diff --git a/mycore-base/src/main/java/org/mycore/access/MCRAccessManager.java b/mycore-base/src/main/java/org/mycore/access/MCRAccessManager.java
index 50c53fd305..b6f2013b61 100644
--- a/mycore-base/src/main/java/org/mycore/access/MCRAccessManager.java
+++ b/mycore-base/src/main/java/org/mycore/access/MCRAccessManager.java
@@ -48,6 +48,8 @@ public class MCRAccessManager {
 
     public static final String PERMISSION_DELETE = "deletedb";
 
+    public static final String PERMISSION_CREATE_DERIVATE = "create-derivate";
+
     public static final String PERMISSION_PREVIEW = "preview";
 
     public static final String PERMISSION_VIEW = "view";
diff --git a/mycore-base/src/main/java/org/mycore/datamodel/metadata/MCRMetadataManager.java b/mycore-base/src/main/java/org/mycore/datamodel/metadata/MCRMetadataManager.java
index 5ab76d3a79..087c080f4e 100644
--- a/mycore-base/src/main/java/org/mycore/datamodel/metadata/MCRMetadataManager.java
+++ b/mycore-base/src/main/java/org/mycore/datamodel/metadata/MCRMetadataManager.java
@@ -18,6 +18,7 @@
 
 package org.mycore.datamodel.metadata;
 
+import static org.mycore.access.MCRAccessManager.PERMISSION_CREATE_DERIVATE;
 import static org.mycore.access.MCRAccessManager.PERMISSION_DELETE;
 import static org.mycore.access.MCRAccessManager.PERMISSION_WRITE;
 import static org.mycore.datamodel.metadata.MCRObjectService.DATE_TYPE_CREATEDATE;
@@ -125,11 +126,10 @@ private static void recordIDIfTracking(MCRObjectID id) {
      * @throws MCRPersistenceException
      *            if a persistence problem is occurred
      * @throws MCRAccessException
-     *            if write permission to object is missing or create permission to derivate is missing
+     *            if write permission or "create-derivate" permission to object is missing
      */
     public static void create(final MCRDerivate mcrDerivate) throws MCRPersistenceException, MCRAccessException {
         MCRObjectID derivateId = mcrDerivate.getId();
-        checkCreatePrivilege(derivateId);
         throwPersistenceExceptionIfExists(derivateId, MCRDerivate.OBJECT_TYPE);
 
         derivateId = assignNewIdIfNecessary(mcrDerivate);
@@ -139,6 +139,7 @@ public static void create(final MCRDerivate mcrDerivate) throws MCRPersistenceEx
 
             final MCRObjectID objectId = getObjectIDFromDerivate(mcrDerivate);
             checkWritePermission(objectId, derivateId);
+            checkCreateDerivatePermission(objectId, derivateId);
 
             byte[] objectBackup = retrieveObjectBackup(objectId);
 
@@ -184,6 +185,14 @@ private static void checkWritePermission(MCRObjectID objectId, MCRObjectID deriv
         }
     }
 
+    private static void checkCreateDerivatePermission(MCRObjectID objectId, MCRObjectID derivateId)
+        throws MCRAccessException {
+        if (!MCRAccessManager.checkPermission(objectId, PERMISSION_CREATE_DERIVATE)) {
+            throw new MCRMissingPermissionException("Add derivate " + derivateId + " to object.",
+                objectId.toString(), PERMISSION_CREATE_DERIVATE);
+        }
+    }
+
     private static byte[] retrieveObjectBackup(MCRObjectID objectId) throws MCRPersistenceException {
         byte[] objectBackup;
         try {
diff --git a/mycore-base/src/main/java/org/mycore/frontend/servlets/persistence/MCRCreateDerivateServlet.java b/mycore-base/src/main/java/org/mycore/frontend/servlets/persistence/MCRCreateDerivateServlet.java
index 4493639779..c8a9ce2c12 100644
--- a/mycore-base/src/main/java/org/mycore/frontend/servlets/persistence/MCRCreateDerivateServlet.java
+++ b/mycore-base/src/main/java/org/mycore/frontend/servlets/persistence/MCRCreateDerivateServlet.java
@@ -18,6 +18,7 @@
 
 package org.mycore.frontend.servlets.persistence;
 
+import static org.mycore.access.MCRAccessManager.PERMISSION_CREATE_DERIVATE;
 import static org.mycore.access.MCRAccessManager.PERMISSION_WRITE;
 
 import java.io.IOException;
@@ -48,6 +49,9 @@ void handlePersistenceOperation(HttpServletRequest request, HttpServletResponse
         if (!MCRAccessManager.checkPermission(objectID, PERMISSION_WRITE)) {
             throw new MCRMissingPermissionException("Add derivate.", objectID, PERMISSION_WRITE);
         }
+        if (!MCRAccessManager.checkPermission(objectID, PERMISSION_CREATE_DERIVATE)) {
+            throw new MCRMissingPermissionException("Add derivate.", objectID, PERMISSION_CREATE_DERIVATE);
+        }
     }
 
     /**
diff --git a/mycore-base/src/main/resources/config/mycore.properties b/mycore-base/src/main/resources/config/mycore.properties
index a75320aeff..1369aa9baa 100644
--- a/mycore-base/src/main/resources/config/mycore.properties
+++ b/mycore-base/src/main/resources/config/mycore.properties
@@ -283,7 +283,7 @@ MCR.Access.StorePermissions=read,writedb,deletedb
 MCR.Access.AddUserPermissions=read,writewf,deletewf,writedb,deletedb
 
 MCR.Access.Strategy.CreatorAnyStatePermissions=
-MCR.Access.Strategy.CreatorPermissions=writedb
+MCR.Access.Strategy.CreatorPermissions=writedb,create-derivate
 MCR.Access.Strategy.CreatorSubmittedPermissions=%MCR.Access.Strategy.CreatorPermissions%
 MCR.Access.Strategy.CreatorReviewPermissions=%MCR.Access.Strategy.CreatorPermissions%
 MCR.Access.Cache.Size=200
diff --git a/mycore-webtools/src/main/java/org/mycore/webtools/upload/MCRDefaultUploadHandler.java b/mycore-webtools/src/main/java/org/mycore/webtools/upload/MCRDefaultUploadHandler.java
index 62e08c7e5c..15d7363428 100644
--- a/mycore-webtools/src/main/java/org/mycore/webtools/upload/MCRDefaultUploadHandler.java
+++ b/mycore-webtools/src/main/java/org/mycore/webtools/upload/MCRDefaultUploadHandler.java
@@ -154,16 +154,9 @@ private static void checkPermissions(MCRObjectID oid) throws MCRInvalidUploadPar
                 OBJECT_DOES_NOT_EXIST_TRANSLATION_KEY, true);
         }
 
-        if (!oid.getTypeId().equals(MCRDerivate.OBJECT_TYPE)) {
-            try {
-                String derivateId = MCRObjectID.formatID(oid.getProjectId(), MCRDerivate.OBJECT_TYPE, 0);
-                MCRObjectID mcrDerivateId = MCRObjectID.getInstance(derivateId);
-                MCRMetadataManager.checkCreatePrivilege(mcrDerivateId);
-            } catch (MCRAccessException e) {
-                MCRUploadForbiddenException uploadForbiddenException = new MCRUploadForbiddenException(e.getMessage());
-                uploadForbiddenException.initCause(e);
-                throw uploadForbiddenException;
-            }
+        if (!oid.getTypeId().equals(MCRDerivate.OBJECT_TYPE)
+            && !MCRAccessManager.checkPermission(oid, MCRAccessManager.PERMISSION_CREATE_DERIVATE)) {
+            throw new MCRUploadForbiddenException();
         }
 
         if (!MCRAccessManager.checkPermission(oid, MCRAccessManager.PERMISSION_WRITE)) {