diff --git a/packages/api/src/router/review.ts b/packages/api/src/router/review.ts
index 217097a..fdf7053 100644
--- a/packages/api/src/router/review.ts
+++ b/packages/api/src/router/review.ts
@@ -1,4 +1,5 @@
 import type { TRPCRouterRecord } from "@trpc/server";
+import { TRPCError } from "@trpc/server";
 import Fuse from "fuse.js";
 import { z } from "zod";
 
@@ -72,7 +73,33 @@ export const reviewRouter = {
 
   create: protectedProcedure
     .input(CreateReviewSchema)
-    .mutation(({ ctx, input }) => {
+    .mutation(async ({ ctx, input }) => {
+      if (!input.profileId) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "You must be logged in to leave a review",
+        });
+      }
+      const reviews = await ctx.db.query.Review.findMany({
+        where: eq(Review.profileId, input.profileId),
+      });
+      if (reviews.length >= 5) {
+        throw new TRPCError({
+          code: "PRECONDITION_FAILED",
+          message: "You can only leave 5 reviews",
+        });
+      }
+      const reviewsInSameCycle = reviews.filter(
+        (review) =>
+          review.workTerm === input.workTerm &&
+          review.workYear === input.workYear,
+      );
+      if (reviewsInSameCycle.length >= 2) {
+        throw new TRPCError({
+          code: "PRECONDITION_FAILED",
+          message: "You can only leave 2 reviews per cycle",
+        });
+      }
       return ctx.db.insert(Review).values(input);
     }),