diff --git a/pkg/services/accesscontrol/accesscontrol.go b/pkg/services/accesscontrol/accesscontrol.go
index f53ac3c8796..a1a918809db 100644
--- a/pkg/services/accesscontrol/accesscontrol.go
+++ b/pkg/services/accesscontrol/accesscontrol.go
@@ -21,7 +21,7 @@ type AccessControl interface {
 	// Evaluate evaluates access to the given resources.
 	Evaluate(ctx context.Context, user *models.SignedInUser, evaluator Evaluator) (bool, error)
 
-	// GetUserPermissions returns user permissions.
+	// GetUserPermissions returns user permissions with only action and scope fields set.
 	GetUserPermissions(ctx context.Context, user *models.SignedInUser, options Options) ([]*Permission, error)
 
 	// GetUserRoles returns user roles.
@@ -40,6 +40,7 @@ type AccessControl interface {
 }
 
 type PermissionsProvider interface {
+	// GetUserPermissions returns user permissions with only action and scope fields set.
 	GetUserPermissions(ctx context.Context, query GetUserPermissionsQuery) ([]*Permission, error)
 }
 
diff --git a/pkg/services/accesscontrol/database/database.go b/pkg/services/accesscontrol/database/database.go
index ec5ef5dbe1c..b69c7b8c858 100644
--- a/pkg/services/accesscontrol/database/database.go
+++ b/pkg/services/accesscontrol/database/database.go
@@ -26,13 +26,9 @@ func (s *AccessControlStore) GetUserPermissions(ctx context.Context, query acces
 		filter, params := userRolesFilter(query.OrgID, query.UserID, query.Roles)
 
 		// TODO: optimize this
-		q := `SELECT
-			permission.id,
-			permission.role_id,
+		q := `SELECT DISTINCT
 			permission.action,
-			permission.scope,
-			permission.updated,
-			permission.created
+			permission.scope
 			FROM permission
 			INNER JOIN role ON role.id = permission.role_id
 		` + filter