diff --git a/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ApproveRejectPurchaseOrderPlugin.php b/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ApproveRejectPurchaseOrderPlugin.php
index 74236b6814a1..279efc076f11 100644
--- a/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ApproveRejectPurchaseOrderPlugin.php
+++ b/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ApproveRejectPurchaseOrderPlugin.php
@@ -12,2 +12,3 @@
 use Magento\Company\Model\CompanyContext;
+use Magento\Company\Api\CompanyManagementInterface;
 use Magento\Company\Model\UserRole;
@@ -20,9 +21,11 @@
 use Magento\PurchaseOrderRule\Api\AppliedRuleRepositoryInterface;
 use Magento\PurchaseOrderRule\Api\Data\AppliedRuleApproverInterface;
 use Magento\PurchaseOrderRule\Api\Data\AppliedRuleInterface;
+use Magento\Framework\App\ObjectManager;
 
 /**
  * Plugin to restrict action to remaining rule approvers and company admin
+ *
  */
 class ApproveRejectPurchaseOrderPlugin
 {
@@ -61,6 +64,11 @@ class ApproveRejectPurchaseOrderPlugin
      */
     private $appliedRuleApproverRepository;
 
+    /**
+     * @var CompanyManagementInterface
+     */
+    private $companyManagement;
+
     /**
      * @param CompanyAdminPermission $companyAdminPermission
      * @param CompanyContext $companyContext
@@ -69,6 +77,7 @@ class ApproveRejectPurchaseOrderPlugin
      * @param AppliedRuleApproverRepositoryInterface $appliedRuleApproverRepository
      * @param UserRoleManagement $userRoleManagement
      * @param SearchCriteriaBuilder $searchCriteriaBuilder
+     * @param CompanyManagementInterface|null $companyManagement
      */
     public function __construct(
         CompanyAdminPermission $companyAdminPermission,
@@ -77,7 +86,8 @@ public function __construct(
         AppliedRuleRepositoryInterface $appliedRuleRepository,
         AppliedRuleApproverRepositoryInterface $appliedRuleApproverRepository,
         UserRoleManagement $userRoleManagement,
-        SearchCriteriaBuilder $searchCriteriaBuilder
+        SearchCriteriaBuilder $searchCriteriaBuilder,
+        ?CompanyManagementInterface $companyManagement = null
     ) {
         $this->companyAdminPermission = $companyAdminPermission;
         $this->companyContext = $companyContext;
@@ -86,6 +96,8 @@ public function __construct(
         $this->appliedRuleApproverRepository = $appliedRuleApproverRepository;
         $this->userRoleManagement = $userRoleManagement;
         $this->searchCriteriaBuilder = $searchCriteriaBuilder;
+        $this->companyManagement = $companyManagement ?:
+            ObjectManager::getInstance()->get(CompanyManagementInterface::class);
     }
 
     /**
@@ -102,6 +114,8 @@ public function __construct(
     {
         if ($this->companyAdminPermission->isGivenUserCompanyAdmin($this->companyContext->getCustomerId()) &&
             $this->companyStructure->getAllowedChildrenIds((int)$this->companyContext->getCustomerId())
+            && (int) $purchaseOrder->getCompanyId() ===
+            (int) $this->companyManagement->getByCustomerId($this->companyContext->getCustomerId())->getId()
         ) {
             return true;
         }
diff --git a/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ViewPurchaseOrderPlugin.php b/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ViewPurchaseOrderPlugin.php
index 36e3f220989f..679022c76a56 100644
--- a/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ViewPurchaseOrderPlugin.php
+++ b/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ViewPurchaseOrderPlugin.php
@@ -12,2 +12,3 @@
 use Magento\Company\Model\CompanyContext;
+use Magento\Company\Api\CompanyManagementInterface;
 use Magento\Company\Model\UserRole;
@@ -20,9 +21,11 @@
 use Magento\PurchaseOrderRule\Api\AppliedRuleRepositoryInterface;
 use Magento\PurchaseOrderRule\Api\Data\AppliedRuleApproverInterface;
 use Magento\PurchaseOrderRule\Api\Data\AppliedRuleInterface;
+use Magento\Framework\App\ObjectManager;
 
 /**
  * Plugin to restrict view to remaining rule approvers and company admin
+ *
  */
 class ViewPurchaseOrderPlugin
 {
@@ -61,6 +64,11 @@ class ViewPurchaseOrderPlugin
      */
     private $appliedRuleApproverRepository;
 
+    /**
+     * @var CompanyManagementInterface
+     */
+    private $companyManagement;
+
     /**
      * @param CompanyAdminPermission $companyAdminPermission
      * @param CompanyContext $companyContext
@@ -69,6 +77,7 @@ class ViewPurchaseOrderPlugin
      * @param AppliedRuleApproverRepositoryInterface $appliedRuleApproverRepository
      * @param UserRoleManagement $userRoleManagement
      * @param SearchCriteriaBuilder $searchCriteriaBuilder
+     * @param CompanyManagementInterface|null $companyManagement
      */
     public function __construct(
         CompanyAdminPermission $companyAdminPermission,
@@ -77,7 +86,8 @@ public function __construct(
         AppliedRuleRepositoryInterface $appliedRuleRepository,
         AppliedRuleApproverRepositoryInterface $appliedRuleApproverRepository,
         UserRoleManagement $userRoleManagement,
-        SearchCriteriaBuilder $searchCriteriaBuilder
+        SearchCriteriaBuilder $searchCriteriaBuilder,
+        ?CompanyManagementInterface $companyManagement = null
     ) {
         $this->companyAdminPermission = $companyAdminPermission;
         $this->companyContext = $companyContext;
@@ -86,6 +96,8 @@ public function __construct(
         $this->appliedRuleApproverRepository = $appliedRuleApproverRepository;
         $this->userRoleManagement = $userRoleManagement;
         $this->searchCriteriaBuilder = $searchCriteriaBuilder;
+        $this->companyManagement = $companyManagement ?:
+            ObjectManager::getInstance()->get(CompanyManagementInterface::class);
     }
 
     /**
@@ -105,6 +117,8 @@ public function afterIsAllowed(ViewPurchaseOrder $subject, $result, $purchaseOrd
         }
         if ($this->companyAdminPermission->isGivenUserCompanyAdmin($this->companyContext->getCustomerId()) &&
             $this->companyStructure->getAllowedChildrenIds((int)$this->companyContext->getCustomerId())
+            && (int) $purchaseOrder->getCompanyId() ===
+            (int) $this->companyManagement->getByCustomerId($this->companyContext->getCustomerId())->getId()
         ) {
             return true;
         }