diff --git a/pkg/services/accesscontrol/resourcepermissions/store.go b/pkg/services/accesscontrol/resourcepermissions/store.go
index 21c706d92d2..5722cbc2a00 100644
--- a/pkg/services/accesscontrol/resourcepermissions/store.go
+++ b/pkg/services/accesscontrol/resourcepermissions/store.go
@@ -393,14 +393,14 @@ func (s *store) getResourcePermissions(sess *db.Session, orgID int64, query GetR
 			return nil, err
 		}
 
-		filter := "(" + userFilter.Where + " AND NOT u.is_service_account)"
+		filter := "((" + userFilter.Where + " AND NOT u.is_service_account)"
 
 		saFilter, err := accesscontrol.Filter(query.User, "u.id", "serviceaccounts:id:", serviceaccounts.ActionRead)
 		if err != nil {
 			return nil, err
 		}
 
-		filter += " OR (" + saFilter.Where + " AND u.is_service_account)"
+		filter += " OR (" + saFilter.Where + " AND u.is_service_account))"
 
 		userQuery += " AND " + filter
 		args = append(args, userFilter.Args...)