diff --git a/system/internal/service/access_control.go b/system/internal/service/access_control.go
index ca47a2b53..0fdd12e23 100644
--- a/system/internal/service/access_control.go
+++ b/system/internal/service/access_control.go
@@ -81,10 +81,6 @@ func (svc accessControl) CanCreateAutomationScript(ctx context.Context) bool {
 	return svc.can(ctx, types.SystemPermissionResource, "automation-script.create")
 }
 
-func (svc accessControl) CanManageMailGatewayAutomation(ctx context.Context) bool {
-	return svc.can(ctx, types.SystemPermissionResource, "mail-gw-automation.manage")
-}
-
 func (svc accessControl) CanReadRole(ctx context.Context, rl *types.Role) bool {
 	return svc.can(ctx, rl, "read", permissions.Allowed)
 }
@@ -196,7 +192,6 @@ func (svc accessControl) DefaultRules() permissions.RuleSet {
 		allowAdm(sys, "user.create"),
 		allowAdm(sys, "role.create"),
 		allowAdm(sys, "automation-script.create"),
-		allowAdm(sys, "mail-gw-automation.manage"),
 
 		allowAdm(organisations, "access"),
 		allowAdm(applications, "read"),
@@ -234,7 +229,6 @@ func (svc accessControl) Whitelist() permissions.Whitelist {
 		"user.create",
 		"application.create",
 		"automation-script.create",
-		"mail-gw-automation.manage",
 	)
 
 	wl.Set(
diff --git a/system/internal/service/automation_script.go b/system/internal/service/automation_script.go
index af3976b65..3e96de5d7 100644
--- a/system/internal/service/automation_script.go
+++ b/system/internal/service/automation_script.go
@@ -29,8 +29,6 @@ type (
 	automationScriptAccessController interface {
 		CanGrant(context.Context) bool
 
-		CanManageMailGatewayAutomation(context.Context) bool
-
 		CanCreateAutomationScript(context.Context) bool
 		CanReadAnyAutomationScript(context.Context) bool
 		CanReadAutomationScript(context.Context, *automation.Script) bool
diff --git a/system/internal/service/automation_trigger.go b/system/internal/service/automation_trigger.go
index eecb6ea1e..5c94fb601 100644
--- a/system/internal/service/automation_trigger.go
+++ b/system/internal/service/automation_trigger.go
@@ -26,8 +26,8 @@ type (
 	}
 
 	automationTriggerAccessController interface {
+		CanCreateAutomationScript(context.Context) bool
 		CanUpdateAutomationScript(context.Context, *automation.Script) bool
-		CanManageMailGatewayAutomation(context.Context) bool
 	}
 )
 
@@ -95,8 +95,8 @@ func (svc automationTrigger) isValid(ctx context.Context, s *automation.Script,
 	}
 
 	if t.Resource == "system:mail" {
-		if !svc.ac.CanManageMailGatewayAutomation(ctx) {
-			return ErrNoMailGatewayManagementPermissions
+		if !svc.ac.CanCreateAutomationScript(ctx) {
+			return ErrNoScriptCreatePermissions
 		}
 
 		if t.IsDeferred() {
diff --git a/system/internal/service/error.go b/system/internal/service/error.go
index 4ca5d0f3a..0564c63a1 100644
--- a/system/internal/service/error.go
+++ b/system/internal/service/error.go
@@ -9,13 +9,13 @@ type (
 )
 
 const (
-	ErrInvalidID                          serviceError = "InvalidID"
-	ErrNoPermissions                      serviceError = "NoPermissions"
-	ErrNoGrantPermissions                 serviceError = "NoGrantPermissions"
-	ErrNoCreatePermissions                serviceError = "NoCreatePermissions"
-	ErrNoReadPermissions                  serviceError = "NoReadPermissions"
-	ErrNoTriggerManagementPermissions     serviceError = "NoTriggerManagementPermissions"
-	ErrNoMailGatewayManagementPermissions serviceError = "NoMailGatewayManagementPermissions"
+	ErrInvalidID                      serviceError = "InvalidID"
+	ErrNoPermissions                  serviceError = "NoPermissions"
+	ErrNoGrantPermissions             serviceError = "NoGrantPermissions"
+	ErrNoCreatePermissions            serviceError = "NoCreatePermissions"
+	ErrNoReadPermissions              serviceError = "NoReadPermissions"
+	ErrNoTriggerManagementPermissions serviceError = "NoTriggerManagementPermissions"
+	ErrNoScriptCreatePermissions      serviceError = "NoScriptCreatePermissions"
 )
 
 func (e serviceError) Error() string {