diff --git a/rhodecode/model/user.py b/rhodecode/model/user.py
--- a/rhodecode/model/user.py
+++ b/rhodecode/model/user.py
@@ -531,6 +531,13 @@ class UserModel(BaseModel):
         """
         user = self.__get_user(user)
         perm = self.__get_perm(perm)
+        # if this permission is already granted skip it
+        _perm = UserToPerm.query()\
+            .filter(UserToPerm.user == user)\
+            .filter(UserToPerm.permission == perm)\
+            .scalar()
+        if _perm:
+            return
         new = UserToPerm()
         new.user = user
         new.permission = perm
@@ -546,7 +553,9 @@ class UserModel(BaseModel):
         user = self.__get_user(user)
         perm = self.__get_perm(perm)
 
-        obj = UserToPerm.query().filter(UserToPerm.user == user)\
-                .filter(UserToPerm.permission == perm).scalar()
+        obj = UserToPerm.query()\
+                .filter(UserToPerm.user == user)\
+                .filter(UserToPerm.permission == perm)\
+                .scalar()
         if obj:
             self.sa.delete(obj)
diff --git a/rhodecode/model/users_group.py b/rhodecode/model/users_group.py
--- a/rhodecode/model/users_group.py
+++ b/rhodecode/model/users_group.py
@@ -172,6 +172,14 @@ class UsersGroupModel(BaseModel):
 
         users_group = self.__get_users_group(users_group)
 
+        # if this permission is already granted skip it
+        _perm = UsersGroupToPerm.query()\
+            .filter(UsersGroupToPerm.users_group == users_group)\
+            .filter(UsersGroupToPerm.permission == perm)\
+            .scalar()
+        if _perm:
+            return
+
         new = UsersGroupToPerm()
         new.users_group = users_group
         new.permission = perm