diff --git a/contracts/terminus/TerminusFacet.sol b/contracts/terminus/TerminusFacet.sol
index ded77d8..dc819e8 100644
--- a/contracts/terminus/TerminusFacet.sol
+++ b/contracts/terminus/TerminusFacet.sol
@@ -185,11 +185,13 @@ contract TerminusFacet is ERC1155WithTerminusStorage {
     }
 
     function setPoolTransferable(uint256 poolID, bool transferable) external {
+        LibTerminus.enforcePoolIsController(poolID, msg.sender);
         LibTerminus.TerminusStorage storage ts = LibTerminus.terminusStorage();
         ts.poolNotTransferable[poolID] = !transferable;
     }
 
     function setPoolBurnable(uint256 poolID, bool burnable) external {
+        LibTerminus.enforcePoolIsController(poolID, msg.sender);
         LibTerminus.TerminusStorage storage ts = LibTerminus.terminusStorage();
         ts.poolBurnable[poolID] = burnable;
     }
diff --git a/dao/test_terminus.py b/dao/test_terminus.py
index ffa9fcc..62e3e67 100644
--- a/dao/test_terminus.py
+++ b/dao/test_terminus.py
@@ -700,6 +700,10 @@ class TestCreatePoolV1(TestPoolOperations):
     def test_pool_state_setters(self):
         self.diamond_terminus.create_pool_v1(10, False, False, {"from": accounts[1]})
         pool_id = self.diamond_terminus.total_pools()
+        self.assertEqual(
+            self.diamond_terminus.terminus_pool_controller(pool_id), accounts[1].address
+        )
+
         self.assertFalse(self.diamond_terminus.pool_is_transferable(pool_id))
         self.assertFalse(self.diamond_terminus.pool_is_burnable(pool_id))
 
@@ -723,6 +727,29 @@ class TestCreatePoolV1(TestPoolOperations):
         self.assertFalse(self.diamond_terminus.pool_is_transferable(pool_id))
         self.assertFalse(self.diamond_terminus.pool_is_burnable(pool_id))
 
+    def test_pool_state_setters_do_not_allow_noncontroller_to_set_parameters(self):
+        self.diamond_terminus.create_pool_v1(10, False, False, {"from": accounts[1]})
+        pool_id = self.diamond_terminus.total_pools()
+        self.assertEqual(
+            self.diamond_terminus.terminus_pool_controller(pool_id), accounts[1].address
+        )
+
+        self.assertFalse(self.diamond_terminus.pool_is_transferable(pool_id))
+        self.assertFalse(self.diamond_terminus.pool_is_burnable(pool_id))
+
+        with self.assertRaises(VirtualMachineError):
+            self.diamond_terminus.set_pool_transferable(
+                pool_id, True, {"from": accounts[2]}
+            )
+
+        with self.assertRaises(VirtualMachineError):
+            self.diamond_terminus.set_pool_burnable(
+                pool_id, True, {"from": accounts[2]}
+            )
+
+        self.assertFalse(self.diamond_terminus.pool_is_transferable(pool_id))
+        self.assertFalse(self.diamond_terminus.pool_is_burnable(pool_id))
+
     def test_burnable_pool_burn_as_token_owner(self):
         self.diamond_terminus.create_pool_v1(10, True, True, {"from": accounts[1]})
         pool_id = self.diamond_terminus.total_pools()