diff --git a/kiss/api/src/box.rs b/kiss/api/src/box.rs
index 4d9ded74..84f6d5b6 100644
--- a/kiss/api/src/box.rs
+++ b/kiss/api/src/box.rs
@@ -253,4 +253,11 @@ pub mod request {
         #[serde(flatten)]
         pub machine: BoxMachineSpec,
     }
+
+    #[derive(Clone, Debug, Serialize, Deserialize, JsonSchema)]
+    pub struct BoxCommissionQuery {
+        pub access: BoxAccessSpec,
+        pub machine: BoxMachineSpec,
+        pub power: Option<BoxPowerSpec>,
+    }
 }
diff --git a/kiss/gateway/src/main.rs b/kiss/gateway/src/main.rs
index 76c19bd1..09bdaa71 100644
--- a/kiss/gateway/src/main.rs
+++ b/kiss/gateway/src/main.rs
@@ -20,7 +20,10 @@ use kiss_api::{
         core::ObjectMeta,
         Api, Client, CustomResourceExt,
     },
-    r#box::{request::BoxNewQuery, BoxCrd, BoxSpec, BoxState, BoxStatus},
+    r#box::{
+        request::{BoxCommissionQuery, BoxNewQuery},
+        BoxCrd, BoxSpec, BoxState, BoxStatus,
+    },
     serde_json::json,
 };
 
@@ -94,11 +97,14 @@ async fn get_new(client: Data<Arc<Client>>, Query(query): Query<BoxNewQuery>) ->
 }
 
 #[post("/commission")]
-async fn get_commission(client: Data<Arc<Client>>, Json(spec): Json<BoxSpec>) -> impl Responder {
-    async fn try_handle(client: Data<Arc<Client>>, spec: BoxSpec) -> Result<()> {
+async fn get_commission(
+    client: Data<Arc<Client>>,
+    Json(query): Json<BoxCommissionQuery>,
+) -> impl Responder {
+    async fn try_handle(client: Data<Arc<Client>>, query: BoxCommissionQuery) -> Result<()> {
         let api = Api::<BoxCrd>::all((***client).clone());
 
-        let name = spec.machine.uuid.to_string();
+        let name = query.machine.uuid.to_string();
 
         match api.get(&name).await {
             Ok(r#box) => {
@@ -106,7 +112,12 @@ async fn get_commission(client: Data<Arc<Client>>, Json(spec): Json<BoxSpec>) ->
                 let patch = Patch::Apply(json!({
                     "apiVersion": crd.api_version,
                     "kind": crd.kind,
-                    "spec": spec,
+                    "spec": BoxSpec {
+                        access: query.access,
+                        group: r#box.spec.group,
+                        machine: query.machine,
+                        power: query.power,
+                    },
                     "status": BoxStatus {
                         state: BoxState::Ready,
                         bind_group: r#box.status.as_ref().and_then(|status| status.bind_group.as_ref()).cloned(),
@@ -122,7 +133,7 @@ async fn get_commission(client: Data<Arc<Client>>, Json(spec): Json<BoxSpec>) ->
         Ok(())
     }
 
-    match try_handle(client, spec).await {
+    match try_handle(client, query).await {
         Ok(()) => HttpResponse::Ok().json("Ok"),
         Err(e) => {
             warn!("failed to commission a client: {e}");