diff --git a/src/main/kotlin/com/android/trisolarisserver/controller/BookingFlow.kt b/src/main/kotlin/com/android/trisolarisserver/controller/BookingFlow.kt
index 935e347..af9254e 100644
--- a/src/main/kotlin/com/android/trisolarisserver/controller/BookingFlow.kt
+++ b/src/main/kotlin/com/android/trisolarisserver/controller/BookingFlow.kt
@@ -435,7 +435,7 @@ class BookingFlow(
     }
 
     private fun requireActor(propertyId: UUID, principal: MyPrincipal?): com.android.trisolarisserver.models.property.AppUser {
-        val resolved = requireRole(propertyAccess, propertyId, principal, Role.ADMIN, Role.MANAGER, Role.STAFF)
+        val resolved = requireRole(propertyAccess, propertyId, principal, Role.ADMIN, Role.MANAGER)
         return appUserRepo.findById(resolved.userId).orElseThrow {
             ResponseStatusException(HttpStatus.UNAUTHORIZED, "User not found")
         }
@@ -462,9 +462,7 @@ class BookingFlow(
         property: com.android.trisolarisserver.models.property.Property,
         mode: TransportMode
     ): Boolean {
-        val allowed = if (property.allowedTransportModes.isNotEmpty()) {
-            property.allowedTransportModes
-        } else {
+        val allowed = property.allowedTransportModes.ifEmpty {
             TransportMode.entries.toSet()
         }
         return allowed.contains(mode)