diff --git a/pkg/apimachinery/identity/context.go b/pkg/apimachinery/identity/context.go
index 08a3ed192b8..58ab1085d36 100644
--- a/pkg/apimachinery/identity/context.go
+++ b/pkg/apimachinery/identity/context.go
@@ -124,6 +124,7 @@ var serviceIdentityTokenPermissions = getTokenPermissions(
 	"folder.grafana.app",
 	"dashboard.grafana.app",
 	"secret.grafana.app",
+	"query.grafana.app",
 )
 
 var ServiceIdentityClaims = &authn.Claims[authn.AccessTokenClaims]{
diff --git a/pkg/services/authz/rbac/mapper.go b/pkg/services/authz/rbac/mapper.go
index c930bb92fcb..023bfb6fc7a 100644
--- a/pkg/services/authz/rbac/mapper.go
+++ b/pkg/services/authz/rbac/mapper.go
@@ -67,6 +67,16 @@ func newMapper() mapper {
 			"securevalues": newResourceTranslation("secret.securevalues", "uid", false),
 			"keepers":      newResourceTranslation("secret.keepers", "uid", false),
 		},
+		"query.grafana.app": {
+			"query": translation{
+				resource:  "datasources",
+				attribute: "uid",
+				verbMapping: map[string]string{
+					utils.VerbCreate: "datasources:query",
+				},
+				folderSupport: false,
+			},
+		},
 	}
 }
 
diff --git a/pkg/services/authz/rbac/service_test.go b/pkg/services/authz/rbac/service_test.go
index 62c06f0e910..6a10dfed3c2 100644
--- a/pkg/services/authz/rbac/service_test.go
+++ b/pkg/services/authz/rbac/service_test.go
@@ -261,6 +261,26 @@ func TestService_checkPermission(t *testing.T) {
 			},
 			expected: true,
 		},
+		{
+			name: "should return true for datasources if service has permission",
+			permissions: []accesscontrol.Permission{
+				{
+					Action:     "datasources:query",
+					Scope:      "datasources:uid:some_datasource",
+					Kind:       "datasources",
+					Attribute:  "uid",
+					Identifier: "some_datasource",
+				},
+			},
+			check: CheckRequest{
+				Action:   "datasources:query",
+				Group:    "query.grafana.app",
+				Resource: "query",
+				Name:     "some_datasource",
+				Verb:     utils.VerbCreate,
+			},
+			expected: true,
+		},
 	}
 
 	for _, tc := range testCases {