diff --git a/pkg/services/folder/folderimpl/folder.go b/pkg/services/folder/folderimpl/folder.go index fa30e3bcd99..23e6ca82875 100644 --- a/pkg/services/folder/folderimpl/folder.go +++ b/pkg/services/folder/folderimpl/folder.go @@ -978,6 +978,12 @@ func (s *Service) canMove(ctx context.Context, cmd *folder.MoveFolderCommand) (b var evaluators []accesscontrol.Evaluator currentFolderScope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(cmd.UID) for action, scopes := range permissions { + // Skip unexpanded action sets - they have no impact if action sets are not enabled + if !s.features.IsEnabled(ctx, featuremgmt.FlagAccessActionSets) { + if action == "folders:view" || action == "folders:edit" || action == "folders:admin" { + continue + } + } for _, scope := range newFolderAndParentUIDs { if slices.Contains(scopes, scope) { evaluators = append(evaluators, accesscontrol.EvalPermission(action, currentFolderScope))