diff --git a/src/main/java/org/cotato/csquiz/common/config/SecurityConfig.java b/src/main/java/org/cotato/csquiz/common/config/SecurityConfig.java
index ec5adf0a..89bf9422 100644
--- a/src/main/java/org/cotato/csquiz/common/config/SecurityConfig.java
+++ b/src/main/java/org/cotato/csquiz/common/config/SecurityConfig.java
@@ -70,28 +70,38 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                                 .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
                                 .requestMatchers("/v1/api/admin/**").hasRole("ADMIN")
                                 .requestMatchers(WHITE_LIST).permitAll()
-                                .requestMatchers("/v1/api/education/result/**").hasAnyRole("MEMBER", "EDUCATION", "ADMIN")
-                                .requestMatchers("/v1/api/education/from").hasAnyRole("MEMBER", "EDUCATION", "ADMIN")
-                                .requestMatchers(new AntPathRequestMatcher("/v1/api/education/winner", "GET")).hasAnyRole("MEMBER", "EDUCATION", "ADMIN")
-                                .requestMatchers(new AntPathRequestMatcher("/v1/api/education/kings", "GET")).hasAnyRole("MEMBER", "EDUCATION", "ADMIN")
+                                .requestMatchers("/v1/api/education/result/**")
+                                .hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
+                                .requestMatchers("/v1/api/education/from")
+                                .hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
+                                .requestMatchers(new AntPathRequestMatcher("/v1/api/education/winner", "GET"))
+                                .hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
+                                .requestMatchers(new AntPathRequestMatcher("/v1/api/education/kings", "GET"))
+                                .hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
                                 .requestMatchers(new AntPathRequestMatcher("/v1/api/education/status", "GET"))
-                                .hasAnyRole("MEMBER", "EDUCATION", "ADMIN")
+                                .hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
                                 .requestMatchers(new AntPathRequestMatcher("/v1/api/education", "GET")).authenticated()
                                 .requestMatchers("/v1/api/education/**").hasAnyRole("EDUCATION", "ADMIN")
                                 .requestMatchers("/v1/api/generation/**").hasAnyRole("ADMIN")
-                                .requestMatchers("/v1/api/mypage/**").hasAnyRole("MEMBER", "OLD_MEMBER", "EDUCATION", "ADMIN")
+                                .requestMatchers("/v1/api/mypage/**")
+                                .hasAnyRole("MEMBER", "OLD_MEMBER", "EDUCATION", "OPERATION", "ADMIN")
                                 .requestMatchers("/v1/api/quiz/cs-admin/**").hasAnyRole("EDUCATION", "ADMIN")
                                 .requestMatchers("/v1/api/quiz/adds").hasAnyRole("EDUCATION", "ADMIN")
-                                .requestMatchers("/v1/api/quiz/**").hasAnyRole("MEMBER", "EDUCATION", "ADMIN")
-                                .requestMatchers("/v1/api/record/reply").hasAnyRole("MEMBER", "EDUCATION", "ADMIN")
+                                .requestMatchers("/v1/api/quiz/**").hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
+                                .requestMatchers("/v1/api/record/reply").hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
                                 .requestMatchers("/v1/api/record/**").hasAnyRole("EDUCATION", "ADMIN")
                                 .requestMatchers("/v1/api/session/cs-on").hasAnyRole("EDUCATION", "ADMIN")
                                 .requestMatchers(new AntPathRequestMatcher("/v1/api/session", "GET")).authenticated()
                                 .requestMatchers("/v1/api/session/**").hasAnyRole("ADMIN")
-                                .requestMatchers("/v2/api/attendance/records").hasAnyRole("ADMIN")
-                                .requestMatchers("/v2/api/attendance").hasAnyRole("ADMIN")
+                                .requestMatchers("/v2/api/attendances/records").hasAnyRole("OPERATION", "ADMIN")
+                                .requestMatchers("/v2/api/attendances/{attendance-id}/records").hasAnyRole("ADMIN")
+                                .requestMatchers("/v2/api/attendances").hasAnyRole("OPERATION", "ADMIN")
+                                .requestMatchers("/v2/api/attendances/info")
+                                .hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
+                                .requestMatchers("/v2/api/attendances/records/**")
+                                .hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
                                 .requestMatchers(new AntPathRequestMatcher("/v1/api/socket/token", "POST"))
-                                .hasAnyRole("MEMBER", "EDUCATION", "ADMIN")
+                                .hasAnyRole("MEMBER", "EDUCATION", "OPERATION", "ADMIN")
 //                        .requestMatchers("/v2/api/events/attendances").hasAnyRole("MEMBER", "ADMIN", "EDUCATION")
                                 .requestMatchers("/v1/api/socket/**").hasAnyRole("EDUCATION", "ADMIN")
                                 .requestMatchers(HttpMethod.POST, "/v2/api/projects").hasRole("ADMIN")
diff --git a/src/main/java/org/cotato/csquiz/domain/auth/enums/MemberRole.java b/src/main/java/org/cotato/csquiz/domain/auth/enums/MemberRole.java
index f7da7193..885503fd 100644
--- a/src/main/java/org/cotato/csquiz/domain/auth/enums/MemberRole.java
+++ b/src/main/java/org/cotato/csquiz/domain/auth/enums/MemberRole.java
@@ -13,7 +13,8 @@ public enum MemberRole {
     MEMBER("ROLE_MEMBER"),
     OLD_MEMBER("ROLE_OM"),
     ADMIN("ROLE_ADMIN"),
-    EDUCATION("ROLE_EDUCATION");
+    EDUCATION("ROLE_EDUCATION"),
+    OPERATION("ROLE_OPERATION");
 
     private final String key;
 
diff --git a/src/main/java/org/cotato/csquiz/domain/auth/enums/MemberRoleGroup.java b/src/main/java/org/cotato/csquiz/domain/auth/enums/MemberRoleGroup.java
index e74b48cd..3bfc8873 100644
--- a/src/main/java/org/cotato/csquiz/domain/auth/enums/MemberRoleGroup.java
+++ b/src/main/java/org/cotato/csquiz/domain/auth/enums/MemberRoleGroup.java
@@ -8,8 +8,8 @@
 @AllArgsConstructor
 public enum MemberRoleGroup {
 
-    ACTIVE_MEMBERS("현재 활동 중인 멤버", List.of(MemberRole.MEMBER, MemberRole.ADMIN, MemberRole.EDUCATION)),
-    CLIENTS("교육 중 문제 풀이가 가능한 멤버", List.of(MemberRole.MEMBER, MemberRole.ADMIN)),
+    ACTIVE_MEMBERS("현재 활동 중인 멤버", List.of(MemberRole.MEMBER, MemberRole.ADMIN, MemberRole.EDUCATION, MemberRole.OPERATION)),
+    CLIENTS("교육 중 문제 풀이가 가능한 멤버", List.of(MemberRole.MEMBER, MemberRole.ADMIN, MemberRole.OPERATION)),
     MANAGERS("교육 진행 관리자", List.of(MemberRole.EDUCATION, MemberRole.ADMIN));
 
     private final String description;