diff --git a/apps/annotation/pkg/app/authorizer.go b/apps/annotation/pkg/app/authorizer.go
new file mode 100644
index 00000000000..4cde905414d
--- /dev/null
+++ b/apps/annotation/pkg/app/authorizer.go
@@ -0,0 +1,20 @@
+package app
+
+import (
+	"context"
+
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+)
+
+func GetAuthorizer() authorizer.Authorizer {
+	return authorizer.AuthorizerFunc(func(
+		ctx context.Context, attr authorizer.Attributes,
+	) (authorized authorizer.Decision, reason string, err error) {
+		if !attr.IsResourceRequest() {
+			return authorizer.DecisionNoOpinion, "", nil
+		}
+
+		// Any authenticated user can access the API
+		return authorizer.DecisionAllow, "", nil
+	})
+}
diff --git a/pkg/registry/apps/annotation/register.go b/pkg/registry/apps/annotation/register.go
index 9d733eb3dcb..e49c1611234 100644
--- a/pkg/registry/apps/annotation/register.go
+++ b/pkg/registry/apps/annotation/register.go
@@ -12,6 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/selection"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/apiserver/pkg/registry/rest"
 	restclient "k8s.io/client-go/rest"
@@ -82,6 +83,10 @@ func RegisterAppInstaller(
 	return installer, nil
 }
 
+func (a *AnnotationAppInstaller) GetAuthorizer() authorizer.Authorizer {
+	return annotationapp.GetAuthorizer()
+}
+
 func (a *AnnotationAppInstaller) GetLegacyStorage(requested schema.GroupVersionResource) apiserverrest.Storage {
 	kind := annotationV0.AnnotationKind()
 	gvr := schema.GroupVersionResource{