diff --git a/litellm/proxy/auth/route_checks.py b/litellm/proxy/auth/route_checks.py
index 1814b575166..0a1950f7df3 100644
--- a/litellm/proxy/auth/route_checks.py
+++ b/litellm/proxy/auth/route_checks.py
@@ -301,7 +301,12 @@ class RouteChecks:
     def _has_truthy_permission(permissions: object | None, name: str) -> bool:
         """True when `name` is opted in with a truthy value (dict) or listed (sequence)."""
         if isinstance(permissions, dict):
-            return bool(permissions.get(name))
+            typed: Final = (
+                cast(  # cast-ok: isinstance(dict) narrows to dict[Unknown, Unknown]; keys are permission names
+                    dict[str, object], permissions
+                )
+            )
+            return bool(typed.get(name))
         if isinstance(permissions, (list, tuple, set)):
             return name in permissions
         return False
diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py
index 2c9dffc4556..a402adafcd3 100644
--- a/litellm/proxy/management_endpoints/key_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/key_management_endpoints.py
@@ -3529,7 +3529,12 @@ def _refuse_get_spend_routes_unless_premium(
     """
     if not isinstance(permissions, dict):
         return
-    if permissions.get("get_spend_routes") and premium_user is not True:
+    typed_permissions: Final = (
+        cast(  # cast-ok: isinstance(dict) narrows to dict[Unknown, Unknown]; permission map is str-keyed
+            dict[str, object], permissions
+        )
+    )
+    if typed_permissions.get("get_spend_routes") and premium_user is not True:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail={
@@ -5283,7 +5288,9 @@ async def generate_key_helper_fn(
         if isinstance(saved_token["metadata"], str):
             saved_token["metadata"] = json.loads(saved_token["metadata"])
         if isinstance(saved_token["permissions"], str):
-            parsed_permissions: Final = json.loads(saved_token["permissions"])
+            parsed_permissions: Final = cast(  # cast-ok: permissions column stores a JSON object of permission flags
+                dict[str, object], json.loads(saved_token["permissions"])
+            )
             # Refuse only when the permission is requested (truthy). An explicit
             # false must not trip a substring check on the serialized JSON.
             _refuse_get_spend_routes_unless_premium(parsed_permissions, premium_user)