diff --git a/orders_app/api/permissions.py b/orders_app/api/permissions.py
index 9242c16..29a6db6 100644
--- a/orders_app/api/permissions.py
+++ b/orders_app/api/permissions.py
@@ -13,16 +13,6 @@ def has_permission(self, request, view):
         ).exists()
 
 
-class IsBusinessUser(BasePermission):
-    """Allow access only to authenticated business users."""
-
-    def has_permission(self, request, view):
-        return UserProfile.objects.filter(
-            user=request.user,
-            type=UserProfile.ProfileType.BUSINESS,
-        ).exists()
-
-
 class IsOrderBusinessOwner(BasePermission):
     """Allow order changes only for the assigned business user."""
 
diff --git a/orders_app/api/test_order_endpoints.py b/orders_app/api/test_order_endpoints.py
index 60bc484..1dc8206 100644
--- a/orders_app/api/test_order_endpoints.py
+++ b/orders_app/api/test_order_endpoints.py
@@ -342,6 +342,19 @@ def test_order_status_update_unknown_returns_404():
     assert response.status_code == 404
 
 
+@pytest.mark.django_db
+def test_order_status_update_unknown_returns_404_for_non_business_user():
+    customer_user = create_user('customer_user')
+
+    response = authenticated_client(customer_user).patch(
+        reverse('order-detail', kwargs={'pk': 999999}),
+        data={'status': 'completed'},
+        format='json',
+    )
+
+    assert response.status_code == 404
+
+
 @pytest.mark.django_db
 def test_staff_user_can_delete_order():
     customer_user = create_user('customer_user')
diff --git a/orders_app/api/views.py b/orders_app/api/views.py
index ce06cec..c9a9b00 100644
--- a/orders_app/api/views.py
+++ b/orders_app/api/views.py
@@ -7,7 +7,7 @@
 from orders_app.models import Order
 from profiles_app.models import UserProfile
 
-from .permissions import IsBusinessUser, IsCustomerUser, IsOrderBusinessOwner
+from .permissions import IsCustomerUser, IsOrderBusinessOwner
 from .serializers import OrderSerializer
 
 
@@ -31,7 +31,7 @@ def get_permissions(self):
         if self.action == 'create':
             return [IsAuthenticated(), IsCustomerUser()]
         if self.action in ['update', 'partial_update']:
-            return [IsAuthenticated(), IsBusinessUser(), IsOrderBusinessOwner()]
+            return [IsAuthenticated(), IsOrderBusinessOwner()]
         if self.action == 'destroy':
             return [IsAuthenticated(), IsAdminUser()]
         return [IsAuthenticated()]