diff --git a/core/java/android/companion/AssociationRequest.java b/core/java/android/companion/AssociationRequest.java
index 17bdd42a0f458..3b4bd9728db70 100644
--- a/core/java/android/companion/AssociationRequest.java
+++ b/core/java/android/companion/AssociationRequest.java
@@ -64,10 +64,12 @@ public final class AssociationRequest implements Parcelable {
      * set up is a specific kind of device, and some extra permissions may be granted to the app
      * as a result.
      *
+     * Using it requires declaring uses-permission
+     * {@link android.Manifest.permission#REQUEST_COMPANION_PROFILE_WATCH} in the manifest.
+     *
      * @see AssociationRequest.Builder#setDeviceProfile
      */
-    public static final String DEVICE_PROFILE_WATCH =
-            "android.app.role.COMPANION_DEVICE_WATCH";
+    public static final String DEVICE_PROFILE_WATCH = "android.app.role.COMPANION_DEVICE_WATCH";
 
     /** @hide */
     @StringDef(value = { DEVICE_PROFILE_WATCH })
diff --git a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
index a3a0cb402c761..52237c934797e 100644
--- a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
+++ b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
@@ -38,6 +38,7 @@ import static com.android.internal.util.function.pooled.PooledLambda.obtainRunna
 import static java.util.Objects.requireNonNull;
 import static java.util.concurrent.TimeUnit.MINUTES;
 
+import android.Manifest;
 import android.annotation.CheckResult;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
@@ -409,6 +410,7 @@ public class CompanionDeviceManagerService extends SystemService implements Bind
             checkCallerIsSystemOr(callingPackage);
             int userId = getCallingUserId();
             checkUsesFeature(callingPackage, userId);
+            checkProfilePermissions(request);
 
             mFindDeviceCallback = callback;
             mRequest = request;
@@ -519,6 +521,21 @@ public class CompanionDeviceManagerService extends SystemService implements Bind
             }
         }
 
+        private void checkProfilePermissions(AssociationRequest request) {
+            checkProfilePermission(request,
+                    AssociationRequest.DEVICE_PROFILE_WATCH,
+                    Manifest.permission.REQUEST_COMPANION_PROFILE_WATCH);
+        }
+
+        private void checkProfilePermission(
+                AssociationRequest request, String profile, String permission) {
+            if (profile.equals(request.getDeviceProfile())
+                    && getContext().checkCallingOrSelfPermission(permission)
+                            != PackageManager.PERMISSION_GRANTED) {
+                throw new SecurityException("Using " + profile + " requires " + permission);
+            }
+        }
+
         @Override
         public PendingIntent requestNotificationAccess(ComponentName component)
                 throws RemoteException {