diff --git a/public/app/features/datasources/state/navModel.ts b/public/app/features/datasources/state/navModel.ts
index 6c10870693d..1a32966e4ec 100644
--- a/public/app/features/datasources/state/navModel.ts
+++ b/public/app/features/datasources/state/navModel.ts
@@ -1,5 +1,7 @@
 import { DataSourceSettings, PluginType, PluginInclude, NavModel, NavModelItem } from '@grafana/data';
 import config from 'app/core/config';
+import { contextSrv } from 'app/core/core';
+import { AccessControlAction } from 'app/types';
 import { GenericDataSourcePlugin } from '../settings/PluginSettings';
 
 export function buildNavModel(dataSource: DataSourceSettings, plugin: GenericDataSourcePlugin): NavModelItem {
@@ -46,13 +48,15 @@ export function buildNavModel(dataSource: DataSourceSettings, plugin: GenericDat
   }
 
   if (config.licenseInfo.hasLicense) {
-    navModel.children!.push({
-      active: false,
-      icon: 'lock',
-      id: `datasource-permissions-${dataSource.id}`,
-      text: 'Permissions',
-      url: `datasources/edit/${dataSource.id}/permissions`,
-    });
+    if (contextSrv.hasPermission(AccessControlAction.DataSourcesPermissionsRead)) {
+      navModel.children!.push({
+        active: false,
+        icon: 'lock',
+        id: `datasource-permissions-${dataSource.id}`,
+        text: 'Permissions',
+        url: `datasources/edit/${dataSource.id}/permissions`,
+      });
+    }
 
     navModel.children!.push({
       active: false,
diff --git a/public/app/types/accessControl.ts b/public/app/types/accessControl.ts
index dbae482b747..b036281d6aa 100644
--- a/public/app/types/accessControl.ts
+++ b/public/app/types/accessControl.ts
@@ -39,6 +39,7 @@ export enum AccessControlAction {
   DataSourcesCreate = 'datasources:create',
   DataSourcesWrite = 'datasources:write',
   DataSourcesDelete = 'datasources:delete',
+  DataSourcesPermissionsRead = 'datasources.permissions:read',
 
   ActionServerStatsRead = 'server.stats:read',
 }