diff --git a/src/Api/Controllers/BorrowsController.cs b/src/Api/Controllers/BorrowsController.cs
index 0503bb34..7f49b61e 100644
--- a/src/Api/Controllers/BorrowsController.cs
+++ b/src/Api/Controllers/BorrowsController.cs
@@ -51,7 +51,7 @@ public async Task<ActionResult<Result<BorrowDto>>> BorrowDocument(
     /// Get a borrow request by id
     /// </summary>
     /// <returns>A BorrowDto of the retrieved borrow</returns>
-    [RequiresRole(IdentityData.Roles.Staff, IdentityData.Roles.Employee)]
+    [RequiresRole(IdentityData.Roles.Admin ,IdentityData.Roles.Staff, IdentityData.Roles.Employee)]
     [HttpGet("{borrowId:guid}")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status403Forbidden)]
diff --git a/src/Application/Borrows/Queries/GetBorrowRequestById.cs b/src/Application/Borrows/Queries/GetBorrowRequestById.cs
index 64486fc5..d747f7c4 100644
--- a/src/Application/Borrows/Queries/GetBorrowRequestById.cs
+++ b/src/Application/Borrows/Queries/GetBorrowRequestById.cs
@@ -1,4 +1,5 @@
 using Application.Common.Exceptions;
+using Application.Common.Extensions;
 using Application.Common.Interfaces;
 using Application.Common.Models.Dtos;
 using Application.Common.Models.Dtos.Physical;
@@ -34,6 +35,10 @@ public async Task<BorrowDto> Handle(Query request, CancellationToken cancellatio
                 .Include(x => x.Borrower)
                 .Include(x => x.Document)
                 .ThenInclude(y => y.Department)
+                .Include(x => x.Document)
+                .ThenInclude(x => x.Folder)
+                .ThenInclude(x => x.Locker)
+                .ThenInclude(x => x.Room)
                 .FirstOrDefaultAsync(x => x.Id == request.BorrowId, cancellationToken);
 
             if (borrow is null)
@@ -41,13 +46,36 @@ public async Task<BorrowDto> Handle(Query request, CancellationToken cancellatio
                 throw new KeyNotFoundException("Borrow request does not exist.");
             }
 
-            if (!request.User.Role.Equals(IdentityData.Roles.Employee))
+            if (request.User.Role.IsAdmin())
+            {
+                return _mapper.Map<BorrowDto>(borrow);
+            }
+
+            if (request.User.Role.IsStaff())
             {
+                var staff = _context.Staffs
+                    .Include(x => x.Room)
+                    .FirstOrDefault(x => x.Id == request.User.Id);
+                if (staff is null)
+                {
+                    throw new KeyNotFoundException("Staff does not exist.");
+                }
+
+                if (staff.Room is null)
+                {
+                    throw new ConflictException("Staff does not manage a room.");
+                }
+                
+                if (staff.Room.Id != borrow.Document.Folder!.Locker.Room.Id )
+                {
+                    throw new UnauthorizedAccessException("User can not access this resource.");
+                }
+                
                 return _mapper.Map<BorrowDto>(borrow);
             }
             
             return borrow.Borrower.Id != request.User.Id
-                ? throw new UnauthorizedAccessException()
+                ? throw new UnauthorizedAccessException("User can not access this resource")
                 : _mapper.Map<BorrowDto>(borrow);
         }
     }