diff --git a/frontend/app/layouts/default.vue b/frontend/app/layouts/default.vue
index c07bf6f..3a80999 100644
--- a/frontend/app/layouts/default.vue
+++ b/frontend/app/layouts/default.vue
@@ -60,13 +60,16 @@ const { sections } = useSidebar()
 
 const isEmployee = computed(() => Boolean(auth.user?.isEmployee))
 
-const isMailVisible = computed(() => {
-    const roles: string[] = auth.user?.roles ?? []
-    return roles.includes('ROLE_USER') || roles.includes('ROLE_ADMIN')
-})
+const { can } = usePermissions()
+
+// L'onglet Messagerie est rendu côté layout (hors sidebar backend) : il faut donc
+// reproduire ici le gate de permission. ROLE_ADMIN bypasse via can().
+const isMailVisible = computed(() => can('mail.access'))
 
 const { enabled: shareEnabled, ensureLoaded: ensureShareStatus } = useShareStatus()
-const isDocumentsVisible = computed(() => shareEnabled.value === true)
+// Documents = explorateur de partage : visible si le module est actif ET la
+// permission d'accès au partage est accordée (alignement avec le middleware de page).
+const isDocumentsVisible = computed(() => shareEnabled.value === true && can('integration.share.access'))
 
 const currentProjectId = computed(() => {
     const match = route.path.match(/^\/projects\/(\d+)/)
diff --git a/frontend/modules/mail/pages/mail.vue b/frontend/modules/mail/pages/mail.vue
index c429359..b47876e 100644
--- a/frontend/modules/mail/pages/mail.vue
+++ b/frontend/modules/mail/pages/mail.vue
@@ -6,6 +6,7 @@ const { t } = useI18n()
 const router = useRouter()
 const route = useRoute()
 
+definePageMeta({ middleware: ['permission'], permission: 'mail.access' })
 useHead({ title: t('mail.title') })
 
 // ─── Store ────────────────────────────────────────────────────────────────