diff --git a/src/modules/module-protocol-pulse.c b/src/modules/module-protocol-pulse.c
index 556fe257d..927562862 100644
--- a/src/modules/module-protocol-pulse.c
+++ b/src/modules/module-protocol-pulse.c
@@ -338,6 +338,8 @@
  * * `block-source-volume` blocks the client from updating any source volumes. This can be used
  *                    to disable things like automatic gain control.
  * * `block-sink-volume` blocks the client from updating any sink volumes.
+ * * `block-record-stream` blocks the client from creating any record stream.
+ * * `block-playback-stream` blocks the client from creating any playback stream.
  *
  * ### update-props
  *
diff --git a/src/modules/module-protocol-pulse/pulse-server.c b/src/modules/module-protocol-pulse/pulse-server.c
index 4baea852d..9098f2a79 100644
--- a/src/modules/module-protocol-pulse/pulse-server.c
+++ b/src/modules/module-protocol-pulse/pulse-server.c
@@ -1726,6 +1726,9 @@ static int do_create_playback_stream(struct client *client, uint32_t command, ui
 	if (n_valid_formats == 0)
 		goto error_no_formats;
 
+	if (client->quirks & QUIRK_BLOCK_PLAYBACK_STREAM)
+		goto error_no_permission;
+
 	stream = stream_new(client, STREAM_TYPE_PLAYBACK, tag, &ss, &map, &attr);
 	if (stream == NULL)
 		goto error_errno;
@@ -1798,6 +1801,9 @@ error_protocol:
 error_no_formats:
 	res = -ENOTSUP;
 	goto error;
+error_no_permission:
+	res = -EPERM;
+	goto error;
 error_invalid:
 	res = -EINVAL;
 	goto error;
@@ -1992,6 +1998,9 @@ static int do_create_record_stream(struct client *client, uint32_t command, uint
 	if (n_valid_formats == 0)
 		goto error_no_formats;
 
+	if (client->quirks & QUIRK_BLOCK_RECORD_STREAM)
+		goto error_no_permission;
+
 	stream = stream_new(client, STREAM_TYPE_RECORD, tag, &ss, &map, &attr);
 	if (stream == NULL)
 		goto error_errno;
@@ -2078,6 +2087,9 @@ error_protocol:
 error_no_formats:
 	res = -ENOTSUP;
 	goto error;
+error_no_permission:
+	res = -EPERM;
+	goto error;
 error_invalid:
 	res = -EINVAL;
 	goto error;
diff --git a/src/modules/module-protocol-pulse/quirks.c b/src/modules/module-protocol-pulse/quirks.c
index e2e972e93..34cd4484f 100644
--- a/src/modules/module-protocol-pulse/quirks.c
+++ b/src/modules/module-protocol-pulse/quirks.c
@@ -19,6 +19,8 @@ static uint64_t parse_quirks(const char *str)
 		{ "remove-capture-dont-move", QUIRK_REMOVE_CAPTURE_DONT_MOVE },
 		{ "block-source-volume", QUIRK_BLOCK_SOURCE_VOLUME },
 		{ "block-sink-volume", QUIRK_BLOCK_SINK_VOLUME },
+		{ "block-record-stream", QUIRK_BLOCK_RECORD_STREAM },
+		{ "block-playback-stream", QUIRK_BLOCK_PLAYBACK_STREAM },
 	};
 	SPA_FOR_EACH_ELEMENT_VAR(quirk_keys, i) {
 		if (spa_streq(str, i->key))
diff --git a/src/modules/module-protocol-pulse/quirks.h b/src/modules/module-protocol-pulse/quirks.h
index e817d0b8f..56ca9fa07 100644
--- a/src/modules/module-protocol-pulse/quirks.h
+++ b/src/modules/module-protocol-pulse/quirks.h
@@ -12,6 +12,8 @@
 #define QUIRK_REMOVE_CAPTURE_DONT_MOVE		(1ull<<1)	/** removes the capture stream DONT_MOVE flag */
 #define QUIRK_BLOCK_SOURCE_VOLUME		(1ull<<2)	/** block volume changes to sources */
 #define QUIRK_BLOCK_SINK_VOLUME			(1ull<<3)	/** block volume changes to sinks */
+#define QUIRK_BLOCK_RECORD_STREAM		(1ull<<4)	/** block creating a record stream */
+#define QUIRK_BLOCK_PLAYBACK_STREAM		(1ull<<5)	/** block creating a playback stream */
 
 int client_update_quirks(struct client *client);