diff --git a/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowChart.svelte b/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowChart.svelte
index 9c987c89d..05cae46cf 100644
--- a/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowChart.svelte
+++ b/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowChart.svelte
@@ -12,6 +12,7 @@
     notifications,
     Modal,
   } from "@budibase/bbui"
+  import { ActionStepID } from "constants/backend/automations"
 
   export let automation
   let testDataModal
@@ -82,7 +83,7 @@
       in:fly|local={{ x: 500, duration: 500 }}
       out:fly|local={{ x: 500, duration: 500 }}
     >
-      {#if block.stepId !== "LOOP"}
+      {#if block.stepId !== ActionStepID.LOOP}
         <FlowItem {testDataModal} {block} />
       {/if}
     </div>
diff --git a/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowItem.svelte b/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowItem.svelte
index 291575f3f..412683721 100644
--- a/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowItem.svelte
+++ b/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowItem.svelte
@@ -10,11 +10,15 @@
     Select,
     ActionButton,
     notifications,
+    Label,
   } from "@budibase/bbui"
   import AutomationBlockSetup from "../../SetupPanel/AutomationBlockSetup.svelte"
   import CreateWebhookModal from "components/automation/Shared/CreateWebhookModal.svelte"
   import ActionModal from "./ActionModal.svelte"
   import FlowItemHeader from "./FlowItemHeader.svelte"
+  import RoleSelect from "components/design/settings/controls/RoleSelect.svelte"
+  import { ActionStepID, TriggerStepID } from "constants/backend/automations"
+  import { permissions } from "stores/backend"
 
   export let block
   export let testDataModal
@@ -23,9 +27,12 @@
   let actionModal
   let blockComplete
   let showLooping = false
+  let role
 
+  $: automationId = $automationStore.selectedAutomation?.automation._id
   $: showBindingPicker =
-    block.stepId === "CREATE_ROW" || block.stepId === "UPDATE_ROW"
+    block.stepId === ActionStepID.CREATE_ROW ||
+    block.stepId === ActionStepID.UPDATE_ROW
 
   $: isTrigger = block.type === "TRIGGER"
 
@@ -45,6 +52,32 @@
       x => x.blockToLoop === block.id
     )
 
+  $: setPermissions(role)
+  $: getPermissions(automationId)
+
+  async function setPermissions(role) {
+    if (!role || !automationId) {
+      return
+    }
+    await permissions.save({
+      level: "execute",
+      role,
+      resource: automationId,
+    })
+  }
+
+  async function getPermissions(automationId) {
+    if (!automationId) {
+      return
+    }
+    const perms = await permissions.forResource(automationId)
+    if (!perms["execute"]) {
+      role = "BASIC"
+    } else {
+      role = perms["execute"]
+    }
+  }
+
   async function removeLooping() {
     loopingSelected = false
     let loopBlock =
@@ -205,6 +238,10 @@
           </div>
         {/if}
 
+        {#if block.stepId === TriggerStepID.APP}
+          <Label>Role</Label>
+          <RoleSelect bind:value={role} />
+        {/if}
         <AutomationBlockSetup
           schemaProperties={Object.entries(block.schema.inputs.properties)}
           {block}
diff --git a/packages/builder/src/components/automation/AutomationBuilder/TestDisplay.svelte b/packages/builder/src/components/automation/AutomationBuilder/TestDisplay.svelte
index c6585b0bc..3f01dbeeb 100644
--- a/packages/builder/src/components/automation/AutomationBuilder/TestDisplay.svelte
+++ b/packages/builder/src/components/automation/AutomationBuilder/TestDisplay.svelte
@@ -1,6 +1,7 @@
 <script>
   import { Icon, Divider, Tabs, Tab, TextArea, Label } from "@budibase/bbui"
   import FlowItemHeader from "./FlowChart/FlowItemHeader.svelte"
+  import { ActionStepID } from "constants/backend/automations"
 
   export let automation
   export let testResults
@@ -10,7 +11,7 @@
   let blocks
 
   function prepTestResults(results) {
-    return results?.steps.filter(x => x.stepId !== "LOOP" || [])
+    return results?.steps.filter(x => x.stepId !== ActionStepID.LOOP || [])
   }
 
   function textArea(results, message) {
@@ -30,7 +31,7 @@
       }
       blocks = blocks
         .concat(automation.definition.steps || [])
-        .filter(x => x.stepId !== "LOOP")
+        .filter(x => x.stepId !== ActionStepID.LOOP)
     } else if (filteredResults) {
       blocks = filteredResults || []
       // make sure there is an ID for each block being displayed
@@ -45,7 +46,7 @@
 <div class="container">
   {#each blocks as block, idx}
     <div class="block" style={width ? `width: ${width}` : ""}>
-      {#if block.stepId !== "LOOP"}
+      {#if block.stepId !== ActionStepID.LOOP}
         <FlowItemHeader
           showTestStatus={true}
           bind:showParameters
diff --git a/packages/builder/src/components/automation/AutomationBuilder/TestPanel.svelte b/packages/builder/src/components/automation/AutomationBuilder/TestPanel.svelte
index 9e84350cd..bdc39b74e 100644
--- a/packages/builder/src/components/automation/AutomationBuilder/TestPanel.svelte
+++ b/packages/builder/src/components/automation/AutomationBuilder/TestPanel.svelte
@@ -2,6 +2,7 @@
   import { Icon, Divider } from "@budibase/bbui"
   import TestDisplay from "./TestDisplay.svelte"
   import { automationStore } from "builderStore"
+  import { ActionStepID } from "constants/backend/automations"
 
   export let automation
   export let testResults
@@ -16,7 +17,7 @@
       }
       blocks = blocks
         .concat(automation.definition.steps || [])
-        .filter(x => x.stepId !== "LOOP")
+        .filter(x => x.stepId !== ActionStepID.LOOP)
     } else if (testResults) {
       blocks = testResults.steps || []
     }
diff --git a/packages/builder/src/components/automation/AutomationPanel/CreateAutomationModal.svelte b/packages/builder/src/components/automation/AutomationPanel/CreateAutomationModal.svelte
index 9543a9c55..eb148534f 100644
--- a/packages/builder/src/components/automation/AutomationPanel/CreateAutomationModal.svelte
+++ b/packages/builder/src/components/automation/AutomationPanel/CreateAutomationModal.svelte
@@ -11,6 +11,7 @@
     Body,
     Icon,
   } from "@budibase/bbui"
+  import { TriggerStepID } from "constants/backend/automations"
 
   let name
   let selectedTrigger
@@ -35,7 +36,7 @@
       )
 
       automationStore.actions.addBlockToAutomation(newBlock)
-      if (triggerVal.stepId === "WEBHOOK") {
+      if (triggerVal.stepId === TriggerStepID.WEBHOOK) {
         webhookModal.show
       }
 
diff --git a/packages/builder/src/components/automation/SetupPanel/AutomationBlockSetup.svelte b/packages/builder/src/components/automation/SetupPanel/AutomationBlockSetup.svelte
index 8b3f32a33..8b34cf8cd 100644
--- a/packages/builder/src/components/automation/SetupPanel/AutomationBlockSetup.svelte
+++ b/packages/builder/src/components/automation/SetupPanel/AutomationBlockSetup.svelte
@@ -30,6 +30,7 @@
   import { LuceneUtils } from "@budibase/frontend-core"
   import { getSchemaForTable } from "builderStore/dataBinding"
   import { Utils } from "@budibase/frontend-core"
+  import { TriggerStepID, ActionStepID } from "constants/backend/automations"
 
   export let block
   export let testData
@@ -60,7 +61,7 @@
     try {
       if (isTestModal) {
         // Special case for webhook, as it requires a body, but the schema already brings back the body's contents
-        if (stepId === "WEBHOOK") {
+        if (stepId === TriggerStepID.WEBHOOK) {
           automationStore.actions.addTestDataToAutomation({
             body: {
               [key]: e.detail,
@@ -101,9 +102,9 @@
     // Extract all outputs from all previous steps as available bindins
     let bindings = []
     for (let idx = 0; idx < blockIdx; idx++) {
-      let wasLoopBlock = allSteps[idx]?.stepId === "LOOP"
+      let wasLoopBlock = allSteps[idx]?.stepId === ActionStepID.LOOP
       let isLoopBlock =
-        allSteps[idx]?.stepId === "LOOP" &&
+        allSteps[idx]?.stepId === ActionStepID.LOOP &&
         allSteps.find(x => x.blockToLoop === block.id)
 
       // If the previous block was a loop block, decerement the index so the following
@@ -345,7 +346,7 @@
   <CreateWebhookModal />
 </Modal>
 
-{#if stepId === "WEBHOOK"}
+{#if stepId === TriggerStepID.WEBHOOK}
   <Button secondary on:click={() => webhookModal.show()}>Set Up Webhook</Button>
 {/if}
 
diff --git a/packages/builder/src/components/deploy/CreateWebhookDeploymentModal.svelte b/packages/builder/src/components/deploy/CreateWebhookDeploymentModal.svelte
index 19cea6db6..ee6b163a3 100644
--- a/packages/builder/src/components/deploy/CreateWebhookDeploymentModal.svelte
+++ b/packages/builder/src/components/deploy/CreateWebhookDeploymentModal.svelte
@@ -3,6 +3,7 @@
   import { ModalContent } from "@budibase/bbui"
   import { onMount } from "svelte"
   import WebhookDisplay from "../automation/Shared/WebhookDisplay.svelte"
+  import { TriggerStepID } from "constants/backend/automations"
 
   let webhookUrls = []
 
@@ -11,7 +12,7 @@
   onMount(() => {
     webhookUrls = automations.map(automation => {
       const trigger = automation.definition.trigger
-      if (trigger?.stepId === "WEBHOOK" && trigger.inputs) {
+      if (trigger?.stepId === TriggerStepID.WEBHOOK && trigger.inputs) {
         return {
           type: "Automation",
           name: automation.name,
diff --git a/packages/builder/src/components/design/settings/controls/ButtonActionEditor/actions/TriggerAutomation.svelte b/packages/builder/src/components/design/settings/controls/ButtonActionEditor/actions/TriggerAutomation.svelte
index fa32c88d6..4f661096c 100644
--- a/packages/builder/src/components/design/settings/controls/ButtonActionEditor/actions/TriggerAutomation.svelte
+++ b/packages/builder/src/components/design/settings/controls/ButtonActionEditor/actions/TriggerAutomation.svelte
@@ -2,6 +2,7 @@
   import { Select, Label, Input, Checkbox } from "@budibase/bbui"
   import { automationStore } from "builderStore"
   import SaveFields from "./SaveFields.svelte"
+  import { TriggerStepID } from "constants/backend/automations"
 
   export let parameters = {}
   export let bindings = []
@@ -16,7 +17,7 @@
     : AUTOMATION_STATUS.NEW
 
   $: automations = $automationStore.automations
-    .filter(a => a.definition.trigger?.stepId === "APP")
+    .filter(a => a.definition.trigger?.stepId === TriggerStepID.APP)
     .map(automation => {
       const schema = Object.entries(
         automation.definition.trigger.inputs.fields || {}
diff --git a/packages/builder/src/constants/backend/automations.js b/packages/builder/src/constants/backend/automations.js
new file mode 100644
index 000000000..e0cd5b640
--- /dev/null
+++ b/packages/builder/src/constants/backend/automations.js
@@ -0,0 +1,28 @@
+export const TriggerStepID = {
+  ROW_SAVED: "ROW_SAVED",
+  ROW_UPDATED: "ROW_UPDATED",
+  ROW_DELETED: "ROW_DELETED",
+  WEBHOOK: "WEBHOOK",
+  APP: "APP",
+  CRON: "CRON",
+}
+
+export const ActionStepID = {
+  SEND_EMAIL_SMTP: "SEND_EMAIL_SMTP",
+  CREATE_ROW: "CREATE_ROW",
+  UPDATE_ROW: "UPDATE_ROW",
+  DELETE_ROW: "DELETE_ROW",
+  OUTGOING_WEBHOOK: "OUTGOING_WEBHOOK",
+  EXECUTE_SCRIPT: "EXECUTE_SCRIPT",
+  EXECUTE_QUERY: "EXECUTE_QUERY",
+  SERVER_LOG: "SERVER_LOG",
+  DELAY: "DELAY",
+  FILTER: "FILTER",
+  QUERY_ROWS: "QUERY_ROWS",
+  LOOP: "LOOP",
+  // these used to be lowercase step IDs, maintain for backwards compat
+  discord: "discord",
+  slack: "slack",
+  zapier: "zapier",
+  integromat: "integromat",
+}
diff --git a/packages/server/src/utilities/security.js b/packages/server/src/utilities/security.js
index de5b69655..a0d9c8d57 100644
--- a/packages/server/src/utilities/security.js
+++ b/packages/server/src/utilities/security.js
@@ -13,6 +13,7 @@ const { DocumentTypes } = require("../db/utils")
 const CURRENTLY_SUPPORTED_LEVELS = [
   PermissionLevels.WRITE,
   PermissionLevels.READ,
+  PermissionLevels.EXECUTE,
 ]
 
 exports.getPermissionType = resourceId => {