diff --git a/src/components/general/panels/access/LAccessPermissions.vue b/src/components/general/panels/access/LAccessPermissions.vue
index b1744ab..d571a62 100644
--- a/src/components/general/panels/access/LAccessPermissions.vue
+++ b/src/components/general/panels/access/LAccessPermissions.vue
@@ -1,11 +1,29 @@
 <template>
-    <div class="permissions">
+    <div
+        class="permissions"
+        :class="{ 'drop-at-end': dropAtEnd }"
+    >
         <h3>Permissions</h3>
         <div
-            v-for="(permission, id) of internals.permissions"
+            v-for="(permission, id, index) of internals.permissions"
             :key="id"
             class="permission"
+            draggable="true"
+            :class="{
+                dragging: draggingPermissionId === id,
+                'drop-before': dropBeforePermissionId === id && draggingPermissionId !== id
+            }"
+            @dragstart="onPermissionDragStart($event, id)"
+            @dragend="onPermissionDragEnd"
+            @dragover.prevent="onPermissionDragOver($event, index)"
+            @drop.prevent="onPermissionDrop"
         >
+            <span
+                class="drag-handle"
+                title="Drag to reorder"
+            >
+                ::
+            </span>
             <LInput
                 borderless
                 disabled
@@ -20,7 +38,7 @@
                 @click="deletePermission(id)"
             />
         </div>
-        <div class="permission">
+        <div class="permission new-permission">
             <LInput
                 v-model="newPermission"
                 borderless
@@ -49,6 +67,9 @@ import { ref } from "vue";
 import { addPermission, internals } from "@/internals";
 
 const newPermission = ref("");
+const draggingPermissionId = ref<string | null>(null);
+const dropBeforePermissionId = ref<string | null>(null);
+const dropAtEnd = ref(false);
 
 function addNewPermission() {
     addPermission({
@@ -64,6 +85,84 @@ function deletePermission(permissionId: string) {
 
     delete internals.permissions[permissionId];
 }
+
+function onPermissionDragStart(event: DragEvent, permissionId: string) {
+    draggingPermissionId.value = permissionId;
+
+    const dataTransfer = event.dataTransfer;
+    if (!dataTransfer) {
+        return;
+    }
+
+    dataTransfer.setData("text/plain", permissionId);
+    dataTransfer.setDragImage(event.currentTarget as Element, 16, 16);
+    dataTransfer.dropEffect = "move";
+    dataTransfer.effectAllowed = "move";
+}
+
+function onPermissionDragEnd() {
+    draggingPermissionId.value = null;
+    dropBeforePermissionId.value = null;
+    dropAtEnd.value = false;
+}
+
+function onPermissionDragOver(event: DragEvent, targetIndex: number) {
+    const permissionIds = Object.keys(internals.permissions);
+    const target = event.currentTarget as HTMLElement | null;
+
+    if (!target || !permissionIds.length) {
+        return;
+    }
+
+    const { height, top } = target.getBoundingClientRect();
+    const insertAfter = event.clientY > top + height / 2;
+    const insertionIndex = insertAfter ? targetIndex + 1 : targetIndex;
+    const nextPermissionId = permissionIds[insertionIndex] ?? null;
+
+    dropBeforePermissionId.value = nextPermissionId;
+    dropAtEnd.value = nextPermissionId === null;
+}
+
+function onPermissionDrop() {
+    if (!draggingPermissionId.value) {
+        return;
+    }
+
+    moveRecordEntryBefore(internals.permissions, draggingPermissionId.value, dropBeforePermissionId.value);
+    draggingPermissionId.value = null;
+    dropBeforePermissionId.value = null;
+    dropAtEnd.value = false;
+}
+
+function moveRecordEntryBefore<T extends { id: string }>(
+    record: Record<string, T>,
+    sourceId: string,
+    beforeId: string | null
+) {
+    if (sourceId === beforeId) {
+        return;
+    }
+
+    const entries = Object.entries(record);
+    const sourceIndex = entries.findIndex(([id]) => id === sourceId);
+    if (sourceIndex === -1) {
+        return;
+    }
+
+    const [sourceEntry] = entries.splice(sourceIndex, 1);
+    const insertionIndex = beforeId ? entries.findIndex(([id]) => id === beforeId) : entries.length;
+    const safeInsertionIndex = insertionIndex === -1 ? entries.length : insertionIndex;
+
+    entries.splice(safeInsertionIndex, 0, sourceEntry);
+
+    for (const id of Object.keys(record)) {
+        delete record[id];
+    }
+
+    for (const [id, value] of entries) {
+        record[id] = value;
+    }
+}
 </script>
 
 <style scoped>
@@ -85,10 +184,65 @@ function deletePermission(permissionId: string) {
     .permission {
         display: flex;
         gap: var(--length-xs);
+        cursor: grab;
+        position: relative;
+        border-radius: var(--length-radius-xs);
+        transition: background-color 0.12s ease;
+
+        &.dragging {
+            opacity: 0.45;
+        }
+
+        &.drop-before {
+            background-color: color-mix(in srgb, #3f8cff 10%, transparent);
+
+            &::before {
+                content: "";
+                position: absolute;
+                left: 0;
+                right: 0;
+                top: -4px;
+                height: 3px;
+                border-radius: 999px;
+                background: linear-gradient(90deg, #3f8cff 0%, #66a3ff 100%);
+            }
+        }
+
+        .drag-handle {
+            align-items: center;
+            color: var(--color-content-softer);
+            display: inline-flex;
+            font-size: var(--font-size-s);
+            justify-content: center;
+            min-width: 16px;
+            user-select: none;
+        }
+
+        &.new-permission {
+            cursor: default;
+            position: relative;
+
+            .drag-handle {
+                display: none;
+            }
+        }
 
         &:deep(.input) {
             flex: 1 1 0;
         }
     }
+
+    &.drop-at-end {
+        .new-permission::before {
+            content: "";
+            position: absolute;
+            left: 0;
+            right: 0;
+            top: -4px;
+            height: 3px;
+            border-radius: 999px;
+            background: linear-gradient(90deg, #3f8cff 0%, #66a3ff 100%);
+        }
+    }
 }
 </style>
diff --git a/src/components/general/panels/access/LAccessRoles.vue b/src/components/general/panels/access/LAccessRoles.vue
index e33095d..e1d4db9 100644
--- a/src/components/general/panels/access/LAccessRoles.vue
+++ b/src/components/general/panels/access/LAccessRoles.vue
@@ -1,11 +1,29 @@
 <template>
-    <div class="roles">
+    <div
+        class="roles"
+        :class="{ 'drop-at-end': dropAtEnd }"
+    >
         <h3>Roles</h3>
         <div
-            v-for="(role, id) of internals.roles"
+            v-for="(role, id, index) of internals.roles"
             :key="id"
             class="role"
+            draggable="true"
+            :class="{
+                dragging: draggingRoleId === id,
+                'drop-before': dropBeforeRoleId === id && draggingRoleId !== id
+            }"
+            @dragstart="onRoleDragStart($event, id)"
+            @dragend="onRoleDragEnd"
+            @dragover.prevent="onRoleDragOver($event, index)"
+            @drop.prevent="onRoleDrop"
         >
+            <span
+                class="drag-handle"
+                title="Drag to reorder"
+            >
+                ::
+            </span>
             <LInput
                 borderless
                 disabled
@@ -21,7 +39,7 @@
                 @click="deleteRole(id)"
             />
         </div>
-        <div class="role">
+        <div class="role new-role">
             <LInput
                 v-model="newRole"
                 borderless
@@ -51,6 +69,9 @@ import { ref } from "vue";
 import { addRole, internals } from "@/internals";
 
 const newRole = ref("");
+const draggingRoleId = ref<string | null>(null);
+const dropBeforeRoleId = ref<string | null>(null);
+const dropAtEnd = ref(false);
 
 function addNewRole() {
     addRole({
@@ -69,6 +90,84 @@ function deleteRole(roleId: string) {
 
     delete internals.roles[roleId];
 }
+
+function onRoleDragStart(event: DragEvent, roleId: string) {
+    draggingRoleId.value = roleId;
+
+    const dataTransfer = event.dataTransfer;
+    if (!dataTransfer) {
+        return;
+    }
+
+    dataTransfer.setData("text/plain", roleId);
+    dataTransfer.setDragImage(event.currentTarget as Element, 16, 16);
+    dataTransfer.dropEffect = "move";
+    dataTransfer.effectAllowed = "move";
+}
+
+function onRoleDragEnd() {
+    draggingRoleId.value = null;
+    dropBeforeRoleId.value = null;
+    dropAtEnd.value = false;
+}
+
+function onRoleDragOver(event: DragEvent, targetIndex: number) {
+    const roleIds = Object.keys(internals.roles);
+    const target = event.currentTarget as HTMLElement | null;
+
+    if (!target || !roleIds.length) {
+        return;
+    }
+
+    const { height, top } = target.getBoundingClientRect();
+    const insertAfter = event.clientY > top + height / 2;
+    const insertionIndex = insertAfter ? targetIndex + 1 : targetIndex;
+    const nextRoleId = roleIds[insertionIndex] ?? null;
+
+    dropBeforeRoleId.value = nextRoleId;
+    dropAtEnd.value = nextRoleId === null;
+}
+
+function onRoleDrop() {
+    if (!draggingRoleId.value) {
+        return;
+    }
+
+    moveRecordEntryBefore(internals.roles, draggingRoleId.value, dropBeforeRoleId.value);
+    draggingRoleId.value = null;
+    dropBeforeRoleId.value = null;
+    dropAtEnd.value = false;
+}
+
+function moveRecordEntryBefore<T extends { id: string }>(
+    record: Record<string, T>,
+    sourceId: string,
+    beforeId: string | null
+) {
+    if (sourceId === beforeId) {
+        return;
+    }
+
+    const entries = Object.entries(record);
+    const sourceIndex = entries.findIndex(([id]) => id === sourceId);
+    if (sourceIndex === -1) {
+        return;
+    }
+
+    const [sourceEntry] = entries.splice(sourceIndex, 1);
+    const insertionIndex = beforeId ? entries.findIndex(([id]) => id === beforeId) : entries.length;
+    const safeInsertionIndex = insertionIndex === -1 ? entries.length : insertionIndex;
+
+    entries.splice(safeInsertionIndex, 0, sourceEntry);
+
+    for (const id of Object.keys(record)) {
+        delete record[id];
+    }
+
+    for (const [id, value] of entries) {
+        record[id] = value;
+    }
+}
 </script>
 
 <style scoped>
@@ -90,10 +189,65 @@ function deleteRole(roleId: string) {
     .role {
         display: flex;
         gap: var(--length-xs);
+        cursor: grab;
+        position: relative;
+        border-radius: var(--length-radius-xs);
+        transition: background-color 0.12s ease;
+
+        &.dragging {
+            opacity: 0.45;
+        }
+
+        &.drop-before {
+            background-color: color-mix(in srgb, #3f8cff 10%, transparent);
+
+            &::before {
+                content: "";
+                position: absolute;
+                left: 0;
+                right: 0;
+                top: -4px;
+                height: 3px;
+                border-radius: 999px;
+                background: linear-gradient(90deg, #3f8cff 0%, #66a3ff 100%);
+            }
+        }
+
+        .drag-handle {
+            align-items: center;
+            color: var(--color-content-softer);
+            display: inline-flex;
+            font-size: var(--font-size-s);
+            justify-content: center;
+            min-width: 16px;
+            user-select: none;
+        }
+
+        &.new-role {
+            cursor: default;
+            position: relative;
+
+            .drag-handle {
+                display: none;
+            }
+        }
 
         &:deep(.input) {
             flex: 1 1 0;
         }
     }
+
+    &.drop-at-end {
+        .new-role::before {
+            content: "";
+            position: absolute;
+            left: 0;
+            right: 0;
+            top: -4px;
+            height: 3px;
+            border-radius: 999px;
+            background: linear-gradient(90deg, #3f8cff 0%, #66a3ff 100%);
+        }
+    }
 }
 </style>