diff --git a/pkg/models/iam/am.go b/pkg/models/iam/am.go
index cd89f00e4af528da93a00dd2dee37927b0211f5a..8131e14de260e601e6731de9f7e5451aff92c575 100644
--- a/pkg/models/iam/am.go
+++ b/pkg/models/iam/am.go
@@ -489,21 +489,24 @@ func GetUserWorkspaceSimpleRules(workspace, username string) ([]models.SimpleRul
 		return GetWorkspaceRoleSimpleRules(workspace, constants.WorkspaceAdmin), nil
 	}
 
-	// workspaces-manager
-	if RulesMatchesRequired(clusterRules, rbacv1.PolicyRule{
-		Verbs:     []string{"*"},
-		APIGroups: []string{"*"},
-		Resources: []string{"workspaces", "workspaces/*"},
-	}) {
-		return GetWorkspaceRoleSimpleRules(workspace, constants.WorkspacesManager), nil
-	}
-
 	workspaceRole, err := GetUserWorkspaceRole(workspace, username)
 
 	if err != nil {
 		if apierrors.IsNotFound(err) {
+
+			// workspaces-manager
+			if RulesMatchesRequired(clusterRules, rbacv1.PolicyRule{
+				Verbs:     []string{"*"},
+				APIGroups: []string{"*"},
+				Resources: []string{"workspaces", "workspaces/*"},
+			}) {
+				return GetWorkspaceRoleSimpleRules(workspace, constants.WorkspacesManager), nil
+			}
+
 			return []models.SimpleRule{}, nil
 		}
+
+		klog.Error(err)
 		return nil, err
 	}