diff --git a/db/changes/235001/00-updateACL_Role_VnRole.sql b/db/changes/235001/00-updateACL_Role_VnRole.sql
new file mode 100644
index 000000000..0b1083991
--- /dev/null
+++ b/db/changes/235001/00-updateACL_Role_VnRole.sql
@@ -0,0 +1,8 @@
+--  Auto-generated SQL script #202311301038
+INSERT INTO `salix`.`ACL` (model,property,accessType,permission,principalType,principalId)
+	VALUES ('VnRole','*','*','ALLOW','ROLE','$everyone');
+INSERT INTO `salix`.`ACL` (model,property,accessType,permission,principalType,principalId)
+	VALUES ('VnRole','*','*','ALLOW','ROLE','employee');
+
+--  Auto-generated SQL script #202311301203
+UPDATE `salix`.`ACL` SET permission='DENY' WHERE model='Role';