diff --git a/src/main/java/info/bukova/isspst/services/users/RoleService.java b/src/main/java/info/bukova/isspst/services/users/RoleService.java
index ea5d1d65..9b9349f8 100644
--- a/src/main/java/info/bukova/isspst/services/users/RoleService.java
+++ b/src/main/java/info/bukova/isspst/services/users/RoleService.java
@@ -4,6 +4,7 @@ import java.util.List;
 
 import info.bukova.isspst.data.Permission;
 import info.bukova.isspst.data.Role;
+import info.bukova.isspst.data.Workgroup;
 import info.bukova.isspst.services.Service;
 
 public interface RoleService extends Service<Role> {
@@ -13,5 +14,9 @@ public interface RoleService extends Service<Role> {
 	public List<Role> getCentreRoles();
 	public List<Role> getRolesWithPermission(Permission perm, boolean centre);
 	public List<Role> getRolesWithPermission(String authority, boolean centre);
+	public boolean canChangeCenter(Role role);
+	public boolean canChangeWorkgroup(Role role);
+	public boolean isInWorkflow(Role role);
+	public List<Workgroup> getRoleUsage(Role role);
 	
 }
diff --git a/src/main/java/info/bukova/isspst/services/users/RoleServiceImpl.java b/src/main/java/info/bukova/isspst/services/users/RoleServiceImpl.java
index 944f93fe..01fcae2c 100644
--- a/src/main/java/info/bukova/isspst/services/users/RoleServiceImpl.java
+++ b/src/main/java/info/bukova/isspst/services/users/RoleServiceImpl.java
@@ -2,6 +2,7 @@ package info.bukova.isspst.services.users;
 
 import info.bukova.isspst.data.Permission;
 import info.bukova.isspst.data.Role;
+import info.bukova.isspst.data.Workgroup;
 import info.bukova.isspst.services.AbstractService;
 
 import java.util.HashSet;
@@ -56,4 +57,40 @@ public class RoleServiceImpl extends AbstractService<Role> implements RoleServic
 		return getRolesWithPermission(p, centre);
 	}
 
+	@Override
+	@Transactional
+	public boolean canChangeWorkgroup(Role role) {
+		Query q = dao.getQuery("select count(w) from Workgroup w join w.members m where w.centre = false and m.role = :role");
+		q.setParameter("role", role);
+		long i = (Long)q.uniqueResult();
+		return i == 0;
+	}
+
+	@Override
+	@Transactional
+	public boolean canChangeCenter(Role role) {
+		Query q = dao.getQuery("select count(w) from Workgroup w join w.members m where w.centre = true and m.role = :role");
+		q.setParameter("role", role);
+		long i = (Long)q.uniqueResult();
+		return i == 0;
+	}
+	
+	@SuppressWarnings("unchecked")
+	@Override
+	@Transactional
+	public List<Workgroup> getRoleUsage(Role role) {
+		Query q = dao.getQuery("select distinct w from Workgroup w join w.members m where m.role = :role");
+		q.setParameter("role", role);
+		return q.list();
+	}
+
+	@Override
+	@Transactional
+	public boolean isInWorkflow(Role role) {
+		Query q = dao.getQuery("select count(*) from Workflow where role = :role");
+		q.setParameter("role", role);
+		long i = (Long)q.uniqueResult();
+		return i != 0;
+	}
+
 }
diff --git a/src/main/java/info/bukova/isspst/ui/users/PermissionForm.java b/src/main/java/info/bukova/isspst/ui/users/PermissionForm.java
index ee5f4c0d..b5082dbe 100644
--- a/src/main/java/info/bukova/isspst/ui/users/PermissionForm.java
+++ b/src/main/java/info/bukova/isspst/ui/users/PermissionForm.java
@@ -2,10 +2,14 @@ package info.bukova.isspst.ui.users;
 
 import info.bukova.isspst.Constants;
 import info.bukova.isspst.Module;
+import info.bukova.isspst.StringUtils;
 import info.bukova.isspst.data.Role;
+import info.bukova.isspst.data.Workgroup;
 import info.bukova.isspst.services.users.PermissionService;
+import info.bukova.isspst.services.users.RoleService;
 import info.bukova.isspst.ui.FormViewModel;
 
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 
@@ -16,11 +20,30 @@ public class PermissionForm extends FormViewModel<Role> {
 	
 	@WireVariable
 	private PermissionService permissionService;
+	@WireVariable
+	private RoleService roleService;
 	private RolePermissions rolePerms;
+	private boolean canChangeWorkgroup;
+	private boolean canChangeCentre;
+	private boolean inWorkflow;
+	private List<String> usage;
 	
 	@Init(superclass = true)
 	public void init() {
 		rolePerms = new RolePermissions(getDataBean(), permissionService.getAll());
+		canChangeWorkgroup = roleService.canChangeWorkgroup(getDataBean());
+		canChangeCentre = roleService.canChangeCenter(getDataBean());
+		inWorkflow = roleService.isInWorkflow(getDataBean());
+		List<Workgroup> wgList = roleService.getRoleUsage(getDataBean());
+		usage = new ArrayList<String>();		
+		
+		for (Workgroup w : wgList) {
+			usage.add(w.toString());
+		}
+		
+		if (inWorkflow) {
+			usage.add(StringUtils.localize("Workflow"));
+		}
 	}
 	
 	public List<Module> getModules() {
@@ -31,4 +54,20 @@ public class PermissionForm extends FormViewModel<Role> {
 		return rolePerms;
 	}
 
+	public boolean isCanChangeWorkgroup() {
+		return canChangeWorkgroup;
+	}
+
+	public boolean isCanChangeCentre() {
+		return canChangeCentre;
+	}
+
+	public boolean isInWorkflow() {
+		return inWorkflow;
+	}
+
+	public List<String> getUsage() {
+		return usage;
+	}
+
 }
diff --git a/src/main/webapp/WEB-INF/locales/zk-label.properties b/src/main/webapp/WEB-INF/locales/zk-label.properties
index 182b7ccf..82410706 100644
--- a/src/main/webapp/WEB-INF/locales/zk-label.properties
+++ b/src/main/webapp/WEB-INF/locales/zk-label.properties
@@ -64,6 +64,8 @@ RightsGridRole=Role
 RightsGridModules=Práva modulů
 WorkgroupFunction=Funkce v komisích
 CentreFunction=Funkce ve střediscích
+PermissionFormUsedIn=Použito v:
+
 
 AgendaSuppliers=Dodavatelé
 SuppliersFormTitle=Dodavatel
diff --git a/src/main/webapp/admin/permissions/permForm.zul b/src/main/webapp/admin/permissions/permForm.zul
index da5fa53c..784d4d2d 100644
--- a/src/main/webapp/admin/permissions/permForm.zul
+++ b/src/main/webapp/admin/permissions/permForm.zul
@@ -5,9 +5,26 @@
 	<caption zclass="form-caption" label="${labels.AgendaRights}" />
 	<label value="@load(vm.dataBean.description)" style="font-weight: bold;"/>
 	<hbox>
-			<checkbox label="${labels.WorkgroupFunction}" checked="@bind(vm.dataBean.workgroup)"/>
-			<checkbox label="${labels.CentreFunction}" checked="@bind(vm.dataBean.centre)"/>
-		</hbox>
+		<checkbox label="${labels.WorkgroupFunction}"
+			checked="@bind(vm.dataBean.workgroup)"
+			disabled="@load(not vm.canChangeWorkgroup or vm.inWorkflow)"
+			tooltip="@load((not vm.canChangeWorkgroup or vm.inWorkflow) ? 'wgUsage' : '')" />
+		<checkbox label="${labels.CentreFunction}"
+			checked="@bind(vm.dataBean.centre)"
+			disabled="@load(not vm.canChangeCentre or vm.inWorkflow)"
+			tooltip="@load((not vm.canChangeCentre or vm.inWorkflow) ? 'wgUsage' : '')" />
+	</hbox>
+	
+	<popup id="wgUsage">
+		<vbox>
+			<label value="${labels.PermissionFormUsedIn}" style="font-weight: bold;"/>
+			<vbox children="@load(vm.usage)">
+				<template name="children">
+					<label value="@load(each)"/>
+				</template>				
+			</vbox>
+		</vbox>
+	</popup>
 	
 	<vbox children="@load(vm.modules)" width="730px">
 		<template name="children" var="module">