diff --git a/x-pack/plugins/elastic_assistant/server/routes/anonymization_fields/bulk_actions_route.ts b/x-pack/plugins/elastic_assistant/server/routes/anonymization_fields/bulk_actions_route.ts
index 5464756739c08..dce2687add193 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/anonymization_fields/bulk_actions_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/anonymization_fields/bulk_actions_route.ts
@@ -120,8 +120,12 @@ export const bulkActionAnonymizationFieldsRoute = (
     .post({
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_ANONYMIZATION_FIELDS_URL_BULK_ACTION,
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution-updateAIAssistantAnonymization'],
+        },
+      },
       options: {
-        tags: ['access:securitySolution-updateAIAssistantAnonymization'],
         timeout: {
           idleSocket: moment.duration(15, 'minutes').asMilliseconds(),
         },
diff --git a/x-pack/plugins/elastic_assistant/server/routes/anonymization_fields/find_route.ts b/x-pack/plugins/elastic_assistant/server/routes/anonymization_fields/find_route.ts
index 904a80d6a3ea4..30c52d004abb0 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/anonymization_fields/find_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/anonymization_fields/find_route.ts
@@ -32,8 +32,10 @@ export const findAnonymizationFieldsRoute = (
     .get({
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_ANONYMIZATION_FIELDS_URL_FIND,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/get/get_attack_discovery.ts b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/get/get_attack_discovery.ts
index e3756b10a3fb3..9049c152183b0 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/get/get_attack_discovery.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/get/get_attack_discovery.ts
@@ -24,8 +24,10 @@ export const getAttackDiscoveryRoute = (router: IRouter<ElasticAssistantRequestH
     .get({
       access: 'internal',
       path: ATTACK_DISCOVERY_BY_CONNECTOR_ID,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post/cancel/cancel_attack_discovery.ts b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post/cancel/cancel_attack_discovery.ts
index 86631708b1cf7..7b17f0db6e7ab 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post/cancel/cancel_attack_discovery.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post/cancel/cancel_attack_discovery.ts
@@ -26,8 +26,10 @@ export const cancelAttackDiscoveryRoute = (
     .post({
       access: 'internal',
       path: ATTACK_DISCOVERY_CANCEL_BY_CONNECTOR_ID,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post/post_attack_discovery.ts b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post/post_attack_discovery.ts
index b0273741bdf5e..ff4764ab04834 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post/post_attack_discovery.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/attack_discovery/post/post_attack_discovery.ts
@@ -35,8 +35,12 @@ export const postAttackDiscoveryRoute = (
     .post({
       access: 'internal',
       path: ATTACK_DISCOVERY,
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
+      },
       options: {
-        tags: ['access:elasticAssistant'],
         timeout: {
           idleSocket: ROUTE_HANDLER_TIMEOUT,
         },
diff --git a/x-pack/plugins/elastic_assistant/server/routes/capabilities/get_capabilities_route.ts b/x-pack/plugins/elastic_assistant/server/routes/capabilities/get_capabilities_route.ts
index 9f57c6c95a32b..7c6a36d7dd2c7 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/capabilities/get_capabilities_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/capabilities/get_capabilities_route.ts
@@ -30,8 +30,10 @@ export const getCapabilitiesRoute = (router: IRouter<ElasticAssistantRequestHand
     .get({
       access: INTERNAL_API_ACCESS,
       path: CAPABILITIES,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/chat/chat_complete_route.ts b/x-pack/plugins/elastic_assistant/server/routes/chat/chat_complete_route.ts
index 47f6f1a486957..1e774374daa32 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/chat/chat_complete_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/chat/chat_complete_route.ts
@@ -45,8 +45,10 @@ export const chatCompleteRoute = (
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_CHAT_COMPLETE_URL,
 
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/evaluate/get_evaluate.ts b/x-pack/plugins/elastic_assistant/server/routes/evaluate/get_evaluate.ts
index 41b455a73598b..3a70175d38ea5 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/evaluate/get_evaluate.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/evaluate/get_evaluate.ts
@@ -26,8 +26,10 @@ export const getEvaluateRoute = (router: IRouter<ElasticAssistantRequestHandlerC
     .get({
       access: INTERNAL_API_ACCESS,
       path: ELASTIC_AI_ASSISTANT_EVALUATE_URL,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/evaluate/post_evaluate.ts b/x-pack/plugins/elastic_assistant/server/routes/evaluate/post_evaluate.ts
index eb12946a9b61f..b38dfc9e91d2c 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/evaluate/post_evaluate.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/evaluate/post_evaluate.ts
@@ -64,8 +64,12 @@ export const postEvaluateRoute = (
     .post({
       access: INTERNAL_API_ACCESS,
       path: ELASTIC_AI_ASSISTANT_EVALUATE_URL,
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
+      },
       options: {
-        tags: ['access:elasticAssistant'],
         timeout: {
           idleSocket: ROUTE_HANDLER_TIMEOUT,
         },
diff --git a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/delete_knowledge_base.ts b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/delete_knowledge_base.ts
index 3e387e8a8a4d2..9e3d392146c89 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/delete_knowledge_base.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/delete_knowledge_base.ts
@@ -32,8 +32,10 @@ export const deleteKnowledgeBaseRoute = (
     .delete({
       access: 'internal',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/bulk_actions_route.ts b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/bulk_actions_route.ts
index cfb2303010756..49c380866d515 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/bulk_actions_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/bulk_actions_route.ts
@@ -115,8 +115,12 @@ export const bulkActionKnowledgeBaseEntriesRoute = (router: ElasticAssistantPlug
     .post({
       access: 'internal',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_BULK_ACTION,
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
+      },
       options: {
-        tags: ['access:elasticAssistant'],
         timeout: {
           idleSocket: moment.duration(15, 'minutes').asMilliseconds(),
         },
diff --git a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/create_route.ts b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/create_route.ts
index 96753bdd690bd..c33e566b5c7f8 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/create_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/create_route.ts
@@ -26,8 +26,10 @@ export const createKnowledgeBaseEntryRoute = (router: ElasticAssistantPluginRout
       access: 'internal',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL,
 
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/find_route.ts b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/find_route.ts
index 356d5d9150a67..54af3eca81798 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/find_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/entries/find_route.ts
@@ -33,8 +33,10 @@ export const findKnowledgeBaseEntriesRoute = (router: ElasticAssistantPluginRout
     .get({
       access: 'internal',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_ENTRIES_URL_FIND,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/get_knowledge_base_status.ts b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/get_knowledge_base_status.ts
index 833e674b68ffd..9718e1c99f1ec 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/get_knowledge_base_status.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/get_knowledge_base_status.ts
@@ -29,8 +29,10 @@ export const getKnowledgeBaseStatusRoute = (router: ElasticAssistantPluginRouter
     .get({
       access: 'internal',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/post_knowledge_base.ts b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/post_knowledge_base.ts
index 96317da303ac1..d3d2f0de4ceb5 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/post_knowledge_base.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/knowledge_base/post_knowledge_base.ts
@@ -31,8 +31,12 @@ export const postKnowledgeBaseRoute = (router: ElasticAssistantPluginRouter) =>
     .post({
       access: 'internal',
       path: ELASTIC_AI_ASSISTANT_KNOWLEDGE_BASE_URL,
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
+      },
       options: {
-        tags: ['access:elasticAssistant'],
         timeout: {
           idleSocket: ROUTE_HANDLER_TIMEOUT,
         },
diff --git a/x-pack/plugins/elastic_assistant/server/routes/post_actions_connector_execute.ts b/x-pack/plugins/elastic_assistant/server/routes/post_actions_connector_execute.ts
index 4b65b5bb3f1e5..5edb406a02169 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/post_actions_connector_execute.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/post_actions_connector_execute.ts
@@ -39,8 +39,10 @@ export const postActionsConnectorExecuteRoute = (
     .post({
       access: 'internal',
       path: POST_ACTIONS_CONNECTOR_EXECUTE,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/prompts/bulk_actions_route.ts b/x-pack/plugins/elastic_assistant/server/routes/prompts/bulk_actions_route.ts
index 44a949cd22eeb..86018190e93cc 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/prompts/bulk_actions_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/prompts/bulk_actions_route.ts
@@ -114,8 +114,12 @@ export const bulkPromptsRoute = (router: ElasticAssistantPluginRouter, logger: L
     .post({
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_PROMPTS_URL_BULK_ACTION,
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
+      },
       options: {
-        tags: ['access:elasticAssistant'],
         timeout: {
           idleSocket: moment.duration(15, 'minutes').asMilliseconds(),
         },
diff --git a/x-pack/plugins/elastic_assistant/server/routes/prompts/find_route.ts b/x-pack/plugins/elastic_assistant/server/routes/prompts/find_route.ts
index 848680be662a3..44680595b0923 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/prompts/find_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/prompts/find_route.ts
@@ -25,8 +25,10 @@ export const findPromptsRoute = (router: ElasticAssistantPluginRouter, logger: L
     .get({
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_PROMPTS_URL_FIND,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/append_conversation_messages_route.ts b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/append_conversation_messages_route.ts
index 796c0d617fe5d..1ead7b94b31b9 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/append_conversation_messages_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/append_conversation_messages_route.ts
@@ -24,8 +24,10 @@ export const appendConversationMessageRoute = (router: ElasticAssistantPluginRou
     .post({
       access: 'internal',
       path: ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL_BY_ID_MESSAGES,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/bulk_actions_route.ts b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/bulk_actions_route.ts
index 6e30acb1a47c7..f6f23d2fd633d 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/bulk_actions_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/bulk_actions_route.ts
@@ -118,8 +118,12 @@ export const bulkActionConversationsRoute = (
     .post({
       access: 'internal',
       path: ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL_BULK_ACTION,
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
+      },
       options: {
-        tags: ['access:elasticAssistant'],
         timeout: {
           idleSocket: moment.duration(15, 'minutes').asMilliseconds(),
         },
diff --git a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/create_route.ts b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/create_route.ts
index b92ad5462963e..e649cde3a6945 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/create_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/create_route.ts
@@ -25,8 +25,10 @@ export const createConversationRoute = (router: ElasticAssistantPluginRouter): v
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL,
 
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/delete_route.ts b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/delete_route.ts
index 5d761c09f682c..d907ceaed535a 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/delete_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/delete_route.ts
@@ -21,8 +21,10 @@ export const deleteConversationRoute = (router: ElasticAssistantPluginRouter) =>
     .delete({
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL_BY_ID,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/find_route.ts b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/find_route.ts
index e7ce80039beb0..96072139c5d17 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/find_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/find_route.ts
@@ -28,8 +28,10 @@ export const findUserConversationsRoute = (router: ElasticAssistantPluginRouter)
     .get({
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL_FIND,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/read_route.ts b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/read_route.ts
index dd540897b0ece..5c0dba399e519 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/read_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/read_route.ts
@@ -23,8 +23,10 @@ export const readConversationRoute = (router: ElasticAssistantPluginRouter) => {
     .get({
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL_BY_ID,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(
diff --git a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/update_route.ts b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/update_route.ts
index 4ad819ef0caa0..b6af3d3412fd4 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/user_conversations/update_route.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/user_conversations/update_route.ts
@@ -26,8 +26,10 @@ export const updateConversationRoute = (router: ElasticAssistantPluginRouter) =>
     .put({
       access: 'public',
       path: ELASTIC_AI_ASSISTANT_CONVERSATIONS_URL_BY_ID,
-      options: {
-        tags: ['access:elasticAssistant'],
+      security: {
+        authz: {
+          requiredPrivileges: ['elasticAssistant'],
+        },
       },
     })
     .addVersion(