diff --git a/api/kiwi_vpn_api/db/user.py b/api/kiwi_vpn_api/db/user.py
index 2f2c50d..ccc4d5e 100644
--- a/api/kiwi_vpn_api/db/user.py
+++ b/api/kiwi_vpn_api/db/user.py
@@ -282,22 +282,24 @@ class User(UserBase, table=True):
         # deny be default
         return False
 
-    def can_issue(self, device: Device) -> bool:
+    @property
+    def can_issue(self) -> bool:
         """
         Check if this user can issue a certificate without approval.
         """
 
         return (
-            device.approved in (None, False)
-            and (self.is_admin or self.has_tag(TagValue.issue))
+            self.is_admin
+            or self.has_tag(TagValue.issue)
         )
 
-    def can_renew(self, device: Device) -> bool:
+    @property
+    def can_renew(self) -> bool:
         """
         Check if this user can renew a certificate without approval.
         """
 
         return (
-            device.approved is True
-            and (self.is_admin or self.has_tag(TagValue.renew))
+            self.is_admin
+            or self.has_tag(TagValue.renew)
         )