diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RolesGrantsAndPermissionsGenerator.java b/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RolesGrantsAndPermissionsGenerator.java
index 7f44c84c..ba01d61f 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RolesGrantsAndPermissionsGenerator.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RolesGrantsAndPermissionsGenerator.java
@@ -11,6 +11,7 @@ import static java.util.stream.Collectors.joining;
 import static java.util.stream.Collectors.toSet;
 import static net.hostsharing.hsadminng.rbac.rbacdef.PostgresTriggerReference.NEW;
 import static net.hostsharing.hsadminng.rbac.rbacdef.PostgresTriggerReference.OLD;
+import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Permission.INSERT;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.RbacGrantDefinition.GrantType.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.RbacView.Role.*;
 import static net.hostsharing.hsadminng.rbac.rbacdef.StringWriter.with;
@@ -228,9 +229,11 @@ class RolesGrantsAndPermissionsGenerator {
             case ROLE_TO_ROLE -> "call grantRoleToRole(${subRoleRef}, ${superRoleRef});"
                     .replace("${subRoleRef}", roleRef(NEW, grantDef.getSubRoleDef()))
                     .replace("${superRoleRef}", roleRef(NEW, grantDef.getSuperRoleDef()));
-            case PERM_TO_ROLE -> "call grantPermissionsToRole(${permRef}, ${superRoleRef});"
-                    .replace("${permRef}", permRef(NEW, grantDef.getPermDef()))
-                    .replace("${superRoleRef}", roleRef(NEW, grantDef.getSuperRoleDef()));
+            case PERM_TO_ROLE ->
+                    grantDef.getPermDef().getPermission() == INSERT ? ""
+                    : "call grantPermissionsToRole(${permRef}, ${superRoleRef});"
+                        .replace("${permRef}", permRef(NEW, grantDef.getPermDef()))
+                        .replace("${superRoleRef}", roleRef(NEW, grantDef.getSuperRoleDef()));
         };
     }