diff --git a/redfish-core/lib/event_service.hpp b/redfish-core/lib/event_service.hpp
index f1d6f50..67ad014 100644
--- a/redfish-core/lib/event_service.hpp
+++ b/redfish-core/lib/event_service.hpp
@@ -194,10 +194,7 @@
                 }
             });
     BMCWEB_ROUTE(app, "/redfish/v1/EventService/Subscriptions/")
-        // The below privilege is wrong, it should be ConfigureManager OR
-        // ConfigureComponents
-        //.privileges(redfish::privileges::postEventDestinationCollection)
-        .privileges({{"ConfigureManager"}})
+        .privileges(redfish::privileges::postEventDestinationCollection)
         .methods(boost::beast::http::verb::post)(
             [](const crow::Request& req,
                const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
@@ -542,12 +539,10 @@
                 asyncResp->res.jsonValue["MetricReportDefinitions"] =
                     mrdJsonArray;
             });
-    /////redfish/v1/EventService/Subscriptions/
-    // ConfigureManager
     BMCWEB_ROUTE(app, "/redfish/v1/EventService/Subscriptions/<str>/")
         // The below privilege is wrong, it should be ConfigureManager OR
         // ConfigureSelf
-        // TODO(ed) follow up with DMTF spec and understand ConfigureSelf
+        // https://github.com/openbmc/bmcweb/issues/220
         //.privileges(redfish::privileges::patchEventDestination)
         .privileges({{"ConfigureManager"}})
         .methods(boost::beast::http::verb::patch)(
@@ -604,6 +599,7 @@
     BMCWEB_ROUTE(app, "/redfish/v1/EventService/Subscriptions/<str>/")
         // The below privilege is wrong, it should be ConfigureManager OR
         // ConfigureSelf
+        // https://github.com/openbmc/bmcweb/issues/220
         //.privileges(redfish::privileges::deleteEventDestination)
         .privileges({{"ConfigureManager"}})
         .methods(boost::beast::http::verb::delete_)(