diff --git a/x-pack/plugins/observability_solution/infra/server/lib/adapters/framework/kibana_framework_adapter.ts b/x-pack/plugins/observability_solution/infra/server/lib/adapters/framework/kibana_framework_adapter.ts
index f245214cfa37a..ad6a6bbcbcc27 100644
--- a/x-pack/plugins/observability_solution/infra/server/lib/adapters/framework/kibana_framework_adapter.ts
+++ b/x-pack/plugins/observability_solution/infra/server/lib/adapters/framework/kibana_framework_adapter.ts
@@ -52,9 +52,8 @@ export class KibanaFramework {
     config: InfraRouteConfig<Params, Query, Body, Method>,
     handler: RequestHandler<Params, Query, Body, InfraPluginRequestHandlerContext>
   ) {
-    const defaultOptions = {
-      tags: ['access:infra'],
-    };
+    const defaultSecurity = { authz: { requiredPrivileges: ['infra'] } };
+
     const routeConfig = {
       path: config.path,
       validate: config.validate,
@@ -65,7 +64,8 @@ export class KibanaFramework {
        * using `as ...` below to ensure the route config has
        * the correct options type.
        */
-      options: { ...config.options, ...defaultOptions },
+      options: { ...config.options },
+      security: defaultSecurity,
     };
     switch (config.method) {
       case 'get':
@@ -89,15 +89,12 @@ export class KibanaFramework {
   public registerVersionedRoute<Method extends RouteMethod = any>(
     config: InfraVersionedRouteConfig<Method>
   ) {
-    const defaultOptions = {
-      tags: ['access:infra'],
-    };
+    const defaultSecurity = { authz: { requiredPrivileges: ['infra'] } };
+
     const routeConfig = {
       access: config.access,
       path: config.path,
-      // Currently we have no use of custom options beyond tags, this can be extended
-      // beyond defaultOptions if it's needed.
-      options: defaultOptions,
+      security: defaultSecurity,
     };
     switch (config.method) {
       case 'get':