diff --git a/coderd/rbac/builtin.go b/coderd/rbac/builtin.go
index 4540538ce3..7115162d75 100644
--- a/coderd/rbac/builtin.go
+++ b/coderd/rbac/builtin.go
@@ -111,7 +111,7 @@ var (
 					ResourceTemplate: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
 					// CRUD all files, even those they did not upload.
 					ResourceFile:      {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
-					ResourceWorkspace: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
+					ResourceWorkspace: {ActionRead},
 					// CRUD to provisioner daemons for now.
 					ResourceProvisionerDaemon: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
 				}),