diff --git a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/WebConnectionInfo.java b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/WebConnectionInfo.java
index 4fe539750e3..40cf606df08 100644
--- a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/WebConnectionInfo.java
+++ b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/WebConnectionInfo.java
@@ -72,6 +72,11 @@ public class WebConnectionInfo {
     private static final String FEATURE_PROVIDED = "provided";
     private static final String FEATURE_MANAGEABLE = "manageable";
 
+    private static final String FEATURE_RESTRICT_DATA_EDIT = "restrictDataEdit";
+    private static final String FEATURE_RESTRICT_SCRIPT_EXECUTE = "restrictScriptExecute";
+    private static final String FEATURE_RESTRICT_DATA_IMPORT = "restrictDataImport";
+    private static final String FEATURE_RESTRICT_METADATA_EDIT = "restrictMetadataEdit";
+
     private static final String TOOL_SESSION_MANAGER = "sessionManager";
     
     private final WebSession session;
@@ -275,6 +280,18 @@ public String[] getFeatures() {
         if (dataSourceContainer.isConnectionReadOnly()) {
             features.add(FEATURE_READ_ONLY);
         }
+        if (!dataSourceContainer.hasModifyPermission(DBPDataSourcePermission.PERMISSION_EDIT_DATA)) {
+            features.add(FEATURE_RESTRICT_DATA_EDIT);
+        }
+        if (!dataSourceContainer.hasModifyPermission(DBPDataSourcePermission.PERMISSION_EXECUTE_SCRIPTS)) {
+            features.add(FEATURE_RESTRICT_SCRIPT_EXECUTE);
+        }
+        if (!dataSourceContainer.hasModifyPermission(DBPDataSourcePermission.PERMISSION_IMPORT_DATA)) {
+            features.add(FEATURE_RESTRICT_DATA_IMPORT);
+        }
+        if (!dataSourceContainer.hasModifyPermission(DBPDataSourcePermission.PERMISSION_EDIT_METADATA)) {
+            features.add(FEATURE_RESTRICT_METADATA_EDIT);
+        }
         if (dataSourceContainer.isProvided()) {
             features.add(FEATURE_PROVIDED);
         }
diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/navigator/impl/WebServiceNavigator.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/navigator/impl/WebServiceNavigator.java
index a35c46d4e30..7783053edcf 100644
--- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/navigator/impl/WebServiceNavigator.java
+++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/navigator/impl/WebServiceNavigator.java
@@ -461,6 +461,7 @@ public String renameNode(
                 return node.getNodeUri();
             }
             if (node instanceof DBNDatabaseNode dbNode) {
+                checkMetadataEditPermission(dbNode);
                 return renameDatabaseObject(
                     session,
                     dbNode,
@@ -545,8 +546,9 @@ public int deleteNodes(
                     throw new DBWebException("Navigator node '"  + path + "' not found");
                 }
                 checkProjectEditAccess(node, session);
-                if (node instanceof DBNDatabaseNode) {
-                    DBSObject object = ((DBNDatabaseNode) node).getObject();
+                if (node instanceof DBNDatabaseNode dbnDatabaseNode) {
+                    checkMetadataEditPermission(dbnDatabaseNode);
+                    DBSObject object = dbnDatabaseNode.getObject();
                     DBEObjectMaker objectDeleter = DBWorkbench.getPlatform().getEditorsRegistry().getObjectManager(
                         object.getClass(), DBEObjectMaker.class);
                     if (objectDeleter == null || !objectDeleter.canDeleteObject(object)) {
@@ -602,6 +604,12 @@ public int deleteNodes(
         }
     }
 
+    private void checkMetadataEditPermission(@NotNull DBNDatabaseNode node) throws DBException {
+        if (!node.getDataSourceContainer().hasModifyPermission(DBPDataSourcePermission.PERMISSION_EDIT_METADATA)) {
+            throw new DBWebException("Structure edit is restricted for this connection");
+        }
+    }
+
     private void checkProjectEditAccess(@NotNull DBNNode node, @NotNull WebSession session) throws DBException {
         var project = node.getOwnerProject();
         if (!(project instanceof BaseWebProjectImpl bwp) || !hasNodeEditPermission(session, node, bwp.getRMProject())) {
diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java
index 1c0372c6a5f..4f6d6ad50d1 100644
--- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java
+++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java
@@ -31,10 +31,7 @@
 import org.jkiss.code.Nullable;
 import org.jkiss.dbeaver.DBException;
 import org.jkiss.dbeaver.Log;
-import org.jkiss.dbeaver.model.DBPDataKind;
-import org.jkiss.dbeaver.model.DBPDataSource;
-import org.jkiss.dbeaver.model.DBPDataSourceContainer;
-import org.jkiss.dbeaver.model.DBUtils;
+import org.jkiss.dbeaver.model.*;
 import org.jkiss.dbeaver.model.data.DBDAttributeBinding;
 import org.jkiss.dbeaver.model.exec.DBCException;
 import org.jkiss.dbeaver.model.exec.DBCLogicalOperator;
@@ -509,6 +506,7 @@ private WebSQLExecuteInfo updateResultsDataBatch(
         @Nullable List<WebSQLResultsRow> addedRows,
         @Nullable WebDataFormat dataFormat
     ) throws DBException {
+        checkDataEditPermission(contextInfo);
         WebSQLExecuteInfo[] result = new WebSQLExecuteInfo[1];
 
         DBExecUtils.tryExecuteRecover(
@@ -521,6 +519,13 @@ private WebSQLExecuteInfo updateResultsDataBatch(
         return result[0];
     }
 
+    private void checkDataEditPermission(@NotNull WebSQLContextInfo contextInfo) throws DBWebException {
+        if (!contextInfo.getProcessor().getConnection().getDataSourceContainer()
+            .hasModifyPermission(DBPDataSourcePermission.PERMISSION_EDIT_DATA)) {
+            throw new DBWebException("Data edit is restricted for this connection");
+        }
+    }
+
     @FunctionalInterface
     private interface ThrowableFunction<T, R> {
         R apply(T obj) throws DBException;
@@ -573,6 +578,7 @@ private String readValue(
 
     @Override
     public String updateResultsDataBatchScript(@NotNull WebSQLContextInfo contextInfo, @NotNull String resultsId, @Nullable List<WebSQLResultsRow> updatedRows, @Nullable List<WebSQLResultsRow> deletedRows, @Nullable List<WebSQLResultsRow> addedRows, WebDataFormat dataFormat) throws DBWebException {
+        checkDataEditPermission(contextInfo);
         try {
             return contextInfo.getProcessor().generateResultsDataUpdateScript(
                 contextInfo.getProcessor().getWebSession().getProgressMonitor(),
@@ -599,6 +605,10 @@ public WebAsyncTaskInfo asyncExecuteQuery(
         if (DBWorkbench.isDistributed() && !webSession.hasPermission(DBWConstants.PERMISSION_SQL_EXECUTE_QUERY)) {
             throw new DBWebException("Permission denied");
         }
+        if (!contextInfo.getProcessor().getConnection().getDataSourceContainer()
+            .hasModifyPermission(DBPDataSourcePermission.PERMISSION_EXECUTE_SCRIPTS)) {
+            throw new DBWebException("Script execution is restricted for this connection");
+        }
         return WebSQLUtils.createAsyncTaskExecuteSqlQuery(
             webSession,
             contextInfo,
diff --git a/server/bundles/io.cloudbeaver.service.data.transfer/src/io/cloudbeaver/service/data/transfer/impl/WebServiceDataTransfer.java b/server/bundles/io.cloudbeaver.service.data.transfer/src/io/cloudbeaver/service/data/transfer/impl/WebServiceDataTransfer.java
index 86a93c4896c..77acb2cbc6a 100644
--- a/server/bundles/io.cloudbeaver.service.data.transfer/src/io/cloudbeaver/service/data/transfer/impl/WebServiceDataTransfer.java
+++ b/server/bundles/io.cloudbeaver.service.data.transfer/src/io/cloudbeaver/service/data/transfer/impl/WebServiceDataTransfer.java
@@ -32,6 +32,7 @@
 import org.jkiss.code.Nullable;
 import org.jkiss.dbeaver.DBException;
 import org.jkiss.dbeaver.Log;
+import org.jkiss.dbeaver.model.DBPDataSourcePermission;
 import org.jkiss.dbeaver.model.data.json.JSONUtils;
 import org.jkiss.dbeaver.model.preferences.DBPPropertyDescriptor;
 import org.jkiss.dbeaver.model.runtime.DBRProgressMonitor;
@@ -245,6 +246,10 @@ public WebAsyncTaskInfo asyncImportDataContainer(
         if (!validateImportPermission(webSession)) {
             throw new DBWebException("Permission denied. Data import is not allowed for this user");
         }
+        if (!sqlContext.getProcessor().getConnection().getDataSourceContainer()
+            .hasModifyPermission(DBPDataSourcePermission.PERMISSION_IMPORT_DATA)) {
+            throw new DBWebException("Data import is restricted for this connection");
+        }
         DataTransferProcessorDescriptor processor = DataTransferRegistry.getInstance().getProcessor(parameters.getProcessorId());
         if (processor == null) {
             throw new DBWebException("Wrong data processor '" + parameters.getProcessorId() + "'");
diff --git a/webapp/packages/core-connections/src/EConnectionFeature.ts b/webapp/packages/core-connections/src/EConnectionFeature.ts
index 757e49eebe5..106afc2852a 100644
--- a/webapp/packages/core-connections/src/EConnectionFeature.ts
+++ b/webapp/packages/core-connections/src/EConnectionFeature.ts
@@ -1,6 +1,6 @@
 /*
  * CloudBeaver - Cloud Database Manager
- * Copyright (C) 2020-2024 DBeaver Corp and others
+ * Copyright (C) 2020-2026 DBeaver Corp and others
  *
  * Licensed under the Apache License, Version 2.0.
  * you may not use this file except in compliance with the License.
@@ -13,4 +13,9 @@ export enum EConnectionFeature {
   readOnly = 'readOnly',
   provided = 'provided',
   manageable = 'manageable',
+
+  restrictDataEdit = 'restrictDataEdit',
+  restrictScriptExecute = 'restrictScriptExecute',
+  restrictDataImport = 'restrictDataImport',
+  restrictMetadataEdit = 'restrictMetadataEdit',
 }
diff --git a/webapp/packages/plugin-ai-chat/src/AIChat/AIChatMessage/AIChatMessageActionsService.ts b/webapp/packages/plugin-ai-chat/src/AIChat/AIChatMessage/AIChatMessageActionsService.ts
index 1dcd5189a95..5cbfa20ccc9 100644
--- a/webapp/packages/plugin-ai-chat/src/AIChat/AIChatMessage/AIChatMessageActionsService.ts
+++ b/webapp/packages/plugin-ai-chat/src/AIChat/AIChatMessage/AIChatMessageActionsService.ts
@@ -16,9 +16,9 @@ import {
   ESqlDataSourceFeatures,
   LocalStorageSqlDataSource,
   SqlDataSourceService,
+  SqlEditorPermissionService,
   SqlEditorService,
   type ILocalStorageSqlDataSourceState,
-  SqlEditorSettingsService,
   type ISqlEditorTabState,
 } from '@cloudbeaver/plugin-sql-editor';
 import { NotificationService } from '@cloudbeaver/core-events';
@@ -41,12 +41,9 @@ const AI_CHAT_ID_METADATA_KEY = 'aiChatId';
   SqlDataSourceService,
   LocalizationService,
   CommonDialogService,
-  SqlEditorSettingsService,
+  SqlEditorPermissionService,
 ])
 export class AIChatMessageActionsService {
-  get isAllowed(): boolean {
-    return this.sqlEditorSettingsService.scriptExecutionEnabled;
-  }
   get isDisabled(): boolean {
     return !this.aiChatContextService.currentContext;
   }
@@ -61,13 +58,21 @@ export class AIChatMessageActionsService {
     private readonly sqlDataSourceService: SqlDataSourceService,
     private readonly localizationService: LocalizationService,
     private readonly commonDialogService: CommonDialogService,
-    private readonly sqlEditorSettingsService: SqlEditorSettingsService,
+    private readonly sqlEditorPermissionService: SqlEditorPermissionService,
   ) {
     makeObservable(this, {
       isDisabled: computed,
     });
   }
 
+  isAllowed(connectionKey: IConnectionInfoParams | null): boolean {
+    if (!connectionKey) {
+      return false;
+    }
+
+    return this.sqlEditorPermissionService.isScriptExecutionEnabled(connectionKey);
+  }
+
   async executeQuery(conversationId: string | undefined | null, connectionKey: IConnectionInfoParams | null, query: string): Promise<void> {
     const currentTab = this.navigationTabsService.currentTab;
 
diff --git a/webapp/packages/plugin-ai-chat/src/AIChat/AIChatMessage/CodeFormatter.tsx b/webapp/packages/plugin-ai-chat/src/AIChat/AIChatMessage/CodeFormatter.tsx
index 433325a875c..46fc209fa17 100644
--- a/webapp/packages/plugin-ai-chat/src/AIChat/AIChatMessage/CodeFormatter.tsx
+++ b/webapp/packages/plugin-ai-chat/src/AIChat/AIChatMessage/CodeFormatter.tsx
@@ -62,7 +62,7 @@ export const CodeFormatter = observer<Props>(function CodeFormatter({ code, conv
           <ActionIconButton
             name="/icons/sql_exec.svg"
             title={translate('plugin_ai_chat_query_execute')}
-            hidden={!aiChatMessageActionsService.isAllowed}
+            hidden={!aiChatMessageActionsService.isAllowed(connectionKey)}
             disabled={disabled}
             img
             onClick={execute}
diff --git a/webapp/packages/plugin-data-import/package.json b/webapp/packages/plugin-data-import/package.json
index 88119f2dfe8..6c8d1018694 100644
--- a/webapp/packages/plugin-data-import/package.json
+++ b/webapp/packages/plugin-data-import/package.json
@@ -23,6 +23,7 @@
   },
   "dependencies": {
     "@cloudbeaver/core-blocks": "workspace:*",
+    "@cloudbeaver/core-connections": "workspace:*",
     "@cloudbeaver/core-di": "workspace:*",
     "@cloudbeaver/core-dialogs": "workspace:*",
     "@cloudbeaver/core-events": "workspace:*",
diff --git a/webapp/packages/plugin-data-import/src/DataImportBootstrap.ts b/webapp/packages/plugin-data-import/src/DataImportBootstrap.ts
index e881c96352e..052e6678aaa 100644
--- a/webapp/packages/plugin-data-import/src/DataImportBootstrap.ts
+++ b/webapp/packages/plugin-data-import/src/DataImportBootstrap.ts
@@ -8,6 +8,7 @@
 import { Bootstrap, injectable } from '@cloudbeaver/core-di';
 import { CommonDialogService, DialogueStateResult } from '@cloudbeaver/core-dialogs';
 import { ACTION_IMPORT, ActionService, menuExtractItems, MenuService } from '@cloudbeaver/core-view';
+import { ConnectionInfoResource, createConnectionParam, EConnectionFeature } from '@cloudbeaver/core-connections';
 import {
   DATA_CONTEXT_DV_DDM,
   DATA_CONTEXT_DV_DDM_RESULT_INDEX,
@@ -16,18 +17,21 @@ import {
   DatabaseDataFeature,
   DataViewerPresentationType,
   isResultSetDataModel,
+  ResultSetDataSource,
+  type IDatabaseDataModel,
 } from '@cloudbeaver/plugin-data-viewer';
 
 import { DataImportDialogLazy } from './DataImportDialog/DataImportDialogLazy.js';
 import { DataImportService } from './DataImportService.js';
 
-@injectable(() => [MenuService, ActionService, CommonDialogService, DataImportService])
+@injectable(() => [MenuService, ActionService, CommonDialogService, DataImportService, ConnectionInfoResource])
 export class DataImportBootstrap extends Bootstrap {
   constructor(
     private readonly menuService: MenuService,
     private readonly actionService: ActionService,
     private readonly commonDialogService: CommonDialogService,
     private readonly dataImportService: DataImportService,
+    private readonly connectionInfoResource: ConnectionInfoResource,
   ) {
     super();
   }
@@ -96,9 +100,21 @@ export class DataImportBootstrap extends Bootstrap {
       menus: [DATA_VIEWER_DATA_MODEL_ACTIONS_MENU],
       contexts: [DATA_CONTEXT_DV_DDM, DATA_CONTEXT_DV_DDM_RESULT_INDEX],
       isApplicable: context => {
-        const model = context.get(DATA_CONTEXT_DV_DDM)!;
+        const model = context.get(DATA_CONTEXT_DV_DDM)! as unknown as IDatabaseDataModel<ResultSetDataSource>;
         const presentation = context.get(DATA_CONTEXT_DV_PRESENTATION);
         const resultIndex = context.get(DATA_CONTEXT_DV_DDM_RESULT_INDEX)!;
+
+        const executionContext = model.source.executionContext?.context;
+
+        if (executionContext) {
+          const connectionKey = createConnectionParam(executionContext.projectId, executionContext.connectionId);
+          const connection = this.connectionInfoResource.get(connectionKey);
+
+          if (connection?.features.includes(EConnectionFeature.restrictDataImport)) {
+            return false;
+          }
+        }
+
         const allowedFeatures = [DatabaseDataFeature.DataEditor];
 
         return (
diff --git a/webapp/packages/plugin-data-import/tsconfig.json b/webapp/packages/plugin-data-import/tsconfig.json
index 50882dab413..8e74883116d 100644
--- a/webapp/packages/plugin-data-import/tsconfig.json
+++ b/webapp/packages/plugin-data-import/tsconfig.json
@@ -16,6 +16,9 @@
     {
       "path": "../core-cli"
     },
+    {
+      "path": "../core-connections"
+    },
     {
       "path": "../core-di"
     },
diff --git a/webapp/packages/plugin-data-viewer/src/DataViewerService.ts b/webapp/packages/plugin-data-viewer/src/DataViewerService.ts
index 3562315164c..8eebd6bfd92 100644
--- a/webapp/packages/plugin-data-viewer/src/DataViewerService.ts
+++ b/webapp/packages/plugin-data-viewer/src/DataViewerService.ts
@@ -1,11 +1,11 @@
 /*
  * CloudBeaver - Cloud Database Manager
- * Copyright (C) 2020-2025 DBeaver Corp and others
+ * Copyright (C) 2020-2026 DBeaver Corp and others
  *
  * Licensed under the Apache License, Version 2.0.
  * you may not use this file except in compliance with the License.
  */
-import type { Connection } from '@cloudbeaver/core-connections';
+import { EConnectionFeature, type Connection } from '@cloudbeaver/core-connections';
 import { injectable } from '@cloudbeaver/core-di';
 import { EAdminPermission, SessionPermissionsResource } from '@cloudbeaver/core-root';
 import { PlaceholderContainer } from '@cloudbeaver/core-blocks';
@@ -37,7 +37,7 @@ export class DataViewerService {
   }
 
   isDataEditable(connection: Connection) {
-    if (connection.readOnly) {
+    if (connection.readOnly || connection.features.includes(EConnectionFeature.restrictDataEdit)) {
       return false;
     }
 
diff --git a/webapp/packages/plugin-navigation-tree/src/NodesManager/NavNodeContextMenuService.ts b/webapp/packages/plugin-navigation-tree/src/NodesManager/NavNodeContextMenuService.ts
index e712641af05..4e1059a8e52 100644
--- a/webapp/packages/plugin-navigation-tree/src/NodesManager/NavNodeContextMenuService.ts
+++ b/webapp/packages/plugin-navigation-tree/src/NodesManager/NavNodeContextMenuService.ts
@@ -26,7 +26,7 @@ import {
   nodeDeleteContext,
   NodeManagerUtils,
 } from '@cloudbeaver/core-navigation-tree';
-import { isConnectionNode } from '@cloudbeaver/core-connections';
+import { ConnectionInfoResource, DATA_CONTEXT_CONNECTION, EConnectionFeature, isConnectionNode } from '@cloudbeaver/core-connections';
 import { ResourceKeyUtils } from '@cloudbeaver/core-resource';
 import {
   ACTION_DELETE,
@@ -59,6 +59,7 @@ export interface INodeMenuData {
   LocalizationService,
   NavNodeInfoResource,
   NavTreeSettingsService,
+  ConnectionInfoResource,
 ])
 export class NavNodeContextMenuService extends Bootstrap {
   constructor(
@@ -71,6 +72,7 @@ export class NavNodeContextMenuService extends Bootstrap {
     private readonly localizationService: LocalizationService,
     private readonly navNodeInfoResource: NavNodeInfoResource,
     private readonly navTreeSettingsService: NavTreeSettingsService,
+    private readonly connectionInfoResource: ConnectionInfoResource,
   ) {
     super();
   }
@@ -116,6 +118,13 @@ export class NavNodeContextMenuService extends Bootstrap {
       contexts: [DATA_CONTEXT_NAV_NODE],
       isActionApplicable: (context, action) => {
         const node = context.get(DATA_CONTEXT_NAV_NODE)!;
+        const connectionKey = context.get(DATA_CONTEXT_CONNECTION)!;
+
+        const connection = this.connectionInfoResource.get(connectionKey);
+
+        if (connection?.features.includes(EConnectionFeature.restrictMetadataEdit)) {
+          return false;
+        }
 
         if (NodeManagerUtils.isDatabaseObject(node.uri) || isConnectionFolder(node)) {
           if (action === ACTION_RENAME) {
diff --git a/webapp/packages/plugin-sql-editor/src/MenuBootstrap.ts b/webapp/packages/plugin-sql-editor/src/MenuBootstrap.ts
index beaebae84d4..09079b2575f 100644
--- a/webapp/packages/plugin-sql-editor/src/MenuBootstrap.ts
+++ b/webapp/packages/plugin-sql-editor/src/MenuBootstrap.ts
@@ -313,7 +313,7 @@ export class MenuBootstrap extends Bootstrap {
       contexts: [DATA_CONTEXT_SQL_EDITOR_DATA],
       isBindingApplicable: (contexts, action) => {
         const sqlEditorData = contexts.get(DATA_CONTEXT_SQL_EDITOR_DATA);
-        return action === ACTION_SQL_EDITOR_EXECUTE_SCRIPT && sqlEditorData?.isExecutionAllowed === true;
+        return action === ACTION_SQL_EDITOR_EXECUTE_SCRIPT && sqlEditorData?.isExecutionAllowed() === true;
       },
       handler: this.sqlEditorActionHandler.bind(this),
     });
diff --git a/webapp/packages/plugin-sql-editor/src/SqlEditor/ISQLEditorData.ts b/webapp/packages/plugin-sql-editor/src/SqlEditor/ISQLEditorData.ts
index 122752e91d4..1dbbc2b751e 100644
--- a/webapp/packages/plugin-sql-editor/src/SqlEditor/ISQLEditorData.ts
+++ b/webapp/packages/plugin-sql-editor/src/SqlEditor/ISQLEditorData.ts
@@ -30,13 +30,13 @@ export interface ISQLEditorData {
   readonly isIncomingChanges: boolean;
   readonly value: string;
   readonly incomingValue?: string;
-  readonly isExecutionAllowed: boolean;
   readonly onExecute: ISyncExecutor<boolean>;
   readonly onSegmentExecute: ISyncExecutor<ISegmentExecutionData>;
   readonly onFormat: ISyncExecutor<[ISQLScriptSegment, string]>;
   /** displays if last getHintProposals call ended with limit */
   readonly hintsLimitIsMet: boolean;
 
+  isExecutionAllowed(): boolean;
   updateParserScriptsDebounced(): Promise<void>;
   setScript(query: string, source?: string, cursor?: ISqlEditorCursor): void;
   setCursor(begin: number, end?: number): void;
diff --git a/webapp/packages/plugin-sql-editor/src/SqlEditor/useSqlEditor.ts b/webapp/packages/plugin-sql-editor/src/SqlEditor/useSqlEditor.ts
index 6ca55db3dfe..152d69b9b29 100644
--- a/webapp/packages/plugin-sql-editor/src/SqlEditor/useSqlEditor.ts
+++ b/webapp/packages/plugin-sql-editor/src/SqlEditor/useSqlEditor.ts
@@ -33,6 +33,7 @@ import { SqlResultTabsService } from '../SqlResultTabs/SqlResultTabsService.js';
 import type { ISQLEditorData } from './ISQLEditorData.js';
 import { SqlEditorSettingsService } from '../SqlEditorSettingsService.js';
 import { SqlEditorModelService } from '../SqlEditorModel/SqlEditorModelService.js';
+import { SqlEditorPermissionService } from '../SqlEditorPermissionService.js';
 
 interface ISQLEditorDataPrivate extends ISQLEditorData {
   readonly sqlDialectInfoService: SqlDialectInfoService;
@@ -44,6 +45,7 @@ interface ISQLEditorDataPrivate extends ISQLEditorData {
   readonly commonDialogService: CommonDialogService;
   readonly sqlResultTabsService: SqlResultTabsService;
   readonly connectionInfoResource: ConnectionInfoResource;
+  readonly sqlEditorPermissionService: SqlEditorPermissionService;
   readonly getLastAutocomplete: LastPromiseGetter<SqlCompletionProposal[]>;
   readonly parseScript: LastPromiseGetter<SqlScriptInfoFragment>;
 
@@ -68,6 +70,7 @@ export function useSqlEditor(state: ISqlEditorTabState): ISQLEditorData {
   const sqlEditorSettingsService = useService(SqlEditorSettingsService);
   const sqlEditorModelService = useService(SqlEditorModelService);
   const connectionInfoResource = useService(ConnectionInfoResource);
+  const sqlEditorPermissionService = useService(SqlEditorPermissionService);
 
   const model = sqlEditorModelService.getOrCreate(state);
 
@@ -119,10 +122,6 @@ export function useSqlEditor(state: ISqlEditorTabState): ISQLEditorData {
         return this.model.dataSource?.incomingScript;
       },
 
-      get isExecutionAllowed(): boolean {
-        return !!this.model.dataSource?.hasFeature(ESqlDataSourceFeatures.executable) && this.sqlEditorSettingsService.scriptExecutionEnabled;
-      },
-
       onExecute: new SyncExecutor(),
       onSegmentExecute: new SyncExecutor(),
 
@@ -131,6 +130,19 @@ export function useSqlEditor(state: ISqlEditorTabState): ISQLEditorData {
       reactionDisposer: null,
       hintsLimitIsMet: false,
 
+      isExecutionAllowed(): boolean {
+        const executionContext = this.model.dataSource?.executionContext;
+
+        if (!executionContext) {
+          return false;
+        }
+
+        const key = createConnectionParam(executionContext.projectId, executionContext.connectionId);
+        return (
+          !!this.model.dataSource?.hasFeature(ESqlDataSourceFeatures.executable) && this.sqlEditorPermissionService.isScriptExecutionEnabled(key)
+        );
+      },
+
       setCursor(begin: number, end = begin): void {
         this.model.dataSource?.setCursor(begin, end);
       },
@@ -358,6 +370,7 @@ export function useSqlEditor(state: ISqlEditorTabState): ISQLEditorData {
       commonDialogService,
       sqlEditorSettingsService,
       connectionInfoResource,
+      sqlEditorPermissionService,
     },
   );
 
diff --git a/webapp/packages/plugin-sql-editor/src/SqlEditorPermissionService.ts b/webapp/packages/plugin-sql-editor/src/SqlEditorPermissionService.ts
new file mode 100644
index 00000000000..5a01b909553
--- /dev/null
+++ b/webapp/packages/plugin-sql-editor/src/SqlEditorPermissionService.ts
@@ -0,0 +1,30 @@
+/*
+ * CloudBeaver - Cloud Database Manager
+ * Copyright (C) 2020-2026 DBeaver Corp and others
+ *
+ * Licensed under the Apache License, Version 2.0.
+ * you may not use this file except in compliance with the License.
+ */
+
+import { EConnectionFeature, ConnectionInfoResource, type IConnectionInfoParams } from '@cloudbeaver/core-connections';
+import { injectable } from '@cloudbeaver/core-di';
+
+import { SqlEditorSettingsService } from './SqlEditorSettingsService.js';
+
+@injectable(() => [ConnectionInfoResource, SqlEditorSettingsService])
+export class SqlEditorPermissionService {
+  constructor(
+    private readonly connectionInfoResource: ConnectionInfoResource,
+    private readonly sqlEditorSettingsService: SqlEditorSettingsService,
+  ) {}
+
+  isScriptExecutionEnabled(connectionKey: IConnectionInfoParams): boolean {
+    const connection = this.connectionInfoResource.get(connectionKey);
+
+    if (!connection) {
+      return false;
+    }
+
+    return !connection.features.includes(EConnectionFeature.restrictScriptExecute) && this.sqlEditorSettingsService.scriptExecutionEnabled;
+  }
+}
diff --git a/webapp/packages/plugin-sql-editor/src/SqlResultTabs/SqlQueryService.ts b/webapp/packages/plugin-sql-editor/src/SqlResultTabs/SqlQueryService.ts
index b341167dff8..9045abb9145 100644
--- a/webapp/packages/plugin-sql-editor/src/SqlResultTabs/SqlQueryService.ts
+++ b/webapp/packages/plugin-sql-editor/src/SqlResultTabs/SqlQueryService.ts
@@ -1,6 +1,6 @@
 /*
  * CloudBeaver - Cloud Database Manager
- * Copyright (C) 2020-2025 DBeaver Corp and others
+ * Copyright (C) 2020-2026 DBeaver Corp and others
  *
  * Licensed under the Apache License, Version 2.0.
  * you may not use this file except in compliance with the License.
@@ -27,9 +27,9 @@ import type { IResultGroup, ISqlEditorTabState } from '../ISqlEditorTabState.js'
 import { QueryDataSource } from '../QueryDataSource.js';
 import { SqlDataSourceService } from '../SqlDataSource/SqlDataSourceService.js';
 import { SqlQueryResultService } from './SqlQueryResultService.js';
-import { SqlEditorSettingsService } from '../SqlEditorSettingsService.js';
 import { Executor, type IExecutor } from '@cloudbeaver/core-executor';
 import { CommonDialogService } from '@cloudbeaver/core-dialogs';
+import { SqlEditorPermissionService } from '../SqlEditorPermissionService.js';
 
 interface IQueryExecutionOptions {
   onQueryExecutionStart?: (query: string, index: number) => void;
@@ -57,9 +57,9 @@ export interface IQueryExecutionStatistics {
   DataViewerService,
   SqlDataSourceService,
   DataViewerSettingsService,
-  SqlEditorSettingsService,
   CommonDialogService,
   AsyncTaskInfoEventHandler,
+  SqlEditorPermissionService,
 ])
 export class SqlQueryService {
   private readonly statisticsMap: Map<string, IQueryExecutionStatistics>;
@@ -78,9 +78,9 @@ export class SqlQueryService {
     private readonly dataViewerService: DataViewerService,
     private readonly sqlDataSourceService: SqlDataSourceService,
     private readonly dataViewerSettingsService: DataViewerSettingsService,
-    private readonly sqlEditorSettingsService: SqlEditorSettingsService,
     private readonly commonDialogService: CommonDialogService,
     private readonly asyncTaskInfoEventHandler: AsyncTaskInfoEventHandler,
+    private readonly sqlEditorPermissionService: SqlEditorPermissionService,
   ) {
     this.statisticsMap = new Map();
     this.onQueryExecution = new Executor();
@@ -143,10 +143,6 @@ export class SqlQueryService {
     try {
       const dataSource = this.sqlDataSourceService.get(editorState.editorId);
 
-      if (!this.sqlEditorSettingsService.scriptExecutionEnabled) {
-        throw new Error('Script execution is not allowed');
-      }
-
       const contextInfo = dataSource?.executionContext;
       const executionContext = contextInfo && this.connectionExecutionContextService.get(contextInfo.id);
 
@@ -155,10 +151,14 @@ export class SqlQueryService {
         return;
       }
 
-      let model: IDatabaseDataModel<QueryDataSource>;
-
       const connectionKey = createConnectionParam(contextInfo.projectId, contextInfo.connectionId);
 
+      if (!this.sqlEditorPermissionService.isScriptExecutionEnabled(connectionKey)) {
+        throw new Error('Script execution is not allowed');
+      }
+
+      let model: IDatabaseDataModel<QueryDataSource>;
+
       const connectionInfo = await this.connectionInfoResource.load(connectionKey);
       tabGroup = this.sqlQueryResultService.getSelectedGroup(editorState);
 
@@ -224,10 +224,6 @@ export class SqlQueryService {
     try {
       const dataSource = this.sqlDataSourceService.get(editorState.editorId);
 
-      if (!this.sqlEditorSettingsService.scriptExecutionEnabled) {
-        throw new Error('Script execution is not allowed');
-      }
-
       const contextInfo = dataSource?.executionContext;
       const executionContext = contextInfo && this.connectionExecutionContextService.get(contextInfo.id);
 
@@ -236,9 +232,14 @@ export class SqlQueryService {
         return;
       }
 
-      const groupNameOrder = this.sqlQueryResultService.getGroupNameOrder(editorState);
       const connectionKey = createConnectionParam(contextInfo.projectId, contextInfo.connectionId);
 
+      if (!this.sqlEditorPermissionService.isScriptExecutionEnabled(connectionKey)) {
+        throw new Error('Script execution is not allowed');
+      }
+
+      const groupNameOrder = this.sqlQueryResultService.getGroupNameOrder(editorState);
+
       const connectionInfo = await this.connectionInfoResource.load(connectionKey);
 
       const statisticsTab = this.sqlQueryResultService.createStatisticsTab(editorState);
diff --git a/webapp/packages/plugin-sql-editor/src/index.ts b/webapp/packages/plugin-sql-editor/src/index.ts
index 29927e0a7e9..f822a978397 100644
--- a/webapp/packages/plugin-sql-editor/src/index.ts
+++ b/webapp/packages/plugin-sql-editor/src/index.ts
@@ -53,3 +53,4 @@ export * from './SqlEditorSettingsService.js';
 export * from './SqlEditorView.js';
 export * from './SqlResultTabs/SqlQueryService.js';
 export * from './downloadSql.js';
+export * from './SqlEditorPermissionService.js';
diff --git a/webapp/packages/plugin-sql-editor/src/module.ts b/webapp/packages/plugin-sql-editor/src/module.ts
index d8ab3301e53..2269065c0b2 100644
--- a/webapp/packages/plugin-sql-editor/src/module.ts
+++ b/webapp/packages/plugin-sql-editor/src/module.ts
@@ -26,6 +26,7 @@ import { MenuBootstrap } from './MenuBootstrap.js';
 import { LocaleService } from './LocaleService.js';
 import { SqlEditorModel } from './SqlEditorModel/SqlEditorModel.js';
 import { SqlEditorModelService } from './SqlEditorModel/SqlEditorModelService.js';
+import { SqlEditorPermissionService } from './SqlEditorPermissionService.js';
 
 export default ModuleRegistry.add({
   name: '@cloudbeaver/plugin-sql-editor',
@@ -56,6 +57,7 @@ export default ModuleRegistry.add({
       .addSingleton(SqlDataSourceService)
       .addSingleton(LocalStorageSqlDataSourceBootstrap)
       .addSingleton(SqlEditorModelService)
-      .addSingleton(MenuBootstrap);
+      .addSingleton(MenuBootstrap)
+      .addSingleton(SqlEditorPermissionService);
   },
 });
diff --git a/webapp/yarn.lock b/webapp/yarn.lock
index 4ff41a0b259..d8ca5ff4a07 100644
--- a/webapp/yarn.lock
+++ b/webapp/yarn.lock
@@ -3152,6 +3152,7 @@ __metadata:
   dependencies:
     "@cloudbeaver/core-blocks": "workspace:*"
     "@cloudbeaver/core-cli": "workspace:*"
+    "@cloudbeaver/core-connections": "workspace:*"
     "@cloudbeaver/core-di": "workspace:*"
     "@cloudbeaver/core-dialogs": "workspace:*"
     "@cloudbeaver/core-events": "workspace:*"