diff --git a/pkg/cloudcommon/db/taskman/tasks.go b/pkg/cloudcommon/db/taskman/tasks.go
index 13ecbd7b8f..11c59be3bd 100644
--- a/pkg/cloudcommon/db/taskman/tasks.go
+++ b/pkg/cloudcommon/db/taskman/tasks.go
@@ -76,11 +76,17 @@ type STaskManager struct {
 }
 
 var TaskManager *STaskManager
+var userCredWidthLimit = 0
 
 func init() {
 	TaskManager = &STaskManager{
 		SResourceBaseManager: db.NewResourceBaseManager(STask{}, "tasks_tbl", "task", "tasks")}
 	TaskManager.SetVirtualObject(TaskManager)
+	if field, ok := reflect.TypeOf(&STask{}).Elem().FieldByName("UserCred"); ok {
+		if widthStr := field.Tag.Get(sqlchemy.TAG_WIDTH); len(widthStr) > 0 {
+			userCredWidthLimit, _ = strconv.Atoi(widthStr)
+		}
+	}
 }
 
 type STask struct {
@@ -278,6 +284,11 @@ func (manager *STaskManager) NewTask(
 		Params:   data,
 		Stage:    TASK_INIT_STAGE,
 	}
+
+	if userCredWidthLimit > 0 && len(userCred.String()) > userCredWidthLimit {
+		return nil, fmt.Errorf("Too many permissions for user %s", userCred.GetUserName())
+	}
+
 	task.SetModelManager(manager, task)
 	err := manager.TableSpec().Insert(ctx, task)
 	if err != nil {