diff --git a/src/repixelizer/gui.py b/src/repixelizer/gui.py
index b2a9980..eb39855 100644
--- a/src/repixelizer/gui.py
+++ b/src/repixelizer/gui.py
@@ -1012,8 +1012,7 @@ def create_app():
             elif path == "/api/jobs" and request.method.upper() == "POST":
                 subject = access_controller.require_request_capability(request, "queue_submit")
             elif path.startswith("/api/jobs/"):
-                capability = "job_cancel_own" if request.method.upper() == "DELETE" else "job_read_own"
-                subject = resolve_job_subject(capability)
+                subject = resolve_job_subject("app_access")
             elif path in {"/app", "/app/"}:
                 if access_controller.runtime.enabled and access_controller.runtime.required:
                     subject = access_controller.require_request_capability(request, "app_access")
@@ -1111,7 +1110,7 @@ def create_app():
         if job is None:
             raise HTTPException(status_code=404, detail="Unknown job")
         try:
-            access_controller.require_current_job_access(job, "job_read_own")
+            access_controller.require_current_job_access(job, "app_access")
         except AccessDenied as exc:
             raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
         payload = manager.get_job_state_payload(job_id)
@@ -1186,7 +1185,7 @@ def create_app():
         if job is None:
             raise HTTPException(status_code=404, detail="Unknown job")
         try:
-            access_controller.require_current_job_access(job, "job_read_own")
+            access_controller.require_current_job_access(job, "app_access")
         except AccessDenied as exc:
             raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
         payload = manager.heartbeat(job_id)
@@ -1199,7 +1198,7 @@ def create_app():
         if job is None:
             raise HTTPException(status_code=404, detail="Unknown job")
         try:
-            access_controller.require_current_job_access(job, "job_cancel_own")
+            access_controller.require_current_job_access(job, "app_access")
         except AccessDenied as exc:
             raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
         payload = manager.cancel_job(job_id, "Canceled because the browser left or explicitly bailed.")
@@ -1212,7 +1211,7 @@ def create_app():
         if job is None:
             raise HTTPException(status_code=404, detail="Unknown job")
         try:
-            access_controller.require_current_job_access(job, "job_read_own")
+            access_controller.require_current_job_access(job, "app_access")
         except AccessDenied as exc:
             raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
 
diff --git a/tests/test_gui.py b/tests/test_gui.py
index 79781fa..82c6db9 100644
--- a/tests/test_gui.py
+++ b/tests/test_gui.py
@@ -908,7 +908,7 @@ def test_gui_job_routes_enforce_bound_subject_ownership(monkeypatch, tmp_path: P
         account_id="acct-1",
         session_id="sess-1",
         access_revision=4,
-        capabilities=frozenset({"queue_submit", "job_read_own", "job_cancel_own"}),
+        capabilities=frozenset({"app_access", "queue_submit"}),
         auth_mode="trusted-header",
     )
     with bind_access_subject(subject):
@@ -936,7 +936,7 @@ def test_gui_job_routes_enforce_bound_subject_ownership(monkeypatch, tmp_path: P
         account_id="acct-2",
         session_id="sess-2",
         access_revision=8,
-        capabilities=frozenset({"job_read_own"}),
+        capabilities=frozenset({"app_access"}),
         auth_mode="trusted-header",
     )
     with bind_access_subject(intruder):