diff --git a/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowChart.svelte b/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowChart.svelte
index 9c987c89d8..05cae46cfc 100644
--- a/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowChart.svelte
+++ b/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowChart.svelte
@@ -12,6 +12,7 @@
     notifications,
     Modal,
   } from "@budibase/bbui"
+  import { ActionStepID } from "constants/backend/automations"
 
   export let automation
   let testDataModal
@@ -82,7 +83,7 @@
       in:fly|local={{ x: 500, duration: 500 }}
       out:fly|local={{ x: 500, duration: 500 }}
     >
-      {#if block.stepId !== "LOOP"}
+      {#if block.stepId !== ActionStepID.LOOP}
         <FlowItem {testDataModal} {block} />
       {/if}
     </div>
diff --git a/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowItem.svelte b/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowItem.svelte
index 291575f3f2..412683721f 100644
--- a/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowItem.svelte
+++ b/packages/builder/src/components/automation/AutomationBuilder/FlowChart/FlowItem.svelte
@@ -10,11 +10,15 @@
     Select,
     ActionButton,
     notifications,
+    Label,
   } from "@budibase/bbui"
   import AutomationBlockSetup from "../../SetupPanel/AutomationBlockSetup.svelte"
   import CreateWebhookModal from "components/automation/Shared/CreateWebhookModal.svelte"
   import ActionModal from "./ActionModal.svelte"
   import FlowItemHeader from "./FlowItemHeader.svelte"
+  import RoleSelect from "components/design/settings/controls/RoleSelect.svelte"
+  import { ActionStepID, TriggerStepID } from "constants/backend/automations"
+  import { permissions } from "stores/backend"
 
   export let block
   export let testDataModal
@@ -23,9 +27,12 @@
   let actionModal
   let blockComplete
   let showLooping = false
+  let role
 
+  $: automationId = $automationStore.selectedAutomation?.automation._id
   $: showBindingPicker =
-    block.stepId === "CREATE_ROW" || block.stepId === "UPDATE_ROW"
+    block.stepId === ActionStepID.CREATE_ROW ||
+    block.stepId === ActionStepID.UPDATE_ROW
 
   $: isTrigger = block.type === "TRIGGER"
 
@@ -45,6 +52,32 @@
       x => x.blockToLoop === block.id
     )
 
+  $: setPermissions(role)
+  $: getPermissions(automationId)
+
+  async function setPermissions(role) {
+    if (!role || !automationId) {
+      return
+    }
+    await permissions.save({
+      level: "execute",
+      role,
+      resource: automationId,
+    })
+  }
+
+  async function getPermissions(automationId) {
+    if (!automationId) {
+      return
+    }
+    const perms = await permissions.forResource(automationId)
+    if (!perms["execute"]) {
+      role = "BASIC"
+    } else {
+      role = perms["execute"]
+    }
+  }
+
   async function removeLooping() {
     loopingSelected = false
     let loopBlock =
@@ -205,6 +238,10 @@
           </div>
         {/if}
 
+        {#if block.stepId === TriggerStepID.APP}
+          <Label>Role</Label>
+          <RoleSelect bind:value={role} />
+        {/if}
         <AutomationBlockSetup
           schemaProperties={Object.entries(block.schema.inputs.properties)}
           {block}
diff --git a/packages/builder/src/components/automation/AutomationBuilder/TestDisplay.svelte b/packages/builder/src/components/automation/AutomationBuilder/TestDisplay.svelte
index c6585b0bce..3f01dbeebd 100644
--- a/packages/builder/src/components/automation/AutomationBuilder/TestDisplay.svelte
+++ b/packages/builder/src/components/automation/AutomationBuilder/TestDisplay.svelte
@@ -1,6 +1,7 @@
 <script>
   import { Icon, Divider, Tabs, Tab, TextArea, Label } from "@budibase/bbui"
   import FlowItemHeader from "./FlowChart/FlowItemHeader.svelte"
+  import { ActionStepID } from "constants/backend/automations"
 
   export let automation
   export let testResults
@@ -10,7 +11,7 @@
   let blocks
 
   function prepTestResults(results) {
-    return results?.steps.filter(x => x.stepId !== "LOOP" || [])
+    return results?.steps.filter(x => x.stepId !== ActionStepID.LOOP || [])
   }
 
   function textArea(results, message) {
@@ -30,7 +31,7 @@
       }
       blocks = blocks
         .concat(automation.definition.steps || [])
-        .filter(x => x.stepId !== "LOOP")
+        .filter(x => x.stepId !== ActionStepID.LOOP)
     } else if (filteredResults) {
       blocks = filteredResults || []
       // make sure there is an ID for each block being displayed
@@ -45,7 +46,7 @@
 <div class="container">
   {#each blocks as block, idx}
     <div class="block" style={width ? `width: ${width}` : ""}>
-      {#if block.stepId !== "LOOP"}
+      {#if block.stepId !== ActionStepID.LOOP}
         <FlowItemHeader
           showTestStatus={true}
           bind:showParameters
diff --git a/packages/builder/src/components/automation/AutomationBuilder/TestPanel.svelte b/packages/builder/src/components/automation/AutomationBuilder/TestPanel.svelte
index 9e84350cd0..bdc39b74e1 100644
--- a/packages/builder/src/components/automation/AutomationBuilder/TestPanel.svelte
+++ b/packages/builder/src/components/automation/AutomationBuilder/TestPanel.svelte
@@ -2,6 +2,7 @@
   import { Icon, Divider } from "@budibase/bbui"
   import TestDisplay from "./TestDisplay.svelte"
   import { automationStore } from "builderStore"
+  import { ActionStepID } from "constants/backend/automations"
 
   export let automation
   export let testResults
@@ -16,7 +17,7 @@
       }
       blocks = blocks
         .concat(automation.definition.steps || [])
-        .filter(x => x.stepId !== "LOOP")
+        .filter(x => x.stepId !== ActionStepID.LOOP)
     } else if (testResults) {
       blocks = testResults.steps || []
     }
diff --git a/packages/builder/src/components/automation/AutomationPanel/CreateAutomationModal.svelte b/packages/builder/src/components/automation/AutomationPanel/CreateAutomationModal.svelte
index 9543a9c552..eb148534f3 100644
--- a/packages/builder/src/components/automation/AutomationPanel/CreateAutomationModal.svelte
+++ b/packages/builder/src/components/automation/AutomationPanel/CreateAutomationModal.svelte
@@ -11,6 +11,7 @@
     Body,
     Icon,
   } from "@budibase/bbui"
+  import { TriggerStepID } from "constants/backend/automations"
 
   let name
   let selectedTrigger
@@ -35,7 +36,7 @@
       )
 
       automationStore.actions.addBlockToAutomation(newBlock)
-      if (triggerVal.stepId === "WEBHOOK") {
+      if (triggerVal.stepId === TriggerStepID.WEBHOOK) {
         webhookModal.show
       }
 
diff --git a/packages/builder/src/components/automation/SetupPanel/AutomationBlockSetup.svelte b/packages/builder/src/components/automation/SetupPanel/AutomationBlockSetup.svelte
index c149b6a00e..8b34cf8cd2 100644
--- a/packages/builder/src/components/automation/SetupPanel/AutomationBlockSetup.svelte
+++ b/packages/builder/src/components/automation/SetupPanel/AutomationBlockSetup.svelte
@@ -30,6 +30,7 @@
   import { LuceneUtils } from "@budibase/frontend-core"
   import { getSchemaForTable } from "builderStore/dataBinding"
   import { Utils } from "@budibase/frontend-core"
+  import { TriggerStepID, ActionStepID } from "constants/backend/automations"
 
   export let block
   export let testData
@@ -54,12 +55,13 @@
   $: schema = getSchemaForTable(tableId, { searchableSchema: true }).schema
   $: schemaFields = Object.values(schema || {})
   $: queryLimit = tableId?.includes("datasource") ? "∞" : "1000"
+  $: isTrigger = block?.type === "TRIGGER"
 
   const onChange = Utils.sequential(async (e, key) => {
     try {
       if (isTestModal) {
         // Special case for webhook, as it requires a body, but the schema already brings back the body's contents
-        if (stepId === "WEBHOOK") {
+        if (stepId === TriggerStepID.WEBHOOK) {
           automationStore.actions.addTestDataToAutomation({
             body: {
               [key]: e.detail,
@@ -100,9 +102,9 @@
     // Extract all outputs from all previous steps as available bindins
     let bindings = []
     for (let idx = 0; idx < blockIdx; idx++) {
-      let wasLoopBlock = allSteps[idx]?.stepId === "LOOP"
+      let wasLoopBlock = allSteps[idx]?.stepId === ActionStepID.LOOP
       let isLoopBlock =
-        allSteps[idx]?.stepId === "LOOP" &&
+        allSteps[idx]?.stepId === ActionStepID.LOOP &&
         allSteps.find(x => x.blockToLoop === block.id)
 
       // If the previous block was a loop block, decerement the index so the following
@@ -261,6 +263,7 @@
         />
       {:else if value.customType === "table"}
         <TableSelector
+          {isTrigger}
           value={inputData[key]}
           on:change={e => onChange(e, key)}
         />
@@ -343,7 +346,7 @@
   <CreateWebhookModal />
 </Modal>
 
-{#if stepId === "WEBHOOK"}
+{#if stepId === TriggerStepID.WEBHOOK}
   <Button secondary on:click={() => webhookModal.show()}>Set Up Webhook</Button>
 {/if}
 
diff --git a/packages/builder/src/components/automation/SetupPanel/CronBuilder.svelte b/packages/builder/src/components/automation/SetupPanel/CronBuilder.svelte
index 1b410cd86a..93b8394b49 100644
--- a/packages/builder/src/components/automation/SetupPanel/CronBuilder.svelte
+++ b/packages/builder/src/components/automation/SetupPanel/CronBuilder.svelte
@@ -1,5 +1,5 @@
 <script>
-  import { Button, Select, Input } from "@budibase/bbui"
+  import { Button, Select, Input, Label } from "@budibase/bbui"
   import { createEventDispatcher } from "svelte"
   const dispatch = createEventDispatcher()
 
@@ -9,6 +9,7 @@
     dispatch("change", e.detail)
   }
 
+  let touched = false
   let presets = false
 
   const CRON_EXPRESSIONS = [
@@ -36,8 +37,10 @@
 </script>
 
 <div class="block-field">
-  <Input on:change={onChange} {value} />
-
+  <Input on:change={onChange} {value} on:blur={() => (touched = true)} />
+  {#if touched && !value}
+    <Label><div class="error">Please specify a CRON expression</div></Label>
+  {/if}
   <div class="presets">
     <Button on:click={() => (presets = !presets)}
       >{presets ? "Hide" : "Show"} Presets</Button
@@ -62,4 +65,8 @@
   .block-field {
     padding-top: var(--spacing-s);
   }
+  .error {
+    padding-top: var(--spacing-xs);
+    color: var(--spectrum-global-color-red-500);
+  }
 </style>
diff --git a/packages/builder/src/components/automation/SetupPanel/TableSelector.svelte b/packages/builder/src/components/automation/SetupPanel/TableSelector.svelte
index ceb28a37ca..1645ded66b 100644
--- a/packages/builder/src/components/automation/SetupPanel/TableSelector.svelte
+++ b/packages/builder/src/components/automation/SetupPanel/TableSelector.svelte
@@ -2,10 +2,16 @@
   import { tables } from "stores/backend"
   import { Select } from "@budibase/bbui"
   import { createEventDispatcher } from "svelte"
+  import { TableNames } from "constants"
 
   const dispatch = createEventDispatcher()
 
   export let value
+  export let isTrigger
+
+  $: filteredTables = $tables.list.filter(table => {
+    return !isTrigger || table._id !== TableNames.USERS
+  })
 
   const onChange = e => {
     value = e.detail
@@ -16,7 +22,7 @@
 <Select
   on:change={onChange}
   bind:value
-  options={$tables.list}
+  options={filteredTables}
   getOptionLabel={table => table.name}
   getOptionValue={table => table._id}
 />
diff --git a/packages/builder/src/components/deploy/CreateWebhookDeploymentModal.svelte b/packages/builder/src/components/deploy/CreateWebhookDeploymentModal.svelte
index 19cea6db65..ee6b163a3e 100644
--- a/packages/builder/src/components/deploy/CreateWebhookDeploymentModal.svelte
+++ b/packages/builder/src/components/deploy/CreateWebhookDeploymentModal.svelte
@@ -3,6 +3,7 @@
   import { ModalContent } from "@budibase/bbui"
   import { onMount } from "svelte"
   import WebhookDisplay from "../automation/Shared/WebhookDisplay.svelte"
+  import { TriggerStepID } from "constants/backend/automations"
 
   let webhookUrls = []
 
@@ -11,7 +12,7 @@
   onMount(() => {
     webhookUrls = automations.map(automation => {
       const trigger = automation.definition.trigger
-      if (trigger?.stepId === "WEBHOOK" && trigger.inputs) {
+      if (trigger?.stepId === TriggerStepID.WEBHOOK && trigger.inputs) {
         return {
           type: "Automation",
           name: automation.name,
diff --git a/packages/builder/src/components/design/settings/controls/ButtonActionEditor/actions/TriggerAutomation.svelte b/packages/builder/src/components/design/settings/controls/ButtonActionEditor/actions/TriggerAutomation.svelte
index fa32c88d65..4f661096c5 100644
--- a/packages/builder/src/components/design/settings/controls/ButtonActionEditor/actions/TriggerAutomation.svelte
+++ b/packages/builder/src/components/design/settings/controls/ButtonActionEditor/actions/TriggerAutomation.svelte
@@ -2,6 +2,7 @@
   import { Select, Label, Input, Checkbox } from "@budibase/bbui"
   import { automationStore } from "builderStore"
   import SaveFields from "./SaveFields.svelte"
+  import { TriggerStepID } from "constants/backend/automations"
 
   export let parameters = {}
   export let bindings = []
@@ -16,7 +17,7 @@
     : AUTOMATION_STATUS.NEW
 
   $: automations = $automationStore.automations
-    .filter(a => a.definition.trigger?.stepId === "APP")
+    .filter(a => a.definition.trigger?.stepId === TriggerStepID.APP)
     .map(automation => {
       const schema = Object.entries(
         automation.definition.trigger.inputs.fields || {}
diff --git a/packages/builder/src/constants/backend/automations.js b/packages/builder/src/constants/backend/automations.js
new file mode 100644
index 0000000000..e0cd5b6405
--- /dev/null
+++ b/packages/builder/src/constants/backend/automations.js
@@ -0,0 +1,28 @@
+export const TriggerStepID = {
+  ROW_SAVED: "ROW_SAVED",
+  ROW_UPDATED: "ROW_UPDATED",
+  ROW_DELETED: "ROW_DELETED",
+  WEBHOOK: "WEBHOOK",
+  APP: "APP",
+  CRON: "CRON",
+}
+
+export const ActionStepID = {
+  SEND_EMAIL_SMTP: "SEND_EMAIL_SMTP",
+  CREATE_ROW: "CREATE_ROW",
+  UPDATE_ROW: "UPDATE_ROW",
+  DELETE_ROW: "DELETE_ROW",
+  OUTGOING_WEBHOOK: "OUTGOING_WEBHOOK",
+  EXECUTE_SCRIPT: "EXECUTE_SCRIPT",
+  EXECUTE_QUERY: "EXECUTE_QUERY",
+  SERVER_LOG: "SERVER_LOG",
+  DELAY: "DELAY",
+  FILTER: "FILTER",
+  QUERY_ROWS: "QUERY_ROWS",
+  LOOP: "LOOP",
+  // these used to be lowercase step IDs, maintain for backwards compat
+  discord: "discord",
+  slack: "slack",
+  zapier: "zapier",
+  integromat: "integromat",
+}
diff --git a/packages/server/src/api/routes/tests/permissions.spec.js b/packages/server/src/api/routes/tests/permissions.spec.js
index 2b231dbe64..b416d1c0bf 100644
--- a/packages/server/src/api/routes/tests/permissions.spec.js
+++ b/packages/server/src/api/routes/tests/permissions.spec.js
@@ -37,9 +37,10 @@ describe("/permission", () => {
         .expect("Content-Type", /json/)
         .expect(200)
       expect(res.body).toBeDefined()
-      expect(res.body.length).toEqual(2)
+      expect(res.body.length).toEqual(3)
       expect(res.body).toContain("read")
       expect(res.body).toContain("write")
+      expect(res.body).toContain("execute")
     })
   })
 
diff --git a/packages/server/src/automations/utils.ts b/packages/server/src/automations/utils.ts
index 1f86abc5b9..906923b2e9 100644
--- a/packages/server/src/automations/utils.ts
+++ b/packages/server/src/automations/utils.ts
@@ -97,7 +97,7 @@ export async function enableCronTrigger(appId: any, automation: any) {
     )
   }
   // need to create cron job
-  if (isCronTrigger(automation)) {
+  if (isCronTrigger(automation) && trigger?.inputs.cron) {
     // make a job id rather than letting Bull decide, makes it easier to handle on way out
     const jobId = `${appId}_cron_${newid()}`
     const job: any = await queue.add(
diff --git a/packages/server/src/utilities/security.js b/packages/server/src/utilities/security.js
index de5b696553..a0d9c8d57f 100644
--- a/packages/server/src/utilities/security.js
+++ b/packages/server/src/utilities/security.js
@@ -13,6 +13,7 @@ const { DocumentTypes } = require("../db/utils")
 const CURRENTLY_SUPPORTED_LEVELS = [
   PermissionLevels.WRITE,
   PermissionLevels.READ,
+  PermissionLevels.EXECUTE,
 ]
 
 exports.getPermissionType = resourceId => {