diff --git a/internal/app/segment/service.go b/internal/app/segment/service.go
index 8c6a5537..17275c72 100644
--- a/internal/app/segment/service.go
+++ b/internal/app/segment/service.go
@@ -1,6 +1,5 @@
-// Package segment manages saved contact audiences (issue #266). A segment is
-// a filter definition plus manual overrides; membership is computed at read
-// time by the repository's SQL compiler, so nothing here schedules work.
+// Package segment manages saved contact audiences; membership is computed at
+// read time, so nothing here schedules work.
 package segment
 
 import (
diff --git a/internal/infrastructure/db/migrations/000110_segments.up.sql b/internal/infrastructure/db/migrations/000110_segments.up.sql
index 839751b6..dc8ba5c3 100644
--- a/internal/infrastructure/db/migrations/000110_segments.up.sql
+++ b/internal/infrastructure/db/migrations/000110_segments.up.sql
@@ -1,8 +1,5 @@
--- Contact segments (issue #266): saved, reusable audiences. A segment is a
--- filter tree over contacts (properties, categories, campaign activity,
--- engagement, other segments) plus per-contact manual overrides. Membership
--- is evaluated at read time, so it is always current and never needs a
--- recompute job; only the definition and the overrides are stored.
+-- Contact segments (issue #266). Membership is evaluated at read time; only
+-- the definition and the manual overrides are stored.
 CREATE TABLE public.segments (
     id uuid DEFAULT gen_random_uuid() PRIMARY KEY,
     organization_id uuid NOT NULL REFERENCES public.organizations(id) ON DELETE CASCADE,
diff --git a/web/src/app/app/segments/[id]/page.tsx b/web/src/app/app/segments/[id]/page.tsx
index 1bf071e8..6131f752 100644
--- a/web/src/app/app/segments/[id]/page.tsx
+++ b/web/src/app/app/segments/[id]/page.tsx
@@ -37,6 +37,8 @@ function SegmentDetail() {
     const navigate = useNavigate();
     const confirm = useConfirm();
     const write = useWriteGuard("MANAGE_CONTACTS");
+    // Enrolment writes campaign leads, so it takes the campaign permission.
+    const campaigns = useWriteGuard("MANAGE_CAMPAIGNS");
     const segment = useSegment(id);
     const fields = useSegmentFields();
     const remove = useDeleteSegment();
@@ -104,7 +106,7 @@ function SegmentDetail() {
                         </button>
                         <button
                             type="button"
-                            onClick={() => setCampaignOpen(true)}
+                            onClick={campaigns.guard(() => setCampaignOpen(true))}
                             className="h-7 px-2.5 rounded-md bg-sky-600 hover:bg-sky-700 text-white text-[12px] font-medium inline-flex items-center gap-1.5 transition-colors"
                         >
                             <MegaphoneIcon className="w-3 h-3" />
diff --git a/web/src/app/app/segments/page.tsx b/web/src/app/app/segments/page.tsx
index c797a23f..79110828 100644
--- a/web/src/app/app/segments/page.tsx
+++ b/web/src/app/app/segments/page.tsx
@@ -38,6 +38,8 @@ function SegmentsList() {
     // Menu items and topbar actions take a bare () => void, so give the
     // permission guard an empty event to swallow.
     const guarded = (fn: () => void) => () => write.guard(fn)({});
+    const campaigns = useWriteGuard("MANAGE_CAMPAIGNS");
+    const campaignGuarded = (fn: () => void) => () => campaigns.guard(fn)({});
     const segments = useSegments();
     const remove = useDeleteSegment();
     const create = useCreateSegment();
@@ -198,7 +200,7 @@ function SegmentsList() {
                                     <PopoverMenuContent minWidth={180}>
                                         <PopoverMenuItem onSelect={() => navigate(`/app/segments/${s.id}`)}>View contacts</PopoverMenuItem>
                                         <PopoverMenuItem onSelect={guarded(() => openEdit(s))}>Edit conditions</PopoverMenuItem>
-                                        <PopoverMenuItem onSelect={() => setCampaignFor(s)}>Add to campaign</PopoverMenuItem>
+                                        <PopoverMenuItem onSelect={campaignGuarded(() => setCampaignFor(s))}>Add to campaign</PopoverMenuItem>
                                         <PopoverMenuItem onSelect={guarded(() => duplicate(s))}>Duplicate</PopoverMenuItem>
                                         <PopoverMenuSeparator />
                                         <PopoverMenuItem onSelect={guarded(() => askDelete(s))}>Delete</PopoverMenuItem>
diff --git a/web/src/components/app/contacts/ContactsTable.tsx b/web/src/components/app/contacts/ContactsTable.tsx
index 0b085590..82359b05 100644
--- a/web/src/components/app/contacts/ContactsTable.tsx
+++ b/web/src/components/app/contacts/ContactsTable.tsx
@@ -40,6 +40,7 @@ import {
 } from "lucide-react";
 
 import { useConfirm } from "@/hooks/context/confirm";
+import { useWriteGuard } from "@/hooks/usePermission";
 import useSearchContacts from "@/lib/api/hooks/app/contacts/useSearchContacts";
 import type SearchContacts from "@/lib/api/models/app/contacts/SearchContacts";
 import useDeleteContacts from "@/lib/api/hooks/app/contacts/useDeleteContacts";
@@ -105,6 +106,8 @@ export default function ContactsTable({
 }) {
     const confirm = useConfirm();
     const segmentMembers = useSetSegmentMembers();
+    // Enrolling a segment writes campaign leads, so it takes the campaign permission.
+    const campaignWrite = useWriteGuard("MANAGE_CAMPAIGNS");
     const [selected, setSelected] = React.useState<string[]>([]);
     const [del, setDelete] = React.useState<boolean>(false);
     const [filtersOpen, setFiltersOpen] = React.useState<boolean>(false);
@@ -341,7 +344,7 @@ export default function ContactsTable({
                         <TopbarAction
                             variant="ghost"
                             icon={<LayersIcon className="w-3 h-3" />}
-                            onClick={() => setFromSegmentOpen(true)}
+                            onClick={() => campaignWrite.guard(() => setFromSegmentOpen(true))({})}
                         >
                             From segment
                         </TopbarAction>
diff --git a/web/src/components/app/segments/SegmentEditor.tsx b/web/src/components/app/segments/SegmentEditor.tsx
index d07aa68d..4d11d395 100644
--- a/web/src/components/app/segments/SegmentEditor.tsx
+++ b/web/src/components/app/segments/SegmentEditor.tsx
@@ -1,4 +1,4 @@
-// SegmentEditor — right-side drawer that creates or edits a segment: name,
+// SegmentEditor: right-side drawer that creates or edits a segment: name,
 // color, all/any match and the condition list, with a live "matches N
 // contacts" preview fed by POST /segments/preview.