diff --git a/modules/dcache-qos/src/main/java/org/dcache/qos/services/engine/provider/PolicyBasedQoSProvider.java b/modules/dcache-qos/src/main/java/org/dcache/qos/services/engine/provider/PolicyBasedQoSProvider.java
index ca53ee80a6f..23ff30157f0 100644
--- a/modules/dcache-qos/src/main/java/org/dcache/qos/services/engine/provider/PolicyBasedQoSProvider.java
+++ b/modules/dcache-qos/src/main/java/org/dcache/qos/services/engine/provider/PolicyBasedQoSProvider.java
@@ -203,25 +203,14 @@ public void handleModifiedRequirements(FileQoSRequirements newRequirements, Subj
 
         FileAttributes modifiedAttributes = new FileAttributes();
 
-        if (currentAttributes.isDefined(FileAttribute.QOS_POLICY)
-            && !newRequirements.hasRequiredQoSPolicy()) {
-            modifiedAttributes.setQosPolicy(null);  // remove the policy from the stored state
-            modifyRequirements(pnfsId, currentAttributes, modifiedAttributes, newRequirements,
-                  subject);
-            return;
-        }
-
         if (newRequirements.hasRequiredQoSPolicy()) {
             modifiedAttributes.setQosPolicy(newRequirements.getRequiredQoSPolicy());
             modifiedAttributes.setQosState(newRequirements.getRequiredQoSStateIndex());
-        }
-
-        if (canModifyQos(subject, isEnableRoles(), currentAttributes)) {
-            pnfsHandler().setFileAttributes(pnfsId, modifiedAttributes);
         } else {
-            throw new PermissionDeniedCacheException("User does not have permissions to set "
-                  + "attributes for " + newRequirements.getPnfsId());
+            modifiedAttributes.setQosPolicy(null);  // remove the policy from the stored state
         }
+
+        modifyRequirements(pnfsId, currentAttributes, modifiedAttributes, newRequirements, subject);
     }
 
     @Required
diff --git a/modules/dcache/src/main/java/org/dcache/util/Transfer.java b/modules/dcache/src/main/java/org/dcache/util/Transfer.java
index 5e8f85de462..bc477bb47e3 100644
--- a/modules/dcache/src/main/java/org/dcache/util/Transfer.java
+++ b/modules/dcache/src/main/java/org/dcache/util/Transfer.java
@@ -28,6 +28,7 @@
 import com.google.common.util.concurrent.MoreExecutors;
 import com.google.common.util.concurrent.ThreadFactoryBuilder;
 import diskCacheV111.poolManager.RequestContainerV5.RequestState;
+import diskCacheV111.util.AccessLatency;
 import diskCacheV111.util.CacheException;
 import diskCacheV111.util.CheckStagePermission;
 import diskCacheV111.util.FileExistsCacheException;
@@ -750,7 +751,7 @@ public ListenableFuture<Void> readNameSpaceEntryAsync(boolean allowWrite) {
     }
 
     private ListenableFuture<Void> readNameSpaceEntryAsync(boolean allowWrite, long timeout) {
-        Set<FileAttribute> attr = EnumSet.of(PNFSID, TYPE, STORAGEINFO, SIZE, CREATION_TIME);
+        Set<FileAttribute> attr = EnumSet.of(PNFSID, TYPE, STORAGEINFO, SIZE, CREATION_TIME, QOS_STATE);
         attr.addAll(_additionalAttributes);
         attr.addAll(PoolMgrSelectReadPoolMsg.getRequiredAttributes());
         Set<AccessMask> mask;
@@ -925,13 +926,22 @@ protected synchronized void setReadPoolSelectionContext(
      */
     public ListenableFuture<Void> selectPoolAsync(long timeout) {
 
+        FileAttributes fileAttributes = getFileAttributes();
+
+        // if this is a read, and the file has QoS policy nearline,
+        // then read is forbidden independent of is there cached copy or not.
+        if (!isWrite() && fileAttributes.isDefined(QOS_STATE) &&
+                fileAttributes.getAccessLatency().equals(AccessLatency.NEARLINE)) {
+            return immediateFailedFuture(
+                    new PermissionDeniedCacheException(
+                            "Read is forbidden for file with QoS policy nearline"));
+        }
+
         if (getPool() != null) {
             // we have a valid preselected pool. Let use it as long as clearPoolSelection is not called.
             return immediateFuture(null);
         }
 
-        FileAttributes fileAttributes = getFileAttributes();
-
         ProtocolInfo protocolInfo = getProtocolInfoForPoolManager();
         ListenableFuture<? extends PoolMgrSelectPoolMsg> reply;
         if (isWrite()) {