right
+		// Server updates don't return the permission. Therefore, the permission is reset after updating the project which is
+		// confusing because all the buttons will disappear in that case. To prevent this, we're keeping the permission
 		// when updating the project in global state.
-		let maxRight: Right | null = newCurrentProject?.maxRight || null
+		let maxPermission: Permission | null = newCurrentProject?.maxPermission || null
 		if (
-			typeof currentProject.value?.maxRight !== 'undefined' &&
+			typeof currentProject.value?.maxPermission !== 'undefined' &&
 			newCurrentProject !== null &&
 			(
-				typeof newCurrentProject.maxRight === 'undefined' ||
-				newCurrentProject.maxRight === null
+				typeof newCurrentProject.maxPermission === 'undefined' ||
+				newCurrentProject.maxPermission === null
 			)
 		) {
-			maxRight = currentProject.value.maxRight
+			maxPermission = currentProject.value.maxPermission
 		}
 		if (newCurrentProject === null) {
 			currentProject.value = null
@@ -60,7 +60,7 @@ export const useBaseStore = defineStore('base', () => {
 		}
 		currentProject.value = {
 			...newCurrentProject,
-			maxRight,
+			maxPermission,
 		}
 		setCurrentProjectViewId(currentViewId)
 	}
diff --git a/frontend/src/stores/projects.ts b/frontend/src/stores/projects.ts
index 6a29b4d35..9ee06244a 100644
--- a/frontend/src/stores/projects.ts
+++ b/frontend/src/stores/projects.ts
@@ -17,7 +17,7 @@ import {success} from '@/message'
 import {useBaseStore} from '@/stores/base'
 import {getSavedFilterIdFromProjectId} from '@/services/savedFilter'
 import type {IProjectView} from '@/modelTypes/IProjectView'
-import {RIGHTS} from '@/constants/rights.ts'
+import {PERMISSIONS} from '@/constants/permissions.ts'
 
 const {add, remove, search, update} = createNewIndexer('projects', ['title', 'description'])
 
@@ -213,7 +213,7 @@ export const useProjectStore = defineStore('project', () => {
 		let page = 1
 		try {
 			do {
-				const newProjects = await projectService.getAll({}, {is_archived: true, expand: 'rights'}, page) as IProject[]
+				const newProjects = await projectService.getAll({}, {is_archived: true, expand: 'permissions'}, page) as IProject[]
 				loadedProjects.push(...newProjects)
 				page++
 			} while (page <= projectService.totalPages)
@@ -320,7 +320,7 @@ export function useProject(projectId: MaybeRefOrGetter<IProject['id']>) {
 
 		const duplicate = await projectDuplicateService.create(projectDuplicate)
 		if (duplicate.duplicatedProject) {
-			duplicate.duplicatedProject.maxRight = RIGHTS.ADMIN
+			duplicate.duplicatedProject.maxPermission = PERMISSIONS.ADMIN
 		}
 
 		projectStore.setProject(duplicate.duplicatedProject)
diff --git a/frontend/src/views/project/settings/ProjectSettingsEdit.vue b/frontend/src/views/project/settings/ProjectSettingsEdit.vue
index 6f51c3b15..3946f34ae 100644
--- a/frontend/src/views/project/settings/ProjectSettingsEdit.vue
+++ b/frontend/src/views/project/settings/ProjectSettingsEdit.vue
@@ -3,7 +3,7 @@
 		:title="$t('project.edit.header')"
 		primary-icon=""
 		:primary-label="$t('misc.save')"
-		:tertiary="project.maxRight === RIGHTS.ADMIN ? $t('misc.delete') : undefined"
+		:tertiary="project.maxPermission === PERMISSIONS.ADMIN ? $t('misc.delete') : undefined"
 		@primary="save"
 		@tertiary="$router.push({ name: 'project.settings.delete', params: { id: projectId } })"
 	>
@@ -100,7 +100,7 @@ import {useProjectStore} from '@/stores/projects'
 import {useProject} from '@/stores/projects'
 
 import {useTitle} from '@/composables/useTitle'
-import {RIGHTS} from '@/constants/rights'
+import {PERMISSIONS} from '@/constants/permissions'
 
 const props = defineProps<{
 	projectId: IProject['id'],
diff --git a/frontend/src/views/project/settings/ProjectSettingsShare.vue b/frontend/src/views/project/settings/ProjectSettingsShare.vue
index df4610aa4..7700b6c37 100644
--- a/frontend/src/views/project/settings/ProjectSettingsShare.vue
+++ b/frontend/src/views/project/settings/ProjectSettingsShare.vue
@@ -34,7 +34,7 @@ import {useTitle} from '@vueuse/core'
 import ProjectService from '@/services/project'
 import ProjectModel from '@/models/project'
 import type {IProject} from '@/modelTypes/IProject'
-import {RIGHTS} from '@/constants/rights'
+import {PERMISSIONS} from '@/constants/permissions'
 
 import CreateEdit from '@/components/misc/CreateEdit.vue'
 import LinkSharing from '@/components/sharing/LinkSharing.vue'
@@ -57,7 +57,7 @@ useTitle(title)
 const configStore = useConfigStore()
 
 const linkSharingEnabled = computed(() => configStore.linkSharingEnabled)
-const userIsAdmin = computed(() => project?.value?.maxRight === RIGHTS.ADMIN)
+const userIsAdmin = computed(() => project?.value?.maxPermission === PERMISSIONS.ADMIN)
 
 async function loadProject(projectId: number) {
 	const projectService = new ProjectService()
diff --git a/frontend/src/views/project/settings/ProjectSettingsViews.vue b/frontend/src/views/project/settings/ProjectSettingsViews.vue
index c8e3eae90..fb64dfca8 100644
--- a/frontend/src/views/project/settings/ProjectSettingsViews.vue
+++ b/frontend/src/views/project/settings/ProjectSettingsViews.vue
@@ -10,7 +10,7 @@ import XButton from '@/components/input/Button.vue'
 import {error, success} from '@/message'
 import {useI18n} from 'vue-i18n'
 import ProjectService from '@/services/project'
-import {RIGHTS} from '@/constants/rights'
+import {PERMISSIONS} from '@/constants/permissions'
 import ProjectModel from '@/models/project'
 import Message from '@/components/misc/Message.vue'
 import draggable from 'zhyswan-vuedraggable'
@@ -49,7 +49,7 @@ watch(
 	async () => {
 		const projectService = new ProjectService()
 		const project = await projectService.get(new ProjectModel({id: props.projectId}))
-		isAdmin.value = project.maxRight === RIGHTS.ADMIN
+		isAdmin.value = project.maxPermission === PERMISSIONS.ADMIN
 	},
 	{immediate: true},
 )
diff --git a/frontend/src/views/tasks/TaskDetailView.vue b/frontend/src/views/tasks/TaskDetailView.vue
index 9c8b6399c..f7db11250 100644
--- a/frontend/src/views/tasks/TaskDetailView.vue
+++ b/frontend/src/views/tasks/TaskDetailView.vue
@@ -603,7 +603,7 @@ import type {ITask} from '@/modelTypes/ITask'
 import type {IProject} from '@/modelTypes/IProject'
 
 import {PRIORITIES, type Priority} from '@/constants/priorities'
-import {RIGHTS} from '@/constants/rights'
+import {PERMISSIONS} from '@/constants/permissions'
 
 import BaseButton from '@/components/base/BaseButton.vue'
 
@@ -703,8 +703,8 @@ const visible = ref(false)
 const project = computed(() => projectStore.projects[task.value.projectId])
 
 const canWrite = computed(() => (
-	task.value.maxRight !== null &&
-	task.value.maxRight > RIGHTS.READ
+	task.value.maxPermission !== null &&
+	task.value.maxPermission > PERMISSIONS.READ
 ))
 
 const color = computed(() => {
diff --git a/frontend/src/views/teams/EditTeam.vue b/frontend/src/views/teams/EditTeam.vue
index 0a9b53fcd..7e19b025e 100644
--- a/frontend/src/views/teams/EditTeam.vue
+++ b/frontend/src/views/teams/EditTeam.vue
@@ -272,7 +272,7 @@ import TeamService from '@/services/team'
 import TeamMemberService from '@/services/teamMember'
 import UserService from '@/services/user'
 
-import {RIGHTS as Rights} from '@/constants/rights'
+import {PERMISSIONS as Permissions} from '@/constants/permissions'
 
 import {useTitle} from '@/composables/useTitle'
 import {success} from '@/message'
@@ -292,8 +292,8 @@ const {t} = useI18n({useScope: 'global'})
 const userIsAdmin = computed(() => {
 	return (
 		team.value &&
-		team.value.maxRight &&
-		team.value.maxRight > Rights.READ
+		team.value.maxPermission &&
+		team.value.maxPermission > Permissions.READ
 	)
 })
 const userInfo = computed(() => authStore.info)
diff --git a/magefile.go b/magefile.go
index 0a2ea1b70..6726a9fdf 100644
--- a/magefile.go
+++ b/magefile.go
@@ -1403,7 +1403,7 @@ func (Plugins) Build(pathToSourceFiles string) error {
 	if pathToSourceFiles == "" {
 		return fmt.Errorf("please provide a plugin path")
 	}
-	
+
 	// Convert relative path to absolute path
 	if !strings.HasPrefix(pathToSourceFiles, "/") {
 		absPath, err := filepath.Abs(pathToSourceFiles)
@@ -1412,7 +1412,7 @@ func (Plugins) Build(pathToSourceFiles string) error {
 		}
 		pathToSourceFiles = absPath
 	}
-	
+
 	out := filepath.Join(RootPath, "plugins", filepath.Base(pathToSourceFiles)+".so")
 	runAndStreamOutput("go", "build", "-buildmode=plugin", "-o", out, pathToSourceFiles)
 	return nil
diff --git a/pkg/db/fixtures/link_shares.yml b/pkg/db/fixtures/link_shares.yml
index 4bfeb83cf..626c119fe 100644
--- a/pkg/db/fixtures/link_shares.yml
+++ b/pkg/db/fixtures/link_shares.yml
@@ -1,7 +1,7 @@
 - id: 1
   hash: test
   project_id: 1
-  right: 0
+  permission: 0
   sharing_type: 1
   shared_by_id: 1
   created: 2018-12-01 15:13:12
@@ -9,7 +9,7 @@
 - id: 2
   hash: test2
   project_id: 2
-  right: 1
+  permission: 1
   sharing_type: 1
   shared_by_id: 1
   created: 2018-12-01 15:13:12
@@ -17,7 +17,7 @@
 - id: 3
   hash: test3
   project_id: 3
-  right: 2
+  permission: 2
   sharing_type: 1
   shared_by_id: 1
   created: 2018-12-01 15:13:12
@@ -26,7 +26,7 @@
   hash: testWithPassword
   name: testWithPassword
   project_id: 1
-  right: 0
+  permission: 0
   password: '$2a$04$X4aRMEt0ytgPwMIgv36cI..7X9.nhY/.tYwxpqSi0ykRHx2CwQ0S6' # 12345678
   sharing_type: 2
   shared_by_id: 1
diff --git a/pkg/db/fixtures/team_projects.yml b/pkg/db/fixtures/team_projects.yml
index c1c6c7b48..45ecb541e 100644
--- a/pkg/db/fixtures/team_projects.yml
+++ b/pkg/db/fixtures/team_projects.yml
@@ -1,96 +1,96 @@
 - id: 1
   team_id: 1
   project_id: 3
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 # This team has read only access on project 6
 - id: 2
   team_id: 2
   project_id: 6
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 # This team has write access on project 7
 - id: 3
   team_id: 3
   project_id: 7
-  right: 1
+  permission: 1
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 # This team has admin access on project 8
 - id: 4
   team_id: 4
   project_id: 8
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 # Readonly acces on project 19
 - id: 5
   team_id: 8
   project_id: 19
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 # Write acces on project 19
 - id: 6
   team_id: 9
   project_id: 19
-  right: 1
+  permission: 1
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 # Admin acces on project 19
 - id: 7
   team_id: 10
   project_id: 19
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 8
   team_id: 1
   project_id: 21
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 9
   team_id: 1
   project_id: 28
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 10
   team_id: 11
   project_id: 29
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 11
   team_id: 12
   project_id: 29
-  right: 1
+  permission: 1
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 12
   team_id: 13
   project_id: 29
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 13
   team_id: 1
   project_id: 32
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 14
   team_id: 1
   project_id: 33
-  right: 1
+  permission: 1
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 15
   team_id: 1
   project_id: 34
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
diff --git a/pkg/db/fixtures/users_projects.yml b/pkg/db/fixtures/users_projects.yml
index 0174768e1..22a32ae8b 100644
--- a/pkg/db/fixtures/users_projects.yml
+++ b/pkg/db/fixtures/users_projects.yml
@@ -1,114 +1,114 @@
 - id: 1
   user_id: 1
   project_id: 3
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 2
   user_id: 2
   project_id: 3
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 3
   user_id: 1
   project_id: 9
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 4
   user_id: 1
   project_id: 10
-  right: 1
+  permission: 1
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 5
   user_id: 1
   project_id: 11
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 6
   user_id: 4
   project_id: 19
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 7
   user_id: 5
   project_id: 19
-  right: 1
+  permission: 1
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 8
   user_id: 6
   project_id: 19
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 9
   user_id: 1
   project_id: 27
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 10
   user_id: 11
   project_id: 29
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 11
   user_id: 12
   project_id: 29
-  right: 1
+  permission: 1
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 12
   user_id: 13
   project_id: 29
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 13
   user_id: 1
   project_id: 30
-  right: 1
+  permission: 1
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 14
   user_id: 1
   project_id: 31
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 15
   user_id: 1
   project_id: 28
-  right: 1
+  permission: 1
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 16
   user_id: 1
   project_id: 29
-  right: 2
+  permission: 2
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 17
   user_id: 15
   project_id: 26
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 18
   user_id: 15
   project_id: 36
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
 - id: 19
   user_id: 15
   project_id: 38
-  right: 0
+  permission: 0
   updated: 2018-12-02 15:13:12
   created: 2018-12-01 15:13:12
diff --git a/pkg/mail/send_mail.go b/pkg/mail/send_mail.go
index 1ed697bea..1b386b7f2 100644
--- a/pkg/mail/send_mail.go
+++ b/pkg/mail/send_mail.go
@@ -45,7 +45,7 @@ type Opts struct {
 // ContentType represents mail content types
 type ContentType int
 
-// Enumerate all the team rights
+// Enumerate all the team permissions
 const (
 	ContentTypePlain ContentType = iota
 	ContentTypeHTML
diff --git a/pkg/migration/20190818210133.go b/pkg/migration/20190818210133.go
index 5e01bc734..7afa66cb3 100644
--- a/pkg/migration/20190818210133.go
+++ b/pkg/migration/20190818210133.go
@@ -26,7 +26,7 @@ type linkSharing20190818210133 struct {
 	ID          int64              `xorm:"int(11) autoincr not null unique pk" json:"id"`
 	Hash        string             `xorm:"varchar(40) not null unique" json:"hash" param:"hash"`
 	ListID      int64              `xorm:"int(11) not null" json:"list_id"`
-	Right       models.Right       `xorm:"int(11) INDEX not null default 0" json:"right" valid:"length(0|2)" maximum:"2" default:"0"`
+	Right       models.Permission  `xorm:"int(11) INDEX not null default 0" json:"right" valid:"length(0|2)" maximum:"2" default:"0"`
 	SharingType models.SharingType `xorm:"int(11) INDEX not null default 0" json:"sharing_type" valid:"length(0|2)" maximum:"2" default:"0"`
 	SharedByID  int64              `xorm:"int(11) INDEX not null"`
 	Created     int64              `xorm:"created not null" json:"created"`
diff --git a/pkg/migration/20250813093602.go b/pkg/migration/20250813093602.go
new file mode 100644
index 000000000..cb61abbd1
--- /dev/null
+++ b/pkg/migration/20250813093602.go
@@ -0,0 +1,44 @@
+// Vikunja is a to-do list application to facilitate your life.
+// Copyright 2018-present Vikunja and contributors. All rights reserved.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package migration
+
+import (
+	"src.techknowlogick.com/xormigrate"
+	"xorm.io/xorm"
+)
+
+func init() {
+	migrations = append(migrations, &xormigrate.Migration{
+		ID:          "20250813093602",
+		Description: "rename 'right' column to 'permission' in link_shares, users_projects, and team_projects tables",
+		Migrate: func(tx *xorm.Engine) error {
+			tables := []string{"link_shares", "users_projects", "team_projects"}
+
+			for _, table := range tables {
+				err := renameColumn(tx, table, "right", "permission")
+				if err != nil {
+					return err
+				}
+			}
+
+			return nil
+		},
+		Rollback: func(tx *xorm.Engine) error {
+			return nil
+		},
+	})
+}
diff --git a/pkg/migration/migration.go b/pkg/migration/migration.go
index 8aa6dff6f..c26c9434c 100644
--- a/pkg/migration/migration.go
+++ b/pkg/migration/migration.go
@@ -186,6 +186,82 @@ func renameTable(x *xorm.Engine, oldName, newName string) error {
 	return nil
 }
 
+// Checks if a column exists in a table
+func columnExists(x *xorm.Engine, tableName, columnName string) (bool, error) {
+	switch config.DatabaseType.GetString() {
+	case "sqlite":
+		results, err := x.Query("PRAGMA table_info(" + tableName + ")")
+		if err != nil {
+			return false, err
+		}
+
+		for _, row := range results {
+			if name, ok := row["name"]; ok && string(name) == columnName {
+				return true, nil
+			}
+		}
+		return false, nil
+	case "mysql":
+		results, err := x.Query("SHOW COLUMNS FROM `" + tableName + "` LIKE '" + columnName + "'")
+		if err != nil {
+			return false, err
+		}
+		return len(results) > 0, nil
+	case "postgres":
+		results, err := x.Query("SELECT column_name FROM information_schema.columns WHERE table_name = '" + tableName + "' AND column_name = '" + columnName + "'")
+		if err != nil {
+			return false, err
+		}
+		return len(results) > 0, nil
+	default:
+		log.Fatal("Unknown db.")
+		return false, nil
+	}
+}
+
+func renameColumn(x *xorm.Engine, tableName, oldColumn, newColumn string) error {
+	// Check if old column exists
+	exists, err := columnExists(x, tableName, oldColumn)
+	if err != nil {
+		return err
+	}
+	if !exists {
+		log.Debugf("Column %s in table %s does not exist, skipping rename", oldColumn, tableName)
+		return nil
+	}
+
+	// Check if new column already exists
+	newExists, err := columnExists(x, tableName, newColumn)
+	if err != nil {
+		return err
+	}
+	if newExists {
+		log.Debugf("Column %s in table %s already exists, skipping rename", newColumn, tableName)
+		return nil
+	}
+
+	switch config.DatabaseType.GetString() {
+	case "sqlite":
+		_, err := x.Exec("ALTER TABLE \"" + tableName + "\" RENAME COLUMN \"" + oldColumn + "\" TO \"" + newColumn + "\"")
+		if err != nil {
+			return err
+		}
+	case "mysql":
+		_, err := x.Exec("ALTER TABLE `" + tableName + "` CHANGE `" + oldColumn + "` `" + newColumn + "` BIGINT NOT NULL DEFAULT 0")
+		if err != nil {
+			return err
+		}
+	case "postgres":
+		_, err := x.Exec("ALTER TABLE \"" + tableName + "\" RENAME COLUMN \"" + oldColumn + "\" TO \"" + newColumn + "\"")
+		if err != nil {
+			return err
+		}
+	default:
+		log.Fatal("Unknown db.")
+	}
+	return nil
+}
+
 func initSchema(tx *xorm.Engine) error {
 	schemeBeans := []interface{}{}
 	schemeBeans = append(schemeBeans, models.GetTables()...)
diff --git a/pkg/models/api_routes.go b/pkg/models/api_routes.go
index 5a980ab9f..078638ffa 100644
--- a/pkg/models/api_routes.go
+++ b/pkg/models/api_routes.go
@@ -244,9 +244,9 @@ func CanDoAPIRoute(c echo.Context, token *APIToken) (can bool) {
 		routeGroupName = "other"
 	}
 
-	group, hasGroup := token.Permissions[routeGroupName]
+	group, hasGroup := token.APIPermissions[routeGroupName]
 	if !hasGroup {
-		group, hasGroup = token.Permissions[routeParts[0]]
+		group, hasGroup = token.APIPermissions[routeParts[0]]
 		if !hasGroup {
 			return false
 		}
@@ -276,7 +276,7 @@ func CanDoAPIRoute(c echo.Context, token *APIToken) (can bool) {
 		}
 	}
 
-	log.Debugf("[auth] Token %d tried to use route %s which requires permission %s but has only %v", token.ID, path, route, token.Permissions)
+	log.Debugf("[auth] Token %d tried to use route %s which requires permission %s but has only %v", token.ID, path, route, token.APIPermissions)
 
 	return false
 }
diff --git a/pkg/models/api_tokens.go b/pkg/models/api_tokens.go
index 5e67dce32..00ae5b747 100644
--- a/pkg/models/api_tokens.go
+++ b/pkg/models/api_tokens.go
@@ -22,13 +22,12 @@ import (
 	"encoding/hex"
 	"time"
 
-	"xorm.io/builder"
-
 	"code.vikunja.io/api/pkg/db"
 	"code.vikunja.io/api/pkg/utils"
-
 	"code.vikunja.io/api/pkg/web"
+
 	"golang.org/x/crypto/pbkdf2"
+	"xorm.io/builder"
 	"xorm.io/xorm"
 )
 
@@ -46,7 +45,7 @@ type APIToken struct {
 	TokenHash      string `xorm:"not null unique" json:"-"`
 	TokenLastEight string `xorm:"not null index varchar(8)" json:"-"`
 	// The permissions this token has. Possible values are available via the /routes endpoint and consist of the keys of the list from that endpoint. For example, if the token should be able to read all tasks as well as update existing tasks, you should add `{"tasks":["read_all","update"]}`.
-	Permissions APIPermissions `xorm:"json not null" json:"permissions" valid:"required"`
+	APIPermissions APIPermissions `xorm:"json not null permissions" json:"permissions" valid:"required"`
 	// The date when this key expires.
 	ExpiresAt time.Time `xorm:"not null" json:"expires_at" valid:"required"`
 
@@ -55,8 +54,8 @@ type APIToken struct {
 
 	OwnerID int64 `xorm:"bigint not null" json:"-"`
 
-	web.Rights   `xorm:"-" json:"-"`
-	web.CRUDable `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
 }
 
 const APITokenPrefix = `tk_`
@@ -102,7 +101,7 @@ func (t *APIToken) Create(s *xorm.Session, a web.Auth) (err error) {
 
 	t.OwnerID = a.GetID()
 
-	if err := PermissionsAreValid(t.Permissions); err != nil {
+	if err := PermissionsAreValid(t.APIPermissions); err != nil {
 		return err
 	}
 
diff --git a/pkg/models/api_tokens_rights.go b/pkg/models/api_tokens_permissions.go
similarity index 100%
rename from pkg/models/api_tokens_rights.go
rename to pkg/models/api_tokens_permissions.go
diff --git a/pkg/models/error.go b/pkg/models/error.go
index ab09b559a..b26950abc 100644
--- a/pkg/models/error.go
+++ b/pkg/models/error.go
@@ -564,31 +564,31 @@ func (err ErrBulkTasksNeedAtLeastOne) HTTPError() web.HTTPError {
 	return web.HTTPError{HTTPCode: http.StatusBadRequest, Code: ErrCodeBulkTasksNeedAtLeastOne, Message: "Need at least one tasks to do bulk editing."}
 }
 
-// ErrNoRightToSeeTask represents an error where a user does not have the right to see a task
-type ErrNoRightToSeeTask struct {
+// ErrNoPermissionToSeeTask represents an error where a user does not have the permission to see a task
+type ErrNoPermissionToSeeTask struct {
 	TaskID int64
 	UserID int64
 }
 
-// IsErrNoRightToSeeTask checks if an error is ErrNoRightToSeeTask.
-func IsErrNoRightToSeeTask(err error) bool {
-	_, ok := err.(ErrNoRightToSeeTask)
+// IsErrNoPermissionToSeeTask checks if an error is ErrNoPermissionToSeeTask.
+func IsErrNoPermissionToSeeTask(err error) bool {
+	_, ok := err.(ErrNoPermissionToSeeTask)
 	return ok
 }
 
-func (err ErrNoRightToSeeTask) Error() string {
-	return fmt.Sprintf("User does not have the right to see the task [TaskID: %v, ID: %v]", err.TaskID, err.UserID)
+func (err ErrNoPermissionToSeeTask) Error() string {
+	return fmt.Sprintf("User does not have the permission to see the task [TaskID: %v, ID: %v]", err.TaskID, err.UserID)
 }
 
 // ErrCodeNoRightToSeeTask holds the unique world-error code of this error
 const ErrCodeNoRightToSeeTask = 4005
 
 // HTTPError holds the http error description
-func (err ErrNoRightToSeeTask) HTTPError() web.HTTPError {
+func (err ErrNoPermissionToSeeTask) HTTPError() web.HTTPError {
 	return web.HTTPError{
 		HTTPCode: http.StatusForbidden,
 		Code:     ErrCodeNoRightToSeeTask,
-		Message:  "You don't have the right to see this task.",
+		Message:  "You don't have the permission to see this task.",
 	}
 }
 
@@ -1497,7 +1497,7 @@ func (err ErrLabelDoesNotExist) HTTPError() web.HTTPError {
 	}
 }
 
-// ErrUserHasNoAccessToLabel represents an error where a user does not have the right to see a label
+// ErrUserHasNoAccessToLabel represents an error where a user does not have the permission to see a label
 type ErrUserHasNoAccessToLabel struct {
 	LabelID int64
 	UserID  int64
@@ -1526,33 +1526,33 @@ func (err ErrUserHasNoAccessToLabel) HTTPError() web.HTTPError {
 }
 
 // ========
-// Rights
+// Permissions
 // ========
 
-// ErrInvalidRight represents an error where a right is invalid
-type ErrInvalidRight struct {
-	Right Right
+// ErrInvalidPermission represents an error where a permission is invalid
+type ErrInvalidPermission struct {
+	Permission Permission
 }
 
-// IsErrInvalidRight checks if an error is ErrInvalidRight.
-func IsErrInvalidRight(err error) bool {
-	_, ok := err.(ErrInvalidRight)
+// IsErrInvalidPermission checks if an error is ErrInvalidPermission.
+func IsErrInvalidPermission(err error) bool {
+	_, ok := err.(ErrInvalidPermission)
 	return ok
 }
 
-func (err ErrInvalidRight) Error() string {
-	return fmt.Sprintf("Right invalid [Right: %d]", err.Right)
+func (err ErrInvalidPermission) Error() string {
+	return fmt.Sprintf("Permission invalid [Permission: %d]", err.Permission)
 }
 
 // ErrCodeInvalidRight holds the unique world-error code of this error
 const ErrCodeInvalidRight = 9001
 
 // HTTPError holds the http error description
-func (err ErrInvalidRight) HTTPError() web.HTTPError {
+func (err ErrInvalidPermission) HTTPError() web.HTTPError {
 	return web.HTTPError{
 		HTTPCode: http.StatusBadRequest,
 		Code:     ErrCodeInvalidRight,
-		Message:  "The right is invalid.",
+		Message:  "The permission is invalid.",
 	}
 }
 
diff --git a/pkg/models/kanban.go b/pkg/models/kanban.go
index 1220dcdf6..01a6a145f 100644
--- a/pkg/models/kanban.go
+++ b/pkg/models/kanban.go
@@ -61,8 +61,8 @@ type Bucket struct {
 	// Including the task collection type so we can use task filters on kanban
 	TaskCollection `xorm:"-" json:"-"`
 
-	web.Rights   `xorm:"-" json:"-"`
-	web.CRUDable `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
 }
 
 // TableName returns the table name for this bucket.
diff --git a/pkg/models/kanban_rights.go b/pkg/models/kanban_permissions.go
similarity index 98%
rename from pkg/models/kanban_rights.go
rename to pkg/models/kanban_permissions.go
index 4b3e6415d..d0c103046 100644
--- a/pkg/models/kanban_rights.go
+++ b/pkg/models/kanban_permissions.go
@@ -42,7 +42,7 @@ func (b *Bucket) CanDelete(s *xorm.Session, a web.Auth) (bool, error) {
 	return b.canDoBucket(s, a)
 }
 
-// canDoBucket checks if the bucket exists and if the user has the right to act on it
+// canDoBucket checks if the bucket exists and if the user has the permission to act on it
 func (b *Bucket) canDoBucket(s *xorm.Session, a web.Auth) (bool, error) {
 	bb, err := getBucketByID(s, b.ID)
 	if err != nil {
diff --git a/pkg/models/kanban_task_bucket.go b/pkg/models/kanban_task_bucket.go
index 2257f1b98..80b23f1b9 100644
--- a/pkg/models/kanban_task_bucket.go
+++ b/pkg/models/kanban_task_bucket.go
@@ -41,8 +41,8 @@ type TaskBucket struct {
 	ProjectID     int64 `xorm:"-" json:"-" param:"project"`
 	Task          *Task `xorm:"-" json:"task"`
 
-	web.Rights   `xorm:"-" json:"-"`
-	web.CRUDable `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
 }
 
 func (b *TaskBucket) TableName() string {
diff --git a/pkg/models/kanban_test.go b/pkg/models/kanban_test.go
index 5998cd7ac..9cf610ad9 100644
--- a/pkg/models/kanban_test.go
+++ b/pkg/models/kanban_test.go
@@ -120,9 +120,9 @@ func TestBucket_ReadAll(t *testing.T) {
 		defer s.Close()
 
 		linkShare := &LinkSharing{
-			ID:        1,
-			ProjectID: 1,
-			Right:     RightRead,
+			ID:         1,
+			ProjectID:  1,
+			Permission: PermissionRead,
 		}
 		b := &TaskCollection{
 			ProjectID:     1,
diff --git a/pkg/models/label.go b/pkg/models/label.go
index fb5648a03..3df013f73 100644
--- a/pkg/models/label.go
+++ b/pkg/models/label.go
@@ -46,8 +46,8 @@ type Label struct {
 	// A timestamp when this label was last updated. You cannot change this value.
 	Updated time.Time `xorm:"updated not null" json:"updated"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName makes a pretty table name
diff --git a/pkg/models/label_rights.go b/pkg/models/label_permissions.go
similarity index 94%
rename from pkg/models/label_rights.go
rename to pkg/models/label_permissions.go
index c9143bebb..4c0badd11 100644
--- a/pkg/models/label_rights.go
+++ b/pkg/models/label_permissions.go
@@ -61,7 +61,7 @@ func (l *Label) isLabelOwner(s *xorm.Session, a web.Auth) (bool, error) {
 }
 
 // Helper method to check if a user can see a specific label
-func (l *Label) hasAccessToLabel(s *xorm.Session, a web.Auth) (has bool, maxRight int, err error) {
+func (l *Label) hasAccessToLabel(s *xorm.Session, a web.Auth) (has bool, maxPermission int, err error) {
 
 	linkShare, isLinkShare := a.(*LinkSharing)
 
@@ -93,10 +93,10 @@ func (l *Label) hasAccessToLabel(s *xorm.Session, a web.Auth) (has bool, maxRigh
 		return
 	}
 
-	// Since the right depends on the task the label is associated with, we need to check that too.
+	// Since the permission depends on the task the label is associated with, we need to check that too.
 	if ll.TaskID > 0 {
 		t := &Task{ID: ll.TaskID}
-		_, maxRight, err = t.CanRead(s, a)
+		_, maxPermission, err = t.CanRead(s, a)
 		if err != nil {
 			return
 		}
diff --git a/pkg/models/label_task.go b/pkg/models/label_task.go
index 8981022f2..8a09a3c01 100644
--- a/pkg/models/label_task.go
+++ b/pkg/models/label_task.go
@@ -40,8 +40,8 @@ type LabelTask struct {
 	// A timestamp when this task was created. You cannot change this value.
 	Created time.Time `xorm:"created not null" json:"created"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName makes a pretty table name
@@ -127,14 +127,14 @@ func (lt *LabelTask) Create(s *xorm.Session, auth web.Auth) (err error) {
 // @Failure 500 {object} models.Message "Internal error"
 // @Router /tasks/{task}/labels [get]
 func (lt *LabelTask) ReadAll(s *xorm.Session, a web.Auth, search string, page int, _ int) (result interface{}, resultCount int, numberOfTotalItems int64, err error) {
-	// Check if the user has the right to see the task
+	// Check if the user has the permission to see the task
 	task := Task{ID: lt.TaskID}
 	canRead, _, err := task.CanRead(s, a)
 	if err != nil {
 		return nil, 0, 0, err
 	}
 	if !canRead {
-		return nil, 0, 0, ErrNoRightToSeeTask{lt.TaskID, a.GetID()}
+		return nil, 0, 0, ErrNoPermissionToSeeTask{lt.TaskID, a.GetID()}
 	}
 
 	return GetLabelsByTaskIDs(s, &LabelByTaskIDsOptions{
@@ -377,7 +377,7 @@ func (t *Task) UpdateTaskLabels(s *xorm.Session, creator web.Auth, labels []*Lab
 			return err
 		}
 
-		// Check if the user has the rights to see the label he is about to add
+		// Check if the user has the permissions to see the label he is about to add
 		hasAccessToLabel, _, err := label.hasAccessToLabel(s, creator)
 		if err != nil {
 			return err
@@ -413,8 +413,8 @@ type LabelTaskBulk struct {
 	Labels []*Label `json:"labels"`
 	TaskID int64    `json:"-" param:"projecttask"`
 
-	web.CRUDable `json:"-"`
-	web.Rights   `json:"-"`
+	web.CRUDable    `json:"-"`
+	web.Permissions `json:"-"`
 }
 
 // Create updates a bunch of labels on a task at once
diff --git a/pkg/models/label_task_rights.go b/pkg/models/label_task_permissions.go
similarity index 100%
rename from pkg/models/label_task_rights.go
rename to pkg/models/label_task_permissions.go
diff --git a/pkg/models/label_task_test.go b/pkg/models/label_task_test.go
index 19659afd6..ceccc1931 100644
--- a/pkg/models/label_task_test.go
+++ b/pkg/models/label_task_test.go
@@ -51,12 +51,12 @@ func TestLabelTask_ReadAll(t *testing.T) {
 	}
 
 	type fields struct {
-		ID       int64
-		TaskID   int64
-		LabelID  int64
-		Created  time.Time
-		CRUDable web.CRUDable
-		Rights   web.Rights
+		ID          int64
+		TaskID      int64
+		LabelID     int64
+		Created     time.Time
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	type args struct {
 		search string
@@ -87,7 +87,7 @@ func TestLabelTask_ReadAll(t *testing.T) {
 			},
 		},
 		{
-			name: "no right to see the task",
+			name: "no permission to see the task",
 			fields: fields{
 				TaskID: 14,
 			},
@@ -95,7 +95,7 @@ func TestLabelTask_ReadAll(t *testing.T) {
 				a: &user.User{ID: 1},
 			},
 			wantErr: true,
-			errType: IsErrNoRightToSeeTask,
+			errType: IsErrNoPermissionToSeeTask,
 		},
 		{
 			name: "nonexistant task",
@@ -131,12 +131,12 @@ func TestLabelTask_ReadAll(t *testing.T) {
 			s := db.NewSession()
 
 			l := &LabelTask{
-				ID:       tt.fields.ID,
-				TaskID:   tt.fields.TaskID,
-				LabelID:  tt.fields.LabelID,
-				Created:  tt.fields.Created,
-				CRUDable: tt.fields.CRUDable,
-				Rights:   tt.fields.Rights,
+				ID:          tt.fields.ID,
+				TaskID:      tt.fields.TaskID,
+				LabelID:     tt.fields.LabelID,
+				Created:     tt.fields.Created,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			gotLabels, _, _, err := l.ReadAll(s, tt.args.a, tt.args.search, tt.args.page, 0)
 			if (err != nil) != tt.wantErr {
@@ -157,12 +157,12 @@ func TestLabelTask_ReadAll(t *testing.T) {
 
 func TestLabelTask_Create(t *testing.T) {
 	type fields struct {
-		ID       int64
-		TaskID   int64
-		LabelID  int64
-		Created  time.Time
-		CRUDable web.CRUDable
-		Rights   web.Rights
+		ID          int64
+		TaskID      int64
+		LabelID     int64
+		Created     time.Time
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	type args struct {
 		a web.Auth
@@ -229,12 +229,12 @@ func TestLabelTask_Create(t *testing.T) {
 			s := db.NewSession()
 
 			l := &LabelTask{
-				ID:       tt.fields.ID,
-				TaskID:   tt.fields.TaskID,
-				LabelID:  tt.fields.LabelID,
-				Created:  tt.fields.Created,
-				CRUDable: tt.fields.CRUDable,
-				Rights:   tt.fields.Rights,
+				ID:          tt.fields.ID,
+				TaskID:      tt.fields.TaskID,
+				LabelID:     tt.fields.LabelID,
+				Created:     tt.fields.Created,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			allowed, err := l.CanCreate(s, tt.args.a)
 			if !allowed && !tt.wantForbidden {
@@ -261,12 +261,12 @@ func TestLabelTask_Create(t *testing.T) {
 
 func TestLabelTask_Delete(t *testing.T) {
 	type fields struct {
-		ID       int64
-		TaskID   int64
-		LabelID  int64
-		Created  time.Time
-		CRUDable web.CRUDable
-		Rights   web.Rights
+		ID          int64
+		TaskID      int64
+		LabelID     int64
+		Created     time.Time
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	tests := []struct {
 		name          string
@@ -329,12 +329,12 @@ func TestLabelTask_Delete(t *testing.T) {
 			defer s.Close()
 
 			l := &LabelTask{
-				ID:       tt.fields.ID,
-				TaskID:   tt.fields.TaskID,
-				LabelID:  tt.fields.LabelID,
-				Created:  tt.fields.Created,
-				CRUDable: tt.fields.CRUDable,
-				Rights:   tt.fields.Rights,
+				ID:          tt.fields.ID,
+				TaskID:      tt.fields.TaskID,
+				LabelID:     tt.fields.LabelID,
+				Created:     tt.fields.Created,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			allowed, _ := l.CanDelete(s, tt.auth)
 			if !allowed && !tt.wantForbidden {
diff --git a/pkg/models/label_test.go b/pkg/models/label_test.go
index d948dd752..04dbfba38 100644
--- a/pkg/models/label_test.go
+++ b/pkg/models/label_test.go
@@ -40,7 +40,7 @@ func TestLabel_ReadAll(t *testing.T) {
 		Created     time.Time
 		Updated     time.Time
 		CRUDable    web.CRUDable
-		Rights      web.Rights
+		Permissions web.Permissions
 	}
 	type args struct {
 		search string
@@ -146,7 +146,7 @@ func TestLabel_ReadAll(t *testing.T) {
 				Created:     tt.fields.Created,
 				Updated:     tt.fields.Updated,
 				CRUDable:    tt.fields.CRUDable,
-				Rights:      tt.fields.Rights,
+				Permissions: tt.fields.Permissions,
 			}
 			db.LoadAndAssertFixtures(t)
 			s := db.NewSession()
@@ -177,7 +177,7 @@ func TestLabel_ReadOne(t *testing.T) {
 		Created     time.Time
 		Updated     time.Time
 		CRUDable    web.CRUDable
-		Rights      web.Rights
+		Permissions web.Permissions
 	}
 	user1 := &user.User{
 		ID:                           1,
@@ -226,7 +226,7 @@ func TestLabel_ReadOne(t *testing.T) {
 			auth:          &user.User{ID: 1},
 		},
 		{
-			name: "no rights",
+			name: "no permissions",
 			fields: fields{
 				ID: 3,
 			},
@@ -272,7 +272,7 @@ func TestLabel_ReadOne(t *testing.T) {
 				Created:     tt.fields.Created,
 				Updated:     tt.fields.Updated,
 				CRUDable:    tt.fields.CRUDable,
-				Rights:      tt.fields.Rights,
+				Permissions: tt.fields.Permissions,
 			}
 
 			s := db.NewSession()
@@ -308,7 +308,7 @@ func TestLabel_Create(t *testing.T) {
 		Created     time.Time
 		Updated     time.Time
 		CRUDable    web.CRUDable
-		Rights      web.Rights
+		Permissions web.Permissions
 	}
 	type args struct {
 		a web.Auth
@@ -344,7 +344,7 @@ func TestLabel_Create(t *testing.T) {
 				Created:     tt.fields.Created,
 				Updated:     tt.fields.Updated,
 				CRUDable:    tt.fields.CRUDable,
-				Rights:      tt.fields.Rights,
+				Permissions: tt.fields.Permissions,
 			}
 			s := db.NewSession()
 			allowed, _ := l.CanCreate(s, tt.args.a)
@@ -378,7 +378,7 @@ func TestLabel_Update(t *testing.T) {
 		Created     time.Time
 		Updated     time.Time
 		CRUDable    web.CRUDable
-		Rights      web.Rights
+		Permissions web.Permissions
 	}
 	tests := []struct {
 		name          string
@@ -406,7 +406,7 @@ func TestLabel_Update(t *testing.T) {
 			wantErr:       true,
 		},
 		{
-			name: "no rights",
+			name: "no permissions",
 			fields: fields{
 				ID:    3,
 				Title: "new and better",
@@ -415,7 +415,7 @@ func TestLabel_Update(t *testing.T) {
 			wantForbidden: true,
 		},
 		{
-			name: "no rights other creator but access",
+			name: "no permissions other creator but access",
 			fields: fields{
 				ID:    4,
 				Title: "new and better",
@@ -436,7 +436,7 @@ func TestLabel_Update(t *testing.T) {
 				Created:     tt.fields.Created,
 				Updated:     tt.fields.Updated,
 				CRUDable:    tt.fields.CRUDable,
-				Rights:      tt.fields.Rights,
+				Permissions: tt.fields.Permissions,
 			}
 			s := db.NewSession()
 			allowed, _ := l.CanUpdate(s, tt.auth)
@@ -468,7 +468,7 @@ func TestLabel_Delete(t *testing.T) {
 		Created     time.Time
 		Updated     time.Time
 		CRUDable    web.CRUDable
-		Rights      web.Rights
+		Permissions web.Permissions
 	}
 	tests := []struct {
 		name          string
@@ -494,7 +494,7 @@ func TestLabel_Delete(t *testing.T) {
 			wantForbidden: true, // When the label does not exist, it is forbidden. We should fix this, but for everything.
 		},
 		{
-			name: "no rights",
+			name: "no permissions",
 			fields: fields{
 				ID: 3,
 			},
@@ -502,7 +502,7 @@ func TestLabel_Delete(t *testing.T) {
 			wantForbidden: true,
 		},
 		{
-			name: "no rights but visible",
+			name: "no permissions but visible",
 			fields: fields{
 				ID: 4,
 			},
@@ -522,7 +522,7 @@ func TestLabel_Delete(t *testing.T) {
 				Created:     tt.fields.Created,
 				Updated:     tt.fields.Updated,
 				CRUDable:    tt.fields.CRUDable,
-				Rights:      tt.fields.Rights,
+				Permissions: tt.fields.Permissions,
 			}
 			s := db.NewSession()
 			allowed, _ := l.CanDelete(s, tt.auth)
diff --git a/pkg/models/link_sharing.go b/pkg/models/link_sharing.go
index 9fdda56ad..5d8b89512 100644
--- a/pkg/models/link_sharing.go
+++ b/pkg/models/link_sharing.go
@@ -52,8 +52,8 @@ type LinkSharing struct {
 	Name string `xorm:"text null" json:"name"`
 	// The ID of the shared project
 	ProjectID int64 `xorm:"bigint not null" json:"-" param:"project"`
-	// The right this project is shared with. 0 = Read only, 1 = Read & Write, 2 = Admin. See the docs for more details.
-	Right Right `xorm:"bigint INDEX not null default 0" json:"right" valid:"length(0|2)" maximum:"2" default:"0"`
+	// The permission this project is shared with. 0 = Read only, 1 = Read & Write, 2 = Admin. See the docs for more details.
+	Permission Permission `xorm:"bigint INDEX not null default 0" json:"permission" valid:"length(0|2)" maximum:"2" default:"0"`
 
 	// The kind of this link. 0 = undefined, 1 = without password, 2 = with password.
 	SharingType SharingType `xorm:"bigint INDEX not null default 0" json:"sharing_type" valid:"length(0|2)" maximum:"2" default:"0"`
@@ -70,8 +70,8 @@ type LinkSharing struct {
 	// A timestamp when this share was last updated. You cannot change this value.
 	Updated time.Time `xorm:"updated not null" json:"updated"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName holds the table name
@@ -95,7 +95,7 @@ func GetLinkShareFromClaims(claims jwt.MapClaims) (share *LinkSharing, err error
 	share.ID = int64(claims["id"].(float64))
 	share.Hash = claims["hash"].(string)
 	share.ProjectID = int64(projectID)
-	share.Right = Right(claims["right"].(float64))
+	share.Permission = Permission(claims["permission"].(float64))
 	share.SharedByID = int64(claims["sharedByID"].(float64))
 	return
 }
@@ -138,7 +138,7 @@ func (share *LinkSharing) toUser() *user.User {
 // @Router /projects/{project}/shares [put]
 func (share *LinkSharing) Create(s *xorm.Session, a web.Auth) (err error) {
 
-	err = share.Right.isValid()
+	err = share.Permission.isValid()
 	if err != nil {
 		return
 	}
diff --git a/pkg/models/link_sharing_rights.go b/pkg/models/link_sharing_permissions.go
similarity index 83%
rename from pkg/models/link_sharing_rights.go
rename to pkg/models/link_sharing_permissions.go
index 4a4f386bc..359be43d7 100644
--- a/pkg/models/link_sharing_rights.go
+++ b/pkg/models/link_sharing_permissions.go
@@ -21,7 +21,7 @@ import (
 	"xorm.io/xorm"
 )
 
-// CanRead implements the read right check for a link share
+// CanRead implements the read permission check for a link share
 func (share *LinkSharing) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) {
 	// Don't allow creating link shares if the user itself authenticated with a link share
 	if _, is := a.(*LinkSharing); is {
@@ -35,17 +35,17 @@ func (share *LinkSharing) CanRead(s *xorm.Session, a web.Auth) (bool, int, error
 	return l.CanRead(s, a)
 }
 
-// CanDelete implements the delete right check for a link share
+// CanDelete implements the delete permission check for a link share
 func (share *LinkSharing) CanDelete(s *xorm.Session, a web.Auth) (bool, error) {
 	return share.canDoLinkShare(s, a)
 }
 
-// CanUpdate implements the update right check for a link share
+// CanUpdate implements the update permission check for a link share
 func (share *LinkSharing) CanUpdate(s *xorm.Session, a web.Auth) (bool, error) {
 	return share.canDoLinkShare(s, a)
 }
 
-// CanCreate implements the create right check for a link share
+// CanCreate implements the create permission check for a link share
 func (share *LinkSharing) CanCreate(s *xorm.Session, a web.Auth) (bool, error) {
 	return share.canDoLinkShare(s, a)
 }
@@ -61,8 +61,8 @@ func (share *LinkSharing) canDoLinkShare(s *xorm.Session, a web.Auth) (bool, err
 		return false, err
 	}
 
-	// Check if the user is admin when the link right is admin
-	if share.Right == RightAdmin {
+	// Check if the user is admin when the link permission is admin
+	if share.Permission == PermissionAdmin {
 		return l.IsAdmin(s, a)
 	}
 
diff --git a/pkg/models/link_sharing_test.go b/pkg/models/link_sharing_test.go
index 2804a4e0a..6e85da88c 100644
--- a/pkg/models/link_sharing_test.go
+++ b/pkg/models/link_sharing_test.go
@@ -36,8 +36,8 @@ func TestLinkSharing_Create(t *testing.T) {
 		defer s.Close()
 
 		share := &LinkSharing{
-			ProjectID: 1,
-			Right:     RightRead,
+			ProjectID:  1,
+			Permission: PermissionRead,
 		}
 		err := share.Create(s, doer)
 
@@ -49,19 +49,19 @@ func TestLinkSharing_Create(t *testing.T) {
 			"id": share.ID,
 		}, false)
 	})
-	t.Run("invalid right", func(t *testing.T) {
+	t.Run("invalid permission", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
 		defer s.Close()
 
 		share := &LinkSharing{
-			ProjectID: 1,
-			Right:     Right(123),
+			ProjectID:  1,
+			Permission: Permission(123),
 		}
 		err := share.Create(s, doer)
 
 		require.Error(t, err)
-		assert.True(t, IsErrInvalidRight(err))
+		assert.True(t, IsErrInvalidPermission(err))
 	})
 	t.Run("password should be hashed", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
@@ -69,9 +69,9 @@ func TestLinkSharing_Create(t *testing.T) {
 		defer s.Close()
 
 		share := &LinkSharing{
-			ProjectID: 1,
-			Right:     RightRead,
-			Password:  "somePassword",
+			ProjectID:  1,
+			Permission: PermissionRead,
+			Password:   "somePassword",
 		}
 		err := share.Create(s, doer)
 
diff --git a/pkg/models/notifications_database.go b/pkg/models/notifications_database.go
index 0b0dc9e0b..3d430b971 100644
--- a/pkg/models/notifications_database.go
+++ b/pkg/models/notifications_database.go
@@ -30,8 +30,8 @@ type DatabaseNotifications struct {
 	// True is read, false is unread.
 	Read bool `xorm:"-" json:"read"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // ReadAll returns all database notifications for a user
diff --git a/pkg/models/rights.go b/pkg/models/permissions.go
similarity index 68%
rename from pkg/models/rights.go
rename to pkg/models/permissions.go
index b040155a9..895f0f9a0 100644
--- a/pkg/models/rights.go
+++ b/pkg/models/permissions.go
@@ -22,38 +22,38 @@ import (
 	"strconv"
 )
 
-// Right defines the rights users/teams can have for projects
-type Right int
+// Permission defines the permissions users/teams can have for projects
+type Permission int
 
-// define unknown right
+// define unknown permission
 const (
-	RightUnknown = -1
+	PermissionUnknown = -1
 	// Can read projects in a
-	RightRead Right = iota - 1
+	PermissionRead Permission = iota - 1
 	// Can write in a like projects and tasks. Cannot create new projects.
-	RightWrite
+	PermissionWrite
 	// Can manage a project, can do everything
-	RightAdmin
+	PermissionAdmin
 )
 
-func (r Right) isValid() error {
-	if r != RightAdmin && r != RightRead && r != RightWrite {
-		return ErrInvalidRight{r}
+func (r Permission) isValid() error {
+	if r != PermissionAdmin && r != PermissionRead && r != PermissionWrite {
+		return ErrInvalidPermission{r}
 	}
 
 	return nil
 }
 
 // MarshalJSON marshals the enum as a quoted json string
-func (r Right) MarshalJSON() ([]byte, error) {
-	if r == RightUnknown {
+func (r Permission) MarshalJSON() ([]byte, error) {
+	if r == PermissionUnknown {
 		return []byte(`null`), nil
 	}
 	return []byte(strconv.Itoa(int(r))), nil
 }
 
 // UnmarshalJSON unmarshals a quoted json string to the enum value
-func (r *Right) UnmarshalJSON(data []byte) error {
+func (r *Permission) UnmarshalJSON(data []byte) error {
 	var s int
 	if err := json.Unmarshal(data, &s); err != nil {
 		return err
@@ -61,15 +61,15 @@ func (r *Right) UnmarshalJSON(data []byte) error {
 
 	switch s {
 	case -1:
-		*r = RightUnknown
+		*r = PermissionUnknown
 	case 0:
-		*r = RightRead
+		*r = PermissionRead
 	case 1:
-		*r = RightWrite
+		*r = PermissionWrite
 	case 2:
-		*r = RightAdmin
+		*r = PermissionAdmin
 	default:
-		return fmt.Errorf("invalid Right %q", s)
+		return fmt.Errorf("invalid Permission %q", s)
 	}
 	return nil
 }
diff --git a/pkg/models/project.go b/pkg/models/project.go
index 641edfc33..5267977b4 100644
--- a/pkg/models/project.go
+++ b/pkg/models/project.go
@@ -77,21 +77,21 @@ type Project struct {
 
 	Views []*ProjectView `xorm:"-" json:"views"`
 
-	Expand   ProjectExpandable `xorm:"-" json:"-" query:"expand"`
-	MaxRight Right             `xorm:"-" json:"max_right"`
+	Expand        ProjectExpandable `xorm:"-" json:"-" query:"expand"`
+	MaxPermission Permission        `xorm:"-" json:"max_permission"`
 
 	// A timestamp when this project was created. You cannot change this value.
 	Created time.Time `xorm:"created not null" json:"created"`
 	// A timestamp when this project was last updated. You cannot change this value.
 	Updated time.Time `xorm:"updated not null" json:"updated"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 type ProjectExpandable string
 
-const ProjectExpandableRights = `rights`
+const ProjectExpandableRights = `permissions`
 
 type ProjectWithTasksAndBuckets struct {
 	Project
@@ -168,7 +168,7 @@ var FavoritesPseudoProject = Project{
 // @Param per_page query int false "The maximum number of items per page. Note this parameter is limited by the configured maximum of items per page."
 // @Param s query string false "Search projects by title."
 // @Param is_archived query bool false "If true, also returns all archived projects."
-// @Param expand query string false "If set to `rights`, Vikunja will return the max right the current user has on this project. You can currently only set this to `rights`."
+// @Param expand query string false "If set to `permissions`, Vikunja will return the max permission the current user has on this project. You can currently only set this to `permissions`."
 // @Security JWTKeyAuth
 // @Success 200 {array} models.Project "The projects"
 // @Failure 403 {object} web.HTTPError "The user does not have access to the project"
@@ -200,13 +200,13 @@ func (p *Project) ReadAll(s *xorm.Session, a web.Auth, search string, page int,
 		if err != nil {
 			return
 		}
-		err = addMaxRightToProjects(s, prs, doer)
+		err = addMaxPermissionToProjects(s, prs, doer)
 		if err != nil {
 			return
 		}
 	} else {
 		for _, pr := range prs {
-			pr.MaxRight = RightUnknown
+			pr.MaxPermission = PermissionUnknown
 		}
 	}
 
@@ -765,25 +765,25 @@ func addProjectDetails(s *xorm.Session, projects []*Project, a web.Auth) (err er
 	return
 }
 
-func addMaxRightToProjects(s *xorm.Session, projects []*Project, u *user.User) (err error) {
+func addMaxPermissionToProjects(s *xorm.Session, projects []*Project, u *user.User) (err error) {
 	projectIDs := make([]int64, 0, len(projects))
 	for _, project := range projects {
 		if GetSavedFilterIDFromProjectID(project.ID) > 0 {
-			project.MaxRight = RightAdmin
+			project.MaxPermission = PermissionAdmin
 			continue
 		}
 		projectIDs = append(projectIDs, project.ID)
 	}
 
-	rights, err := checkRightsForProjects(s, u, projectIDs)
+	permissions, err := checkPermissionsForProjects(s, u, projectIDs)
 	if err != nil {
 		return err
 	}
 
 	for _, project := range projects {
-		right, has := rights[project.ID]
+		permission, has := permissions[project.ID]
 		if has {
-			project.MaxRight = right.MaxRight
+			project.MaxPermission = permission.MaxPermission
 		}
 	}
 
diff --git a/pkg/models/project_duplicate.go b/pkg/models/project_duplicate.go
index af0855993..8d904f8b1 100644
--- a/pkg/models/project_duplicate.go
+++ b/pkg/models/project_duplicate.go
@@ -35,11 +35,11 @@ type ProjectDuplicate struct {
 	// The copied project
 	Project *Project `json:"duplicated_project,omitempty"`
 
-	web.Rights   `json:"-"`
-	web.CRUDable `json:"-"`
+	web.Permissions `json:"-"`
+	web.CRUDable    `json:"-"`
 }
 
-// CanCreate checks if a user has the right to duplicate a project
+// CanCreate checks if a user has the permission to duplicate a project
 func (pd *ProjectDuplicate) CanCreate(s *xorm.Session, a web.Auth) (canCreate bool, err error) {
 	// Project Exists + user has read access to project
 	pd.Project = &Project{ID: pd.ProjectID}
@@ -59,7 +59,7 @@ func (pd *ProjectDuplicate) CanCreate(s *xorm.Session, a web.Auth) (canCreate bo
 
 // Create duplicates a project
 // @Summary Duplicate an existing project
-// @Description Copies the project, tasks, files, kanban data, assignees, comments, attachments, labels, relations, backgrounds, user/team rights and link shares from one project to a new one. The user needs read access in the project and write access in the parent of the new project.
+// @Description Copies the project, tasks, files, kanban data, assignees, comments, attachments, labels, relations, backgrounds, user/team permissions and link shares from one project to a new one. The user needs read access in the project and write access in the parent of the new project.
 // @tags project
 // @Accept json
 // @Produce json
@@ -114,8 +114,8 @@ func (pd *ProjectDuplicate) Create(s *xorm.Session, doer web.Auth) (err error) {
 		return
 	}
 
-	// Rights / Shares
-	// To keep it simple(r) we will only copy rights which are directly used with the project, not the parent
+	// Permissions / Shares
+	// To keep it simple(r) we will only copy permissions which are directly used with the project, not the parent
 	users := []*ProjectUser{}
 	err = s.Where("project_id = ?", pd.ProjectID).Find(&users)
 	if err != nil {
diff --git a/pkg/models/project_rights.go b/pkg/models/project_permissions.go
similarity index 80%
rename from pkg/models/project_rights.go
rename to pkg/models/project_permissions.go
index 35816b5cf..213c9559f 100644
--- a/pkg/models/project_rights.go
+++ b/pkg/models/project_permissions.go
@@ -22,6 +22,7 @@ import (
 	"code.vikunja.io/api/pkg/user"
 	"code.vikunja.io/api/pkg/utils"
 	"code.vikunja.io/api/pkg/web"
+
 	"xorm.io/xorm"
 )
 
@@ -33,7 +34,7 @@ func (p *Project) CanWrite(s *xorm.Session, a web.Auth) (bool, error) {
 		return false, nil
 	}
 
-	// Get the project and check the right
+	// Get the project and check the permission
 	originalProject, err := GetProjectSimpleByID(s, p.ID)
 	if err != nil {
 		return false, err
@@ -49,7 +50,7 @@ func (p *Project) CanWrite(s *xorm.Session, a web.Auth) (bool, error) {
 	shareAuth, ok := a.(*LinkSharing)
 	if ok {
 		return originalProject.ID == shareAuth.ProjectID &&
-			(shareAuth.Right == RightWrite || shareAuth.Right == RightAdmin), errIsArchived
+			(shareAuth.Permission == PermissionWrite || shareAuth.Permission == PermissionAdmin), errIsArchived
 	}
 
 	u := &user.User{ID: a.GetID()}
@@ -63,7 +64,7 @@ func (p *Project) CanWrite(s *xorm.Session, a web.Auth) (bool, error) {
 		return canWrite, errIsArchived
 	}
 
-	canWrite, _, err = originalProject.checkRight(s, u, RightWrite, RightAdmin)
+	canWrite, _, err = originalProject.checkPermission(s, u, PermissionWrite, PermissionAdmin)
 	if err != nil {
 		return false, err
 	}
@@ -82,7 +83,7 @@ func (p *Project) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) {
 
 		*p = FavoritesPseudoProject
 		p.Owner = owner
-		return true, int(RightRead), nil
+		return true, int(PermissionRead), nil
 	}
 
 	// Saved Filter Projects need a special case
@@ -104,10 +105,10 @@ func (p *Project) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) {
 	shareAuth, ok := a.(*LinkSharing)
 	if ok {
 		return p.ID == shareAuth.ProjectID &&
-			(shareAuth.Right == RightRead || shareAuth.Right == RightWrite || shareAuth.Right == RightAdmin), int(shareAuth.Right), nil
+			(shareAuth.Permission == PermissionRead || shareAuth.Permission == PermissionWrite || shareAuth.Permission == PermissionAdmin), int(shareAuth.Permission), nil
 	}
 
-	return p.checkRight(s, &user.User{ID: a.GetID()}, RightRead, RightWrite, RightAdmin)
+	return p.checkPermission(s, &user.User{ID: a.GetID()}, PermissionRead, PermissionWrite, PermissionAdmin)
 }
 
 // CanUpdate checks if the user can update a project
@@ -175,7 +176,7 @@ func (p *Project) CanCreate(s *xorm.Session, a web.Auth) (bool, error) {
 	return true, nil
 }
 
-// IsAdmin returns whether the user has admin rights on the project or not
+// IsAdmin returns whether the user has admin permissions on the project or not
 func (p *Project) IsAdmin(s *xorm.Session, a web.Auth) (bool, error) {
 	// The favorite project can't be edited
 	if p.ID == FavoritesPseudoProject.ID {
@@ -190,7 +191,7 @@ func (p *Project) IsAdmin(s *xorm.Session, a web.Auth) (bool, error) {
 	// Check if we're dealing with a share auth
 	shareAuth, ok := a.(*LinkSharing)
 	if ok {
-		return originalProject.ID == shareAuth.ProjectID && shareAuth.Right == RightAdmin, nil
+		return originalProject.ID == shareAuth.ProjectID && shareAuth.Permission == PermissionAdmin, nil
 	}
 
 	u := &user.User{ID: a.GetID()}
@@ -201,7 +202,7 @@ func (p *Project) IsAdmin(s *xorm.Session, a web.Auth) (bool, error) {
 	if originalProject.isOwner(u) {
 		return true, nil
 	}
-	is, _, err := originalProject.checkRight(s, u, RightAdmin)
+	is, _, err := originalProject.checkPermission(s, u, PermissionAdmin)
 	return is, err
 }
 
@@ -210,33 +211,33 @@ func (p *Project) isOwner(u *user.User) bool {
 	return p.OwnerID == u.ID
 }
 
-// Checks n different rights for any given user
-func (p *Project) checkRight(s *xorm.Session, u *user.User, rights ...Right) (bool, int, error) {
-	projectRights, err := checkRightsForProjects(s, u, []int64{p.ID})
+// Checks n different permissions for any given user
+func (p *Project) checkPermission(s *xorm.Session, u *user.User, permissions ...Permission) (bool, int, error) {
+	projectPermissions, err := checkPermissionsForProjects(s, u, []int64{p.ID})
 	if err != nil {
 		return false, 0, err
 	}
-	right, has := projectRights[p.ID]
+	permission, has := projectPermissions[p.ID]
 	if !has {
 		return false, 0, nil
 	}
 
-	for _, r := range rights {
-		if r == right.MaxRight {
-			return true, int(right.MaxRight), nil
+	for _, r := range permissions {
+		if r == permission.MaxPermission {
+			return true, int(permission.MaxPermission), nil
 		}
 	}
 
 	return false, 0, nil
 }
 
-type projectRight struct {
-	ID       int64 `xorm:"pk autoincr"`
-	MaxRight Right
+type projectPermission struct {
+	ID            int64 `xorm:"pk autoincr"`
+	MaxPermission Permission
 }
 
-func checkRightsForProjects(s *xorm.Session, u *user.User, projectIDs []int64) (projectRightMap map[int64]*projectRight, err error) {
-	projectRightMap = make(map[int64]*projectRight)
+func checkPermissionsForProjects(s *xorm.Session, u *user.User, projectIDs []int64) (projectPermissionMap map[int64]*projectPermission, err error) {
+	projectPermissionMap = make(map[int64]*projectPermission)
 
 	if len(projectIDs) < 1 {
 		return
@@ -277,9 +278,9 @@ WITH RECURSIVE
                                    ph.original_project_id,
                                    CASE
                                        WHEN p.owner_id = ? THEN 2
-                                       WHEN COALESCE(ul.right, 0) > COALESCE(tl.right, 0) THEN ul.right
-                                       ELSE COALESCE(tl.right, 0)
-                                       END AS project_right,
+                                       WHEN COALESCE(ul.permission, 0) > COALESCE(tl.permission, 0) THEN ul.permission
+                                       ELSE COALESCE(tl.permission, 0)
+                                       END AS project_permission,
             CASE
                 WHEN p.owner_id = ? THEN 1  -- Direct project ownership
                 ELSE ph.level + 1  -- Derived from parent project
@@ -293,12 +294,12 @@ WITH RECURSIVE
                             WHERE p.owner_id = ? OR ul.user_id = ? OR tm.user_id = ?)
 
 SELECT ph.original_project_id AS id,
-       COALESCE(MAX(pp.project_right), -1) AS max_right
+       COALESCE(MAX(pp.project_permission), -1) AS max_permission
 FROM project_hierarchy ph
          LEFT JOIN (SELECT *,
                            ROW_NUMBER() OVER (PARTITION BY original_project_id ORDER BY priority) AS rn
                     FROM project_permissions) pp ON ph.id = pp.id AND pp.rn = 1
 GROUP BY ph.original_project_id`, args...).
-		Find(&projectRightMap)
+		Find(&projectPermissionMap)
 	return
 }
diff --git a/pkg/models/project_team.go b/pkg/models/project_team.go
index 40905175a..0a7016d68 100644
--- a/pkg/models/project_team.go
+++ b/pkg/models/project_team.go
@@ -34,16 +34,16 @@ type TeamProject struct {
 	TeamID int64 `xorm:"bigint not null INDEX" json:"team_id" param:"team"`
 	// The project id.
 	ProjectID int64 `xorm:"bigint not null INDEX" json:"-" param:"project"`
-	// The right this team has. 0 = Read only, 1 = Read & Write, 2 = Admin. See the docs for more details.
-	Right Right `xorm:"bigint INDEX not null default 0" json:"right" valid:"length(0|2)" maximum:"2" default:"0"`
+	// The permission this team has. 0 = Read only, 1 = Read & Write, 2 = Admin. See the docs for more details.
+	Permission Permission `xorm:"bigint INDEX not null default 0" json:"permission" valid:"length(0|2)" maximum:"2" default:"0"`
 
 	// A timestamp when this relation was created. You cannot change this value.
 	Created time.Time `xorm:"created not null" json:"created"`
 	// A timestamp when this relation was last updated. You cannot change this value.
 	Updated time.Time `xorm:"updated not null" json:"updated"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName makes beautiful table names
@@ -51,10 +51,10 @@ func (*TeamProject) TableName() string {
 	return "team_projects"
 }
 
-// TeamWithRight represents a team, combined with rights.
-type TeamWithRight struct {
-	Team  `xorm:"extends"`
-	Right Right `json:"right"`
+// TeamWithPermission represents a team, combined with permissions.
+type TeamWithPermission struct {
+	Team       `xorm:"extends"`
+	Permission Permission `json:"permission"`
 }
 
 // Create creates a new team <-> project relation
@@ -74,8 +74,8 @@ type TeamWithRight struct {
 // @Router /projects/{id}/teams [put]
 func (tl *TeamProject) Create(s *xorm.Session, a web.Auth) (err error) {
 
-	// Check if the rights are valid
-	if err = tl.Right.isValid(); err != nil {
+	// Check if the permissions are valid
+	if err = tl.Permission.isValid(); err != nil {
 		return
 	}
 
@@ -177,8 +177,8 @@ func (tl *TeamProject) Delete(s *xorm.Session, _ web.Auth) (err error) {
 // @Param per_page query int false "The maximum number of items per page. Note this parameter is limited by the configured maximum of items per page."
 // @Param s query string false "Search teams by its name."
 // @Security JWTKeyAuth
-// @Success 200 {array} models.TeamWithRight "The teams with their right."
-// @Failure 403 {object} web.HTTPError "No right to see the project."
+// @Success 200 {array} models.TeamWithPermission "The teams with their permission."
+// @Failure 403 {object} web.HTTPError "No permission to see the project."
 // @Failure 500 {object} models.Message "Internal error"
 // @Router /projects/{id}/teams [get]
 func (tl *TeamProject) ReadAll(s *xorm.Session, a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, totalItems int64, err error) {
@@ -195,7 +195,7 @@ func (tl *TeamProject) ReadAll(s *xorm.Session, a web.Auth, search string, page
 	limit, start := getLimitFromPageIndex(page, perPage)
 
 	// Get the teams
-	all := []*TeamWithRight{}
+	all := []*TeamWithPermission{}
 	query := s.
 		Table("teams").
 		Join("INNER", "team_projects", "team_id = teams.id").
@@ -224,7 +224,7 @@ func (tl *TeamProject) ReadAll(s *xorm.Session, a web.Auth, search string, page
 		Join("INNER", "team_projects", "team_id = teams.id").
 		Where("team_projects.project_id = ?", tl.ProjectID).
 		Where("teams.name LIKE ?", "%"+search+"%").
-		Count(&TeamWithRight{})
+		Count(&TeamWithPermission{})
 	if err != nil {
 		return nil, 0, 0, err
 	}
@@ -234,7 +234,7 @@ func (tl *TeamProject) ReadAll(s *xorm.Session, a web.Auth, search string, page
 
 // Update updates a team <-> project relation
 // @Summary Update a team <-> project relation
-// @Description Update a team <-> project relation. Mostly used to update the right that team has.
+// @Description Update a team <-> project relation. Mostly used to update the permission that team has.
 // @tags sharing
 // @Accept json
 // @Produce json
@@ -249,14 +249,14 @@ func (tl *TeamProject) ReadAll(s *xorm.Session, a web.Auth, search string, page
 // @Router /projects/{projectID}/teams/{teamID} [post]
 func (tl *TeamProject) Update(s *xorm.Session, _ web.Auth) (err error) {
 
-	// Check if the right is valid
-	if err := tl.Right.isValid(); err != nil {
+	// Check if the permission is valid
+	if err := tl.Permission.isValid(); err != nil {
 		return err
 	}
 
 	_, err = s.
 		Where("project_id = ? AND team_id = ?", tl.ProjectID, tl.TeamID).
-		Cols("right").
+		Cols("permission").
 		Update(tl)
 	if err != nil {
 		return err
diff --git a/pkg/models/project_team_rights.go b/pkg/models/project_team_permissions.go
similarity index 100%
rename from pkg/models/project_team_rights.go
rename to pkg/models/project_team_permissions.go
diff --git a/pkg/models/project_team_test.go b/pkg/models/project_team_test.go
index a1702d4ba..e907c9966 100644
--- a/pkg/models/project_team_test.go
+++ b/pkg/models/project_team_test.go
@@ -60,9 +60,9 @@ func TestTeamProject_ReadAll(t *testing.T) {
 	})
 	t.Run("no access", func(t *testing.T) {
 		tl := TeamProject{
-			TeamID:    1,
-			ProjectID: 5,
-			Right:     RightAdmin,
+			TeamID:     1,
+			ProjectID:  5,
+			Permission: PermissionAdmin,
 		}
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
@@ -80,7 +80,7 @@ func TestTeamProject_ReadAll(t *testing.T) {
 		teams, _, _, err := tl.ReadAll(s, u, "TEAM9", 1, 50)
 		require.NoError(t, err)
 		assert.Equal(t, reflect.Slice, reflect.TypeOf(teams).Kind())
-		ts := teams.([]*TeamWithRight)
+		ts := teams.([]*TeamWithPermission)
 		assert.Len(t, ts, 1)
 		assert.Equal(t, int64(9), ts[0].ID)
 		_ = s.Close()
@@ -93,9 +93,9 @@ func TestTeamProject_Create(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
 		tl := TeamProject{
-			TeamID:    1,
-			ProjectID: 1,
-			Right:     RightAdmin,
+			TeamID:     1,
+			ProjectID:  1,
+			Permission: PermissionAdmin,
 		}
 		allowed, _ := tl.CanCreate(s, u)
 		assert.True(t, allowed)
@@ -106,33 +106,33 @@ func TestTeamProject_Create(t *testing.T) {
 		db.AssertExists(t, "team_projects", map[string]interface{}{
 			"team_id":    1,
 			"project_id": 1,
-			"right":      RightAdmin,
+			"permission": PermissionAdmin,
 		}, false)
 	})
 	t.Run("team already has access", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
 		tl := TeamProject{
-			TeamID:    1,
-			ProjectID: 3,
-			Right:     RightAdmin,
+			TeamID:     1,
+			ProjectID:  3,
+			Permission: PermissionAdmin,
 		}
 		err := tl.Create(s, u)
 		require.Error(t, err)
 		assert.True(t, IsErrTeamAlreadyHasAccess(err))
 		_ = s.Close()
 	})
-	t.Run("wrong rights", func(t *testing.T) {
+	t.Run("wrong permissions", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
 		tl := TeamProject{
-			TeamID:    1,
-			ProjectID: 1,
-			Right:     RightUnknown,
+			TeamID:     1,
+			ProjectID:  1,
+			Permission: PermissionUnknown,
 		}
 		err := tl.Create(s, u)
 		require.Error(t, err)
-		assert.True(t, IsErrInvalidRight(err))
+		assert.True(t, IsErrInvalidPermission(err))
 		_ = s.Close()
 	})
 	t.Run("nonexistant team", func(t *testing.T) {
@@ -208,14 +208,14 @@ func TestTeamProject_Delete(t *testing.T) {
 
 func TestTeamProject_Update(t *testing.T) {
 	type fields struct {
-		ID        int64
-		TeamID    int64
-		ProjectID int64
-		Right     Right
-		Created   time.Time
-		Updated   time.Time
-		CRUDable  web.CRUDable
-		Rights    web.Rights
+		ID          int64
+		TeamID      int64
+		ProjectID   int64
+		Permission  Permission
+		Created     time.Time
+		Updated     time.Time
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	tests := []struct {
 		name    string
@@ -226,36 +226,36 @@ func TestTeamProject_Update(t *testing.T) {
 		{
 			name: "Test Update Normally",
 			fields: fields{
-				ProjectID: 3,
-				TeamID:    1,
-				Right:     RightAdmin,
+				ProjectID:  3,
+				TeamID:     1,
+				Permission: PermissionAdmin,
 			},
 		},
 		{
 			name: "Test Update to write",
 			fields: fields{
-				ProjectID: 3,
-				TeamID:    1,
-				Right:     RightWrite,
+				ProjectID:  3,
+				TeamID:     1,
+				Permission: PermissionWrite,
 			},
 		},
 		{
 			name: "Test Update to Read",
 			fields: fields{
-				ProjectID: 3,
-				TeamID:    1,
-				Right:     RightRead,
+				ProjectID:  3,
+				TeamID:     1,
+				Permission: PermissionRead,
 			},
 		},
 		{
-			name: "Test Update with invalid right",
+			name: "Test Update with invalid permission",
 			fields: fields{
-				ProjectID: 3,
-				TeamID:    1,
-				Right:     500,
+				ProjectID:  3,
+				TeamID:     1,
+				Permission: 500,
 			},
 			wantErr: true,
-			errType: IsErrInvalidRight,
+			errType: IsErrInvalidPermission,
 		},
 	}
 	for _, tt := range tests {
@@ -264,14 +264,14 @@ func TestTeamProject_Update(t *testing.T) {
 			s := db.NewSession()
 
 			tl := &TeamProject{
-				ID:        tt.fields.ID,
-				TeamID:    tt.fields.TeamID,
-				ProjectID: tt.fields.ProjectID,
-				Right:     tt.fields.Right,
-				Created:   tt.fields.Created,
-				Updated:   tt.fields.Updated,
-				CRUDable:  tt.fields.CRUDable,
-				Rights:    tt.fields.Rights,
+				ID:          tt.fields.ID,
+				TeamID:      tt.fields.TeamID,
+				ProjectID:   tt.fields.ProjectID,
+				Permission:  tt.fields.Permission,
+				Created:     tt.fields.Created,
+				Updated:     tt.fields.Updated,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			err := tl.Update(s, &user.User{ID: 1})
 			if (err != nil) != tt.wantErr {
@@ -286,7 +286,7 @@ func TestTeamProject_Update(t *testing.T) {
 				db.AssertExists(t, "team_projects", map[string]interface{}{
 					"project_id": tt.fields.ProjectID,
 					"team_id":    tt.fields.TeamID,
-					"right":      tt.fields.Right,
+					"permission": tt.fields.Permission,
 				}, false)
 			}
 		})
diff --git a/pkg/models/project_users.go b/pkg/models/project_users.go
index 708085753..4d8096858 100644
--- a/pkg/models/project_users.go
+++ b/pkg/models/project_users.go
@@ -37,16 +37,16 @@ type ProjectUser struct {
 	UserID int64 `xorm:"bigint not null INDEX" json:"-"`
 	// The project id.
 	ProjectID int64 `xorm:"bigint not null INDEX" json:"-" param:"project"`
-	// The right this user has. 0 = Read only, 1 = Read & Write, 2 = Admin. See the docs for more details.
-	Right Right `xorm:"bigint INDEX not null default 0" json:"right" valid:"length(0|2)" maximum:"2" default:"0"`
+	// The permission this user has. 0 = Read only, 1 = Read & Write, 2 = Admin. See the docs for more details.
+	Permission Permission `xorm:"bigint INDEX not null default 0" json:"permission" valid:"length(0|2)" maximum:"2" default:"0"`
 
 	// A timestamp when this relation was created. You cannot change this value.
 	Created time.Time `xorm:"created not null" json:"created"`
 	// A timestamp when this relation was last updated. You cannot change this value.
 	Updated time.Time `xorm:"updated not null" json:"updated"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName is the table name for ProjectUser
@@ -54,10 +54,10 @@ func (*ProjectUser) TableName() string {
 	return "users_projects"
 }
 
-// UserWithRight represents a user in combination with the right it can have on a project
-type UserWithRight struct {
-	user.User `xorm:"extends"`
-	Right     Right `json:"right"`
+// UserWithPermission represents a user in combination with the permission it can have on a project
+type UserWithPermission struct {
+	user.User  `xorm:"extends"`
+	Permission Permission `json:"permission"`
 }
 
 // Create creates a new project <-> user relation
@@ -77,8 +77,8 @@ type UserWithRight struct {
 // @Router /projects/{id}/users [put]
 func (lu *ProjectUser) Create(s *xorm.Session, a web.Auth) (err error) {
 
-	// Check if the right is valid
-	if err := lu.Right.isValid(); err != nil {
+	// Check if the permission is valid
+	if err := lu.Permission.isValid(); err != nil {
 		return err
 	}
 
@@ -183,8 +183,8 @@ func (lu *ProjectUser) Delete(s *xorm.Session, _ web.Auth) (err error) {
 // @Param per_page query int false "The maximum number of items per page. Note this parameter is limited by the configured maximum of items per page."
 // @Param s query string false "Search users by its name."
 // @Security JWTKeyAuth
-// @Success 200 {array} models.UserWithRight "The users with the right they have."
-// @Failure 403 {object} web.HTTPError "No right to see the project."
+// @Success 200 {array} models.UserWithPermission "The users with the permission they have."
+// @Failure 403 {object} web.HTTPError "No permission to see the project."
 // @Failure 500 {object} models.Message "Internal error"
 // @Router /projects/{id}/users [get]
 func (lu *ProjectUser) ReadAll(s *xorm.Session, a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error) {
@@ -201,7 +201,7 @@ func (lu *ProjectUser) ReadAll(s *xorm.Session, a web.Auth, search string, page
 	limit, start := getLimitFromPageIndex(page, perPage)
 
 	// Get all users
-	all := []*UserWithRight{}
+	all := []*UserWithPermission{}
 	query := s.
 		Join("INNER", "users_projects", "user_id = users.id").
 		Where("users_projects.project_id = ?", lu.ProjectID).
@@ -223,14 +223,14 @@ func (lu *ProjectUser) ReadAll(s *xorm.Session, a web.Auth, search string, page
 		Join("INNER", "users_projects", "user_id = users.id").
 		Where("users_projects.project_id = ?", lu.ProjectID).
 		Where("users.username LIKE ?", "%"+search+"%").
-		Count(&UserWithRight{})
+		Count(&UserWithPermission{})
 
 	return all, len(all), numberOfTotalItems, err
 }
 
 // Update updates a user <-> project relation
 // @Summary Update a user <-> project relation
-// @Description Update a user <-> project relation. Mostly used to update the right that user has.
+// @Description Update a user <-> project relation. Mostly used to update the permission that user has.
 // @tags sharing
 // @Accept json
 // @Produce json
@@ -245,8 +245,8 @@ func (lu *ProjectUser) ReadAll(s *xorm.Session, a web.Auth, search string, page
 // @Router /projects/{projectID}/users/{userID} [post]
 func (lu *ProjectUser) Update(s *xorm.Session, _ web.Auth) (err error) {
 
-	// Check if the right is valid
-	if err := lu.Right.isValid(); err != nil {
+	// Check if the permission is valid
+	if err := lu.Permission.isValid(); err != nil {
 		return err
 	}
 
@@ -259,7 +259,7 @@ func (lu *ProjectUser) Update(s *xorm.Session, _ web.Auth) (err error) {
 
 	_, err = s.
 		Where("project_id = ? AND user_id = ?", lu.ProjectID, lu.UserID).
-		Cols("right").
+		Cols("permission").
 		Update(lu)
 	if err != nil {
 		return err
diff --git a/pkg/models/project_users_rights.go b/pkg/models/project_users_permissions.go
similarity index 100%
rename from pkg/models/project_users_rights.go
rename to pkg/models/project_users_permissions.go
diff --git a/pkg/models/project_users_rights_test.go b/pkg/models/project_users_permissions_test.go
similarity index 81%
rename from pkg/models/project_users_rights_test.go
rename to pkg/models/project_users_permissions_test.go
index f25ae9e1b..75b240d42 100644
--- a/pkg/models/project_users_rights_test.go
+++ b/pkg/models/project_users_permissions_test.go
@@ -28,14 +28,14 @@ import (
 
 func TestProjectUser_CanDoSomething(t *testing.T) {
 	type fields struct {
-		ID        int64
-		UserID    int64
-		ProjectID int64
-		Right     Right
-		Created   time.Time
-		Updated   time.Time
-		CRUDable  web.CRUDable
-		Rights    web.Rights
+		ID          int64
+		UserID      int64
+		ProjectID   int64
+		Permission  Permission
+		Created     time.Time
+		Updated     time.Time
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	type args struct {
 		a web.Auth
@@ -67,7 +67,7 @@ func TestProjectUser_CanDoSomething(t *testing.T) {
 			want: map[string]bool{"CanCreate": false, "CanDelete": false, "CanUpdate": false},
 		},
 		{
-			name: "CanDoSomething where the user does not have the rights",
+			name: "CanDoSomething where the user does not have the permissions",
 			fields: fields{
 				ProjectID: 3,
 			},
@@ -83,14 +83,14 @@ func TestProjectUser_CanDoSomething(t *testing.T) {
 			s := db.NewSession()
 
 			lu := &ProjectUser{
-				ID:        tt.fields.ID,
-				UserID:    tt.fields.UserID,
-				ProjectID: tt.fields.ProjectID,
-				Right:     tt.fields.Right,
-				Created:   tt.fields.Created,
-				Updated:   tt.fields.Updated,
-				CRUDable:  tt.fields.CRUDable,
-				Rights:    tt.fields.Rights,
+				ID:          tt.fields.ID,
+				UserID:      tt.fields.UserID,
+				ProjectID:   tt.fields.ProjectID,
+				Permission:  tt.fields.Permission,
+				Created:     tt.fields.Created,
+				Updated:     tt.fields.Updated,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			if got, _ := lu.CanCreate(s, tt.args.a); got != tt.want["CanCreate"] {
 				t.Errorf("ProjectUser.CanCreate() = %v, want %v", got, tt.want["CanCreate"])
diff --git a/pkg/models/project_users_test.go b/pkg/models/project_users_test.go
index 37e1e8328..38cb7d20a 100644
--- a/pkg/models/project_users_test.go
+++ b/pkg/models/project_users_test.go
@@ -32,15 +32,15 @@ import (
 
 func TestProjectUser_Create(t *testing.T) {
 	type fields struct {
-		ID        int64
-		UserID    int64
-		Username  string
-		ProjectID int64
-		Right     Right
-		Created   time.Time
-		Updated   time.Time
-		CRUDable  web.CRUDable
-		Rights    web.Rights
+		ID          int64
+		UserID      int64
+		Username    string
+		ProjectID   int64
+		Permission  Permission
+		Created     time.Time
+		Updated     time.Time
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	type args struct {
 		a web.Auth
@@ -69,14 +69,14 @@ func TestProjectUser_Create(t *testing.T) {
 			errType: IsErrUserAlreadyHasAccess,
 		},
 		{
-			name: "ListUsers Create with invalid right",
+			name: "ListUsers Create with invalid permission",
 			fields: fields{
-				Username:  "user1",
-				ProjectID: 2,
-				Right:     500,
+				Username:   "user1",
+				ProjectID:  2,
+				Permission: 500,
 			},
 			wantErr: true,
-			errType: IsErrInvalidRight,
+			errType: IsErrInvalidPermission,
 		},
 		{
 			name: "ListUsers Create with inexisting project",
@@ -112,15 +112,15 @@ func TestProjectUser_Create(t *testing.T) {
 			s := db.NewSession()
 
 			ul := &ProjectUser{
-				ID:        tt.fields.ID,
-				UserID:    tt.fields.UserID,
-				Username:  tt.fields.Username,
-				ProjectID: tt.fields.ProjectID,
-				Right:     tt.fields.Right,
-				Created:   tt.fields.Created,
-				Updated:   tt.fields.Updated,
-				CRUDable:  tt.fields.CRUDable,
-				Rights:    tt.fields.Rights,
+				ID:          tt.fields.ID,
+				UserID:      tt.fields.UserID,
+				Username:    tt.fields.Username,
+				ProjectID:   tt.fields.ProjectID,
+				Permission:  tt.fields.Permission,
+				Created:     tt.fields.Created,
+				Updated:     tt.fields.Updated,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			err := ul.Create(s, tt.args.a)
 			if (err != nil) != tt.wantErr {
@@ -144,7 +144,7 @@ func TestProjectUser_Create(t *testing.T) {
 }
 
 func TestProjectUser_ReadAll(t *testing.T) {
-	user1Read := &UserWithRight{
+	user1Read := &UserWithPermission{
 		User: user.User{
 			ID:                           1,
 			Username:                     "user1",
@@ -157,9 +157,9 @@ func TestProjectUser_ReadAll(t *testing.T) {
 			Updated:                      testUpdatedTime,
 			ExportFileID:                 1,
 		},
-		Right: RightRead,
+		Permission: PermissionRead,
 	}
-	user2Read := &UserWithRight{
+	user2Read := &UserWithPermission{
 		User: user.User{
 			ID:                           2,
 			Username:                     "user2",
@@ -172,18 +172,18 @@ func TestProjectUser_ReadAll(t *testing.T) {
 			Created:                      testCreatedTime,
 			Updated:                      testUpdatedTime,
 		},
-		Right: RightRead,
+		Permission: PermissionRead,
 	}
 
 	type fields struct {
-		ID        int64
-		UserID    int64
-		ProjectID int64
-		Right     Right
-		Created   time.Time
-		Updated   time.Time
-		CRUDable  web.CRUDable
-		Rights    web.Rights
+		ID          int64
+		UserID      int64
+		ProjectID   int64
+		Permission  Permission
+		Created     time.Time
+		Updated     time.Time
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	type args struct {
 		search string
@@ -206,7 +206,7 @@ func TestProjectUser_ReadAll(t *testing.T) {
 			args: args{
 				a: &user.User{ID: 3},
 			},
-			want: []*UserWithRight{
+			want: []*UserWithPermission{
 				user1Read,
 				user2Read,
 			},
@@ -231,7 +231,7 @@ func TestProjectUser_ReadAll(t *testing.T) {
 				a:      &user.User{ID: 3},
 				search: "USER2",
 			},
-			want: []*UserWithRight{
+			want: []*UserWithPermission{
 				user2Read,
 			},
 		},
@@ -242,14 +242,14 @@ func TestProjectUser_ReadAll(t *testing.T) {
 			s := db.NewSession()
 
 			ul := &ProjectUser{
-				ID:        tt.fields.ID,
-				UserID:    tt.fields.UserID,
-				ProjectID: tt.fields.ProjectID,
-				Right:     tt.fields.Right,
-				Created:   tt.fields.Created,
-				Updated:   tt.fields.Updated,
-				CRUDable:  tt.fields.CRUDable,
-				Rights:    tt.fields.Rights,
+				ID:          tt.fields.ID,
+				UserID:      tt.fields.UserID,
+				ProjectID:   tt.fields.ProjectID,
+				Permission:  tt.fields.Permission,
+				Created:     tt.fields.Created,
+				Updated:     tt.fields.Updated,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			got, _, _, err := ul.ReadAll(s, tt.args.a, tt.args.search, tt.args.page, 50)
 			if (err != nil) != tt.wantErr {
@@ -268,14 +268,14 @@ func TestProjectUser_ReadAll(t *testing.T) {
 
 func TestProjectUser_Update(t *testing.T) {
 	type fields struct {
-		ID        int64
-		Username  string
-		ProjectID int64
-		Right     Right
-		Created   time.Time
-		Updated   time.Time
-		CRUDable  web.CRUDable
-		Rights    web.Rights
+		ID          int64
+		Username    string
+		ProjectID   int64
+		Permission  Permission
+		Created     time.Time
+		Updated     time.Time
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	tests := []struct {
 		name    string
@@ -286,36 +286,36 @@ func TestProjectUser_Update(t *testing.T) {
 		{
 			name: "Test Update Normally",
 			fields: fields{
-				ProjectID: 3,
-				Username:  "user1",
-				Right:     RightAdmin,
+				ProjectID:  3,
+				Username:   "user1",
+				Permission: PermissionAdmin,
 			},
 		},
 		{
 			name: "Test Update to write",
 			fields: fields{
-				ProjectID: 3,
-				Username:  "user1",
-				Right:     RightWrite,
+				ProjectID:  3,
+				Username:   "user1",
+				Permission: PermissionWrite,
 			},
 		},
 		{
 			name: "Test Update to Read",
 			fields: fields{
-				ProjectID: 3,
-				Username:  "user1",
-				Right:     RightRead,
+				ProjectID:  3,
+				Username:   "user1",
+				Permission: PermissionRead,
 			},
 		},
 		{
-			name: "Test Update with invalid right",
+			name: "Test Update with invalid permission",
 			fields: fields{
-				ProjectID: 3,
-				Username:  "user1",
-				Right:     500,
+				ProjectID:  3,
+				Username:   "user1",
+				Permission: 500,
 			},
 			wantErr: true,
-			errType: IsErrInvalidRight,
+			errType: IsErrInvalidPermission,
 		},
 	}
 	for _, tt := range tests {
@@ -324,14 +324,14 @@ func TestProjectUser_Update(t *testing.T) {
 			s := db.NewSession()
 
 			lu := &ProjectUser{
-				ID:        tt.fields.ID,
-				Username:  tt.fields.Username,
-				ProjectID: tt.fields.ProjectID,
-				Right:     tt.fields.Right,
-				Created:   tt.fields.Created,
-				Updated:   tt.fields.Updated,
-				CRUDable:  tt.fields.CRUDable,
-				Rights:    tt.fields.Rights,
+				ID:          tt.fields.ID,
+				Username:    tt.fields.Username,
+				ProjectID:   tt.fields.ProjectID,
+				Permission:  tt.fields.Permission,
+				Created:     tt.fields.Created,
+				Updated:     tt.fields.Updated,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			err := lu.Update(s, &user.User{ID: 1})
 			if (err != nil) != tt.wantErr {
@@ -348,7 +348,7 @@ func TestProjectUser_Update(t *testing.T) {
 				db.AssertExists(t, "users_projects", map[string]interface{}{
 					"project_id": tt.fields.ProjectID,
 					"user_id":    lu.UserID,
-					"right":      tt.fields.Right,
+					"permission": tt.fields.Permission,
 				}, false)
 			}
 		})
@@ -357,15 +357,15 @@ func TestProjectUser_Update(t *testing.T) {
 
 func TestProjectUser_Delete(t *testing.T) {
 	type fields struct {
-		ID        int64
-		Username  string
-		UserID    int64
-		ProjectID int64
-		Right     Right
-		Created   time.Time
-		Updated   time.Time
-		CRUDable  web.CRUDable
-		Rights    web.Rights
+		ID          int64
+		Username    string
+		UserID      int64
+		ProjectID   int64
+		Permission  Permission
+		Created     time.Time
+		Updated     time.Time
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	tests := []struct {
 		name    string
@@ -406,14 +406,14 @@ func TestProjectUser_Delete(t *testing.T) {
 			s := db.NewSession()
 
 			lu := &ProjectUser{
-				ID:        tt.fields.ID,
-				Username:  tt.fields.Username,
-				ProjectID: tt.fields.ProjectID,
-				Right:     tt.fields.Right,
-				Created:   tt.fields.Created,
-				Updated:   tt.fields.Updated,
-				CRUDable:  tt.fields.CRUDable,
-				Rights:    tt.fields.Rights,
+				ID:          tt.fields.ID,
+				Username:    tt.fields.Username,
+				ProjectID:   tt.fields.ProjectID,
+				Permission:  tt.fields.Permission,
+				Created:     tt.fields.Created,
+				Updated:     tt.fields.Updated,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			err := lu.Delete(s, &user.User{ID: 1})
 			if (err != nil) != tt.wantErr {
diff --git a/pkg/models/project_view.go b/pkg/models/project_view.go
index 2fc0fce49..d77487c75 100644
--- a/pkg/models/project_view.go
+++ b/pkg/models/project_view.go
@@ -157,8 +157,8 @@ type ProjectView struct {
 	// A timestamp when this reaction was created. You cannot change this value.
 	Created time.Time `xorm:"created not null" json:"created"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 func (pv *ProjectView) TableName() string {
diff --git a/pkg/models/project_view_rights.go b/pkg/models/project_view_permissions.go
similarity index 100%
rename from pkg/models/project_view_rights.go
rename to pkg/models/project_view_permissions.go
diff --git a/pkg/models/reaction.go b/pkg/models/reaction.go
index d7a9f3c4e..712e144a2 100644
--- a/pkg/models/reaction.go
+++ b/pkg/models/reaction.go
@@ -53,8 +53,8 @@ type Reaction struct {
 	// A timestamp when this reaction was created. You cannot change this value.
 	Created time.Time `xorm:"created not null" json:"created"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 func (*Reaction) TableName() string {
diff --git a/pkg/models/reaction_rights.go b/pkg/models/reaction_permissions.go
similarity index 100%
rename from pkg/models/reaction_rights.go
rename to pkg/models/reaction_permissions.go
diff --git a/pkg/models/saved_filters.go b/pkg/models/saved_filters.go
index b43953db7..dad2bae25 100644
--- a/pkg/models/saved_filters.go
+++ b/pkg/models/saved_filters.go
@@ -53,8 +53,8 @@ type SavedFilter struct {
 	// A timestamp when this filter was last updated. You cannot change this value.
 	Updated time.Time `xorm:"updated not null" json:"updated"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName returns a better table name for saved filters
@@ -170,7 +170,7 @@ func GetSavedFilterSimpleByID(s *xorm.Session, id int64) (sf *SavedFilter, err e
 // @Failure 500 {object} models.Message "Internal error"
 // @Router /filters/{id} [get]
 func (sf *SavedFilter) ReadOne(s *xorm.Session, _ web.Auth) error {
-	// s already contains almost the full saved filter from the rights check, we only need to add the user
+	// s already contains almost the full saved filter from the permissions check, we only need to add the user
 	u, err := user.GetUserByID(s, sf.OwnerID)
 	sf.Owner = u
 	return err
diff --git a/pkg/models/saved_filters_rights.go b/pkg/models/saved_filters_permissions.go
similarity index 83%
rename from pkg/models/saved_filters_rights.go
rename to pkg/models/saved_filters_permissions.go
index 8438e4979..c97153040 100644
--- a/pkg/models/saved_filters_rights.go
+++ b/pkg/models/saved_filters_permissions.go
@@ -21,25 +21,25 @@ import (
 	"xorm.io/xorm"
 )
 
-// CanRead checks if a user has the right to read a saved filter
+// CanRead checks if a user has the permission to read a saved filter
 func (sf *SavedFilter) CanRead(s *xorm.Session, auth web.Auth) (bool, int, error) {
 	can, err := sf.canDoFilter(s, auth)
-	return can, int(RightAdmin), err
+	return can, int(PermissionAdmin), err
 }
 
-// CanDelete checks if a user has the right to delete a saved filter
+// CanDelete checks if a user has the permission to delete a saved filter
 func (sf *SavedFilter) CanDelete(s *xorm.Session, auth web.Auth) (bool, error) {
 	return sf.canDoFilter(s, auth)
 }
 
-// CanUpdate checks if a user has the right to update a saved filter
+// CanUpdate checks if a user has the permission to update a saved filter
 func (sf *SavedFilter) CanUpdate(s *xorm.Session, auth web.Auth) (bool, error) {
 	// A normal check would replace the passed struct which in our case would override the values we want to update.
 	sff := &SavedFilter{ID: sf.ID}
 	return sff.canDoFilter(s, auth)
 }
 
-// CanCreate checks if a user has the right to update a saved filter
+// CanCreate checks if a user has the permission to update a saved filter
 func (sf *SavedFilter) CanCreate(_ *xorm.Session, auth web.Auth) (bool, error) {
 	if _, is := auth.(*LinkSharing); is {
 		return false, nil
@@ -48,7 +48,7 @@ func (sf *SavedFilter) CanCreate(_ *xorm.Session, auth web.Auth) (bool, error) {
 	return true, nil
 }
 
-// Helper function to check saved filter rights sind they all have the same logic
+// Helper function to check saved filter permissions sind they all have the same logic
 func (sf *SavedFilter) canDoFilter(s *xorm.Session, auth web.Auth) (can bool, err error) {
 	// Link shares can't view or modify saved filters, therefore we can error out right away
 	if _, is := auth.(*LinkSharing); is {
diff --git a/pkg/models/saved_filters_test.go b/pkg/models/saved_filters_test.go
index 396d149e3..3124f6782 100644
--- a/pkg/models/saved_filters_test.go
+++ b/pkg/models/saved_filters_test.go
@@ -191,7 +191,7 @@ func TestSavedFilter_Delete(t *testing.T) {
 	})
 }
 
-func TestSavedFilter_Rights(t *testing.T) {
+func TestSavedFilter_Permissions(t *testing.T) {
 	user1 := &user.User{ID: 1}
 	user2 := &user.User{ID: 2}
 	ls := &LinkSharing{ID: 1}
@@ -216,9 +216,9 @@ func TestSavedFilter_Rights(t *testing.T) {
 				ID:    1,
 				Title: "Lorem",
 			}
-			can, maxRight, err := sf.CanRead(s, user1)
+			can, maxPermission, err := sf.CanRead(s, user1)
 			require.NoError(t, err)
-			assert.Equal(t, int(RightAdmin), maxRight)
+			assert.Equal(t, int(PermissionAdmin), maxPermission)
 			assert.True(t, can)
 		})
 		t.Run("not owner", func(t *testing.T) {
diff --git a/pkg/models/subscription.go b/pkg/models/subscription.go
index fcce7529c..ad664c23f 100644
--- a/pkg/models/subscription.go
+++ b/pkg/models/subscription.go
@@ -109,8 +109,8 @@ type Subscription struct {
 	// A timestamp when this subscription was created. You cannot change this value.
 	Created time.Time `xorm:"created not null" json:"created"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 type SubscriptionWithUser struct {
@@ -145,7 +145,7 @@ func (sb *Subscription) TableName() string {
 // @Failure 500 {object} models.Message "Internal error"
 // @Router /subscriptions/{entity}/{entityID} [put]
 func (sb *Subscription) Create(s *xorm.Session, auth web.Auth) (err error) {
-	// Rights method already does the validation of the entity type, so we don't need to do that here
+	// Permissions method already does the validation of the entity type, so we don't need to do that here
 
 	sb.ID = 0
 	sb.UserID = auth.GetID()
diff --git a/pkg/models/subscription_rights.go b/pkg/models/subscription_permissions.go
similarity index 100%
rename from pkg/models/subscription_rights.go
rename to pkg/models/subscription_permissions.go
diff --git a/pkg/models/subscription_test.go b/pkg/models/subscription_test.go
index acfd63fac..2aeab0d7d 100644
--- a/pkg/models/subscription_test.go
+++ b/pkg/models/subscription_test.go
@@ -136,7 +136,7 @@ func TestSubscription_Create(t *testing.T) {
 		assert.True(t, IsErrTaskDoesNotExist(err))
 		assert.False(t, can)
 	})
-	t.Run("no rights to see project", func(t *testing.T) {
+	t.Run("no permissions to see project", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
 		defer s.Close()
@@ -151,7 +151,7 @@ func TestSubscription_Create(t *testing.T) {
 		require.NoError(t, err)
 		assert.False(t, can)
 	})
-	t.Run("no rights to see task", func(t *testing.T) {
+	t.Run("no permissions to see task", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
 		defer s.Close()
diff --git a/pkg/models/task_assignees.go b/pkg/models/task_assignees.go
index 48873723a..b6823238e 100644
--- a/pkg/models/task_assignees.go
+++ b/pkg/models/task_assignees.go
@@ -35,8 +35,8 @@ type TaskAssginee struct {
 	UserID  int64     `xorm:"bigint INDEX not null" json:"user_id" param:"user"`
 	Created time.Time `xorm:"created not null"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName makes a pretty table name
@@ -355,8 +355,8 @@ type BulkAssignees struct {
 	Assignees []*user.User `json:"assignees"`
 	TaskID    int64        `json:"-" param:"projecttask"`
 
-	web.CRUDable `json:"-"`
-	web.Rights   `json:"-"`
+	web.CRUDable    `json:"-"`
+	web.Permissions `json:"-"`
 }
 
 // Create adds new assignees to a task
diff --git a/pkg/models/task_assignees_rights.go b/pkg/models/task_assignees_permissions.go
similarity index 100%
rename from pkg/models/task_assignees_rights.go
rename to pkg/models/task_assignees_permissions.go
diff --git a/pkg/models/task_attachment.go b/pkg/models/task_attachment.go
index e4800274f..9dcb1b806 100644
--- a/pkg/models/task_attachment.go
+++ b/pkg/models/task_attachment.go
@@ -48,8 +48,8 @@ type TaskAttachment struct {
 
 	Created time.Time `xorm:"created" json:"created"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName returns the table name for task attachments
diff --git a/pkg/models/task_attachment_rights.go b/pkg/models/task_attachment_permissions.go
similarity index 100%
rename from pkg/models/task_attachment_rights.go
rename to pkg/models/task_attachment_permissions.go
diff --git a/pkg/models/task_attachment_test.go b/pkg/models/task_attachment_test.go
index acb93971f..d42384560 100644
--- a/pkg/models/task_attachment_test.go
+++ b/pkg/models/task_attachment_test.go
@@ -197,7 +197,7 @@ func TestTaskAttachment_Delete(t *testing.T) {
 	})
 }
 
-func TestTaskAttachment_Rights(t *testing.T) {
+func TestTaskAttachment_Permissions(t *testing.T) {
 	u := &user.User{ID: 1}
 	t.Run("Can Read", func(t *testing.T) {
 		t.Run("Allowed", func(t *testing.T) {
diff --git a/pkg/models/task_collection.go b/pkg/models/task_collection.go
index 083131278..9d89e0cf3 100644
--- a/pkg/models/task_collection.go
+++ b/pkg/models/task_collection.go
@@ -60,8 +60,8 @@ type TaskCollection struct {
 
 	isSavedFilter bool
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 type TaskCollectionExpandable string
diff --git a/pkg/models/task_collection_test.go b/pkg/models/task_collection_test.go
index 90b092022..e324452df 100644
--- a/pkg/models/task_collection_test.go
+++ b/pkg/models/task_collection_test.go
@@ -661,8 +661,8 @@ func TestTaskCollection_ReadAll(t *testing.T) {
 
 		Expand []TaskCollectionExpandable
 
-		CRUDable web.CRUDable
-		Rights   web.Rights
+		CRUDable    web.CRUDable
+		Permissions web.Permissions
 	}
 	type args struct {
 		search string
@@ -1644,8 +1644,8 @@ func TestTaskCollection_ReadAll(t *testing.T) {
 
 				Expand: tt.fields.Expand,
 
-				CRUDable: tt.fields.CRUDable,
-				Rights:   tt.fields.Rights,
+				CRUDable:    tt.fields.CRUDable,
+				Permissions: tt.fields.Permissions,
 			}
 			got, _, _, err := lt.ReadAll(s, tt.args.a, tt.args.search, tt.args.page, 50)
 			if (err != nil) != tt.wantErr {
diff --git a/pkg/models/task_comment_rights.go b/pkg/models/task_comment_permissions.go
similarity index 100%
rename from pkg/models/task_comment_rights.go
rename to pkg/models/task_comment_permissions.go
diff --git a/pkg/models/task_comments.go b/pkg/models/task_comments.go
index 572287fb7..f6f40e34e 100644
--- a/pkg/models/task_comments.go
+++ b/pkg/models/task_comments.go
@@ -41,8 +41,8 @@ type TaskComment struct {
 	Created time.Time `xorm:"created" json:"created"`
 	Updated time.Time `xorm:"updated" json:"updated"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName holds the table name for the task comments table
diff --git a/pkg/models/task_position.go b/pkg/models/task_position.go
index ea01711d8..d218544eb 100644
--- a/pkg/models/task_position.go
+++ b/pkg/models/task_position.go
@@ -41,8 +41,8 @@ type TaskPosition struct {
 	// endpoint, otherwise they will always be 0. To update them, take a look at the Task Position endpoint.
 	Position float64 `xorm:"double not null" json:"position"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 func (tp *TaskPosition) TableName() string {
diff --git a/pkg/models/task_relation.go b/pkg/models/task_relation.go
index a1dc91aa3..bb75f6148 100644
--- a/pkg/models/task_relation.go
+++ b/pkg/models/task_relation.go
@@ -95,8 +95,8 @@ type TaskRelation struct {
 	// A timestamp when this label was created. You cannot change this value.
 	Created time.Time `xorm:"created not null" json:"created"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName holds the table name for the task relation table
@@ -188,7 +188,7 @@ func checkTaskRelationCycle(s *xorm.Session, relation *TaskRelation, otherTaskID
 
 // Create creates a new task relation
 // @Summary Create a new relation between two tasks
-// @Description Creates a new relation between two tasks. The user needs to have update rights on the base task and at least read rights on the other task. Both tasks do not need to be on the same project. Take a look at the docs for available task relation kinds.
+// @Description Creates a new relation between two tasks. The user needs to have update permissions on the base task and at least read permissions on the other task. Both tasks do not need to be on the same project. Take a look at the docs for available task relation kinds.
 // @tags task
 // @Accept json
 // @Produce json
diff --git a/pkg/models/task_relation_rights.go b/pkg/models/task_relation_permissions.go
similarity index 100%
rename from pkg/models/task_relation_rights.go
rename to pkg/models/task_relation_permissions.go
diff --git a/pkg/models/task_relation_test.go b/pkg/models/task_relation_test.go
index 6df3b9165..09f5c3b7e 100644
--- a/pkg/models/task_relation_test.go
+++ b/pkg/models/task_relation_test.go
@@ -347,7 +347,7 @@ func TestTaskRelation_CanCreate(t *testing.T) {
 		require.NoError(t, err)
 		assert.True(t, can)
 	})
-	t.Run("No update rights on base task", func(t *testing.T) {
+	t.Run("No update permissions on base task", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
 		defer s.Close()
@@ -361,7 +361,7 @@ func TestTaskRelation_CanCreate(t *testing.T) {
 		require.NoError(t, err)
 		assert.False(t, can)
 	})
-	t.Run("No update rights on base task, but read rights", func(t *testing.T) {
+	t.Run("No update permissions on base task, but read permissions", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
 		defer s.Close()
@@ -375,7 +375,7 @@ func TestTaskRelation_CanCreate(t *testing.T) {
 		require.NoError(t, err)
 		assert.False(t, can)
 	})
-	t.Run("No read rights on other task", func(t *testing.T) {
+	t.Run("No read permissions on other task", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
 		s := db.NewSession()
 		defer s.Close()
diff --git a/pkg/models/tasks.go b/pkg/models/tasks.go
index 509f8acd4..139082f3b 100644
--- a/pkg/models/tasks.go
+++ b/pkg/models/tasks.go
@@ -141,8 +141,8 @@ type Task struct {
 	CreatedBy   *user.User `xorm:"-" json:"created_by" valid:"-"`
 	CreatedByID int64      `xorm:"bigint not null" json:"-"` // ID of the user who put that task on the project
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 type TaskWithComments struct {
@@ -1184,7 +1184,7 @@ func (t *Task) Update(s *xorm.Session, a web.Auth) (err error) {
 	//
 	// Maybe FIXME:
 	// I've disabled this for now, because it requires significant changes in the way we do updates (using the
-	// Update() function. We need a user object in updateTaskLabels to check if the user has the right to see
+	// Update() function. We need a user object in updateTaskLabels to check if the user has the permission to see
 	// the label it is currently adding. To do this, we'll need to update the webhandler to let it pass the current
 	// user object (like it's already the case with the create method). However when we change it, that'll break
 	// a lot of existing code which we'll then need to refactor.
diff --git a/pkg/models/tasks_rights.go b/pkg/models/tasks_permissions.go
similarity index 90%
rename from pkg/models/tasks_rights.go
rename to pkg/models/tasks_permissions.go
index b859cbe46..cfae002f1 100644
--- a/pkg/models/tasks_rights.go
+++ b/pkg/models/tasks_permissions.go
@@ -26,12 +26,12 @@ func (t *Task) CanDelete(s *xorm.Session, a web.Auth) (bool, error) {
 	return t.canDoTask(s, a)
 }
 
-// CanUpdate determines if a user has the right to update a project task
+// CanUpdate determines if a user has the permission to update a project task
 func (t *Task) CanUpdate(s *xorm.Session, a web.Auth) (bool, error) {
 	return t.canDoTask(s, a)
 }
 
-// CanCreate determines if a user has the right to create a project task
+// CanCreate determines if a user has the permission to create a project task
 func (t *Task) CanCreate(s *xorm.Session, a web.Auth) (bool, error) {
 	// A user can do a task if he has write acces to its project
 	l := &Project{ID: t.ProjectID}
@@ -39,7 +39,7 @@ func (t *Task) CanCreate(s *xorm.Session, a web.Auth) (bool, error) {
 }
 
 // CanRead determines if a user can read a task
-func (t *Task) CanRead(s *xorm.Session, a web.Auth) (canRead bool, maxRight int, err error) {
+func (t *Task) CanRead(s *xorm.Session, a web.Auth) (canRead bool, maxPermission int, err error) {
 	expand := t.Expand
 	// Get the task, error out if it doesn't exist
 	*t, err = GetTaskByIDSimple(s, t.ID)
@@ -67,7 +67,7 @@ func (t *Task) canDoTask(s *xorm.Session, a web.Auth) (bool, error) {
 		return false, err
 	}
 
-	// Check if we're moving the task into a different project to check if the user has sufficient rights for that on the new project
+	// Check if we're moving the task into a different project to check if the user has sufficient permissions for that on the new project
 	if t.ProjectID != 0 && t.ProjectID != ot.ProjectID {
 		newProject := &Project{ID: t.ProjectID}
 		can, err := newProject.CanWrite(s, a)
diff --git a/pkg/models/tasks_test.go b/pkg/models/tasks_test.go
index e5fedf1d8..cc00c23b9 100644
--- a/pkg/models/tasks_test.go
+++ b/pkg/models/tasks_test.go
@@ -36,7 +36,7 @@ func TestTask_Create(t *testing.T) {
 		Email:    "user1@example.com",
 	}
 
-	// We only test creating a task here, the rights are all well tested in the web tests.
+	// We only test creating a task here, the permissions are all well tested in the web tests.
 
 	t.Run("normal", func(t *testing.T) {
 		db.LoadAndAssertFixtures(t)
diff --git a/pkg/models/team_members.go b/pkg/models/team_members.go
index 22f27a3fc..ec0a9410b 100644
--- a/pkg/models/team_members.go
+++ b/pkg/models/team_members.go
@@ -132,7 +132,7 @@ func (tm *TeamMember) MembershipExists(s *xorm.Session) (exists bool, err error)
 // @Security JWTKeyAuth
 // @Param id path int true "Team ID"
 // @Param userID path int true "User ID"
-// @Success 200 {object} models.Message "The member right was successfully changed."
+// @Success 200 {object} models.Message "The member permission was successfully changed."
 // @Failure 500 {object} models.Message "Internal error"
 // @Router /teams/{id}/members/{userID}/admin [post]
 func (tm *TeamMember) Update(s *xorm.Session, _ web.Auth) (err error) {
@@ -143,7 +143,7 @@ func (tm *TeamMember) Update(s *xorm.Session, _ web.Auth) (err error) {
 	}
 	tm.UserID = user.ID
 
-	// Get the full member object and change the admin right
+	// Get the full member object and change the admin permission
 	ttm := &TeamMember{}
 	_, err = s.
 		Where("team_id = ? AND user_id = ?", tm.TeamID, tm.UserID).
@@ -158,6 +158,6 @@ func (tm *TeamMember) Update(s *xorm.Session, _ web.Auth) (err error) {
 		Where("team_id = ? AND user_id = ?", tm.TeamID, tm.UserID).
 		Cols("admin").
 		Update(ttm)
-	tm.Admin = ttm.Admin // Since we're returning the updated rights object
+	tm.Admin = ttm.Admin // Since we're returning the updated permissions object
 	return
 }
diff --git a/pkg/models/team_members_rights.go b/pkg/models/team_members_permissions.go
similarity index 96%
rename from pkg/models/team_members_rights.go
rename to pkg/models/team_members_permissions.go
index d4f782b71..d7135ccdb 100644
--- a/pkg/models/team_members_rights.go
+++ b/pkg/models/team_members_permissions.go
@@ -39,7 +39,7 @@ func (tm *TeamMember) CanDelete(s *xorm.Session, a web.Auth) (bool, error) {
 	return tm.IsAdmin(s, a)
 }
 
-// CanUpdate checks if the user can modify a team member's right
+// CanUpdate checks if the user can modify a team member's permission
 func (tm *TeamMember) CanUpdate(s *xorm.Session, a web.Auth) (bool, error) {
 	return tm.IsAdmin(s, a)
 }
diff --git a/pkg/models/team_members_test.go b/pkg/models/team_members_test.go
index abbfc98a7..47beb076c 100644
--- a/pkg/models/team_members_test.go
+++ b/pkg/models/team_members_test.go
@@ -130,7 +130,7 @@ func TestTeamMember_Update(t *testing.T) {
 		}
 		err := tm.Update(s, u)
 		require.NoError(t, err)
-		assert.False(t, tm.Admin) // Since this endpoint toggles the right, we should get a false for admin back.
+		assert.False(t, tm.Admin) // Since this endpoint toggles the permission, we should get a false for admin back.
 		err = s.Commit()
 		require.NoError(t, err)
 
diff --git a/pkg/models/teams.go b/pkg/models/teams.go
index 8f1a0ec63..2d5256d89 100644
--- a/pkg/models/teams.go
+++ b/pkg/models/teams.go
@@ -59,8 +59,8 @@ type Team struct {
 	// Query parameter controlling whether to include public projects or not
 	IncludePublic bool `xorm:"-" query:"include_public" json:"include_public"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName makes beautiful table names
@@ -84,8 +84,8 @@ type TeamMember struct {
 	// A timestamp when this relation was created. You cannot change this value.
 	Created time.Time `xorm:"created not null" json:"created"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 // TableName makes beautiful table names
diff --git a/pkg/models/teams_rights.go b/pkg/models/teams_permissions.go
similarity index 96%
rename from pkg/models/teams_rights.go
rename to pkg/models/teams_permissions.go
index 50e9cd3fb..b6b8f61a3 100644
--- a/pkg/models/teams_rights.go
+++ b/pkg/models/teams_permissions.go
@@ -69,10 +69,10 @@ func (t *Team) CanRead(s *xorm.Session, a web.Auth) (bool, int, error) {
 		And("user_id = ?", a.GetID()).
 		Get(tm)
 
-	maxRights := 0
+	maxPermissions := 0
 	if tm.Admin {
-		maxRights = int(RightAdmin)
+		maxPermissions = int(PermissionAdmin)
 	}
 
-	return can, maxRights, err
+	return can, maxPermissions, err
 }
diff --git a/pkg/models/teams_rights_test.go b/pkg/models/teams_permissions_test.go
similarity index 95%
rename from pkg/models/teams_rights_test.go
rename to pkg/models/teams_permissions_test.go
index 13ec3cd20..a5d937038 100644
--- a/pkg/models/teams_rights_test.go
+++ b/pkg/models/teams_permissions_test.go
@@ -37,7 +37,7 @@ func TestTeam_CanDoSomething(t *testing.T) {
 		Created     time.Time
 		Updated     time.Time
 		CRUDable    web.CRUDable
-		Rights      web.Rights
+		Permissions web.Permissions
 	}
 	type args struct {
 		a web.Auth
@@ -59,7 +59,7 @@ func TestTeam_CanDoSomething(t *testing.T) {
 			want: map[string]bool{"CanCreate": true, "IsAdmin": true, "CanRead": true, "CanDelete": true, "CanUpdate": true},
 		},
 		{
-			name: "CanDoSomething where the user does not have the rights",
+			name: "CanDoSomething where the user does not have the permissions",
 			fields: fields{
 				ID: 1,
 			},
@@ -85,7 +85,7 @@ func TestTeam_CanDoSomething(t *testing.T) {
 				Created:     tt.fields.Created,
 				Updated:     tt.fields.Updated,
 				CRUDable:    tt.fields.CRUDable,
-				Rights:      tt.fields.Rights,
+				Permissions: tt.fields.Permissions,
 			}
 
 			if got, _ := tm.CanCreate(s, tt.args.a); got != tt.want["CanCreate"] { // CanCreate is currently always true
diff --git a/pkg/models/teams_test.go b/pkg/models/teams_test.go
index 09dd4cdf8..747df9584 100644
--- a/pkg/models/teams_test.go
+++ b/pkg/models/teams_test.go
@@ -273,14 +273,14 @@ func TestTeam_Delete(t *testing.T) {
 	})
 }
 
-func TestIsErrInvalidRight(t *testing.T) {
-	require.NoError(t, RightAdmin.isValid())
-	require.NoError(t, RightRead.isValid())
-	require.NoError(t, RightWrite.isValid())
+func TestIsErrInvalidPermission(t *testing.T) {
+	require.NoError(t, PermissionAdmin.isValid())
+	require.NoError(t, PermissionRead.isValid())
+	require.NoError(t, PermissionWrite.isValid())
 
 	// Check invalid
-	var tr Right = 938
+	var tr Permission = 938
 	err := tr.isValid()
 	require.Error(t, err)
-	assert.True(t, IsErrInvalidRight(err))
+	assert.True(t, IsErrInvalidPermission(err))
 }
diff --git a/pkg/models/user_delete.go b/pkg/models/user_delete.go
index cde660a0d..4d3e7b812 100644
--- a/pkg/models/user_delete.go
+++ b/pkg/models/user_delete.go
@@ -171,26 +171,26 @@ func ensureProjectAdminUser(s *xorm.Session, l *Project) (hadUsers bool, err err
 	}
 
 	for _, lu := range projectUsers {
-		if lu.Right == RightAdmin {
+		if lu.Permission == PermissionAdmin {
 			// Project already has more than one admin, no need to do anything
 			return true, nil
 		}
 	}
 
 	for _, lu := range projectUsers {
-		if lu.Right == RightWrite {
-			lu.Right = RightAdmin
+		if lu.Permission == PermissionWrite {
+			lu.Permission = PermissionAdmin
 			_, err = s.Where("id = ?", lu.ID).
-				Cols("right").
+				Cols("permission").
 				Update(lu)
 			return true, err
 		}
 	}
 
 	firstUser := projectUsers[0]
-	firstUser.Right = RightAdmin
+	firstUser.Permission = PermissionAdmin
 	_, err = s.Where("id = ?", firstUser.ID).
-		Cols("right").
+		Cols("permission").
 		Update(firstUser)
 	if err != nil {
 		return true, err
@@ -218,26 +218,26 @@ func ensureProjectAdminTeam(s *xorm.Session, l *Project) (hadTeams bool, err err
 	}
 
 	for _, lu := range projectTeams {
-		if lu.Right == RightAdmin {
+		if lu.Permission == PermissionAdmin {
 			// Project already has more than one admin, no need to do anything
 			return true, nil
 		}
 	}
 
 	for _, lu := range projectTeams {
-		if lu.Right == RightWrite {
-			lu.Right = RightAdmin
+		if lu.Permission == PermissionWrite {
+			lu.Permission = PermissionAdmin
 			_, err = s.Where("id = ?", lu.ID).
-				Cols("right").
+				Cols("permission").
 				Update(lu)
 			return true, err
 		}
 	}
 
 	firstTeam := projectTeams[0]
-	firstTeam.Right = RightAdmin
+	firstTeam.Permission = PermissionAdmin
 	_, err = s.Where("id = ?", firstTeam.ID).
-		Cols("right").
+		Cols("permission").
 		Update(firstTeam)
 	return true, err
 }
diff --git a/pkg/models/user_project.go b/pkg/models/user_project.go
index 7baf9b182..34ea85abe 100644
--- a/pkg/models/user_project.go
+++ b/pkg/models/user_project.go
@@ -56,14 +56,14 @@ func ListUsersFromProject(s *xorm.Session, l *Project, currentUser *user.User, s
 			// The actual condition
 			Where(
 				builder.Or(
-					builder.Or(builder.Eq{"ul.right": RightRead}),
-					builder.Or(builder.Eq{"tl.right": RightRead}),
+					builder.Or(builder.Eq{"ul.permission": PermissionRead}),
+					builder.Or(builder.Eq{"tl.permission": PermissionRead}),
 
-					builder.Or(builder.Eq{"ul.right": RightWrite}),
-					builder.Or(builder.Eq{"tl.right": RightWrite}),
+					builder.Or(builder.Eq{"ul.permission": PermissionWrite}),
+					builder.Or(builder.Eq{"tl.permission": PermissionWrite}),
 
-					builder.Or(builder.Eq{"ul.right": RightAdmin}),
-					builder.Or(builder.Eq{"tl.right": RightAdmin}),
+					builder.Or(builder.Eq{"ul.permission": PermissionAdmin}),
+					builder.Or(builder.Eq{"tl.permission": PermissionAdmin}),
 				),
 				builder.Eq{"l.id": currentProject.ID},
 			).
diff --git a/pkg/models/webhooks.go b/pkg/models/webhooks.go
index 77dacce64..ae4674bf5 100644
--- a/pkg/models/webhooks.go
+++ b/pkg/models/webhooks.go
@@ -65,8 +65,8 @@ type Webhook struct {
 	// A timestamp when this webhook target was last updated. You cannot change this value.
 	Updated time.Time `xorm:"updated not null" json:"updated"`
 
-	web.CRUDable `xorm:"-" json:"-"`
-	web.Rights   `xorm:"-" json:"-"`
+	web.CRUDable    `xorm:"-" json:"-"`
+	web.Permissions `xorm:"-" json:"-"`
 }
 
 func (w *Webhook) TableName() string {
diff --git a/pkg/models/webhooks_rights.go b/pkg/models/webhooks_permissions.go
similarity index 100%
rename from pkg/models/webhooks_rights.go
rename to pkg/models/webhooks_permissions.go
diff --git a/pkg/modules/auth/auth.go b/pkg/modules/auth/auth.go
index b93af6425..8c2e1556c 100644
--- a/pkg/modules/auth/auth.go
+++ b/pkg/modules/auth/auth.go
@@ -94,7 +94,7 @@ func NewLinkShareJWTAuthtoken(share *models.LinkSharing) (token string, err erro
 	claims["id"] = share.ID
 	claims["hash"] = share.Hash
 	claims["project_id"] = share.ProjectID
-	claims["right"] = share.Right
+	claims["permission"] = share.Permission
 	claims["sharedByID"] = share.SharedByID
 	claims["exp"] = exp
 	claims["isLocalUser"] = true // Link shares are always local
diff --git a/pkg/modules/background/handler/background.go b/pkg/modules/background/handler/background.go
index c89253474..fbb1ab3c2 100644
--- a/pkg/modules/background/handler/background.go
+++ b/pkg/modules/background/handler/background.go
@@ -115,14 +115,14 @@ func (bp *BackgroundProvider) setBackgroundPreparations(s *xorm.Session, c echo.
 		return nil, nil, echo.NewHTTPError(http.StatusBadRequest, "Invalid project ID: "+err.Error()).SetInternal(err)
 	}
 
-	// Check if the user has the right to change the project background
+	// Check if the user has the permission to change the project background
 	project = &models.Project{ID: projectID}
 	can, err := project.CanUpdate(s, auth)
 	if err != nil {
 		return
 	}
 	if !can {
-		log.Infof("Tried to update project background of project %d while not having the rights for it (User: %v)", projectID, auth)
+		log.Infof("Tried to update project background of project %d while not having the permissions for it (User: %v)", projectID, auth)
 		return project, auth, models.ErrGenericForbidden{}
 	}
 	// Load the project
@@ -309,7 +309,7 @@ func checkProjectBackgroundRights(s *xorm.Session, c echo.Context) (project *mod
 		return nil, auth, echo.NewHTTPError(http.StatusBadRequest, "Invalid project ID: "+err.Error()).SetInternal(err)
 	}
 
-	// Check if a background for this project exists + Rights
+	// Check if a background for this project exists + Permissions
 	project = &models.Project{ID: projectID}
 	can, _, err := project.CanRead(s, auth)
 	if err != nil {
@@ -318,7 +318,7 @@ func checkProjectBackgroundRights(s *xorm.Session, c echo.Context) (project *mod
 	}
 	if !can {
 		_ = s.Rollback()
-		log.Infof("Tried to get project background of project %d while not having the rights for it (User: %v)", projectID, auth)
+		log.Infof("Tried to get project background of project %d while not having the permissions for it (User: %v)", projectID, auth)
 		return nil, auth, echo.NewHTTPError(http.StatusForbidden)
 	}
 
diff --git a/pkg/routes/api/v1/task_attachment.go b/pkg/routes/api/v1/task_attachment.go
index 01db5dbb8..05afb8f6d 100644
--- a/pkg/routes/api/v1/task_attachment.go
+++ b/pkg/routes/api/v1/task_attachment.go
@@ -50,7 +50,7 @@ func UploadTaskAttachment(c echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, "No task ID provided").SetInternal(err)
 	}
 
-	// Rights check
+	// Permissions check
 	auth, err := auth2.GetAuthFromClaims(c)
 	if err != nil {
 		return handler.HandleHTTPError(err)
@@ -134,7 +134,7 @@ func GetTaskAttachment(c echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, "No task ID provided").SetInternal(err)
 	}
 
-	// Rights check
+	// Permissions check
 	auth, err := auth2.GetAuthFromClaims(c)
 	if err != nil {
 		return handler.HandleHTTPError(err)
diff --git a/pkg/routes/api/v1/user_list.go b/pkg/routes/api/v1/user_list.go
index 2365a9b8c..27870a56f 100644
--- a/pkg/routes/api/v1/user_list.go
+++ b/pkg/routes/api/v1/user_list.go
@@ -78,7 +78,7 @@ func UserList(c echo.Context) error {
 // @Param id path int true "Project ID"
 // @Success 200 {array} user.User "All (found) users."
 // @Failure 400 {object} web.HTTPError "Something's invalid."
-// @Failure 401 {object} web.HTTPError "The user does not have the right to see the project."
+// @Failure 401 {object} web.HTTPError "The user does not have the permission to see the project."
 // @Failure 500 {object} models.Message "Internal server error."
 // @Router /projects/{id}/projectusers [get]
 func ListUsersForProject(c echo.Context) error {
diff --git a/pkg/routes/caldav/listStorageProvider.go b/pkg/routes/caldav/listStorageProvider.go
index 5c23d3012..c5b5e5b41 100644
--- a/pkg/routes/caldav/listStorageProvider.go
+++ b/pkg/routes/caldav/listStorageProvider.go
@@ -293,7 +293,7 @@ func (vcls *VikunjaCaldavProjectStorage) CreateResource(rpath, content string) (
 
 	vTask.ProjectID = vcls.project.ID
 
-	// Check the rights
+	// Check the permissions
 	canCreate, err := vTask.CanCreate(s, vcls.user)
 	if err != nil {
 		return nil, err
@@ -354,7 +354,7 @@ func (vcls *VikunjaCaldavProjectStorage) UpdateResource(rpath, content string) (
 	s := db.NewSession()
 	defer s.Close()
 
-	// Check the rights
+	// Check the permissions
 	canUpdate, err := vTask.CanUpdate(s, vcls.user)
 	if err != nil {
 		_ = s.Rollback()
@@ -403,7 +403,7 @@ func (vcls *VikunjaCaldavProjectStorage) DeleteResource(_ string) error {
 		s := db.NewSession()
 		defer s.Close()
 
-		// Check the rights
+		// Check the permissions
 		canDelete, err := vcls.task.CanDelete(s, vcls.user)
 		if err != nil {
 			_ = s.Rollback()
diff --git a/pkg/routes/routes.go b/pkg/routes/routes.go
index 9d6cbac74..65b0505a1 100644
--- a/pkg/routes/routes.go
+++ b/pkg/routes/routes.go
@@ -21,9 +21,9 @@
 // @description Every endpoint capable of pagination will return two headers:
 // @description * `x-pagination-total-pages`: The total number of available pages for this request
 // @description * `x-pagination-result-count`: The number of items returned for this request.
-// @description # Rights
-// @description All endpoints which return a single item (project, task, etc.) - no array - will also return a `x-max-right` header with the max right the user has on this item as an int where `0` is `Read Only`, `1` is `Read & Write` and `2` is `Admin`.
-// @description This can be used to show or hide ui elements based on the rights the user has.
+// @description # Permissions
+// @description All endpoints which return a single item (project, task, etc.) - no array - will also return a `x-max-permission` header with the max permission the user has on this item as an int where `0` is `Read Only`, `1` is `Read & Write` and `2` is `Admin`.
+// @description This can be used to show or hide ui elements based on the permissions the user has.
 // @description # Errors
 // @description All errors have an error code and a human-readable error message in addition to the http status code. You should always check for the status code in the response, not only the http status code.
 // @description Due to limitations in the swagger library we're using for this document, only one error per http status code is documented here. Make sure to check the [error docs](https://vikunja.io/docs/errors/) in Vikunja's documentation for a full list of available error codes.
diff --git a/pkg/swagger/docs.go b/pkg/swagger/docs.go
index d699b962d..627a0834d 100644
--- a/pkg/swagger/docs.go
+++ b/pkg/swagger/docs.go
@@ -8270,7 +8270,7 @@ const docTemplate = `{
                     "maximum": 2,
                     "allOf": [
                         {
-                            "$ref": "#/definitions/models.Right"
+                            "$ref": "#/definitions/models.Permission"
                         }
                     ]
                 },
@@ -8349,7 +8349,7 @@ const docTemplate = `{
                     "type": "boolean"
                 },
                 "max_right": {
-                    "$ref": "#/definitions/models.Right"
+                    "$ref": "#/definitions/models.Permission"
                 },
                 "owner": {
                     "description": "The user who created this project.",
@@ -8426,7 +8426,7 @@ const docTemplate = `{
                     "maximum": 2,
                     "allOf": [
                         {
-                            "$ref": "#/definitions/models.Right"
+                            "$ref": "#/definitions/models.Permission"
                         }
                     ]
                 },
@@ -8606,7 +8606,7 @@ const docTemplate = `{
                 "ReminderRelationEndDate"
             ]
         },
-        "models.Right": {
+        "models.Permission": {
             "type": "integer",
             "enum": [
                 0,
@@ -9166,7 +9166,7 @@ const docTemplate = `{
                     "maximum": 2,
                     "allOf": [
                         {
-                            "$ref": "#/definitions/models.Right"
+                            "$ref": "#/definitions/models.Permission"
                         }
                     ]
                 },
@@ -9266,7 +9266,7 @@ const docTemplate = `{
                     "minLength": 1
                 },
                 "right": {
-                    "$ref": "#/definitions/models.Right"
+                    "$ref": "#/definitions/models.Permission"
                 },
                 "updated": {
                     "description": "A timestamp when this relation was last updated. You cannot change this value.",
@@ -9295,7 +9295,7 @@ const docTemplate = `{
                     "type": "string"
                 },
                 "right": {
-                    "$ref": "#/definitions/models.Right"
+                    "$ref": "#/definitions/models.Permission"
                 },
                 "updated": {
                     "description": "A timestamp when this task was last updated. You cannot change this value.",
diff --git a/pkg/web/handler/create.go b/pkg/web/handler/create.go
index cbb268a0b..3a23c27ee 100644
--- a/pkg/web/handler/create.go
+++ b/pkg/web/handler/create.go
@@ -63,7 +63,7 @@ func (c *WebHandler) CreateWeb(ctx echo.Context) error {
 		}
 	}()
 
-	// Check rights
+	// Check permissions
 	canCreate, err := currentStruct.CanCreate(s, currentAuth)
 	if err != nil {
 		_ = s.Rollback()
@@ -71,7 +71,7 @@ func (c *WebHandler) CreateWeb(ctx echo.Context) error {
 	}
 	if !canCreate {
 		_ = s.Rollback()
-		log.Warningf("Tried to create while not having the rights for it (User: %v)", currentAuth)
+		log.Warningf("Tried to create while not having the permissions for it (User: %v)", currentAuth)
 		return echo.NewHTTPError(http.StatusForbidden)
 	}
 
diff --git a/pkg/web/handler/delete.go b/pkg/web/handler/delete.go
index fb8e70b3b..de3b70d86 100644
--- a/pkg/web/handler/delete.go
+++ b/pkg/web/handler/delete.go
@@ -48,7 +48,7 @@ func (c *WebHandler) DeleteWeb(ctx echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, "Invalid model provided.").SetInternal(err)
 	}
 
-	// Check if the user has the right to delete
+	// Check if the user has the permission to delete
 	currentAuth, err := auth.GetAuthFromClaims(ctx)
 	if err != nil {
 		return echo.NewHTTPError(http.StatusInternalServerError).SetInternal(err)
@@ -70,7 +70,7 @@ func (c *WebHandler) DeleteWeb(ctx echo.Context) error {
 	}
 	if !canDelete {
 		_ = s.Rollback()
-		log.Warningf("Tried to delete while not having the rights for it (User: %v)", currentAuth)
+		log.Warningf("Tried to delete while not having the permissions for it (User: %v)", currentAuth)
 		return echo.NewHTTPError(http.StatusForbidden)
 	}
 
diff --git a/pkg/web/handler/helper.go b/pkg/web/handler/helper.go
index f7ecc7c71..1f5f4966f 100644
--- a/pkg/web/handler/helper.go
+++ b/pkg/web/handler/helper.go
@@ -34,7 +34,7 @@ type WebHandler struct {
 // CObject is the definition of our object, holds the structs
 type CObject interface {
 	web.CRUDable
-	web.Rights
+	web.Permissions
 }
 
 // HandleHTTPError does what it says
diff --git a/pkg/web/handler/read_one.go b/pkg/web/handler/read_one.go
index e4d8fd4c6..1cf6270a8 100644
--- a/pkg/web/handler/read_one.go
+++ b/pkg/web/handler/read_one.go
@@ -44,7 +44,7 @@ func (c *WebHandler) ReadOneWeb(ctx echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, "Invalid model provided.").SetInternal(err)
 	}
 
-	// Check rights
+	// Check permissions
 	currentAuth, err := auth.GetAuthFromClaims(ctx)
 	if err != nil {
 		return echo.NewHTTPError(http.StatusInternalServerError, "Could not determine the current user.").SetInternal(err)
@@ -59,15 +59,15 @@ func (c *WebHandler) ReadOneWeb(ctx echo.Context) error {
 		}
 	}()
 
-	canRead, maxRight, err := currentStruct.CanRead(s, currentAuth)
+	canRead, maxPermission, err := currentStruct.CanRead(s, currentAuth)
 	if err != nil {
 		_ = s.Rollback()
 		return HandleHTTPError(err)
 	}
 	if !canRead {
 		_ = s.Rollback()
-		log.Warningf("Tried to read while not having the rights for it (User: %v)", currentAuth)
-		return echo.NewHTTPError(http.StatusForbidden, "You don't have the right to see this")
+		log.Warningf("Tried to read while not having the permissions for it (User: %v)", currentAuth)
+		return echo.NewHTTPError(http.StatusForbidden, "You don't have the permission to see this")
 	}
 
 	// Get our object
@@ -79,8 +79,8 @@ func (c *WebHandler) ReadOneWeb(ctx echo.Context) error {
 
 	// Set the headers
 	if canRead {
-		ctx.Response().Header().Set("x-max-right", strconv.FormatInt(int64(maxRight), 10))
-		ctx.Response().Header().Set("Access-Control-Expose-Headers", "x-max-right")
+		ctx.Response().Header().Set("x-max-permission", strconv.FormatInt(int64(maxPermission), 10))
+		ctx.Response().Header().Set("Access-Control-Expose-Headers", "x-max-permission")
 	}
 
 	err = s.Commit()
diff --git a/pkg/web/handler/update.go b/pkg/web/handler/update.go
index 949eaa704..2ef6bd180 100644
--- a/pkg/web/handler/update.go
+++ b/pkg/web/handler/update.go
@@ -49,7 +49,7 @@ func (c *WebHandler) UpdateWeb(ctx echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, err).SetInternal(err)
 	}
 
-	// Check if the user has the right to do that
+	// Check if the user has the permission to do that
 	currentAuth, err := auth.GetAuthFromClaims(ctx)
 	if err != nil {
 		return echo.NewHTTPError(http.StatusInternalServerError, "Could not determine the current user.").SetInternal(err)
@@ -71,7 +71,7 @@ func (c *WebHandler) UpdateWeb(ctx echo.Context) error {
 	}
 	if !canUpdate {
 		_ = s.Rollback()
-		log.Warningf("Tried to update while not having the rights for it (User: %v)", currentAuth)
+		log.Warningf("Tried to update while not having the permissions for it (User: %v)", currentAuth)
 		return echo.NewHTTPError(http.StatusForbidden)
 	}
 
diff --git a/pkg/web/readme.md b/pkg/web/readme.md
index bb175e23c..28ee00e8c 100644
--- a/pkg/web/readme.md
+++ b/pkg/web/readme.md
@@ -16,7 +16,7 @@ other handler implementations, enabling a lot of flexibility while developing.
 * Easy to use
 * Built for REST-APIs
 * Beautiful error handling built in
-* Manages rights
+* Manages permissions
 * Pluggable authentication mechanisms
 
 ## Table of contents
@@ -25,7 +25,7 @@ other handler implementations, enabling a lot of flexibility while developing.
 * [Todos](#todos)
 * [DB Sessions](#db-sessions)
 * [CRUDable](#crudable)
-* [Rights](#rights)
+* [Permissions](#permissions)
 * [Handler Config](#handler-config)
   * [Auth](#auth)
   * [Logging](#logging)
@@ -41,7 +41,7 @@ other handler implementations, enabling a lot of flexibility while developing.
 
 * [x] Improve docs/Merge with the ones of Vikunja
 * [x] Description of web.HTTPError
-* [x] Rights methods should return errors (I know, this will break a lot of existing stuff)
+* [x] Permissions methods should return errors (I know, this will break a lot of existing stuff)
 * [ ] optional Before- and after-{load|update|create} methods which do some preprocessing/after processing like making human-readable names from automatically up counting consts
 * [ ] "Magic": Check if a passed struct implements Crudable methods and use a general (user defined) function if not
 
@@ -49,7 +49,7 @@ other handler implementations, enabling a lot of flexibility while developing.
 
 Using the web handler in your application is pretty straight forward, simply run `go get -u code.vikunja.io/web` and start using it. 
 
-In order to use the common web handler, the struct must implement the `web.CRUDable` and `web.Rights` interface.
+In order to use the common web handler, the struct must implement the `web.CRUDable` and `web.Permissions` interface.
 
 To learn how to use the handler, take a look at the [handler config](#handler-config) [defining routes](#defining-routes-using-the-standard-web-handler)
 
@@ -59,7 +59,7 @@ Each request runs in its own db session.
 This ensures each operation is one atomic entity without any side effects for concurrent requests happening at the same time.
 
 The session is started at the beginning of the request, rolled back in case of any errors and committed if no errors occur.
-The rights methods get the same session (for the same request) as the actual crud methods.
+The permissions methods get the same session (for the same request) as the actual crud methods.
 
 See [`SessionFactory`](#sessionfactory) for docs about how to configure it.
 
@@ -94,17 +94,17 @@ contain the created/updated struct instance. The only exception is `ReadAll()` w
 Usually this method returns a slice of results because you cannot make an array of a set type (If you know a 
 way to do this, don't hesitate to [drop me a message](https://vikunja.io/en/contact/)).
 
-## Rights
+## Permissions
 
-This interface defines methods to check for rights on structs. They accept an `Auth`-element as parameter and return a `bool` and `error`.
+This interface defines methods to check for permissions on structs. They accept an `Auth`-element as parameter and return a `bool` and `error`.
 
 The `error` is handled [as usual](#errors).
 
 The interface is defined as followed:
 
 ```go
-type Rights interface {
-	CanRead(*xorm.Session, Auth) (bool, int, error) // The int is the max right the user has for this entity.
+type Permissions interface {
+	CanRead(*xorm.Session, Auth) (bool, int, error) // The int is the max permission the user has for this entity.
 	CanDelete(*xorm.Session, Auth) (bool, error)
 	CanUpdate(*xorm.Session, Auth) (bool, error)
 	CanCreate(*xorm.Session, Auth) (bool, error)
@@ -112,10 +112,10 @@ type Rights interface {
 ```
 
 When using the standard web handler, all methods are called before their `CRUD` counterparts.
-Use pointers for methods like `CanRead()` to get the base data of the model first, then check the right and then add additional data.
+Use pointers for methods like `CanRead()` to get the base data of the model first, then check the permission and then add additional data.
 
-The `CanRead` method should also return the max right a user has on this entity.
-This number will be returned in the `x-max-right` header to enable user interfaces to show/hide UI elements based on the right the user has.
+The `CanRead` method should also return the max permission a user has on this entity.
+This number will be returned in the `x-max-permission` header to enable user interfaces to show/hide UI elements based on the permission the user has.
 
 ## Handler Config
 
@@ -206,7 +206,7 @@ Also just adding `?s=query` to the url one already knows and uses is a lot more
 
 You can define routes for the standard web handler like so:
 
-`models.List` needs to implement `web.CRUDable` and `web.Rights`.
+`models.List` needs to implement `web.CRUDable` and `web.Permissions`.
 
 ```go
 listHandler := &crud.WebHandler{
@@ -221,7 +221,7 @@ a.DELETE("/lists/:list", listHandler.DeleteWeb)
 a.PUT("/namespaces/:namespace/lists", listHandler.CreateWeb)
 ```
 
-The handler will take care of everything like parsing the request, checking rights, pretty-print errors and return appropriate responses.
+The handler will take care of everything like parsing the request, checking permissions, pretty-print errors and return appropriate responses.
 
 ## Errors
 
diff --git a/pkg/web/web.go b/pkg/web/web.go
index 2368be296..4e724578a 100644
--- a/pkg/web/web.go
+++ b/pkg/web/web.go
@@ -21,8 +21,8 @@ import (
 	"xorm.io/xorm"
 )
 
-// Rights defines rights methods
-type Rights interface {
+// Permissions defines permissions methods
+type Permissions interface {
 	CanRead(*xorm.Session, Auth) (bool, int, error)
 	CanDelete(*xorm.Session, Auth) (bool, error)
 	CanUpdate(*xorm.Session, Auth) (bool, error)
diff --git a/pkg/webtests/kanban_test.go b/pkg/webtests/kanban_test.go
index 75eb9dce0..b169f670c 100644
--- a/pkg/webtests/kanban_test.go
+++ b/pkg/webtests/kanban_test.go
@@ -41,7 +41,7 @@ func TestBucket(t *testing.T) {
 			ID:          2,
 			Hash:        "test2",
 			ProjectID:   2,
-			Right:       models.RightWrite,
+			Permission:  models.PermissionWrite,
 			SharingType: models.SharingTypeWithoutPassword,
 			SharedByID:  1,
 		},
@@ -92,7 +92,7 @@ func TestBucket(t *testing.T) {
 			require.Error(t, err)
 			assert.Contains(t, err.(*echo.HTTPError).Message.(models.ValidationHTTPError).InvalidFields, "title: non zero value required")
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				// Owned by user13
 				_, err := testHandler.testUpdateWithUser(nil, map[string]string{
@@ -231,7 +231,7 @@ func TestBucket(t *testing.T) {
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeBucketDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				// Owned by user13
 				_, err := testHandler.testDeleteWithUser(nil, map[string]string{"project": "20", "bucket": "5"})
@@ -372,7 +372,7 @@ func TestBucket(t *testing.T) {
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeProjectViewDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				// Owned by user13
 				_, err := testHandler.testCreateWithUser(nil, map[string]string{
diff --git a/pkg/webtests/link_share_avatar_test.go b/pkg/webtests/link_share_avatar_test.go
index 26e693243..f00968107 100644
--- a/pkg/webtests/link_share_avatar_test.go
+++ b/pkg/webtests/link_share_avatar_test.go
@@ -33,7 +33,7 @@ func TestLinkShareAvatar(t *testing.T) {
 		ID:          1,
 		Hash:        "test",
 		ProjectID:   1,
-		Right:       models.RightRead,
+		Permission:  models.PermissionRead,
 		SharingType: models.SharingTypeWithoutPassword,
 		SharedByID:  1,
 	}
diff --git a/pkg/webtests/link_sharing_test.go b/pkg/webtests/link_sharing_test.go
index 77901d0f0..92d948b5c 100644
--- a/pkg/webtests/link_sharing_test.go
+++ b/pkg/webtests/link_sharing_test.go
@@ -34,7 +34,7 @@ func TestLinkSharing(t *testing.T) {
 		ID:          1,
 		Hash:        "test1",
 		ProjectID:   1,
-		Right:       models.RightRead,
+		Permission:  models.PermissionRead,
 		SharingType: models.SharingTypeWithoutPassword,
 		SharedByID:  1,
 	}
@@ -43,7 +43,7 @@ func TestLinkSharing(t *testing.T) {
 		ID:          2,
 		Hash:        "test2",
 		ProjectID:   2,
-		Right:       models.RightWrite,
+		Permission:  models.PermissionWrite,
 		SharingType: models.SharingTypeWithoutPassword,
 		SharedByID:  1,
 	}
@@ -52,7 +52,7 @@ func TestLinkSharing(t *testing.T) {
 		ID:          3,
 		Hash:        "test3",
 		ProjectID:   3,
-		Right:       models.RightAdmin,
+		Permission:  models.PermissionAdmin,
 		SharingType: models.SharingTypeWithoutPassword,
 		SharedByID:  1,
 	}
@@ -67,68 +67,68 @@ func TestLinkSharing(t *testing.T) {
 		}
 		t.Run("Forbidden", func(t *testing.T) {
 			t.Run("read only", func(t *testing.T) {
-				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "20"}, `{"right":0}`)
+				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "20"}, `{"permission":0}`)
 				require.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
 			t.Run("write", func(t *testing.T) {
-				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "20"}, `{"right":1}`)
+				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "20"}, `{"permission":1}`)
 				require.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
 			t.Run("admin", func(t *testing.T) {
-				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "20"}, `{"right":2}`)
+				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "20"}, `{"permission":2}`)
 				require.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
 		})
 		t.Run("Read only access", func(t *testing.T) {
 			t.Run("read only", func(t *testing.T) {
-				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "9"}, `{"right":0}`)
+				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "9"}, `{"permission":0}`)
 				require.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
 			t.Run("write", func(t *testing.T) {
-				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "9"}, `{"right":1}`)
+				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "9"}, `{"permission":1}`)
 				require.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
 			t.Run("admin", func(t *testing.T) {
-				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "9"}, `{"right":2}`)
+				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "9"}, `{"permission":2}`)
 				require.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
 		})
 		t.Run("Write access", func(t *testing.T) {
 			t.Run("read only", func(t *testing.T) {
-				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "10"}, `{"right":0}`)
+				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "10"}, `{"permission":0}`)
 				require.NoError(t, err)
 				assert.Contains(t, req.Body.String(), `"hash":`)
 			})
 			t.Run("write", func(t *testing.T) {
-				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "10"}, `{"right":1}`)
+				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "10"}, `{"permission":1}`)
 				require.NoError(t, err)
 				assert.Contains(t, req.Body.String(), `"hash":`)
 			})
 			t.Run("admin", func(t *testing.T) {
-				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "10"}, `{"right":2}`)
+				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "10"}, `{"permission":2}`)
 				require.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
 		})
 		t.Run("Admin access", func(t *testing.T) {
 			t.Run("read only", func(t *testing.T) {
-				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "11"}, `{"right":0}`)
+				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "11"}, `{"permission":0}`)
 				require.NoError(t, err)
 				assert.Contains(t, req.Body.String(), `"hash":`)
 			})
 			t.Run("write", func(t *testing.T) {
-				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "11"}, `{"right":1}`)
+				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "11"}, `{"permission":1}`)
 				require.NoError(t, err)
 				assert.Contains(t, req.Body.String(), `"hash":`)
 			})
 			t.Run("admin", func(t *testing.T) {
-				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "11"}, `{"right":2}`)
+				req, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "11"}, `{"permission":2}`)
 				require.NoError(t, err)
 				assert.Contains(t, req.Body.String(), `"hash":`)
 			})
@@ -192,12 +192,12 @@ func TestLinkSharing(t *testing.T) {
 				require.Error(t, err)
 				assertHandlerErrorCode(t, err, models.ErrCodeProjectDoesNotExist)
 			})
-			t.Run("Rights check", func(t *testing.T) {
+			t.Run("Permissions check", func(t *testing.T) {
 				t.Run("Forbidden", func(t *testing.T) {
 					// Project 2, not shared with this token
 					_, err := testHandlerProjectReadOnly.testReadOneWithLinkShare(nil, map[string]string{"project": "2"})
 					require.Error(t, err)
-					assert.Contains(t, err.(*echo.HTTPError).Message, `You don't have the right to see this`)
+					assert.Contains(t, err.(*echo.HTTPError).Message, `You don't have the permission to see this`)
 				})
 				t.Run("Shared readonly", func(t *testing.T) {
 					rec, err := testHandlerProjectReadOnly.testReadOneWithLinkShare(nil, map[string]string{"project": "1"})
@@ -222,7 +222,7 @@ func TestLinkSharing(t *testing.T) {
 				require.Error(t, err)
 				assertHandlerErrorCode(t, err, models.ErrCodeProjectDoesNotExist)
 			})
-			t.Run("Rights check", func(t *testing.T) {
+			t.Run("Permissions check", func(t *testing.T) {
 				t.Run("Forbidden", func(t *testing.T) {
 					_, err := testHandlerProjectReadOnly.testUpdateWithLinkShare(nil, map[string]string{"project": "2"}, `{"title":"TestLoremIpsum"}`)
 					require.Error(t, err)
@@ -251,7 +251,7 @@ func TestLinkSharing(t *testing.T) {
 				require.Error(t, err)
 				assertHandlerErrorCode(t, err, models.ErrCodeProjectDoesNotExist)
 			})
-			t.Run("Rights check", func(t *testing.T) {
+			t.Run("Permissions check", func(t *testing.T) {
 				t.Run("Forbidden", func(t *testing.T) {
 					_, err := testHandlerProjectReadOnly.testDeleteWithLinkShare(nil, map[string]string{"project": "1"})
 					require.Error(t, err)
@@ -282,7 +282,7 @@ func TestLinkSharing(t *testing.T) {
 				require.Error(t, err)
 				assert.Contains(t, err.(*echo.HTTPError).Message, `Forbidden`)
 			})
-			t.Run("Rights check", func(t *testing.T) {
+			t.Run("Permissions check", func(t *testing.T) {
 				t.Run("Shared readonly", func(t *testing.T) {
 					_, err := testHandlerProjectReadOnly.testCreateWithLinkShare(nil, map[string]string{"namespace": "1"}, `{"title":"Lorem","description":"Lorem Ipsum"}`)
 					require.Error(t, err)
@@ -301,7 +301,7 @@ func TestLinkSharing(t *testing.T) {
 			})
 		})
 
-		t.Run("Right Management", func(t *testing.T) {
+		t.Run("Permission Management", func(t *testing.T) {
 			t.Run("Users", func(t *testing.T) {
 				testHandlerProjectUserReadOnly := webHandlerTest{
 					linkShare: linkshareRead,
diff --git a/pkg/webtests/project_test.go b/pkg/webtests/project_test.go
index 05e081e54..bd6b537ed 100644
--- a/pkg/webtests/project_test.go
+++ b/pkg/webtests/project_test.go
@@ -77,95 +77,95 @@ func TestProject(t *testing.T) {
 			assert.Contains(t, rec.Body.String(), `"owner":{"id":1,"name":"","username":"user1",`)
 			assert.NotContains(t, rec.Body.String(), `"owner":{"id":2,"name":"","username":"user2",`)
 			assert.NotContains(t, rec.Body.String(), `"tasks":`)
-			assert.Equal(t, "2", rec.Result().Header.Get("x-max-right")) // User 1 is owner, so they should have admin rights.
+			assert.Equal(t, "2", rec.Result().Header.Get("x-max-permission")) // User 1 is owner, so they should have admin permissions.
 		})
 		t.Run("Nonexisting", func(t *testing.T) {
 			_, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "9999"})
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeProjectDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				// Owned by user13
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "20"})
 				require.Error(t, err)
-				assert.Contains(t, err.(*echo.HTTPError).Message, `You don't have the right to see this`)
-				assert.Empty(t, rec.Result().Header.Get("x-max-rights"))
+				assert.Contains(t, err.(*echo.HTTPError).Message, `You don't have the permission to see this`)
+				assert.Empty(t, rec.Result().Header.Get("x-max-permissions"))
 			})
 			t.Run("Shared Via Team readonly", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "6"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test6"`)
-				assert.Equal(t, "0", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "0", rec.Result().Header.Get("x-max-permission"))
 			})
 			t.Run("Shared Via Team write", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "7"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test7"`)
-				assert.Equal(t, "1", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "1", rec.Result().Header.Get("x-max-permission"))
 			})
 			t.Run("Shared Via Team admin", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "8"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test8"`)
-				assert.Equal(t, "2", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "2", rec.Result().Header.Get("x-max-permission"))
 			})
 
 			t.Run("Shared Via User readonly", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "9"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test9"`)
-				assert.Equal(t, "0", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "0", rec.Result().Header.Get("x-max-permission"))
 			})
 			t.Run("Shared Via User write", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "10"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test10"`)
-				assert.Equal(t, "1", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "1", rec.Result().Header.Get("x-max-permission"))
 			})
 			t.Run("Shared Via User admin", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "11"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test11"`)
-				assert.Equal(t, "2", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "2", rec.Result().Header.Get("x-max-permission"))
 			})
 
 			t.Run("Shared Via Parent Project Team readonly", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "12"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test12"`)
-				assert.Equal(t, "0", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "0", rec.Result().Header.Get("x-max-permission"))
 			})
 			t.Run("Shared Via Parent Project Team write", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "13"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test13"`)
-				assert.Equal(t, "1", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "1", rec.Result().Header.Get("x-max-permission"))
 			})
 			t.Run("Shared Via Parent Project Team admin", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "14"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test14"`)
-				assert.Equal(t, "2", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "2", rec.Result().Header.Get("x-max-permission"))
 			})
 
 			t.Run("Shared Via Parent Project User readonly", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "15"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test15"`)
-				assert.Equal(t, "0", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "0", rec.Result().Header.Get("x-max-permission"))
 			})
 			t.Run("Shared Via Parent Project User write", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "16"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test16"`)
-				assert.Equal(t, "1", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "1", rec.Result().Header.Get("x-max-permission"))
 			})
 			t.Run("Shared Via Parent Project User admin", func(t *testing.T) {
 				rec, err := testHandler.testReadOneWithUser(nil, map[string]string{"project": "17"})
 				require.NoError(t, err)
 				assert.Contains(t, rec.Body.String(), `"title":"Test17"`)
-				assert.Equal(t, "2", rec.Result().Header.Get("x-max-right"))
+				assert.Equal(t, "2", rec.Result().Header.Get("x-max-permission"))
 			})
 		})
 	})
@@ -199,7 +199,7 @@ func TestProject(t *testing.T) {
 			require.Error(t, err)
 			assert.Contains(t, err.(*echo.HTTPError).Message.(models.ValidationHTTPError).InvalidFields[0], "does not validate as runelength(1|250)")
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				// Owned by user13
 				_, err := testHandler.testUpdateWithUser(nil, map[string]string{"project": "20"}, `{"title":"TestLoremIpsum"}`)
@@ -282,7 +282,7 @@ func TestProject(t *testing.T) {
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeProjectDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				// Owned by user13
 				_, err := testHandler.testDeleteWithUser(nil, map[string]string{"project": "20"})
@@ -387,7 +387,7 @@ func TestProject(t *testing.T) {
 			require.Error(t, err)
 			assert.Contains(t, err.(*echo.HTTPError).Message.(models.ValidationHTTPError).InvalidFields[0], "does not validate as runelength(1|250)")
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				// Owned by user13
 				_, err := testHandler.testCreateWithUser(nil, nil, `{"title":"Lorem","parent_project_id":20}`)
diff --git a/pkg/webtests/task_comment_test.go b/pkg/webtests/task_comment_test.go
index 707f97784..641d4196a 100644
--- a/pkg/webtests/task_comment_test.go
+++ b/pkg/webtests/task_comment_test.go
@@ -41,7 +41,7 @@ func TestTaskComments(t *testing.T) {
 			ID:          2,
 			Hash:        "test2",
 			ProjectID:   2,
-			Right:       models.RightWrite,
+			Permission:  models.PermissionWrite,
 			SharingType: models.SharingTypeWithoutPassword,
 			SharedByID:  1,
 		},
@@ -63,7 +63,7 @@ func TestTaskComments(t *testing.T) {
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeTaskDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			// Only the own comments can be updated
 			t.Run("Forbidden", func(t *testing.T) {
 				_, err := testHandler.testUpdateWithUser(nil, map[string]string{"task": "14", "commentid": "2"}, `{"comment":"Lorem Ipsum"}`)
@@ -146,7 +146,7 @@ func TestTaskComments(t *testing.T) {
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeTaskDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			// Only the own comments can be deleted
 			t.Run("Forbidden", func(t *testing.T) {
 				_, err := testHandler.testDeleteWithUser(nil, map[string]string{"task": "14", "commentid": "2"})
@@ -229,7 +229,7 @@ func TestTaskComments(t *testing.T) {
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeTaskDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				// Owned by user13
 				_, err := testHandler.testCreateWithUser(nil, map[string]string{"task": "34"}, `{"comment":"Lorem Ipsum"}`)
diff --git a/pkg/webtests/task_test.go b/pkg/webtests/task_test.go
index e246c9632..aebb8307f 100644
--- a/pkg/webtests/task_test.go
+++ b/pkg/webtests/task_test.go
@@ -41,7 +41,7 @@ func TestTask(t *testing.T) {
 			ID:          2,
 			Hash:        "test2",
 			ProjectID:   2,
-			Right:       models.RightWrite,
+			Permission:  models.PermissionWrite,
 			SharingType: models.SharingTypeWithoutPassword,
 			SharedByID:  1,
 		},
@@ -219,7 +219,7 @@ func TestTask(t *testing.T) {
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeTaskDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				_, err := testHandler.testUpdateWithUser(nil, map[string]string{"projecttask": "14"}, `{"title":"Lorem Ipsum"}`)
 				require.Error(t, err)
@@ -319,7 +319,7 @@ func TestTask(t *testing.T) {
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeTaskDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				_, err := testHandler.testDeleteWithUser(nil, map[string]string{"projecttask": "14"})
 				require.Error(t, err)
@@ -401,7 +401,7 @@ func TestTask(t *testing.T) {
 			require.Error(t, err)
 			assertHandlerErrorCode(t, err, models.ErrCodeProjectDoesNotExist)
 		})
-		t.Run("Rights check", func(t *testing.T) {
+		t.Run("Permissions check", func(t *testing.T) {
 			t.Run("Forbidden", func(t *testing.T) {
 				// Owned by user13
 				_, err := testHandler.testCreateWithUser(nil, map[string]string{"project": "20"}, `{"title":"Lorem Ipsum"}`)