diff --git a/tests/system/role_test.go b/tests/system/role_test.go
index 9e8932798..ceaf399c3 100644
--- a/tests/system/role_test.go
+++ b/tests/system/role_test.go
@@ -504,6 +504,22 @@ func TestMemberAdd(t *testing.T) {
 		End()
 }
 
+func TestMemberAdd_denied(t *testing.T) {
+	h := newHelper(t)
+	helpers.AllowMe(h, types.UserRbacResource(0), "read")
+
+	r := h.repoMakeRole(h.randEmail())
+	u := h.createUserWithEmail(h.randEmail())
+
+	h.apiInit().
+		Post(fmt.Sprintf("/roles/%d/member/%d", r.ID, u.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("role.errors.notAllowedToManageMembers")).
+		End()
+}
+
 func TestMemberRemove(t *testing.T) {
 	h := newHelper(t)
 	helpers.AllowMe(h, types.UserRbacResource(0), "read")
@@ -520,3 +536,19 @@ func TestMemberRemove(t *testing.T) {
 		Assert(helpers.AssertNoErrors).
 		End()
 }
+
+func TestMemberRemove_denied(t *testing.T) {
+	h := newHelper(t)
+	helpers.AllowMe(h, types.UserRbacResource(0), "read")
+
+	r := h.repoMakeRole(h.randEmail())
+	u := h.createUserWithEmail(h.randEmail())
+
+	h.apiInit().
+		Post(fmt.Sprintf("/roles/%d/member/%d", r.ID, u.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("role.errors.notAllowedToManageMembers")).
+		End()
+}