diff --git a/automation/rest/workflow.go b/automation/rest/workflow.go
index 8ea29fdac..b07b20d21 100644
--- a/automation/rest/workflow.go
+++ b/automation/rest/workflow.go
@@ -31,11 +31,36 @@ type (
 		svcModule interface {
 			FindByID(ctx context.Context, namespaceID, moduleID uint64) (*cmpTypes.Module, error)
 		}
+
+		ac workflowAccessControl
+	}
+
+	workflowAccessControl interface {
+		CanGrant(context.Context) bool
+
+		CanUpdateWorkflow(context.Context, *types.Workflow) bool
+		CanDeleteWorkflow(context.Context, *types.Workflow) bool
+		CanUndeleteWorkflow(context.Context, *types.Workflow) bool
+		CanExecuteWorkflow(context.Context, *types.Workflow) bool
+		CanManageWorkflowTriggers(context.Context, *types.Workflow) bool
+		CanManageWorkflowSessions(context.Context, *types.Workflow) bool
+	}
+
+	workflowPayload struct {
+		*types.Workflow
+
+		CanGrant                  bool `json:"canGrant"`
+		CanUpdateWorkflow         bool `json:"canUpdateWorkflow"`
+		CanDeleteWorkflow         bool `json:"canDeleteWorkflow"`
+		CanUndeleteWorkflow       bool `json:"canUndeleteWorkflow"`
+		CanExecuteWorkflow        bool `json:"canExecuteWorkflow"`
+		CanManageWorkflowTriggers bool `json:"canManageWorkflowTriggers"`
+		CanManageWorkflowSessions bool `json:"canManageWorkflowSessions"`
 	}
 
 	workflowSetPayload struct {
 		Filter types.WorkflowFilter `json:"filter"`
-		Set    types.WorkflowSet    `json:"set"`
+		Set    []*workflowPayload   `json:"set"`
 	}
 
 	workflowExecPayload struct {
@@ -49,6 +74,7 @@ func (Workflow) New() *Workflow {
 	ctrl := &Workflow{}
 	ctrl.svc = service.DefaultWorkflow
 	ctrl.svcModule = cmpService.DefaultModule
+	ctrl.ac = service.DefaultAccessControl
 	return ctrl
 }
 
@@ -91,7 +117,8 @@ func (ctrl Workflow) Create(ctx context.Context, r *request.WorkflowCreate) (int
 		OwnedBy:      r.OwnedBy,
 	}
 
-	return ctrl.svc.Create(ctx, workflow)
+	wf, err := ctrl.svc.Create(ctx, workflow)
+	return ctrl.makePayload(ctx, wf, err)
 }
 
 func (ctrl Workflow) Update(ctx context.Context, r *request.WorkflowUpdate) (interface{}, error) {
@@ -110,11 +137,13 @@ func (ctrl Workflow) Update(ctx context.Context, r *request.WorkflowUpdate) (int
 		OwnedBy:      r.OwnedBy,
 	}
 
-	return ctrl.svc.Update(ctx, workflow)
+	wf, err := ctrl.svc.Update(ctx, workflow)
+	return ctrl.makePayload(ctx, wf, err)
 }
 
 func (ctrl Workflow) Read(ctx context.Context, r *request.WorkflowRead) (interface{}, error) {
-	return ctrl.svc.LookupByID(ctx, r.WorkflowID)
+	wf, err := ctrl.svc.LookupByID(ctx, r.WorkflowID)
+	return ctrl.makePayload(ctx, wf, err)
 }
 
 func (ctrl Workflow) Test(ctx context.Context, r *request.WorkflowTest) (interface{}, error) {
@@ -182,14 +211,34 @@ func (ctrl Workflow) Exec(ctx context.Context, r *request.WorkflowExec) (interfa
 	return wep, err
 }
 
-func (ctrl Workflow) makeFilterPayload(ctx context.Context, uu types.WorkflowSet, f types.WorkflowFilter, err error) (*workflowSetPayload, error) {
+func (ctrl Workflow) makeFilterPayload(ctx context.Context, set types.WorkflowSet, f types.WorkflowFilter, err error) (*workflowSetPayload, error) {
 	if err != nil {
 		return nil, err
 	}
 
-	if len(uu) == 0 {
-		uu = make([]*types.Workflow, 0)
+	wfsp := &workflowSetPayload{Filter: f, Set: make([]*workflowPayload, len(set))}
+
+	for i, wf := range set {
+		wfsp.Set[i], _ = ctrl.makePayload(ctx, wf, nil)
 	}
 
-	return &workflowSetPayload{Filter: f, Set: uu}, nil
+	return wfsp, nil
+}
+
+func (ctrl Workflow) makePayload(ctx context.Context, wf *types.Workflow, err error) (*workflowPayload, error) {
+	if err != nil {
+		return nil, err
+	}
+
+	return &workflowPayload{
+		Workflow: wf,
+
+		CanGrant:                  ctrl.ac.CanGrant(ctx),
+		CanUpdateWorkflow:         ctrl.ac.CanUpdateWorkflow(ctx, wf),
+		CanDeleteWorkflow:         ctrl.ac.CanDeleteWorkflow(ctx, wf),
+		CanUndeleteWorkflow:       ctrl.ac.CanUndeleteWorkflow(ctx, wf),
+		CanExecuteWorkflow:        ctrl.ac.CanExecuteWorkflow(ctx, wf),
+		CanManageWorkflowTriggers: ctrl.ac.CanManageWorkflowTriggers(ctx, wf),
+		CanManageWorkflowSessions: ctrl.ac.CanManageWorkflowSessions(ctx, wf),
+	}, nil
 }