diff --git a/compte.php b/compte.php
index d13dbb1..5ccfbb1 100644
--- a/compte.php
+++ b/compte.php
@@ -22,6 +22,7 @@ require_once('superadm/php/inc_fx_excell.php');
 
 require_once('php/inc_fx_liste_attente.php');
 require_once('php/inc_fx_inscriptions_mobile.php');
+require_once('php/inc_fx_eve_acces.php');
 global $objDatabase, $vPage, $vDomaine;
 // vérifier les paramètres
 
@@ -314,6 +315,11 @@ if (isset($_GET['promoteur_eve_id'])) {
             header('Location: ' . $vDomaine . '/' . $strPage);
             exit;
         }
+    } elseif ($strCode === 'compte_inc_tableau_gestion_epreuves') {
+        if (!fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveIdbase)) {
+            header('Location: ' . $vDomaine . '/' . $strPage);
+            exit;
+        }
     } elseif (!fxIsPromoteur($_SESSION['com_id'], $intEveIdbase)) {
         header('Location: ' . $vDomaine . '/' . $strPage);
         exit;
@@ -471,7 +477,7 @@ require_once("inc_header.php");
                         break;
                     case 'compte_accueil':
                     //MSIN-4371
-                if (isset($_SESSION['usa_id'])) { ?>
+                if (fxEveAccesCanQrTest($_SESSION['com_id'])) { ?>
 
                     <a href="qr_test.php"  target="_blank" class="btn btn-primary">
                         QR Test
diff --git a/inc_tableau_gestion_epreuves.php b/inc_tableau_gestion_epreuves.php
index 8dcda63..da2ce48 100644
--- a/inc_tableau_gestion_epreuves.php
+++ b/inc_tableau_gestion_epreuves.php
@@ -1,22 +1,14 @@
 <?php
 
-// MSIN-4379 — Gestion quantités + dossards v4 (rollout superadm, fxShowBibTool4 seulement)
+// MSIN-4379 — Gestion quantités + dossards v4 (droits v2 ou super admin)
 include_once("php/inc_fx_modifierinscriptions.php");
 include_once("php/inc_fx_memberships.php");
 include_once("php/inc_fx_promoteur.php");
+require_once('php/inc_fx_eve_acces.php');
 require_once('superadm/php/inc_manager.php');
 
 global $objDatabase, $vDomaine, $strLangue;
 
-if (!isset($_SESSION['usa_id'])) {
-    $strRedirect = $vDomaine . '/compte/inc_tableau_promoteur';
-    if (!empty($_GET['promoteur_eve_id'])) {
-        $strRedirect .= '?promoteur_eve_id=' . urlencode($_GET['promoteur_eve_id']);
-    }
-    header('Location: ' . $strRedirect);
-    exit;
-}
-
 $intEveId = 0;
 
 if ($strLangue == 'fr') {
@@ -36,6 +28,15 @@ if (isset($_GET['promoteur_eve_id'])) {
     $intEveId = base64_decode(urldecode($_GET['promoteur_eve_id']));
 }
 
+if ($intEveId <= 0 || (empty($_SESSION['com_id']) && empty($_SESSION['usa_id'])) || !fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveId)) {
+    $strRedirect = $vDomaine . '/compte/inc_tableau_promoteur';
+    if (!empty($_GET['promoteur_eve_id'])) {
+        $strRedirect .= '?promoteur_eve_id=' . urlencode($_GET['promoteur_eve_id']);
+    }
+    header('Location: ' . $strRedirect);
+    exit;
+}
+
 $strBackUrl = fxGetPromoteurBackUrl($intEveId, $strPage);
 ?>
 <a class="btn btn-primary rounded-pill" id="link_back" href="<?php echo $strBackUrl; ?>">
@@ -56,8 +57,7 @@ if (isset($_POST['btn_cancel_event_promo'])) {
     fxAnnulerRetablirInscription($tabEpreuve, $int_pec_id);
 }
 
-if ($intEveId != 0) {
-    ?>
+?>
     
 
     <?php
@@ -72,10 +72,3 @@ if ($intEveId != 0) {
         <?php afficheTexte('promoteur_back'); ?>
     </a>
     <?php
-} else {
-    if ($strLangue == 'fr') {
-        echo "Une erreur quelconque est survenue.";
-    } else {
-        echo "A generic error occurred.";
-    }
-}
diff --git a/inc_tableau_promoteur.php b/inc_tableau_promoteur.php
index 0bf01f7..d0b9027 100644
--- a/inc_tableau_promoteur.php
+++ b/inc_tableau_promoteur.php
@@ -4,6 +4,7 @@
 include_once("php/inc_fx_modifierinscriptions.php");
 include_once("php/inc_fx_memberships.php");
 include_once("php/inc_fx_promoteur.php");
+require_once('php/inc_fx_eve_acces.php');
 require_once('superadm/php/inc_manager.php');
 
 global $objDatabase, $vDomaine, $strLangue;
@@ -233,7 +234,7 @@ if ($intEveId != 0) {
             </li><?php
         }
 
-        if (isset($_SESSION['usa_id'])) {
+        if (fxEveAccesCanManageBibV4($_SESSION['com_id'] ?? 0, $intEveId)) {
             ?>
             <li class="nav-item">
                 <a class="nav-list"
diff --git a/php/inc_fx_eve_acces.php b/php/inc_fx_eve_acces.php
index 38db236..5833de4 100644
--- a/php/inc_fx_eve_acces.php
+++ b/php/inc_fx_eve_acces.php
@@ -171,6 +171,43 @@ function fxEveAccesGetEventIdsWithAnyPermission($intComId, $arrPermKeys)
     return $arrIds;
 }
 
+function fxEveAccesIsSuperAdminSession()
+{
+    return !empty($_SESSION['usa_id']);
+}
+
+/** Permissions gestion bib v4 (quantites + dossards). */
+function fxEveAccesBibV4PermKeys()
+{
+    return array('dossards.manage', 'epreuves.edit_qte');
+}
+
+function fxEveAccesCanManageBibV4($intComId, $intEveId)
+{
+    if (fxEveAccesIsSuperAdminSession()) {
+        return true;
+    }
+
+    return fxEveAccesHasAnyPermission(intval($intComId), intval($intEveId), fxEveAccesBibV4PermKeys());
+}
+
+/** Outil debug QR — acces v2 actif avec tools.qr_test (pas de bypass super admin). */
+function fxEveAccesCanQrTest($intComId)
+{
+    if (!fxEveAccesIsEnabled() || intval($intComId) <= 0) {
+        return false;
+    }
+
+    global $objDatabase;
+
+    $sql = "SELECT COUNT(*) FROM v_eve_acces_permissions
+            WHERE com_id = " . intval($intComId) . "
+              AND perm_key = 'tools.qr_test'";
+    $intNb = $objDatabase->fxGetVar($sql);
+
+    return ($intNb != null && intval($intNb) > 0);
+}
+
 function fxEveAccesGrant($intComId, $intEveId, $intRoleId, $intExpireDays, $intGrantedBy, $strNote = '')
 {
     global $objDatabase;
diff --git a/php/inc_fx_promoteur.php b/php/inc_fx_promoteur.php
index 5c18a94..68392fd 100644
--- a/php/inc_fx_promoteur.php
+++ b/php/inc_fx_promoteur.php
@@ -2724,7 +2724,27 @@ function fxBibRequirePromoteurSession() {
     return !empty($_SESSION['com_id']) || !empty($_SESSION['usa_id']);
 }
 
-/** Gate AJAX bib v4 — session + CSRF (même règle que toggle_lock / save_auto_config). */
+/** Resout eve_id depuis la requete AJAX bib (eve_id direct ou via epr_id). */
+function fxBibResolveEveIdFromRequest() {
+    global $objDatabase;
+
+    if (!empty($_REQUEST['eve_id'])) {
+        return intval($_REQUEST['eve_id']);
+    }
+
+    $intEprId = intval($_REQUEST['epr_id'] ?? 0);
+    if ($intEprId <= 0) {
+        return 0;
+    }
+
+    $intEveId = intval($objDatabase->fxGetVar(
+        'SELECT eve_id FROM inscriptions_epreuves WHERE epr_id = ' . $intEprId . ' LIMIT 1'
+    ));
+
+    return ($intEveId > 0) ? $intEveId : 0;
+}
+
+/** Gate AJAX bib v4 — session, droits v2 par evenement (usa_id = bypass), CSRF. */
 function fxBibRequireAjaxAccess() {
     if (!fxBibRequirePromoteurSession()) {
         echo json_encode([
@@ -2734,6 +2754,20 @@ function fxBibRequireAjaxAccess() {
         exit;
     }
 
+    if (empty($_SESSION['usa_id'])) {
+        require_once __DIR__ . '/inc_fx_eve_acces.php';
+        $intComId = intval($_SESSION['com_id'] ?? 0);
+        $intEveId = fxBibResolveEveIdFromRequest();
+
+        if ($intComId <= 0 || $intEveId <= 0 || !fxEveAccesCanManageBibV4($intComId, $intEveId)) {
+            echo json_encode([
+                'success' => false,
+                'message' => fxBibMsg('bib_v4_ajax_unauthorized'),
+            ]);
+            exit;
+        }
+    }
+
     $strToken = $_POST['csrf_token'] ?? $_REQUEST['csrf_token'] ?? '';
     if (!fxBibValidateCsrf($strToken)) {
         echo json_encode([
diff --git a/qr_test.php b/qr_test.php
index 787e342..6cd05c5 100644
--- a/qr_test.php
+++ b/qr_test.php
@@ -6,6 +6,19 @@ require_once('php/inc_fonctions.php');
 ini_set('display_errors',1);
 error_reporting(E_ALL);
 require_once('php/inc_fx_panier.php');
+require_once('php/inc_fx_eve_acces.php');
+
+if (empty($_SESSION['com_id'])) {
+    header('Location: /compte');
+    exit;
+}
+
+if (!fxEveAccesCanQrTest($_SESSION['com_id'])) {
+    header('HTTP/1.1 403 Forbidden');
+    echo 'Acces refuse';
+    exit;
+}
+
 ini_set('display_errors',1);
 error_reporting(E_ALL);
 global $objDatabase;
diff --git a/sql/MSIN-eve-acces-v2-bib-qr-seed.sql b/sql/MSIN-eve-acces-v2-bib-qr-seed.sql
new file mode 100644
index 0000000..be1af99
--- /dev/null
+++ b/sql/MSIN-eve-acces-v2-bib-qr-seed.sql
@@ -0,0 +1,82 @@
+/*
+  MSIN - Acces evenement v2 - Bib v4 + QR test debug
+  Executer APRES MSIN-eve-acces-v2-phase1-seed.sql
+*/
+
+SET NAMES utf8mb4;
+
+
+INSERT INTO `inscriptions_eve_permissions`
+  (`perm_key`, `perm_group`, `perm_label_fr`, `perm_label_en`, `perm_description_fr`, `perm_description_en`, `perm_phase`, `perm_actif`, `perm_tri`)
+VALUES
+  ('tools.qr_test', 'tools', 'Outil test QR', 'QR test tool',
+   'Page debug scanner QR (qr_test.php)', NULL, 2, 1, 810)
+ON DUPLICATE KEY UPDATE
+  `perm_group` = VALUES(`perm_group`),
+  `perm_label_fr` = VALUES(`perm_label_fr`),
+  `perm_label_en` = VALUES(`perm_label_en`),
+  `perm_description_fr` = VALUES(`perm_description_fr`),
+  `perm_description_en` = VALUES(`perm_description_en`),
+  `perm_phase` = VALUES(`perm_phase`),
+  `perm_actif` = VALUES(`perm_actif`),
+  `perm_tri` = VALUES(`perm_tri`);
+
+
+INSERT INTO `inscriptions_eve_roles`
+  (`role_code`, `role_label_fr`, `role_label_en`, `role_description_fr`, `role_description_en`, `role_icone`, `role_systeme`, `role_actif`, `role_tri`)
+VALUES
+  ('bib_ops', 'Gestion dossards', 'Bib management',
+   'Quantites epreuves et gestion dossards v4',
+   'Race quantities and bib management v4',
+   'fa-hashtag', 1, 1, 35),
+  ('qr_debug', 'Debug QR', 'QR debug',
+   'Outil interne test scanner QR',
+   'Internal QR scanner test tool',
+   'fa-qrcode', 1, 1, 36)
+ON DUPLICATE KEY UPDATE
+  `role_label_fr` = VALUES(`role_label_fr`),
+  `role_label_en` = VALUES(`role_label_en`),
+  `role_description_fr` = VALUES(`role_description_fr`),
+  `role_description_en` = VALUES(`role_description_en`),
+  `role_icone` = VALUES(`role_icone`),
+  `role_systeme` = VALUES(`role_systeme`),
+  `role_actif` = VALUES(`role_actif`),
+  `role_tri` = VALUES(`role_tri`);
+
+
+DELETE erp FROM inscriptions_eve_role_permissions erp
+INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
+WHERE r.role_code = 'owner';
+
+INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
+SELECT r.role_id, p.perm_key
+FROM inscriptions_eve_roles r
+CROSS JOIN inscriptions_eve_permissions p
+WHERE r.role_code = 'owner'
+  AND p.perm_actif = 1;
+
+
+DELETE erp FROM inscriptions_eve_role_permissions erp
+INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
+WHERE r.role_code = 'bib_ops';
+
+INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
+SELECT r.role_id, p.perm_key
+FROM inscriptions_eve_roles r
+INNER JOIN inscriptions_eve_permissions p
+  ON p.perm_key IN ('dossards.view', 'dossards.manage', 'epreuves.view', 'epreuves.edit_qte')
+ AND p.perm_actif = 1
+WHERE r.role_code = 'bib_ops';
+
+
+DELETE erp FROM inscriptions_eve_role_permissions erp
+INNER JOIN inscriptions_eve_roles r ON r.role_id = erp.role_id
+WHERE r.role_code = 'qr_debug';
+
+INSERT INTO inscriptions_eve_role_permissions (role_id, perm_key)
+SELECT r.role_id, p.perm_key
+FROM inscriptions_eve_roles r
+INNER JOIN inscriptions_eve_permissions p
+  ON p.perm_key IN ('tools.qr_test')
+ AND p.perm_actif = 1
+WHERE r.role_code = 'qr_debug';