diff --git a/pkg/services/authz/rbac/store/permission_query.sql b/pkg/services/authz/rbac/store/permission_query.sql
index dfa82390541..fea4353c259 100644
--- a/pkg/services/authz/rbac/store/permission_query.sql
+++ b/pkg/services/authz/rbac/store/permission_query.sql
@@ -1,21 +1,21 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM {{ .Ident .PermissionTable }} as p
+INNER JOIN (
+  SELECT role_id FROM {{ .Ident .BuiltinRoleTable }} as br WHERE (br.role = {{ .Arg .Query.Role }} AND (br.org_id = {{ .Arg .Query.OrgID }} OR br.org_id = 0))
+    {{ if .Query.IsServerAdmin }}
+    OR (br.role = 'Grafana Admin')
+    {{ end }}
+    {{ if .Query.UserID }}
+  UNION ALL
+  SELECT role_id FROM {{ .Ident .UserRoleTable }} as ur WHERE ur.user_id = {{ .Arg .Query.UserID }} AND (ur.org_id = {{ .Arg .Query.OrgID }} OR ur.org_id = 0)
+    {{ end }}
+    {{ if .Query.TeamIDs }}
+  UNION ALL
+  SELECT role_id FROM {{ .Ident .TeamRoleTable }} as tr WHERE tr.team_id IN ({{ .ArgList .Query.TeamIDs }}) AND tr.org_id = {{ .Arg .Query.OrgID }}
+  {{ end }}
+) as roles ON p.role_id = roles.role_id
 WHERE
   {{ if .Query.ActionSets }}
   p.action IN ({{ .ArgList .Query.ActionSets }}, {{ .Arg .Query.Action }})
   {{ else }}
   p.action = {{ .Arg .Query.Action }}
-  {{ end }}
-AND p.role_id IN (
-  SELECT role_id FROM {{ .Ident .BuiltinRoleTable }} as br WHERE (br.role = {{ .Arg .Query.Role }} AND (br.org_id = {{ .Arg .Query.OrgID }} OR br.org_id = 0))
-    {{ if .Query.IsServerAdmin }}
-   OR (br.role = 'Grafana Admin')
-    {{ end }}
-    {{ if .Query.UserID }}
-    UNION
-  SELECT role_id FROM {{ .Ident .UserRoleTable }} as ur WHERE ur.user_id = {{ .Arg .Query.UserID }} AND (ur.org_id = {{ .Arg .Query.OrgID }} OR ur.org_id = 0)
-    {{ end }}
-    {{ if .Query.TeamIDs }}
-    UNION
-    SELECT role_id FROM {{ .Ident .TeamRoleTable }} as tr WHERE tr.team_id IN ({{ .ArgList .Query.TeamIDs }}) AND tr.org_id = {{ .Arg .Query.OrgID }}
-  {{ end }}
-)
+  {{ end }}
\ No newline at end of file
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-With_action_sets.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-With_action_sets.sql
index 0393be57d3f..443e4b6f518 100755
--- a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-With_action_sets.sql
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-With_action_sets.sql
@@ -1,8 +1,8 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+INNER JOIN (
+  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+  UNION ALL
+  SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action IN ('folders:edit', 'folders:admin', 'folders:create')
-AND p.role_id IN (
-  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
-    UNION
-  SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-)
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-admin_user.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-admin_user.sql
index ba9f7064c91..39cdf20bd5d 100755
--- a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-admin_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-admin_user.sql
@@ -1,9 +1,9 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+INNER JOIN (
+  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
+    OR (br.role = 'Grafana Admin')
+  UNION ALL
+  SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
-   OR (br.role = 'Grafana Admin')
-    UNION
-  SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-)
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-anonymous_user.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-anonymous_user.sql
index 99959aeef2d..040afd50301 100755
--- a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-anonymous_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-anonymous_user.sql
@@ -1,6 +1,6 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+INNER JOIN (
+  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
-)
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-user_with_teams.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-user_with_teams.sql
index d47a6b8226d..efd22a9b118 100755
--- a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-user_with_teams.sql
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-user_with_teams.sql
@@ -1,10 +1,10 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+INNER JOIN (
+  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
+  UNION ALL
+  SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+  UNION ALL
+  SELECT role_id FROM `grafana`.`team_role` as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
-    UNION
-  SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-    UNION
-    SELECT role_id FROM `grafana`.`team_role` as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
-)
diff --git a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-viewer_user.sql b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-viewer_user.sql
index 15f8dde3169..17746dd3319 100755
--- a/pkg/services/authz/rbac/store/testdata/mysql--permission_query-viewer_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/mysql--permission_query-viewer_user.sql
@@ -1,8 +1,8 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
+INNER JOIN (
+  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+  UNION ALL
+  SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
-    UNION
-  SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-)
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-With_action_sets.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-With_action_sets.sql
index 8c35badfb31..5759d3b0017 100755
--- a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-With_action_sets.sql
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-With_action_sets.sql
@@ -1,8 +1,8 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+  UNION ALL
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action IN ('folders:edit', 'folders:admin', 'folders:create')
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
-    UNION
-  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-)
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-admin_user.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-admin_user.sql
index c78b0cbd2aa..45e8dc2b6fd 100755
--- a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-admin_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-admin_user.sql
@@ -1,9 +1,9 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
+    OR (br.role = 'Grafana Admin')
+  UNION ALL
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
-   OR (br.role = 'Grafana Admin')
-    UNION
-  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-)
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-anonymous_user.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-anonymous_user.sql
index 20544064211..8af7430873d 100755
--- a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-anonymous_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-anonymous_user.sql
@@ -1,6 +1,6 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
-)
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-user_with_teams.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-user_with_teams.sql
index ae269975c83..e07071250ea 100755
--- a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-user_with_teams.sql
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-user_with_teams.sql
@@ -1,10 +1,10 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
+  UNION ALL
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+  UNION ALL
+  SELECT role_id FROM "grafana"."team_role" as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
-    UNION
-  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-    UNION
-    SELECT role_id FROM "grafana"."team_role" as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
-)
diff --git a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-viewer_user.sql b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-viewer_user.sql
index 3a78a730602..a2a6695ef1d 100755
--- a/pkg/services/authz/rbac/store/testdata/postgres--permission_query-viewer_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/postgres--permission_query-viewer_user.sql
@@ -1,8 +1,8 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+  UNION ALL
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
-    UNION
-  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-)
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-With_action_sets.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-With_action_sets.sql
index 8c35badfb31..5759d3b0017 100755
--- a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-With_action_sets.sql
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-With_action_sets.sql
@@ -1,8 +1,8 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+  UNION ALL
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action IN ('folders:edit', 'folders:admin', 'folders:create')
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
-    UNION
-  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-)
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-admin_user.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-admin_user.sql
index c78b0cbd2aa..45e8dc2b6fd 100755
--- a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-admin_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-admin_user.sql
@@ -1,9 +1,9 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
+    OR (br.role = 'Grafana Admin')
+  UNION ALL
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
-   OR (br.role = 'Grafana Admin')
-    UNION
-  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-)
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-anonymous_user.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-anonymous_user.sql
index 20544064211..8af7430873d 100755
--- a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-anonymous_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-anonymous_user.sql
@@ -1,6 +1,6 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
-)
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-user_with_teams.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-user_with_teams.sql
index ae269975c83..e07071250ea 100755
--- a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-user_with_teams.sql
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-user_with_teams.sql
@@ -1,10 +1,10 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
+  UNION ALL
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+  UNION ALL
+  SELECT role_id FROM "grafana"."team_role" as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
-    UNION
-  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-    UNION
-    SELECT role_id FROM "grafana"."team_role" as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
-)
diff --git a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-viewer_user.sql b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-viewer_user.sql
index 3a78a730602..a2a6695ef1d 100755
--- a/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-viewer_user.sql
+++ b/pkg/services/authz/rbac/store/testdata/sqlite--permission_query-viewer_user.sql
@@ -1,8 +1,8 @@
 SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
+INNER JOIN (
+  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
+  UNION ALL
+  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
+) as roles ON p.role_id = roles.role_id
 WHERE
   p.action = 'folders:read'
-AND p.role_id IN (
-  SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
-    UNION
-  SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
-)