diff --git a/apps/web/app/(use-page-wrapper)/event-types/[type]/page.tsx b/apps/web/app/(use-page-wrapper)/event-types/[type]/page.tsx
index 43f400905c..116c8ff97f 100644
--- a/apps/web/app/(use-page-wrapper)/event-types/[type]/page.tsx
+++ b/apps/web/app/(use-page-wrapper)/event-types/[type]/page.tsx
@@ -8,6 +8,10 @@ import { z } from "zod";
 
 import { EventTypeWebWrapper } from "@calcom/atoms/event-types/wrappers/EventTypeWebWrapper";
 import { getServerSession } from "@calcom/features/auth/lib/getServerSession";
+import { Resource } from "@calcom/features/pbac/domain/types/permission-registry";
+import { getResourcePermissions } from "@calcom/features/pbac/lib/resource-permissions";
+import { prisma } from "@calcom/prisma";
+import { MembershipRole } from "@calcom/prisma/enums";
 import { eventTypesRouter } from "@calcom/trpc/server/routers/viewer/eventTypes/_router";
 
 import { buildLegacyRequest } from "@lib/buildLegacyCtx";
@@ -40,6 +44,95 @@ const getCachedEventType = unstable_cache(
   { revalidate: 3600 } // Cache for 1 hour
 );
 
+const getEventPermissions = async (userId: number, teamId: number | null) => {
+  // Personal event - has all perms
+  if (!teamId)
+    return {
+      eventTypes: {
+        canRead: true,
+        canCreate: true,
+        canUpdate: true,
+        canDelete: true,
+      },
+      workflows: {
+        canRead: true,
+        canCreate: true,
+        canUpdate: true,
+        canDelete: true,
+      },
+    };
+
+  const membership = await prisma.membership.findFirst({
+    where: {
+      userId,
+      teamId,
+    },
+    select: {
+      role: true,
+    },
+  });
+
+  if (!membership) throw new Error("Membership not found");
+
+  const [eventTypePermissions, workflowPermissions] = await Promise.all([
+    getResourcePermissions({
+      userId,
+      teamId,
+      resource: Resource.EventType,
+      userRole: membership.role,
+      fallbackRoles: {
+        read: {
+          roles: [MembershipRole.MEMBER, MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+        update: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+        delete: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+        create: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+      },
+    }),
+    getResourcePermissions({
+      userId,
+      teamId,
+      resource: Resource.Workflow,
+      userRole: membership.role,
+      fallbackRoles: {
+        read: {
+          roles: [MembershipRole.MEMBER, MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+        update: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+        delete: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+        create: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+      },
+    }),
+  ]);
+
+  return {
+    eventTypes: {
+      canRead: eventTypePermissions.canRead,
+      canCreate: eventTypePermissions.canCreate,
+      canUpdate: eventTypePermissions.canEdit,
+      canDelete: eventTypePermissions.canDelete,
+    },
+    workflows: {
+      canRead: workflowPermissions.canRead,
+      canCreate: workflowPermissions.canCreate,
+      canUpdate: workflowPermissions.canEdit,
+      canDelete: workflowPermissions.canDelete,
+    },
+  };
+};
+
 const ServerPage = async ({ params }: PageProps) => {
   const session = await getServerSession({ req: buildLegacyRequest(await headers(), await cookies()) });
   if (!session?.user?.id) {
@@ -59,7 +152,10 @@ const ServerPage = async ({ params }: PageProps) => {
     throw new Error("This event type does not exist");
   }
 
-  return <EventTypeWebWrapper data={data} id={eventTypeId} />;
+  // Fetch permissions for the event type's team
+  const permissions = await getEventPermissions(session.user.id, data.eventType.teamId);
+
+  return <EventTypeWebWrapper data={data} id={eventTypeId} permissions={permissions} />;
 };
 
 export default ServerPage;
diff --git a/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/RoleSheet.tsx b/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/RoleSheet.tsx
index df10530954..68360fdb30 100644
--- a/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/RoleSheet.tsx
+++ b/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/RoleSheet.tsx
@@ -107,9 +107,9 @@ export function RoleSheet({ role, open, onOpenChange, teamId, scope = Scope.Orga
 
   const { isAdvancedMode, permissions, color } = form.watch();
 
-  const filteredResources = useMemo(() => {
+  const { filteredResources, scopedRegistry } = useMemo(() => {
     const scopedRegistry = getPermissionsForScope(scope);
-    return Object.keys(scopedRegistry).filter((resource) =>
+    const filteredResources = Object.keys(scopedRegistry).filter((resource) =>
       t(
         scopedRegistry[resource as Resource][CrudAction.All as keyof (typeof scopedRegistry)[Resource]]
           ?.i18nKey || ""
@@ -117,6 +117,7 @@ export function RoleSheet({ role, open, onOpenChange, teamId, scope = Scope.Orga
         .toLowerCase()
         .includes(searchQuery.toLowerCase())
     );
+    return { filteredResources, scopedRegistry };
   }, [searchQuery, t, scope]);
 
   const createMutation = trpc.viewer.pbac.createRole.useMutation({
@@ -212,7 +213,6 @@ export function RoleSheet({ role, open, onOpenChange, teamId, scope = Scope.Orga
                       disabled={isSystemRole}
                     />
                   </div>
-
                   {filteredResources.map((resource) => (
                     <AdvancedPermissionGroup
                       key={resource}
@@ -222,7 +222,7 @@ export function RoleSheet({ role, open, onOpenChange, teamId, scope = Scope.Orga
                       disabled={isSystemRole}
                       scope={scope}
                     />
-                  ))}
+                  ))}{" "}
                 </div>
               ) : (
                 <div className="bg-muted rounded-xl p-1">
@@ -237,7 +237,7 @@ export function RoleSheet({ role, open, onOpenChange, teamId, scope = Scope.Orga
                     </div>
                   </div>
                   <div className="bg-default border-subtle divide-subtle divide-y rounded-[10px] border">
-                    {Object.keys(getPermissionsForScope(scope)).map((resource) => (
+                    {Object.keys(scopedRegistry).map((resource) => (
                       <SimplePermissionItem
                         key={resource}
                         resource={resource}
@@ -247,7 +247,7 @@ export function RoleSheet({ role, open, onOpenChange, teamId, scope = Scope.Orga
                         scope={scope}
                       />
                     ))}
-                  </div>
+                  </div>{" "}
                 </div>
               )}
             </div>
diff --git a/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/SimplePermissionItem.tsx b/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/SimplePermissionItem.tsx
index 5ba1ec0d86..e658890c30 100644
--- a/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/SimplePermissionItem.tsx
+++ b/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/SimplePermissionItem.tsx
@@ -1,7 +1,11 @@
 "use client";
 
-import type { Resource, Scope } from "@calcom/features/pbac/domain/types/permission-registry";
-import { PERMISSION_REGISTRY } from "@calcom/features/pbac/domain/types/permission-registry";
+import type { Resource } from "@calcom/features/pbac/domain/types/permission-registry";
+import {
+  Scope,
+  PERMISSION_REGISTRY,
+  getPermissionsForScope,
+} from "@calcom/features/pbac/domain/types/permission-registry";
 import { useLocale } from "@calcom/lib/hooks/useLocale";
 import { ToggleGroup } from "@calcom/ui/components/form";
 
@@ -21,11 +25,13 @@ export function SimplePermissionItem({
   permissions,
   onChange,
   disabled,
-  scope,
+  scope = Scope.Organization,
 }: SimplePermissionItemProps) {
   const { t } = useLocale();
   const { getResourcePermissionLevel, toggleResourcePermissionLevel } = usePermissions(scope);
+  const scopedRegistry = getPermissionsForScope(scope);
 
+  const registry = scopedRegistry || PERMISSION_REGISTRY;
   const isAllResources = resource === "*";
   const options = isAllResources
     ? [
@@ -41,7 +47,7 @@ export function SimplePermissionItem({
   return (
     <div className="flex items-center justify-between px-3 py-2">
       <span className="text-default text-sm font-medium leading-none">
-        {t(PERMISSION_REGISTRY[resource as Resource]._resource?.i18nKey || resource)}
+        {t(registry[resource as Resource]._resource?.i18nKey || resource)}
       </span>
       <ToggleGroup
         onValueChange={(val) => {
diff --git a/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/usePermissions.ts b/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/usePermissions.ts
index d7d5c2ea36..176186a29f 100644
--- a/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/usePermissions.ts
+++ b/apps/web/app/(use-page-wrapper)/settings/(settings-layout)/organizations/roles/_components/usePermissions.ts
@@ -1,8 +1,5 @@
 import { CrudAction, Scope } from "@calcom/features/pbac/domain/types/permission-registry";
-import {
-  PERMISSION_REGISTRY,
-  getPermissionsForScope,
-} from "@calcom/features/pbac/domain/types/permission-registry";
+import { getPermissionsForScope } from "@calcom/features/pbac/domain/types/permission-registry";
 import {
   getTransitiveDependencies,
   getTransitiveDependents,
@@ -52,7 +49,8 @@ export function usePermissions(scope: Scope = Scope.Organization): UsePermission
       return permissions.includes("*.*") ? "all" : "none";
     }
 
-    const resourceConfig = PERMISSION_REGISTRY[resource as keyof typeof PERMISSION_REGISTRY];
+    const scopedRegistry = getPermissionsForScope(scope);
+    const resourceConfig = scopedRegistry[resource as keyof typeof scopedRegistry];
     if (!resourceConfig) return "none";
 
     // Check if global all permissions (*.*) is present
@@ -111,7 +109,19 @@ export function usePermissions(scope: Scope = Scope.Organization): UsePermission
           allResourcePerms = Object.keys(resourceConfig)
             .filter((action) => !action.startsWith("_"))
             .map((action) => `${resource}.${action}`);
+
+          // Add the resource permissions
           newPermissions.push(...allResourcePerms);
+
+          // Add all transitive dependencies for each permission
+          allResourcePerms.forEach((perm) => {
+            const dependencies = getTransitiveDependencies(perm, scope);
+            dependencies.forEach((dep) => {
+              if (!newPermissions.includes(dep)) {
+                newPermissions.push(dep);
+              }
+            });
+          });
           break;
       }
 
@@ -132,15 +142,12 @@ export function usePermissions(scope: Scope = Scope.Organization): UsePermission
     // First, remove *.* since we're modifying individual permissions
     let newPermissions = currentPermissions.filter((p) => p !== "*.*");
 
-    // Parse the permission to get resource and action
-    const [resource, action] = permission.split(".");
-
     if (enabled) {
       // Add the requested permission
       newPermissions.push(permission);
 
       // Add all transitive dependencies
-      const dependencies = getTransitiveDependencies(permission);
+      const dependencies = getTransitiveDependencies(permission, scope);
       dependencies.forEach((dependency) => {
         if (!newPermissions.includes(dependency)) {
           newPermissions.push(dependency);
@@ -151,7 +158,7 @@ export function usePermissions(scope: Scope = Scope.Organization): UsePermission
       newPermissions = newPermissions.filter((p) => p !== permission);
 
       // Remove all transitive dependents
-      const dependents = getTransitiveDependents(permission);
+      const dependents = getTransitiveDependents(permission, scope);
       dependents.forEach((dependent) => {
         newPermissions = newPermissions.filter((p) => p !== dependent);
       });
diff --git a/apps/web/modules/event-types/views/event-types-listing-view.tsx b/apps/web/modules/event-types/views/event-types-listing-view.tsx
index 6ca2619060..6fe670651a 100644
--- a/apps/web/modules/event-types/views/event-types-listing-view.tsx
+++ b/apps/web/modules/event-types/views/event-types-listing-view.tsx
@@ -27,7 +27,7 @@ import { useTypedQuery } from "@calcom/lib/hooks/useTypedQuery";
 import { HttpError } from "@calcom/lib/http-error";
 import { parseEventTypeColor } from "@calcom/lib/isEventTypeColor";
 import { localStorage } from "@calcom/lib/webstorage";
-import type { MembershipRole } from "@calcom/prisma/enums";
+import { MembershipRole } from "@calcom/prisma/enums";
 import { SchedulingType } from "@calcom/prisma/enums";
 import type { RouterOutputs } from "@calcom/trpc/react";
 import { trpc } from "@calcom/trpc/react";
@@ -954,6 +954,24 @@ export const EventTypesCTA = ({ userEventGroupsData }: Omit<Props, "user">) => {
     userEventGroupsData?.profiles
       ?.filter((profile) => !profile.readOnly)
       ?.filter((profile) => !profile.eventTypesLockedByOrg)
+      ?.filter((profile) => {
+        // For personal profiles (teamId is null), always allow creation
+        if (!profile.teamId) {
+          return true;
+        }
+
+        // For team profiles, check if user has eventType.create permission
+        // This will be populated by the server-side PBAC check
+        // Fallback to role-based check (admin/owner) if canCreateEventTypes is not set
+        if (profile.canCreateEventTypes !== undefined) {
+          return profile.canCreateEventTypes;
+        }
+
+        // Fallback: allow admin and owner roles
+        return (
+          profile.membershipRole === MembershipRole.ADMIN || profile.membershipRole === MembershipRole.OWNER
+        );
+      })
       ?.map((profile) => {
         return {
           teamId: profile.teamId,
diff --git a/packages/features/eventtypes/components/tabs/workflows/EventWorkfowsTab.tsx b/packages/features/eventtypes/components/tabs/workflows/EventWorkfowsTab.tsx
index 87e27a2200..0cae9b1b9a 100644
--- a/packages/features/eventtypes/components/tabs/workflows/EventWorkfowsTab.tsx
+++ b/packages/features/eventtypes/components/tabs/workflows/EventWorkfowsTab.tsx
@@ -25,7 +25,10 @@ import { showToast } from "@calcom/ui/components/toast";
 import { Tooltip } from "@calcom/ui/components/tooltip";
 import { revalidateEventTypeEditPage } from "@calcom/web/app/(use-page-wrapper)/event-types/[type]/actions";
 
-type PartialWorkflowType = Pick<WorkflowType, "name" | "activeOn" | "isOrg" | "steps" | "id" | "readOnly">;
+type PartialWorkflowType = Pick<
+  WorkflowType,
+  "name" | "activeOn" | "isOrg" | "steps" | "id" | "readOnly" | "permissions"
+>;
 
 type ItemProps = {
   workflow: PartialWorkflowType;
@@ -42,14 +45,6 @@ const WorkflowListItem = (props: ItemProps) => {
   const { workflow, eventType, isActive } = props;
   const { t } = useLocale();
 
-  const [activeEventTypeIds, setActiveEventTypeIds] = useState(
-    workflow.activeOn?.map((active) => {
-      if (active.eventType) {
-        return active.eventType.id;
-      }
-    }) ?? []
-  );
-
   const utils = trpc.useUtils();
 
   const activateEventTypeMutation = trpc.viewer.workflows.activateEventType.useMutation({
@@ -137,7 +132,7 @@ const WorkflowListItem = (props: ItemProps) => {
             </div>
           </>
         </div>
-        {!workflow.readOnly && (
+        {workflow.permissions?.canUpdate && (
           <div className="flex-none">
             <Link href={`/workflows/${workflow.id}`} passHref={true} target="_blank">
               <Button type="button" color="minimal" className="mr-4" EndIcon="external-link">
@@ -162,7 +157,7 @@ const WorkflowListItem = (props: ItemProps) => {
             )}
             <Switch
               checked={isActive}
-              disabled={workflow.readOnly}
+              disabled={!workflow.permissions?.canUpdate}
               onCheckedChange={() => {
                 activateEventTypeMutation.mutate({ workflowId: workflow.id, eventTypeId: eventType.id });
               }}
@@ -230,7 +225,7 @@ function EventWorkflowsTab(props: Props) {
 
   const createMutation = trpc.viewer.workflows.create.useMutation({
     onSuccess: async ({ workflow }) => {
-      await router.replace(`/workflows/${workflow.id}?eventTypeId=${eventType.id}`);
+      router.replace(`/workflows/${workflow.id}?eventTypeId=${eventType.id}`);
     },
     onError: (err) => {
       if (err instanceof HttpError) {
diff --git a/packages/features/pbac/client/components/WorkflowTabPermissionGuard.tsx b/packages/features/pbac/client/components/WorkflowTabPermissionGuard.tsx
new file mode 100644
index 0000000000..3eec868a93
--- /dev/null
+++ b/packages/features/pbac/client/components/WorkflowTabPermissionGuard.tsx
@@ -0,0 +1,23 @@
+"use client";
+
+import type { ReactNode } from "react";
+
+import { useWorkflowPermission } from "../hooks/useEventPermission";
+
+interface WorkflowTabPermissionGuardProps {
+  children: ReactNode;
+  fallback?: ReactNode;
+}
+
+export const WorkflowTabPermissionGuard = ({
+  children,
+  fallback = null,
+}: WorkflowTabPermissionGuardProps) => {
+  const { hasPermission } = useWorkflowPermission("workflow.read");
+
+  if (!hasPermission) {
+    return <>{fallback}</>;
+  }
+
+  return <>{children}</>;
+};
diff --git a/packages/features/pbac/client/context/EventPermissionContext.tsx b/packages/features/pbac/client/context/EventPermissionContext.tsx
new file mode 100644
index 0000000000..c63725a972
--- /dev/null
+++ b/packages/features/pbac/client/context/EventPermissionContext.tsx
@@ -0,0 +1,80 @@
+"use client";
+
+import { createContext, useContext } from "react";
+import { createStore, useStore } from "zustand";
+
+export interface EventPermissions {
+  eventTypes: {
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+  };
+  workflows: {
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+  };
+}
+
+interface EventPermissionStore {
+  permissions: EventPermissions;
+  setPermissions: (permissions: EventPermissions) => void;
+  hasEventTypePermission: (permission: keyof EventPermissions["eventTypes"]) => boolean;
+  hasWorkflowPermission: (permission: keyof EventPermissions["workflows"]) => boolean;
+}
+
+const createEventPermissionStore = (
+  initialPermissions: EventPermissions = {
+    eventTypes: {
+      canRead: false,
+      canCreate: false,
+      canUpdate: false,
+      canDelete: false,
+    },
+    workflows: {
+      canRead: false,
+      canCreate: false,
+      canUpdate: false,
+      canDelete: false,
+    },
+  }
+) =>
+  createStore<EventPermissionStore>()((set, get) => ({
+    permissions: initialPermissions,
+    setPermissions: (permissions) => set({ permissions }),
+    hasEventTypePermission: (permission) => {
+      const { permissions } = get();
+      return permissions.eventTypes[permission];
+    },
+    hasWorkflowPermission: (permission) => {
+      const { permissions } = get();
+      return permissions.workflows[permission];
+    },
+  }));
+
+type EventPermissionStoreApi = ReturnType<typeof createEventPermissionStore>;
+
+const EventPermissionContext = createContext<EventPermissionStoreApi | undefined>(undefined);
+
+interface EventPermissionProviderProps {
+  children: React.ReactNode;
+  initialPermissions: EventPermissions;
+}
+
+export const EventPermissionProvider = ({ children, initialPermissions }: EventPermissionProviderProps) => {
+  const store = createEventPermissionStore(initialPermissions);
+
+  return <EventPermissionContext.Provider value={store}>{children}</EventPermissionContext.Provider>;
+};
+
+export const useEventPermissionStore = <T,>(selector: (store: EventPermissionStore) => T): T => {
+  const eventPermissionStoreContext = useContext(EventPermissionContext);
+
+  if (!eventPermissionStoreContext) {
+    throw new Error("useEventPermissionStore must be used within EventPermissionProvider");
+  }
+
+  return useStore(eventPermissionStoreContext, selector);
+};
diff --git a/packages/features/pbac/client/hooks/useEventPermission.ts b/packages/features/pbac/client/hooks/useEventPermission.ts
new file mode 100644
index 0000000000..a4529ac02b
--- /dev/null
+++ b/packages/features/pbac/client/hooks/useEventPermission.ts
@@ -0,0 +1,51 @@
+"use client";
+
+import type { EventPermissions } from "../context/EventPermissionContext";
+import { useEventPermissionStore } from "../context/EventPermissionContext";
+
+export const useEventTypePermission = (permission: keyof EventPermissions["eventTypes"]) => {
+  return useEventPermissionStore((state) => ({
+    hasPermission: state.hasEventTypePermission(permission),
+    permissions: state.permissions.eventTypes,
+  }));
+};
+
+export const useWorkflowPermission = (permission: keyof EventPermissions["workflows"]) => {
+  return useEventPermissionStore((state) => ({
+    hasPermission: state.hasWorkflowPermission(permission),
+    permissions: state.permissions.workflows,
+  }));
+};
+
+export const useAllEventPermissions = () => {
+  return useEventPermissionStore((state) => state.permissions);
+};
+
+// Convenience hooks for common permissions
+export const useCanCreateEventTypes = () => {
+  return useEventPermissionStore((state) => state.permissions.eventTypes.canCreate);
+};
+
+export const useCanUpdateEventTypes = () => {
+  return useEventPermissionStore((state) => state.permissions.eventTypes.canUpdate);
+};
+
+export const useCanDeleteEventTypes = () => {
+  return useEventPermissionStore((state) => state.permissions.eventTypes.canDelete);
+};
+
+export const useCanReadWorkflows = () => {
+  return useEventPermissionStore((state) => state.permissions.workflows.canRead);
+};
+
+export const useCanCreateWorkflows = () => {
+  return useEventPermissionStore((state) => state.permissions.workflows.canCreate);
+};
+
+export const useCanUpdateWorkflows = () => {
+  return useEventPermissionStore((state) => state.permissions.workflows.canUpdate);
+};
+
+export const useCanDeleteWorkflows = () => {
+  return useEventPermissionStore((state) => state.permissions.workflows.canDelete);
+};
diff --git a/packages/features/pbac/domain/types/permission-registry.ts b/packages/features/pbac/domain/types/permission-registry.ts
index 89850633c0..3a60b06faa 100644
--- a/packages/features/pbac/domain/types/permission-registry.ts
+++ b/packages/features/pbac/domain/types/permission-registry.ts
@@ -264,7 +264,7 @@ export const PERMISSION_REGISTRY: PermissionRegistry = {
       category: "team",
       i18nKey: "pbac_action_invite",
       descriptionI18nKey: "pbac_desc_invite_team_members",
-      dependsOn: ["team.read", "team.listMembers"],
+      dependsOn: ["team.read", "team.listMembers", "role.read"],
     },
     [CustomAction.Remove]: {
       description: "Remove team members",
@@ -284,7 +284,7 @@ export const PERMISSION_REGISTRY: PermissionRegistry = {
       category: "team",
       i18nKey: "pbac_action_change_member_role",
       descriptionI18nKey: "pbac_desc_change_team_member_role",
-      dependsOn: ["team.read", "team.listMembers"],
+      dependsOn: ["team.read", "team.listMembers", "role.read"],
     },
     [CustomAction.Impersonate]: {
       description: "Impersonate team members",
diff --git a/packages/features/pbac/utils/permissionTraversal.ts b/packages/features/pbac/utils/permissionTraversal.ts
index e0acd23ea2..70f0892437 100644
--- a/packages/features/pbac/utils/permissionTraversal.ts
+++ b/packages/features/pbac/utils/permissionTraversal.ts
@@ -1,4 +1,10 @@
-import { CrudAction, type CustomAction, PERMISSION_REGISTRY } from "../domain/types/permission-registry";
+import {
+  CrudAction,
+  type CustomAction,
+  PERMISSION_REGISTRY,
+  Scope,
+  getPermissionsForScope,
+} from "../domain/types/permission-registry";
 
 /**
  * Helper function to split permission string into resource and action
@@ -22,15 +28,18 @@ const splitPermission = (permission: string): { resource: string; action: string
  * Generic permission graph traversal function using BFS
  * @param startPermission The permission to start traversal from
  * @param direction Whether to find dependencies or dependents
+ * @param scope The scope to use for permission registry (defaults to Organization)
  * @returns Array of related permissions (excluding the start permission itself)
  */
 export const traversePermissions = (
   startPermission: string,
-  direction: "dependencies" | "dependents"
+  direction: "dependencies" | "dependents",
+  scope: Scope = Scope.Organization
 ): string[] => {
   const visited = new Set<string>();
   const result = new Set<string>();
   const queue: string[] = [startPermission];
+  const registry = getPermissionsForScope(scope);
 
   while (queue.length > 0) {
     const currentPermission = queue.shift();
@@ -46,7 +55,7 @@ export const traversePermissions = (
     if (direction === "dependencies") {
       // Find what the current permission depends on
       const { resource, action } = splitPermission(currentPermission);
-      const resourceConfig = PERMISSION_REGISTRY[resource as keyof typeof PERMISSION_REGISTRY];
+      const resourceConfig = registry[resource as keyof typeof registry];
 
       if (resourceConfig && resourceConfig[action as CrudAction | CustomAction]) {
         const permissionDetails = resourceConfig[action as CrudAction | CustomAction];
@@ -70,7 +79,7 @@ export const traversePermissions = (
       }
     } else {
       // Find what depends on the current permission
-      Object.entries(PERMISSION_REGISTRY).forEach(([resource, config]) => {
+      Object.entries(registry).forEach(([resource, config]) => {
         Object.entries(config).forEach(([action, details]) => {
           if (action.startsWith("_")) return; // Skip internal keys
 
@@ -108,17 +117,19 @@ export const traversePermissions = (
 /**
  * Get all permissions that the given permission transitively depends on
  * @param permission The permission to find dependencies for
+ * @param scope The scope to use for permission registry (defaults to Organization)
  * @returns Array of dependency permissions
  */
-export const getTransitiveDependencies = (permission: string): string[] => {
-  return traversePermissions(permission, "dependencies");
+export const getTransitiveDependencies = (permission: string, scope: Scope = Scope.Organization): string[] => {
+  return traversePermissions(permission, "dependencies", scope);
 };
 
 /**
  * Get all permissions that transitively depend on the given permission
  * @param permission The permission to find dependents for
+ * @param scope The scope to use for permission registry (defaults to Organization)
  * @returns Array of dependent permissions
  */
-export const getTransitiveDependents = (permission: string): string[] => {
-  return traversePermissions(permission, "dependents");
+export const getTransitiveDependents = (permission: string, scope: Scope = Scope.Organization): string[] => {
+  return traversePermissions(permission, "dependents", scope);
 };
diff --git a/packages/platform/atoms/event-types/hooks/useTabsNavigations.tsx b/packages/platform/atoms/event-types/hooks/useTabsNavigations.tsx
index c36cbaaefc..c5d27b56cd 100644
--- a/packages/platform/atoms/event-types/hooks/useTabsNavigations.tsx
+++ b/packages/platform/atoms/event-types/hooks/useTabsNavigations.tsx
@@ -24,6 +24,7 @@ type Props = {
   team: EventTypeSetupProps["team"];
   eventTypeApps?: EventTypeApps;
   allActiveWorkflows?: Workflow[];
+  canReadWorkflows?: boolean;
 };
 export const useTabsNavigations = ({
   formMethods,
@@ -31,6 +32,7 @@ export const useTabsNavigations = ({
   team,
   eventTypeApps,
   allActiveWorkflows,
+  canReadWorkflows = false,
 }: Props) => {
   const { t } = useLocale();
 
@@ -79,6 +81,7 @@ export const useTabsNavigations = ({
       installedAppsNumber,
       enabledWorkflowsNumber,
       availability,
+      canReadWorkflows,
     });
 
     if (!requirePayment) {
@@ -166,6 +169,7 @@ export const useTabsNavigations = ({
     watchSchedulingType,
     watchChildrenCount,
     activeWebhooksNumber,
+    canReadWorkflows,
   ]);
 
   return { tabsNavigation: EventTypeTabs };
@@ -180,6 +184,7 @@ type getNavigationProps = {
   enabledWorkflowsNumber: number;
   installedAppsNumber: number;
   availability: AvailabilityOption | undefined;
+  canReadWorkflows: boolean;
 };
 
 function getNavigation({
@@ -190,10 +195,11 @@ function getNavigation({
   enabledAppsNumber,
   installedAppsNumber,
   enabledWorkflowsNumber,
+  canReadWorkflows,
 }: getNavigationProps) {
   const duration = multipleDuration?.map((duration) => ` ${duration}`) || length;
 
-  return [
+  const baseNavigation: VerticalTabItemProps[] = [
     {
       name: t("basics"),
       href: `/event-types/${id}?tabName=setup`,
@@ -223,12 +229,18 @@ function getNavigation({
       info: `${installedAppsNumber} apps, ${enabledAppsNumber} ${t("active")}`,
       "data-testid": "apps",
     },
-    {
+  ];
+
+  // Only add workflows tab if user has permission to read workflows
+  if (canReadWorkflows) {
+    baseNavigation.push({
       name: t("workflows"),
       href: `/event-types/${id}?tabName=workflows`,
       icon: "zap",
       info: `${enabledWorkflowsNumber} ${t("active")}`,
       "data-testid": "workflows",
-    },
-  ] satisfies VerticalTabItemProps[];
+    });
+  }
+
+  return baseNavigation;
 }
diff --git a/packages/platform/atoms/event-types/wrappers/EventTypeWebWrapper.tsx b/packages/platform/atoms/event-types/wrappers/EventTypeWebWrapper.tsx
index 2a391b1bcf..d5f3c87090 100644
--- a/packages/platform/atoms/event-types/wrappers/EventTypeWebWrapper.tsx
+++ b/packages/platform/atoms/event-types/wrappers/EventTypeWebWrapper.tsx
@@ -9,6 +9,8 @@ import { useOrgBranding } from "@calcom/features/ee/organizations/context/provid
 import type { ChildrenEventType } from "@calcom/features/eventtypes/components/ChildrenEventTypeSelect";
 import { EventType as EventTypeComponent } from "@calcom/features/eventtypes/components/EventType";
 import type { EventTypeSetupProps } from "@calcom/features/eventtypes/lib/types";
+import { EventPermissionProvider } from "@calcom/features/pbac/client/context/EventPermissionContext";
+import { useWorkflowPermission } from "@calcom/features/pbac/client/hooks/useEventPermission";
 import { WEBSITE_URL } from "@calcom/lib/constants";
 import { useLocale } from "@calcom/lib/hooks/useLocale";
 import { useTelemetry } from "@calcom/lib/hooks/useTelemetry";
@@ -29,6 +31,21 @@ import { useEventTypeForm } from "../hooks/useEventTypeForm";
 import { useHandleRouteChange } from "../hooks/useHandleRouteChange";
 import { useTabsNavigations } from "../hooks/useTabsNavigations";
 
+type EventPermissions = {
+  eventTypes: {
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+  };
+  workflows: {
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+  };
+};
+
 const ManagedEventTypeDialog = dynamic(
   () => import("@calcom/features/eventtypes/components/dialogs/ManagedEventDialog")
 );
@@ -91,21 +108,47 @@ const EventAITab = dynamic(() =>
 export type EventTypeWebWrapperProps = {
   id: number;
   data: RouterOutputs["viewer"]["eventTypes"]["get"];
+  permissions?: EventPermissions;
 };
 
-export const EventTypeWebWrapper = ({ id, data: serverFetchedData }: EventTypeWebWrapperProps) => {
+export const EventTypeWebWrapper = ({
+  id,
+  data: serverFetchedData,
+  permissions = {
+    eventTypes: {
+      canRead: false,
+      canCreate: false,
+      canUpdate: false,
+      canDelete: false,
+    },
+    workflows: {
+      canRead: false,
+      canCreate: false,
+      canUpdate: false,
+      canDelete: false,
+    },
+  },
+}: EventTypeWebWrapperProps) => {
   const { data: eventTypeQueryData } = trpc.viewer.eventTypes.get.useQuery(
     { id },
     { enabled: !serverFetchedData }
   );
 
   if (serverFetchedData) {
-    return <EventTypeWeb {...serverFetchedData} id={id} />;
+    return (
+      <EventPermissionProvider initialPermissions={permissions}>
+        <EventTypeWeb {...serverFetchedData} id={id} />
+      </EventPermissionProvider>
+    );
   }
 
   if (!eventTypeQueryData) return null;
 
-  return <EventTypeWeb {...eventTypeQueryData} id={id} />;
+  return (
+    <EventPermissionProvider initialPermissions={permissions}>
+      <EventTypeWeb {...eventTypeQueryData} id={id} />
+    </EventPermissionProvider>
+  );
 };
 
 const EventTypeWeb = ({
@@ -131,6 +174,9 @@ const EventTypeWeb = ({
     teamId: eventType.team?.id || eventType.parent?.teamId,
     onlyInstalled: true,
   });
+
+  // Check workflow permissions
+  const { hasPermission: canReadWorkflows } = useWorkflowPermission("canRead");
   const updateMutation = trpc.viewer.eventTypes.heavy.update.useMutation({
     onSuccess: async () => {
       const currentValues = form.getValues();
@@ -241,11 +287,12 @@ const EventTypeWeb = ({
     instant: <EventInstantTab eventType={eventType} isTeamEvent={!!team} />,
     recurring: <EventRecurringTab eventType={eventType} />,
     apps: <EventAppsTab eventType={{ ...eventType, URL: permalink }} />,
-    workflows: allActiveWorkflows ? (
-      <EventWorkflowsTab eventType={eventType} workflows={allActiveWorkflows} />
-    ) : (
-      <></>
-    ),
+    workflows:
+      allActiveWorkflows && canReadWorkflows ? (
+        <EventWorkflowsTab eventType={eventType} workflows={allActiveWorkflows} />
+      ) : (
+        <></>
+      ),
     webhooks: <EventWebhooksTab eventType={eventType} />,
     ai: <EventAITab eventType={eventType} isTeamEvent={!!team} />,
   } as const;
@@ -358,6 +405,7 @@ const EventTypeWeb = ({
     team,
     eventTypeApps,
     allActiveWorkflows,
+    canReadWorkflows,
   });
 
   return (
diff --git a/packages/trpc/server/routers/viewer/eventTypes/__tests__/getUserEventGroups.test.ts b/packages/trpc/server/routers/viewer/eventTypes/__tests__/getUserEventGroups.test.ts
new file mode 100644
index 0000000000..375e304f92
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/__tests__/getUserEventGroups.test.ts
@@ -0,0 +1,374 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+import type { PrismaClient } from "@calcom/prisma";
+import { MembershipRole } from "@calcom/prisma/enums";
+
+import { TRPCError } from "@trpc/server";
+
+import { getUserEventGroups } from "../getUserEventGroups.handler";
+
+// Mock dependencies
+vi.mock("@calcom/lib/checkRateLimitAndThrowError", () => ({
+  checkRateLimitAndThrowError: vi.fn(),
+}));
+
+vi.mock("@calcom/lib/server/repository/membership", () => ({
+  MembershipRepository: {
+    findAllByUpIdIncludeTeam: vi.fn(),
+  },
+}));
+
+vi.mock("@calcom/lib/server/repository/profile", () => ({
+  ProfileRepository: {
+    findByUpId: vi.fn(),
+  },
+}));
+
+const mockFilterTeamsByEventTypeReadPermission = vi.fn();
+
+vi.mock("../teamAccessUseCase", () => ({
+  TeamAccessUseCase: vi.fn().mockImplementation(() => ({
+    filterTeamsByEventTypeReadPermission: mockFilterTeamsByEventTypeReadPermission,
+  })),
+}));
+
+vi.mock("@calcom/lib/getBookerUrl/server", () => ({
+  getBookerBaseUrl: vi.fn().mockResolvedValue("https://cal.com"),
+}));
+
+vi.mock("@calcom/lib/getBookerUrl/client", () => ({
+  getBookerBaseUrlSync: vi.fn().mockReturnValue("https://cal.com"),
+}));
+
+vi.mock("@calcom/lib/getAvatarUrl", () => ({
+  getUserAvatarUrl: vi.fn().mockReturnValue("https://avatar.com/user.jpg"),
+}));
+
+vi.mock("@calcom/lib/defaultAvatarImage", () => ({
+  getPlaceholderAvatar: vi.fn().mockReturnValue("https://avatar.com/placeholder.jpg"),
+}));
+
+vi.mock("@calcom/features/pbac/lib/resource-permissions", () => ({
+  getResourcePermissions: vi.fn(),
+}));
+
+describe("getUserEventGroups", () => {
+  const mockUser = {
+    id: 1,
+    profile: {
+      upId: "user-123",
+    },
+  } as unknown as NonNullable<Parameters<typeof getUserEventGroups>[0]["ctx"]["user"]>;
+
+  const mockProfile = {
+    id: 1,
+    username: "testuser",
+    name: "Test User",
+    avatarUrl: null,
+    organizationId: null,
+    organization: null,
+  } as unknown as NonNullable<
+    Awaited<ReturnType<typeof import("@calcom/lib/server/repository/profile").ProfileRepository.findByUpId>>
+  >;
+
+  const mockCtx = {
+    user: mockUser,
+    prisma: {} as PrismaClient,
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe("Basic functionality", () => {
+    it("should throw TRPCError when profile is not found", async () => {
+      const { ProfileRepository } = await import("@calcom/lib/server/repository/profile");
+      vi.mocked(ProfileRepository.findByUpId).mockResolvedValue(null);
+
+      await expect(
+        getUserEventGroups({
+          ctx: mockCtx,
+          input: null,
+        })
+      ).rejects.toThrow(TRPCError);
+    });
+
+    it("should return user event groups when no filters are applied", async () => {
+      const { ProfileRepository } = await import("@calcom/lib/server/repository/profile");
+      const { MembershipRepository } = await import("@calcom/lib/server/repository/membership");
+
+      vi.mocked(ProfileRepository.findByUpId).mockResolvedValue(mockProfile);
+      vi.mocked(MembershipRepository.findAllByUpIdIncludeTeam).mockResolvedValue([]);
+      mockFilterTeamsByEventTypeReadPermission.mockResolvedValue([]);
+
+      const result = await getUserEventGroups({
+        ctx: mockCtx,
+        input: null,
+      });
+
+      expect(result).toHaveProperty("eventTypeGroups");
+      expect(result).toHaveProperty("profiles");
+      expect(result.eventTypeGroups).toHaveLength(1);
+      expect(result.eventTypeGroups[0]).toMatchObject({
+        teamId: null,
+        membershipRole: null,
+        profile: {
+          slug: "testuser",
+          name: "Test User",
+        },
+      });
+    });
+  });
+
+  describe("Team memberships", () => {
+    it("should include team events when team memberships exist", async () => {
+      const { ProfileRepository } = await import("@calcom/lib/server/repository/profile");
+      const { MembershipRepository } = await import("@calcom/lib/server/repository/membership");
+      const { getResourcePermissions } = await import("@calcom/features/pbac/lib/resource-permissions");
+
+      const mockTeamMembership = {
+        id: 1,
+        teamId: 100,
+        userId: 1,
+        accepted: true,
+        role: MembershipRole.MEMBER,
+        customRoleId: null,
+        disableImpersonation: false,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        team: {
+          id: 100,
+          name: "Test Team",
+          slug: "test-team",
+          logoUrl: null,
+          parentId: null,
+          parent: null,
+          metadata: {},
+        },
+      } as unknown as NonNullable<
+        Awaited<
+          ReturnType<
+            typeof import("@calcom/lib/server/repository/membership").MembershipRepository.findAllByUpIdIncludeTeam
+          >
+        >
+      >[0];
+
+      vi.mocked(ProfileRepository.findByUpId).mockResolvedValue(mockProfile);
+      vi.mocked(MembershipRepository.findAllByUpIdIncludeTeam).mockResolvedValue([mockTeamMembership]);
+      mockFilterTeamsByEventTypeReadPermission.mockResolvedValue([mockTeamMembership]);
+
+      vi.mocked(getResourcePermissions).mockResolvedValue({
+        canCreate: false,
+        canEdit: true,
+        canDelete: false,
+        canRead: true,
+      });
+
+      const result = await getUserEventGroups({
+        ctx: mockCtx,
+        input: null,
+      });
+
+      expect(result.eventTypeGroups).toHaveLength(2); // User + Team
+      expect(result.eventTypeGroups[1]).toMatchObject({
+        teamId: 100,
+        profile: {
+          name: "Test Team",
+          slug: "team/test-team",
+        },
+      });
+    });
+  });
+
+  describe("Permissions", () => {
+    it("should handle PBAC permissions correctly", async () => {
+      const { ProfileRepository } = await import("@calcom/lib/server/repository/profile");
+      const { MembershipRepository } = await import("@calcom/lib/server/repository/membership");
+      const { getResourcePermissions } = await import("@calcom/features/pbac/lib/resource-permissions");
+
+      const mockTeamMembership = {
+        id: 1,
+        teamId: 100,
+        userId: 1,
+        accepted: true,
+        role: MembershipRole.ADMIN,
+        customRoleId: null,
+        disableImpersonation: false,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        team: {
+          id: 100,
+          name: "Test Team",
+          slug: "test-team",
+          logoUrl: null,
+          parentId: null,
+          parent: null,
+          metadata: {},
+        },
+      } as unknown as NonNullable<
+        Awaited<
+          ReturnType<
+            typeof import("@calcom/lib/server/repository/membership").MembershipRepository.findAllByUpIdIncludeTeam
+          >
+        >
+      >[0];
+
+      vi.mocked(ProfileRepository.findByUpId).mockResolvedValue(mockProfile);
+      vi.mocked(MembershipRepository.findAllByUpIdIncludeTeam).mockResolvedValue([mockTeamMembership]);
+      mockFilterTeamsByEventTypeReadPermission.mockResolvedValue([mockTeamMembership]);
+
+      vi.mocked(getResourcePermissions).mockResolvedValue({
+        canCreate: true,
+        canEdit: true,
+        canDelete: true,
+        canRead: true,
+      });
+
+      const result = await getUserEventGroups({
+        ctx: mockCtx,
+        input: null,
+      });
+
+      expect(result.profiles[1]).toMatchObject({
+        canCreateEventTypes: true,
+        canUpdateEventTypes: true,
+      });
+    });
+
+    it("should fallback to role-based permissions when PBAC fails", async () => {
+      const { ProfileRepository } = await import("@calcom/lib/server/repository/profile");
+      const { MembershipRepository } = await import("@calcom/lib/server/repository/membership");
+      const { getResourcePermissions } = await import("@calcom/features/pbac/lib/resource-permissions");
+
+      const mockTeamMembership = {
+        id: 1,
+        teamId: 100,
+        userId: 1,
+        accepted: true,
+        role: MembershipRole.MEMBER,
+        customRoleId: null,
+        disableImpersonation: false,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        team: {
+          id: 100,
+          name: "Test Team",
+          slug: "test-team",
+          logoUrl: null,
+          parentId: null,
+          parent: null,
+          metadata: {},
+        },
+      } as unknown as NonNullable<
+        Awaited<
+          ReturnType<
+            typeof import("@calcom/lib/server/repository/membership").MembershipRepository.findAllByUpIdIncludeTeam
+          >
+        >
+      >[0];
+
+      vi.mocked(ProfileRepository.findByUpId).mockResolvedValue(mockProfile);
+      vi.mocked(MembershipRepository.findAllByUpIdIncludeTeam).mockResolvedValue([mockTeamMembership]);
+      mockFilterTeamsByEventTypeReadPermission.mockResolvedValue([mockTeamMembership]);
+
+      vi.mocked(getResourcePermissions).mockRejectedValue(new Error("PBAC failed"));
+
+      const result = await getUserEventGroups({
+        ctx: mockCtx,
+        input: null,
+      });
+
+      // Member role should not have create/update/delete permissions
+      expect(result.profiles[1]).toMatchObject({
+        canCreateEventTypes: false,
+        canUpdateEventTypes: false,
+      });
+    });
+  });
+
+  describe("Organization handling", () => {
+    it("should handle organization locked event types", async () => {
+      const { ProfileRepository } = await import("@calcom/lib/server/repository/profile");
+      const { MembershipRepository } = await import("@calcom/lib/server/repository/membership");
+
+      const mockProfileWithOrg = {
+        ...mockProfile,
+        organization: {
+          organizationSettings: {
+            lockEventTypeCreationForUsers: true,
+          },
+        },
+      } as unknown as NonNullable<
+        Awaited<
+          ReturnType<typeof import("@calcom/lib/server/repository/profile").ProfileRepository.findByUpId>
+        >
+      >;
+
+      vi.mocked(ProfileRepository.findByUpId).mockResolvedValue(mockProfileWithOrg);
+      vi.mocked(MembershipRepository.findAllByUpIdIncludeTeam).mockResolvedValue([]);
+      mockFilterTeamsByEventTypeReadPermission.mockResolvedValue([]);
+
+      const result = await getUserEventGroups({
+        ctx: mockCtx,
+        input: null,
+      });
+
+      expect(result.eventTypeGroups[0].profile.eventTypesLockedByOrg).toBe(true);
+    });
+  });
+
+  describe("Routing forms", () => {
+    it("should handle routing forms slug format", async () => {
+      const { ProfileRepository } = await import("@calcom/lib/server/repository/profile");
+      const { MembershipRepository } = await import("@calcom/lib/server/repository/membership");
+      const { getResourcePermissions } = await import("@calcom/features/pbac/lib/resource-permissions");
+
+      const mockTeamMembership = {
+        id: 1,
+        teamId: 100,
+        userId: 1,
+        accepted: true,
+        role: MembershipRole.MEMBER,
+        customRoleId: null,
+        disableImpersonation: false,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        team: {
+          id: 100,
+          name: "Test Team",
+          slug: "test-team",
+          logoUrl: null,
+          parentId: null,
+          parent: null,
+          metadata: {},
+        },
+      } as unknown as NonNullable<
+        Awaited<
+          ReturnType<
+            typeof import("@calcom/lib/server/repository/membership").MembershipRepository.findAllByUpIdIncludeTeam
+          >
+        >
+      >[0];
+
+      vi.mocked(ProfileRepository.findByUpId).mockResolvedValue(mockProfile);
+      vi.mocked(MembershipRepository.findAllByUpIdIncludeTeam).mockResolvedValue([mockTeamMembership]);
+      mockFilterTeamsByEventTypeReadPermission.mockResolvedValue([mockTeamMembership]);
+
+      vi.mocked(getResourcePermissions).mockResolvedValue({
+        canCreate: false,
+        canEdit: true,
+        canDelete: false,
+        canRead: true,
+      });
+
+      const result = await getUserEventGroups({
+        ctx: mockCtx,
+        input: {
+          forRoutingForms: true,
+        },
+      });
+
+      expect(result.eventTypeGroups[1].profile.slug).toBe("team/test-team");
+    });
+  });
+});
diff --git a/packages/trpc/server/routers/viewer/eventTypes/_router.ts b/packages/trpc/server/routers/viewer/eventTypes/_router.ts
index fda63764f3..d9e12aca1c 100644
--- a/packages/trpc/server/routers/viewer/eventTypes/_router.ts
+++ b/packages/trpc/server/routers/viewer/eventTypes/_router.ts
@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { logP } from "@calcom/lib/perf";
+import { MembershipRole } from "@calcom/prisma/enums";
 
 import authedProcedure from "../../../procedures/authedProcedure";
 import { router } from "../../../trpc";
@@ -10,23 +11,7 @@ import { ZGetHashedLinkInputSchema } from "./getHashedLink.schema";
 import { ZGetHashedLinksInputSchema } from "./getHashedLinks.schema";
 import { ZGetTeamAndEventTypeOptionsSchema } from "./getTeamAndEventTypeOptions.schema";
 import { get } from "./procedures/get";
-import { eventOwnerProcedure } from "./util";
-
-type BookingsRouterHandlerCache = {
-  getByViewer?: typeof import("./getByViewer.handler").getByViewerHandler;
-  getUserEventGroups?: typeof import("./getUserEventGroups.handler").getUserEventGroups;
-  getEventTypesFromGroup?: typeof import("./getEventTypesFromGroup.handler").getEventTypesFromGroup;
-  getTeamAndEventTypeOptions?: typeof import("./getTeamAndEventTypeOptions.handler").getTeamAndEventTypeOptions;
-  list?: typeof import("./list.handler").listHandler;
-  listWithTeam?: typeof import("./listWithTeam.handler").listWithTeamHandler;
-  get?: typeof import("./get.handler").getHandler;
-  delete?: typeof import("./delete.handler").deleteHandler;
-  bulkEventFetch?: typeof import("./bulkEventFetch.handler").bulkEventFetchHandler;
-  bulkUpdateToDefaultLocation?: typeof import("./bulkUpdateToDefaultLocation.handler").bulkUpdateToDefaultLocationHandler;
-};
-
-// Init the handler cache
-const UNSTABLE_HANDLER_CACHE: BookingsRouterHandlerCache = {};
+import { createEventPbacProcedure } from "./util";
 
 export const eventTypesRouter = router({
   // REVIEW: What should we name this procedure?
@@ -111,14 +96,16 @@ export const eventTypesRouter = router({
 
   get,
 
-  delete: eventOwnerProcedure.input(ZDeleteInputSchema).mutation(async ({ ctx, input }) => {
-    const { deleteHandler } = await import("./delete.handler");
+  delete: createEventPbacProcedure("eventType.delete", [MembershipRole.ADMIN, MembershipRole.OWNER])
+    .input(ZDeleteInputSchema)
+    .mutation(async ({ ctx, input }) => {
+      const { deleteHandler } = await import("./delete.handler");
 
-    return deleteHandler({
-      ctx,
-      input,
-    });
-  }),
+      return deleteHandler({
+        ctx,
+        input,
+      });
+    }),
 
   bulkEventFetch: authedProcedure.query(async ({ ctx }) => {
     const { bulkEventFetchHandler } = await import("./bulkEventFetch.handler");
diff --git a/packages/trpc/server/routers/viewer/eventTypes/getUserEventGroups.handler.ts b/packages/trpc/server/routers/viewer/eventTypes/getUserEventGroups.handler.ts
index f2d8584834..57e6e8b13e 100644
--- a/packages/trpc/server/routers/viewer/eventTypes/getUserEventGroups.handler.ts
+++ b/packages/trpc/server/routers/viewer/eventTypes/getUserEventGroups.handler.ts
@@ -1,20 +1,16 @@
-import { hasFilter } from "@calcom/features/filters/lib/hasFilter";
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
-import { getPlaceholderAvatar } from "@calcom/lib/defaultAvatarImage";
-import { getUserAvatarUrl } from "@calcom/lib/getAvatarUrl";
-import { getBookerBaseUrlSync } from "@calcom/lib/getBookerUrl/client";
-import { getBookerBaseUrl } from "@calcom/lib/getBookerUrl/server";
 import { MembershipRepository } from "@calcom/lib/server/repository/membership";
 import { ProfileRepository } from "@calcom/lib/server/repository/profile";
-// import { getEventTypesByViewer } from "@calcom/lib/event-types/getEventTypesByViewer";
 import type { PrismaClient } from "@calcom/prisma";
-import { MembershipRole } from "@calcom/prisma/enums";
-import { teamMetadataSchema } from "@calcom/prisma/zod-utils";
 
 import { TRPCError } from "@trpc/server";
 
 import type { TrpcSessionUser } from "../../../types";
 import type { TEventTypeInputSchema } from "./getByViewer.schema";
+import { TeamAccessUseCase } from "./teamAccessUseCase";
+import { EventGroupBuilder } from "./usecases/EventGroupBuilder";
+import { ProfilePermissionProcessor } from "./usecases/ProfilePermissionProcessor";
+import { EventTypeGroupFilter } from "./utils/EventTypeGroupFilter";
 
 type GetByViewerOptions = {
   ctx: {
@@ -29,174 +25,45 @@ export const getUserEventGroups = async ({ ctx, input }: GetByViewerOptions) =>
     identifier: `eventTypes:getUserProfiles:${ctx.user.id}`,
     rateLimitingType: "common",
   });
+
   const user = ctx.user;
-  const filters = input?.filters;
-  const forRoutingForms = input?.forRoutingForms;
-
   const userProfile = user.profile;
+
+  // Validate profile exists
   const profile = await ProfileRepository.findByUpId(userProfile.upId);
-  const parentOrgHasLockedEventTypes =
-    profile?.organization?.organizationSettings?.lockEventTypeCreationForUsers;
-  const isFilterSet = filters && hasFilter(filters);
-  const isUpIdInFilter = filters?.upIds?.includes(userProfile.upId);
-
-  let shouldListUserEvents = !isFilterSet || isUpIdInFilter;
-
-  if (isFilterSet && filters?.upIds && !isUpIdInFilter) {
-    shouldListUserEvents = true;
-  }
-
-  const profileMemberships = await MembershipRepository.findAllByUpIdIncludeTeam(
-    {
-      upId: userProfile.upId,
-    },
-    {
-      where: {
-        accepted: true,
-      },
-    }
-  );
-
   if (!profile) {
     throw new TRPCError({ code: "INTERNAL_SERVER_ERROR" });
   }
 
-  const memberships = profileMemberships.map((membership) => ({
-    ...membership,
-    team: {
-      ...membership.team,
-      metadata: teamMetadataSchema.parse(membership.team.metadata),
-    },
-  }));
-
-  const teamMemberships = profileMemberships.map((membership) => ({
-    teamId: membership.team.id,
-    membershipRole: membership.role,
-  }));
-
-  type EventTypeGroup = {
-    teamId?: number | null;
-    parentId?: number | null;
-    bookerUrl: string;
-    membershipRole?: MembershipRole | null;
-    profile: {
-      slug: (typeof profile)["username"] | null;
-      name: (typeof profile)["name"];
-      image: string;
-      eventTypesLockedByOrg?: boolean;
-    };
-    metadata: {
-      membershipCount: number;
-      readOnly: boolean;
-    };
+  // Initialize dependencies
+  const dependencies = {
+    membershipRepository: MembershipRepository,
+    profileRepository: ProfileRepository,
+    teamAccessUseCase: new TeamAccessUseCase(),
   };
 
-  let eventTypeGroups: EventTypeGroup[] = [];
+  // Build event groups
+  const eventGroupBuilder = new EventGroupBuilder(dependencies);
+  const { eventTypeGroups, teamPermissionsMap } = await eventGroupBuilder.buildEventGroups({
+    userId: user.id,
+    userUpId: userProfile.upId,
+    filters: input?.filters,
+    forRoutingForms: input?.forRoutingForms,
+  });
 
-  if (shouldListUserEvents) {
-    const bookerUrl = await getBookerBaseUrl(profile.organizationId ?? null);
-    eventTypeGroups.push({
-      teamId: null,
-      bookerUrl,
-      membershipRole: null,
-      profile: {
-        slug: profile.username,
-        name: profile.name,
-        image: getUserAvatarUrl({
-          avatarUrl: profile.avatarUrl,
-        }),
-        eventTypesLockedByOrg: parentOrgHasLockedEventTypes,
-      },
-      metadata: {
-        membershipCount: 1,
-        readOnly: false,
-      },
-    });
-  }
+  const filteredEventTypeGroups = new EventTypeGroupFilter(eventTypeGroups, teamPermissionsMap)
+    .has("eventType.read")
+    .get();
 
-  eventTypeGroups = ([] as EventTypeGroup[]).concat(
-    eventTypeGroups,
-    await Promise.all(
-      memberships
-        .filter((mmship) => {
-          if (mmship.team.isOrganization) {
-            return false;
-          } else {
-            if (!filters || !hasFilter(filters)) {
-              return true;
-            }
-            return filters?.teamIds?.includes(mmship?.team?.id || 0) ?? false;
-          }
-        })
-        .map(async (membership) => {
-          const orgMembership = teamMemberships.find(
-            (teamM) => teamM.teamId === membership.team.parentId
-          )?.membershipRole;
+  // Process profiles with permissions
+  const profileProcessor = new ProfilePermissionProcessor();
+  const profiles = profileProcessor.processProfiles(eventTypeGroups, teamPermissionsMap);
 
-          const team = {
-            ...membership.team,
-            metadata: teamMetadataSchema.parse(membership.team.metadata),
-          };
-
-          let slug;
-
-          if (forRoutingForms) {
-            // For Routing form we want to ensure that after migration of team to an org, the URL remains same for the team
-            // Once we solve this https://github.com/calcom/cal.com/issues/12399, we can remove this conditional change in slug
-            slug = `team/${team.slug}`;
-          } else {
-            // In an Org, a team can be accessed without /team prefix as well as with /team prefix
-            slug = team.slug ? (!team.parentId ? `team/${team.slug}` : `${team.slug}`) : null;
-          }
-
-          // const eventTypes = await Promise.all(team.eventTypes.map(mapEventType));
-          const teamParentMetadata = team.parent ? teamMetadataSchema.parse(team.parent.metadata) : null;
-          return {
-            teamId: team.id,
-            parentId: team.parentId,
-            bookerUrl: getBookerBaseUrlSync(team.parent?.slug ?? teamParentMetadata?.requestedSlug ?? null),
-            membershipRole:
-              orgMembership && compareMembership(orgMembership, membership.role)
-                ? orgMembership
-                : membership.role,
-            profile: {
-              image: team.parent
-                ? getPlaceholderAvatar(team.parent.logoUrl, team.parent.name)
-                : getPlaceholderAvatar(team.logoUrl, team.name),
-              name: team.name,
-              slug,
-            },
-            metadata: {
-              membershipCount: 0,
-              readOnly:
-                membership.role ===
-                (team.parentId
-                  ? orgMembership && compareMembership(orgMembership, membership.role)
-                    ? orgMembership
-                    : MembershipRole.MEMBER
-                  : MembershipRole.MEMBER),
-            },
-          };
-        })
-    )
-  );
-
-  const denormalizedPayload = {
-    eventTypeGroups,
-    // so we can show a dropdown when the user has teams
-    profiles: eventTypeGroups.map((group) => ({
-      ...group.profile,
-      ...group.metadata,
-      teamId: group.teamId,
-      membershipRole: group.membershipRole,
-    })),
+  return {
+    eventTypeGroups: filteredEventTypeGroups,
+    profiles,
   };
-
-  return denormalizedPayload;
 };
 
-export function compareMembership(mship1: MembershipRole, mship2: MembershipRole) {
-  const mshipToNumber = (mship: MembershipRole) =>
-    Object.keys(MembershipRole).findIndex((mmship) => mmship === mship);
-  return mshipToNumber(mship1) > mshipToNumber(mship2);
-}
+// Re-export the compareMembership function for backward compatibility
+export { compareMembership } from "@calcom/lib/event-types/getEventTypesByViewer";
diff --git a/packages/trpc/server/routers/viewer/eventTypes/heavy/_router.ts b/packages/trpc/server/routers/viewer/eventTypes/heavy/_router.ts
index 5bc5353dcc..14b2bfdd60 100644
--- a/packages/trpc/server/routers/viewer/eventTypes/heavy/_router.ts
+++ b/packages/trpc/server/routers/viewer/eventTypes/heavy/_router.ts
@@ -1,22 +1,12 @@
-import { z } from "zod";
-
-import { logP } from "@calcom/lib/perf";
+import { MembershipRole } from "@calcom/prisma/enums";
 
 import authedProcedure from "../../../../procedures/authedProcedure";
 import { router } from "../../../../trpc";
+import { createEventPbacProcedure } from "../util";
 import { ZCreateInputSchema } from "./create.schema";
 import { ZDuplicateInputSchema } from "./duplicate.schema";
-import { eventOwnerProcedure } from "../util";
 import { ZUpdateInputSchema } from "./update.schema";
 
-type BookingsRouterHandlerCache = {
-  create?: typeof import("./create.handler").createHandler;
-  duplicate?: typeof import("./duplicate.handler").duplicateHandler;
-  update?: typeof import("./update.handler").updateHandler;
-};
-
-const UNSTABLE_HANDLER_CACHE: BookingsRouterHandlerCache = {};
-
 export const eventTypesRouter = router({
   create: authedProcedure.input(ZCreateInputSchema).mutation(async ({ ctx, input }) => {
     const { createHandler } = await import("./create.handler");
@@ -26,20 +16,24 @@ export const eventTypesRouter = router({
       input,
     });
   }),
-  duplicate: eventOwnerProcedure.input(ZDuplicateInputSchema).mutation(async ({ ctx, input }) => {
-    const { duplicateHandler } = await import("./duplicate.handler");
+  duplicate: createEventPbacProcedure("eventType.create", [MembershipRole.ADMIN, MembershipRole.OWNER])
+    .input(ZDuplicateInputSchema)
+    .mutation(async ({ ctx, input }) => {
+      const { duplicateHandler } = await import("./duplicate.handler");
 
-    return duplicateHandler({
-      ctx,
-      input,
-    });
-  }),
-  update: eventOwnerProcedure.input(ZUpdateInputSchema).mutation(async ({ ctx, input }) => {
-    const { updateHandler } = await import("./update.handler");
+      return duplicateHandler({
+        ctx,
+        input,
+      });
+    }),
+  update: createEventPbacProcedure("eventType.update", [MembershipRole.ADMIN, MembershipRole.OWNER])
+    .input(ZUpdateInputSchema)
+    .mutation(async ({ ctx, input }) => {
+      const { updateHandler } = await import("./update.handler");
 
-    return updateHandler({
-      ctx,
-      input,
-    });
-  })
+      return updateHandler({
+        ctx,
+        input,
+      });
+    }),
 });
diff --git a/packages/trpc/server/routers/viewer/eventTypes/heavy/create.handler.ts b/packages/trpc/server/routers/viewer/eventTypes/heavy/create.handler.ts
index 7dfe8cbe4f..e7c2461021 100644
--- a/packages/trpc/server/routers/viewer/eventTypes/heavy/create.handler.ts
+++ b/packages/trpc/server/routers/viewer/eventTypes/heavy/create.handler.ts
@@ -2,10 +2,12 @@ import type { z } from "zod";
 
 import { getDefaultLocations } from "@calcom/app-store/_utils/getDefaultLocations";
 import { DailyLocationType } from "@calcom/app-store/constants";
+import { Resource } from "@calcom/features/pbac/domain/types/permission-registry";
+import { getResourcePermissions } from "@calcom/features/pbac/lib/resource-permissions";
 import { EventTypeRepository } from "@calcom/lib/server/repository/eventTypeRepository";
 import type { PrismaClient } from "@calcom/prisma";
 import { Prisma } from "@calcom/prisma/client";
-import { SchedulingType } from "@calcom/prisma/enums";
+import { MembershipRole, SchedulingType } from "@calcom/prisma/enums";
 import type { eventTypeLocations } from "@calcom/prisma/zod-utils";
 
 import { TRPCError } from "@trpc/server";
@@ -53,6 +55,29 @@ export const createHandler = async ({ ctx, input }: CreateOptions) => {
   const isManagedEventType = schedulingType === SchedulingType.MANAGED;
   const isOrgAdmin = !!ctx.user?.organization?.isOrgAdmin;
 
+  // Check if user has organization-level eventType.create permission (equivalent to org admin for event types)
+  let hasOrgEventTypeCreatePermission = isOrgAdmin; // Default fallback
+
+  if (ctx.user.organizationId) {
+    try {
+      const orgPermissions = await getResourcePermissions({
+        userId,
+        teamId: ctx.user.organizationId,
+        resource: Resource.EventType,
+        userRole: isOrgAdmin ? MembershipRole.ADMIN : MembershipRole.MEMBER,
+        fallbackRoles: {
+          create: {
+            roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+          },
+        },
+      });
+      hasOrgEventTypeCreatePermission = orgPermissions.canCreate;
+    } catch (error) {
+      // If PBAC check fails, fall back to isOrgAdmin
+      hasOrgEventTypeCreatePermission = isOrgAdmin;
+    }
+  }
+
   const locations: EventTypeLocation[] =
     inputLocations && inputLocations.length !== 0 ? inputLocations : await getDefaultLocations(ctx.user);
 
@@ -91,14 +116,41 @@ export const createHandler = async ({ ctx, input }: CreateOptions) => {
       },
     });
 
+    if (!hasMembership) {
+      console.warn(`User ${userId} is not a member of team ${teamId}`);
+      throw new TRPCError({ code: "UNAUTHORIZED" });
+    }
+
     const isSystemAdmin = ctx.user.role === "ADMIN";
 
-    if (
-      !isSystemAdmin &&
-      !isOrgAdmin &&
-      (!hasMembership?.role || !["ADMIN", "OWNER"].includes(hasMembership.role))
-    ) {
-      console.warn(`User ${userId} does not have permission to create this new event type`);
+    // Check PBAC permissions for eventType.create with fallback to role-based check
+    let hasCreatePermission = false;
+
+    try {
+      const permissions = await getResourcePermissions({
+        userId,
+        teamId,
+        resource: Resource.EventType,
+        userRole: hasMembership.role,
+        fallbackRoles: {
+          create: {
+            roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+          },
+        },
+      });
+      hasCreatePermission = permissions.canCreate;
+    } catch (error) {
+      // If PBAC check fails, fall back to role-based check
+      console.warn(
+        `PBAC check failed for user ${userId} on team ${teamId}, falling back to role check:`,
+        error
+      );
+      hasCreatePermission = ["ADMIN", "OWNER"].includes(hasMembership.role);
+    }
+
+    // System admins and users with org-level eventType.create permission can always create event types
+    if (!isSystemAdmin && !hasOrgEventTypeCreatePermission && !hasCreatePermission) {
+      console.warn(`User ${userId} does not have eventType.create permission for team ${teamId}`);
       throw new TRPCError({ code: "UNAUTHORIZED" });
     }
 
@@ -110,9 +162,9 @@ export const createHandler = async ({ ctx, input }: CreateOptions) => {
     data.schedulingType = schedulingType;
   }
 
-  // If we are in an organization & they are not admin & they are not creating an event on a teamID
+  // If we are in an organization & they don't have org-level eventType.create permission & they are not creating an event on a teamID
   // Check if evenTypes are locked.
-  if (ctx.user.organizationId && !ctx.user?.organization?.isOrgAdmin && !teamId) {
+  if (ctx.user.organizationId && !hasOrgEventTypeCreatePermission && !teamId) {
     const orgSettings = await ctx.prisma.organizationSettings.findUnique({
       where: {
         organizationId: ctx.user.organizationId,
diff --git a/packages/trpc/server/routers/viewer/eventTypes/teamAccessUseCase.test.ts b/packages/trpc/server/routers/viewer/eventTypes/teamAccessUseCase.test.ts
new file mode 100644
index 0000000000..3c8132c4a3
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/teamAccessUseCase.test.ts
@@ -0,0 +1,133 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+import { MembershipRole } from "@calcom/prisma/enums";
+
+import { TeamAccessUseCase } from "./teamAccessUseCase";
+
+// Mock the PermissionCheckService
+vi.mock("@calcom/features/pbac/services/permission-check.service", () => ({
+  PermissionCheckService: vi.fn().mockImplementation(() => ({
+    checkPermission: vi.fn(),
+  })),
+}));
+
+describe("TeamAccessUseCase", () => {
+  let teamAccessUseCase: TeamAccessUseCase;
+  let mockCheckPermission: any;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    teamAccessUseCase = new TeamAccessUseCase();
+    mockCheckPermission = (teamAccessUseCase as any).permissionCheckService.checkPermission;
+  });
+
+  describe("filterTeamsByEventTypeReadPermission", () => {
+    const createMockMembership = (teamId: number, isOrganization = false) => ({
+      id: teamId * 100,
+      teamId,
+      userId: 1,
+      accepted: true,
+      role: MembershipRole.MEMBER,
+      disableImpersonation: false,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+      customRoleId: null,
+      team: {
+        id: teamId,
+        name: `Team ${teamId}`,
+        slug: `team-${teamId}`,
+        logoUrl: null,
+        isOrganization,
+        parentId: isOrganization ? null : 1,
+        metadata: {},
+        theme: null,
+        brandColor: null,
+        darkBrandColor: null,
+        bio: null,
+        hideBranding: false,
+        hideBookATeamMember: false,
+        isPrivate: false,
+        parent: null,
+        calVideoLogo: null,
+        appLogo: null,
+        appIconLogo: null,
+        bannerUrl: null,
+        timeFormat: null,
+        timeZone: "UTC",
+        weekStart: "Monday",
+        createdAt: new Date(),
+        pendingPayment: false,
+        isPlatform: false,
+        smsLockState: "UNLOCKED" as const,
+        smsLockReviewedByAdmin: false,
+        includeManagedEventsInLimits: false,
+        bookingLimits: null,
+        rrResetInterval: "MONTH" as const,
+        rrTimestampBasis: "CREATED_AT" as const,
+        createdByOAuthClientId: null,
+        hideTeamProfileLink: false,
+      },
+    });
+
+    it("should filter out organization memberships", async () => {
+      const memberships = [
+        createMockMembership(1, false),
+        createMockMembership(2, true), // Organization
+        createMockMembership(3, false),
+      ];
+
+      mockCheckPermission.mockResolvedValue(true);
+
+      const result = await teamAccessUseCase.filterTeamsByEventTypeReadPermission(memberships as any, 1);
+
+      expect(result).toHaveLength(2);
+      expect(result.map((m) => m.teamId)).toEqual([1, 3]);
+    });
+
+    it("should filter out teams without eventType.read permission when PBAC is enabled", async () => {
+      const memberships = [
+        createMockMembership(1, false),
+        createMockMembership(2, false),
+        createMockMembership(3, false),
+      ];
+
+      mockCheckPermission
+        .mockResolvedValueOnce(true) // Team 1 has permission
+        .mockResolvedValueOnce(false) // Team 2 does not have permission
+        .mockResolvedValueOnce(true); // Team 3 has permission
+
+      const result = await teamAccessUseCase.filterTeamsByEventTypeReadPermission(memberships as any, 1);
+
+      expect(result).toHaveLength(2);
+      expect(result.map((m) => m.teamId)).toEqual([1, 3]);
+      expect(mockCheckPermission).toHaveBeenCalledTimes(3);
+      expect(mockCheckPermission).toHaveBeenCalledWith({
+        userId: 1,
+        teamId: 1,
+        permission: "eventType.read",
+        fallbackRoles: ["ADMIN", "OWNER", "MEMBER"],
+      });
+    });
+
+    it("should return all non-organization teams when PBAC returns true for all", async () => {
+      const memberships = [createMockMembership(1, false), createMockMembership(2, false)];
+
+      mockCheckPermission.mockResolvedValue(true);
+
+      const result = await teamAccessUseCase.filterTeamsByEventTypeReadPermission(memberships as any, 1);
+
+      expect(result).toHaveLength(2);
+      expect(result).toEqual(memberships);
+    });
+
+    it("should return empty array when no teams have permission", async () => {
+      const memberships = [createMockMembership(1, false), createMockMembership(2, false)];
+
+      mockCheckPermission.mockResolvedValue(false);
+
+      const result = await teamAccessUseCase.filterTeamsByEventTypeReadPermission(memberships as any, 1);
+
+      expect(result).toHaveLength(0);
+    });
+  });
+});
diff --git a/packages/trpc/server/routers/viewer/eventTypes/teamAccessUseCase.ts b/packages/trpc/server/routers/viewer/eventTypes/teamAccessUseCase.ts
new file mode 100644
index 0000000000..6c160027c1
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/teamAccessUseCase.ts
@@ -0,0 +1,47 @@
+import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
+import type { Membership, Team } from "@calcom/prisma/client";
+
+type TeamMembershipWithTeam = Membership & {
+  team: Team & {
+    parent?: {
+      id: number;
+      name: string;
+      slug: string | null;
+      logoUrl: string | null;
+      parentId: number | null;
+      metadata: any;
+    } | null;
+  };
+};
+
+export class TeamAccessUseCase {
+  constructor(private permissionCheckService: PermissionCheckService = new PermissionCheckService()) {}
+
+  async filterTeamsByEventTypeReadPermission(
+    memberships: TeamMembershipWithTeam[],
+    userId: number
+  ): Promise<TeamMembershipWithTeam[]> {
+    const filteredMemberships = await Promise.all(
+      memberships.map(async (membership) => {
+        // Organization memberships are excluded from this logic
+        if (membership.team.isOrganization) {
+          return null;
+        }
+
+        // Check if user has eventType.read permission for this team
+        const hasPermission = await this.permissionCheckService.checkPermission({
+          userId,
+          teamId: membership.team.id,
+          permission: "eventType.read",
+          fallbackRoles: ["ADMIN", "OWNER", "MEMBER"], // All roles can read event types by default
+        });
+
+        return hasPermission ? membership : null;
+      })
+    );
+
+    return filteredMemberships.filter(
+      (membership): membership is TeamMembershipWithTeam => membership !== null
+    );
+  }
+}
diff --git a/packages/trpc/server/routers/viewer/eventTypes/usecases/EventGroupBuilder.ts b/packages/trpc/server/routers/viewer/eventTypes/usecases/EventGroupBuilder.ts
new file mode 100644
index 0000000000..0f8c47a3d5
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/usecases/EventGroupBuilder.ts
@@ -0,0 +1,134 @@
+import type { MembershipRepository } from "@calcom/lib/server/repository/membership";
+import type { ProfileRepository } from "@calcom/lib/server/repository/profile";
+import { teamMetadataSchema } from "@calcom/prisma/zod-utils";
+
+import type { TeamAccessUseCase } from "../teamAccessUseCase";
+import {
+  shouldListUserEvents,
+  shouldIncludeTeamMembership,
+  createTeamSlug,
+  type FilterContext,
+} from "../utils/filterUtils";
+import { buildTeamPermissionsMap, getEffectiveRole, type TeamPermissions } from "../utils/permissionUtils";
+import { createUserEventGroup, createTeamEventGroup, type EventTypeGroup } from "../utils/transformUtils";
+
+export interface EventGroupBuilderDependencies {
+  membershipRepository: typeof MembershipRepository;
+  profileRepository: typeof ProfileRepository;
+  teamAccessUseCase: TeamAccessUseCase;
+}
+
+export interface EventGroupBuilderInput {
+  userId: number;
+  userUpId: string;
+  filters?: FilterContext["filters"];
+  forRoutingForms?: boolean;
+}
+
+export class EventGroupBuilder {
+  constructor(private dependencies: EventGroupBuilderDependencies) {}
+
+  async buildEventGroups(input: EventGroupBuilderInput): Promise<{
+    eventTypeGroups: EventTypeGroup[];
+    teamPermissionsMap: Map<number, TeamPermissions>;
+  }> {
+    const { userId, userUpId, filters, forRoutingForms } = input;
+
+    // Get user profile
+    const profile = await this.dependencies.profileRepository.findByUpId(userUpId);
+    if (!profile) {
+      throw new Error("Profile not found");
+    }
+
+    const parentOrgHasLockedEventTypes =
+      profile.organization?.organizationSettings?.lockEventTypeCreationForUsers;
+
+    // Get memberships
+    const profileMemberships = await this.dependencies.membershipRepository.findAllByUpIdIncludeTeam(
+      { upId: userUpId },
+      { where: { accepted: true } }
+    );
+
+    // Filter memberships based on PBAC permissions
+    const accessibleMemberships =
+      await this.dependencies.teamAccessUseCase.filterTeamsByEventTypeReadPermission(
+        profileMemberships,
+        userId
+      );
+
+    if (!accessibleMemberships) {
+      throw new Error("Failed to filter team memberships");
+    }
+
+    const memberships = accessibleMemberships.map((membership) => ({
+      ...membership,
+      team: {
+        ...membership.team,
+        metadata: teamMetadataSchema.parse(membership.team.metadata),
+      },
+    }));
+
+    const teamMemberships = accessibleMemberships.map((membership) => ({
+      teamId: membership.team.id,
+      membershipRole: membership.role,
+    }));
+
+    // Build permissions map
+    const teamPermissionsMap = await buildTeamPermissionsMap(memberships, teamMemberships, userId);
+
+    // Build event type groups
+    const eventTypeGroups: EventTypeGroup[] = [];
+
+    // Add user events if needed
+    const filterContext: FilterContext = { filters, userUpId };
+    if (shouldListUserEvents(filterContext)) {
+      const userGroup = await createUserEventGroup(profile, parentOrgHasLockedEventTypes ?? false);
+      eventTypeGroups.push(userGroup);
+    }
+
+    // Add team events
+    const teamGroupResults = await Promise.allSettled(
+      memberships
+        .filter((membership) => shouldIncludeTeamMembership(membership, filters))
+        .map(async (membership) => {
+          const orgMembership = teamMemberships.find(
+            (teamM) => teamM.teamId === membership.team.parentId
+          )?.membershipRole;
+
+          const effectiveRole = getEffectiveRole(orgMembership, membership.role);
+          const permissions = teamPermissionsMap.get(membership.team.id);
+
+          if (!permissions) {
+            throw new Error(`Permissions not found for team ${membership.team.id}`);
+          }
+
+          const teamSlug = createTeamSlug(
+            membership.team.slug,
+            !!membership.team.parentId,
+            forRoutingForms ?? false
+          );
+
+          return createTeamEventGroup(membership, effectiveRole, teamSlug, permissions);
+        })
+    );
+
+    const teamGroups = teamGroupResults
+      .filter((result): result is PromiseFulfilledResult<EventTypeGroup> => result.status === "fulfilled")
+      .map((result) => result.value);
+
+    const failedTeams = teamGroupResults.filter(
+      (result): result is PromiseRejectedResult => result.status === "rejected"
+    );
+
+    if (failedTeams.length > 0) {
+      console.warn(`Failed to process ${failedTeams.length} teams:`, failedTeams);
+    }
+
+    eventTypeGroups.push(...teamGroups);
+
+    return {
+      eventTypeGroups,
+      teamPermissionsMap,
+    };
+  }
+}
diff --git a/packages/trpc/server/routers/viewer/eventTypes/usecases/ProfilePermissionProcessor.ts b/packages/trpc/server/routers/viewer/eventTypes/usecases/ProfilePermissionProcessor.ts
new file mode 100644
index 0000000000..345f4b9079
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/usecases/ProfilePermissionProcessor.ts
@@ -0,0 +1,15 @@
+import type { TeamPermissions } from "../utils/permissionUtils";
+import {
+  createProfilesWithPermissions,
+  type EventTypeGroup,
+  type ProfileWithPermissions,
+} from "../utils/transformUtils";
+
+export class ProfilePermissionProcessor {
+  processProfiles(
+    eventTypeGroups: EventTypeGroup[],
+    teamPermissionsMap: Map<number, TeamPermissions>
+  ): ProfileWithPermissions[] {
+    return createProfilesWithPermissions(eventTypeGroups, teamPermissionsMap);
+  }
+}
diff --git a/packages/trpc/server/routers/viewer/eventTypes/util.ts b/packages/trpc/server/routers/viewer/eventTypes/util.ts
index 5f32253a33..93e1a27590 100644
--- a/packages/trpc/server/routers/viewer/eventTypes/util.ts
+++ b/packages/trpc/server/routers/viewer/eventTypes/util.ts
@@ -1,10 +1,12 @@
 import { z } from "zod";
 
-import { checkAdminOrOwner } from "@calcom/features/auth/lib/checkAdminOrOwner";
+import type { PermissionString } from "@calcom/features/pbac/domain/types/permission-registry";
+import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
 import { markdownToSafeHTML } from "@calcom/lib/markdownToSafeHTML";
 import type { EventTypeRepository } from "@calcom/lib/server/repository/eventTypeRepository";
 import { UserRepository } from "@calcom/lib/server/repository/user";
 import prisma from "@calcom/prisma";
+import type { MembershipRole } from "@calcom/prisma/enums";
 import { PeriodType } from "@calcom/prisma/enums";
 import type { CustomInputSchema } from "@calcom/prisma/zod-utils";
 import { EventTypeMetaDataSchema } from "@calcom/prisma/zod-utils";
@@ -59,13 +61,7 @@ export const eventOwnerProcedure = authedProcedure
 
     const isAuthorized = (function () {
       if (event.team) {
-        const isOrgAdmin = !!ctx.user?.organization?.isOrgAdmin;
-        return (
-          event.team.members
-            .filter((member) => checkAdminOrOwner(member.role))
-            .map((member) => member.userId)
-            .includes(ctx.user.id) || isOrgAdmin
-        );
+        return event.team.members.map((member) => member.userId).includes(ctx.user.id);
       }
       return event.userId === ctx.user.id || event.users.find((user) => user.id === ctx.user.id);
     })();
@@ -92,6 +88,62 @@ export const eventOwnerProcedure = authedProcedure
     return next();
   });
 
+/**
+ * Creates an event admin procedure with configurable permissions
+ * @param permission - The specific permission required (e.g., "eventType.manage", "eventType.update")
+ * @param fallbackRoles - Roles to check when PBAC is disabled (defaults to ["ADMIN", "OWNER"])
+ * @returns A procedure that checks the specified permission
+ */
+export const createEventPbacProcedure = (
+  permission: PermissionString,
+  fallbackRoles: MembershipRole[] = ["ADMIN", "OWNER"]
+) => {
+  return eventOwnerProcedure.use(async ({ ctx, input, next }) => {
+    const id = input.eventTypeId ?? input.id;
+
+    const event = await ctx.prisma.eventType.findUnique({
+      where: { id },
+      select: {
+        id: true,
+        userId: true,
+        teamId: true,
+      },
+    });
+
+    if (!event) {
+      throw new TRPCError({ code: "NOT_FOUND" });
+    }
+
+    // For team events, check PBAC permissions
+    if (event.teamId) {
+      const permissionCheckService = new PermissionCheckService();
+      const hasPermission = await permissionCheckService.checkPermission({
+        userId: ctx.user.id,
+        teamId: event.teamId,
+        permission,
+        fallbackRoles,
+      });
+
+      if (!hasPermission) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: `Permission required: ${permission}`,
+        });
+      }
+    } else {
+      // For personal events, only the owner can manage
+      if (event.userId !== ctx.user.id) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: `Permission required: ${permission}`,
+        });
+      }
+    }
+
+    return next();
+  });
+};
+
 export function isPeriodType(keyInput: string): keyInput is PeriodType {
   return Object.keys(PeriodType).includes(keyInput);
 }
diff --git a/packages/trpc/server/routers/viewer/eventTypes/utils/EventTypeGroupFilter.test.ts b/packages/trpc/server/routers/viewer/eventTypes/utils/EventTypeGroupFilter.test.ts
new file mode 100644
index 0000000000..31694a9605
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/utils/EventTypeGroupFilter.test.ts
@@ -0,0 +1,193 @@
+import { describe, it, expect } from "vitest";
+
+import { MembershipRole } from "@calcom/prisma/enums";
+
+import { filterEvents } from "./EventTypeGroupFilter";
+import type { TeamPermissions } from "./permissionUtils";
+import type { EventTypeGroup } from "./transformUtils";
+
+describe("EventTypeGroupFilter", () => {
+  const mockUserGroup: EventTypeGroup = {
+    teamId: null,
+    bookerUrl: "https://cal.com/user",
+    membershipRole: null,
+    profile: {
+      slug: "user",
+      name: "User",
+      image: "avatar.jpg",
+    },
+    metadata: {
+      membershipCount: 1,
+      readOnly: false,
+    },
+  };
+
+  const mockTeamGroup1: EventTypeGroup = {
+    teamId: 1,
+    bookerUrl: "https://cal.com/team1",
+    membershipRole: MembershipRole.ADMIN,
+    profile: {
+      slug: "team1",
+      name: "Team 1",
+      image: "team1.jpg",
+    },
+    metadata: {
+      membershipCount: 5,
+      readOnly: false,
+    },
+  };
+
+  const mockTeamGroup2: EventTypeGroup = {
+    teamId: 2,
+    bookerUrl: "https://cal.com/team2",
+    membershipRole: MembershipRole.MEMBER,
+    profile: {
+      slug: "team2",
+      name: "Team 2",
+      image: "team2.jpg",
+    },
+    metadata: {
+      membershipCount: 3,
+      readOnly: true,
+    },
+  };
+
+  const mockPermissionsMap = new Map<number, TeamPermissions>([
+    [1, { canCreate: true, canEdit: true, canDelete: true, canRead: true }],
+    [2, { canCreate: false, canEdit: true, canDelete: false, canRead: true }],
+  ]);
+
+  const allGroups = [mockUserGroup, mockTeamGroup1, mockTeamGroup2];
+
+  describe("has() method", () => {
+    it("should filter groups with eventType.create permission", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap).has("eventType.create").get();
+
+      expect(result).toHaveLength(2);
+      expect(result).toContain(mockUserGroup); // User groups always have permissions
+      expect(result).toContain(mockTeamGroup1); // Team 1 has create permission
+      expect(result).not.toContain(mockTeamGroup2); // Team 2 doesn't have create permission
+    });
+
+    it("should filter groups with eventType.read permission", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap).has("eventType.read").get();
+
+      expect(result).toHaveLength(3); // All groups can read
+      expect(result).toContain(mockUserGroup);
+      expect(result).toContain(mockTeamGroup1);
+      expect(result).toContain(mockTeamGroup2);
+    });
+
+    it("should filter groups with eventType.update permission", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap).has("eventType.update").get();
+
+      expect(result).toHaveLength(3); // All groups can edit in this test
+      expect(result).toContain(mockUserGroup);
+      expect(result).toContain(mockTeamGroup1);
+      expect(result).toContain(mockTeamGroup2);
+    });
+
+    it("should filter groups with eventType.delete permission", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap).has("eventType.delete").get();
+
+      expect(result).toHaveLength(2);
+      expect(result).toContain(mockUserGroup);
+      expect(result).toContain(mockTeamGroup1);
+      expect(result).not.toContain(mockTeamGroup2);
+    });
+
+    it("should return empty array for unknown permission", () => {
+      const teamOnlyGroups = [mockTeamGroup1, mockTeamGroup2];
+      const result = filterEvents(teamOnlyGroups, mockPermissionsMap)
+        .has("unknown.permission" as "eventType.read")
+        .get();
+
+      expect(result).toHaveLength(0);
+    });
+  });
+
+  describe("byTeam() method", () => {
+    it("should filter groups by team ID", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap).byTeam(1).get();
+
+      expect(result).toHaveLength(1);
+      expect(result).toContain(mockTeamGroup1);
+    });
+
+    it("should return empty array for non-existent team", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap).byTeam(999).get();
+
+      expect(result).toHaveLength(0);
+    });
+  });
+
+  describe("userOnly() method", () => {
+    it("should return only user groups", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap).userOnly().get();
+
+      expect(result).toHaveLength(1);
+      expect(result).toContain(mockUserGroup);
+    });
+  });
+
+  describe("teamsOnly() method", () => {
+    it("should return only team groups", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap).teamsOnly().get();
+
+      expect(result).toHaveLength(2);
+      expect(result).toContain(mockTeamGroup1);
+      expect(result).toContain(mockTeamGroup2);
+      expect(result).not.toContain(mockUserGroup);
+    });
+  });
+
+  describe("readOnly() method", () => {
+    it("should filter by read-only status", () => {
+      const readOnlyResult = filterEvents(allGroups, mockPermissionsMap).readOnly(true).get();
+      const writableResult = filterEvents(allGroups, mockPermissionsMap).readOnly(false).get();
+
+      expect(readOnlyResult).toHaveLength(1);
+      expect(readOnlyResult).toContain(mockTeamGroup2);
+
+      expect(writableResult).toHaveLength(2);
+      expect(writableResult).toContain(mockUserGroup);
+      expect(writableResult).toContain(mockTeamGroup1);
+    });
+  });
+
+  describe("chaining methods", () => {
+    it("should support method chaining", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap).teamsOnly().has("eventType.create").get();
+
+      expect(result).toHaveLength(1);
+      expect(result).toContain(mockTeamGroup1);
+    });
+
+    it("should support complex chaining", () => {
+      const result = filterEvents(allGroups, mockPermissionsMap)
+        .has("eventType.update")
+        .readOnly(false)
+        .get();
+
+      expect(result).toHaveLength(2);
+      expect(result).toContain(mockUserGroup);
+      expect(result).toContain(mockTeamGroup1);
+    });
+  });
+
+  describe("utility methods", () => {
+    it("should return correct count", () => {
+      const count = filterEvents(allGroups, mockPermissionsMap).teamsOnly().count();
+
+      expect(count).toBe(2);
+    });
+
+    it("should check existence correctly", () => {
+      const exists = filterEvents(allGroups, mockPermissionsMap).byTeam(1).exists();
+      const notExists = filterEvents(allGroups, mockPermissionsMap).byTeam(999).exists();
+
+      expect(exists).toBe(true);
+      expect(notExists).toBe(false);
+    });
+  });
+});
diff --git a/packages/trpc/server/routers/viewer/eventTypes/utils/EventTypeGroupFilter.ts b/packages/trpc/server/routers/viewer/eventTypes/utils/EventTypeGroupFilter.ts
new file mode 100644
index 0000000000..410bee7acf
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/utils/EventTypeGroupFilter.ts
@@ -0,0 +1,124 @@
+import type { PermissionString } from "@calcom/features/pbac/domain/types/permission-registry";
+
+import type { TeamPermissions } from "./permissionUtils";
+import type { EventTypeGroup } from "./transformUtils";
+
+export class EventTypeGroupFilter {
+  private groups: EventTypeGroup[];
+  private permissionsMap: Map<number, TeamPermissions>;
+
+  constructor(groups: EventTypeGroup[], permissionsMap: Map<number, TeamPermissions>) {
+    this.groups = groups;
+    this.permissionsMap = permissionsMap;
+  }
+
+  /**
+   * Filter event type groups by permission
+   * @param permission - Permission to check (e.g., "eventType.read", "eventType.create", "eventType.update", "eventType.delete")
+   * @returns New EventTypeGroupFilter instance with filtered groups
+   */
+  has(permission: PermissionString): EventTypeGroupFilter {
+    const filteredGroups = this.groups.filter((group) => {
+      // For user groups (no teamId), they have all permissions
+      if (!group.teamId) {
+        return true;
+      }
+
+      const permissions = this.permissionsMap.get(group.teamId);
+      if (!permissions) {
+        return false;
+      }
+
+      switch (permission) {
+        case "eventType.read":
+          // All groups with permissions can read
+          return permissions.canRead;
+        case "eventType.create":
+          return permissions.canCreate;
+        case "eventType.update":
+          return permissions.canEdit;
+        case "eventType.delete":
+          return permissions.canDelete;
+        default:
+          return false;
+      }
+    });
+
+    return new EventTypeGroupFilter(filteredGroups, this.permissionsMap);
+  }
+
+  /**
+   * Filter by team ID
+   * @param teamId - Team ID to filter by
+   * @returns New EventTypeGroupFilter instance with filtered groups
+   */
+  byTeam(teamId: number): EventTypeGroupFilter {
+    const filteredGroups = this.groups.filter((group) => group.teamId === teamId);
+    return new EventTypeGroupFilter(filteredGroups, this.permissionsMap);
+  }
+
+  /**
+   * Filter by user groups only (no team)
+   * @returns New EventTypeGroupFilter instance with user groups only
+   */
+  userOnly(): EventTypeGroupFilter {
+    const filteredGroups = this.groups.filter((group) => !group.teamId);
+    return new EventTypeGroupFilter(filteredGroups, this.permissionsMap);
+  }
+
+  /**
+   * Filter by team groups only (exclude user groups)
+   * @returns New EventTypeGroupFilter instance with team groups only
+   */
+  teamsOnly(): EventTypeGroupFilter {
+    const filteredGroups = this.groups.filter((group) => group.teamId);
+    return new EventTypeGroupFilter(filteredGroups, this.permissionsMap);
+  }
+
+  /**
+   * Filter by read-only status
+   * @param readOnly - Whether to include only read-only or writable groups
+   * @returns New EventTypeGroupFilter instance with filtered groups
+   */
+  readOnly(readOnly: boolean): EventTypeGroupFilter {
+    const filteredGroups = this.groups.filter((group) => group.metadata.readOnly === readOnly);
+    return new EventTypeGroupFilter(filteredGroups, this.permissionsMap);
+  }
+
+  /**
+   * Get the filtered results
+   * @returns Array of filtered EventTypeGroup objects
+   */
+  get(): EventTypeGroup[] {
+    return this.groups;
+  }
+
+  /**
+   * Get the count of filtered groups
+   * @returns Number of groups after filtering
+   */
+  count(): number {
+    return this.groups.length;
+  }
+
+  /**
+   * Check if any groups match the current filter
+   * @returns Boolean indicating if any groups exist
+   */
+  exists(): boolean {
+    return this.groups.length > 0;
+  }
+}
+
+/**
+ * Create a new EventTypeGroupFilter instance
+ * @param groups - Array of EventTypeGroup objects
+ * @param permissionsMap - Map of team permissions
+ * @returns EventTypeGroupFilter instance for chaining
+ */
+export function filterEvents(
+  groups: EventTypeGroup[],
+  permissionsMap: Map<number, TeamPermissions>
+): EventTypeGroupFilter {
+  return new EventTypeGroupFilter(groups, permissionsMap);
+}
diff --git a/packages/trpc/server/routers/viewer/eventTypes/utils/filterUtils.ts b/packages/trpc/server/routers/viewer/eventTypes/utils/filterUtils.ts
new file mode 100644
index 0000000000..bae68cfc7d
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/utils/filterUtils.ts
@@ -0,0 +1,49 @@
+import { hasFilter } from "@calcom/features/filters/lib/hasFilter";
+
+import type { TEventTypeInputSchema } from "../getByViewer.schema";
+
+type FiltersType = NonNullable<TEventTypeInputSchema>["filters"];
+
+export interface FilterContext {
+  filters?: FiltersType;
+  userUpId: string;
+}
+
+export function shouldListUserEvents(context: FilterContext): boolean {
+  const { filters, userUpId } = context;
+  const isFilterSet = filters && hasFilter(filters);
+  const isUpIdInFilter = filters?.upIds?.includes(userUpId) ?? false;
+
+  let shouldList = !isFilterSet || isUpIdInFilter;
+
+  if (isFilterSet && filters?.upIds && !isUpIdInFilter) {
+    shouldList = true;
+  }
+
+  return shouldList;
+}
+
+export function shouldIncludeTeamMembership(
+  membership: { team: { id: number } },
+  filters?: FiltersType
+): boolean {
+  if (!filters || !hasFilter(filters)) {
+    return true;
+  }
+
+  return filters?.teamIds?.includes(membership.team.id) ?? false;
+}
+
+export function createTeamSlug(
+  teamSlug: string | null,
+  hasParent: boolean,
+  forRoutingForms: boolean
+): string | null {
+  if (!teamSlug) return null;
+
+  if (forRoutingForms) {
+    return `team/${teamSlug}`;
+  }
+
+  return hasParent ? teamSlug : `team/${teamSlug}`;
+}
diff --git a/packages/trpc/server/routers/viewer/eventTypes/utils/permissionUtils.ts b/packages/trpc/server/routers/viewer/eventTypes/utils/permissionUtils.ts
new file mode 100644
index 0000000000..041d06fa06
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/utils/permissionUtils.ts
@@ -0,0 +1,107 @@
+import { Resource } from "@calcom/features/pbac/domain/types/permission-registry";
+import { getResourcePermissions } from "@calcom/features/pbac/lib/resource-permissions";
+import { MembershipRole } from "@calcom/prisma/enums";
+
+export interface TeamPermissions {
+  canCreate: boolean;
+  canEdit: boolean;
+  canDelete: boolean;
+  canRead: boolean;
+}
+
+export interface MembershipWithRole {
+  teamId: number;
+  membershipRole: MembershipRole;
+}
+
+const MEMBERSHIP_HIERARCHY: Record<MembershipRole, number> = {
+  [MembershipRole.MEMBER]: 1,
+  [MembershipRole.ADMIN]: 2,
+  [MembershipRole.OWNER]: 3,
+};
+
+export function hasHigherPrivilege(role1: MembershipRole, role2: MembershipRole): boolean {
+  return MEMBERSHIP_HIERARCHY[role1] > MEMBERSHIP_HIERARCHY[role2];
+}
+
+export function getEffectiveRole(
+  orgMembership: MembershipRole | undefined,
+  membershipRole: MembershipRole
+): MembershipRole {
+  return orgMembership && hasHigherPrivilege(orgMembership, membershipRole) ? orgMembership : membershipRole;
+}
+
+export async function getTeamPermissions(
+  userId: number,
+  teamId: number,
+  effectiveRole: MembershipRole
+): Promise<TeamPermissions> {
+  try {
+    const permissions = await getResourcePermissions({
+      userId,
+      teamId,
+      resource: Resource.EventType,
+      userRole: effectiveRole,
+      fallbackRoles: {
+        read: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER, MembershipRole.MEMBER],
+        },
+        create: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+        update: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+        delete: {
+          roles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+        },
+      },
+    });
+
+    return {
+      canCreate: permissions.canCreate,
+      canEdit: permissions.canEdit,
+      canDelete: permissions.canDelete,
+      canRead: permissions.canRead,
+    };
+  } catch (error) {
+    console.warn(
+      `PBAC check failed for user ${userId} on team ${teamId}, falling back to role check:`,
+      error
+    );
+
+    return getFallbackPermissions(effectiveRole);
+  }
+}
+
+function getFallbackPermissions(role: MembershipRole): TeamPermissions {
+  const isAdminOrOwner = role === MembershipRole.ADMIN || role === MembershipRole.OWNER;
+  const isMember = role === MembershipRole.MEMBER;
+
+  return {
+    canRead: isAdminOrOwner || isMember,
+    canCreate: isAdminOrOwner,
+    canEdit: isAdminOrOwner,
+    canDelete: isAdminOrOwner,
+  };
+}
+
+export async function buildTeamPermissionsMap(
+  memberships: Array<{ team: { id: number; parentId?: number | null }; role: MembershipRole }>,
+  teamMemberships: MembershipWithRole[],
+  userId: number
+): Promise<Map<number, TeamPermissions>> {
+  const permissionPromises = memberships.map(async (membership) => {
+    const orgMembership = teamMemberships.find(
+      (teamM) => teamM.teamId === membership.team.parentId
+    )?.membershipRole;
+
+    const effectiveRole = getEffectiveRole(orgMembership, membership.role);
+    const permissions = await getTeamPermissions(userId, membership.team.id, effectiveRole);
+
+    return [membership.team.id, permissions] as const;
+  });
+
+  const results = await Promise.all(permissionPromises);
+  return new Map(results);
+}
diff --git a/packages/trpc/server/routers/viewer/eventTypes/utils/transformUtils.ts b/packages/trpc/server/routers/viewer/eventTypes/utils/transformUtils.ts
new file mode 100644
index 0000000000..f4dc094037
--- /dev/null
+++ b/packages/trpc/server/routers/viewer/eventTypes/utils/transformUtils.ts
@@ -0,0 +1,145 @@
+import { getPlaceholderAvatar } from "@calcom/lib/defaultAvatarImage";
+import { getUserAvatarUrl } from "@calcom/lib/getAvatarUrl";
+import { getBookerBaseUrlSync } from "@calcom/lib/getBookerUrl/client";
+import { getBookerBaseUrl } from "@calcom/lib/getBookerUrl/server";
+import type { MembershipRole } from "@calcom/prisma/enums";
+import { teamMetadataSchema } from "@calcom/prisma/zod-utils";
+
+import type { TeamPermissions } from "./permissionUtils";
+
+export interface EventTypeGroup {
+  teamId?: number | null;
+  parentId?: number | null;
+  bookerUrl: string;
+  membershipRole?: MembershipRole | null;
+  profile: {
+    slug: string | null;
+    name: string | null;
+    image: string;
+    eventTypesLockedByOrg?: boolean;
+  };
+  metadata: {
+    membershipCount: number;
+    readOnly: boolean;
+  };
+}
+
+export interface ProfileWithPermissions {
+  slug: string | null;
+  name: string | null;
+  image: string;
+  eventTypesLockedByOrg?: boolean;
+  membershipCount: number;
+  readOnly: boolean;
+  teamId?: number | null;
+  membershipRole?: MembershipRole | null;
+  canCreateEventTypes?: boolean;
+  canUpdateEventTypes?: boolean;
+  canDeleteEventTypes?: boolean;
+}
+
+export async function createUserEventGroup(
+  profile: {
+    username: string | null;
+    name: string | null;
+    avatarUrl: string | null;
+    organizationId: number | null;
+  },
+  parentOrgHasLockedEventTypes: boolean
+): Promise<EventTypeGroup> {
+  const bookerUrl = await getBookerBaseUrl(profile.organizationId);
+
+  return {
+    teamId: null,
+    bookerUrl,
+    membershipRole: null,
+    profile: {
+      slug: profile.username,
+      name: profile.name,
+      image: getUserAvatarUrl({
+        avatarUrl: profile.avatarUrl,
+      }),
+      eventTypesLockedByOrg: parentOrgHasLockedEventTypes,
+    },
+    metadata: {
+      membershipCount: 1,
+      readOnly: false,
+    },
+  };
+}
+
+export async function createTeamEventGroup(
+  membership: {
+    team: {
+      id: number;
+      name: string;
+      slug: string | null;
+      logoUrl: string | null;
+      parentId: number | null;
+      parent?: {
+        name: string;
+        slug: string | null;
+        logoUrl: string | null;
+        metadata: unknown;
+      } | null;
+      metadata: unknown;
+    };
+    role: MembershipRole;
+  },
+  effectiveRole: MembershipRole,
+  teamSlug: string | null,
+  permissions: TeamPermissions
+): Promise<EventTypeGroup> {
+  const team = {
+    ...membership.team,
+    metadata: teamMetadataSchema.parse(membership.team.metadata),
+  };
+
+  const teamParentMetadata = team.parent ? teamMetadataSchema.parse(team.parent.metadata) : null;
+
+  return {
+    teamId: team.id,
+    parentId: team.parentId,
+    bookerUrl: getBookerBaseUrlSync(team.parent?.slug ?? teamParentMetadata?.requestedSlug ?? null),
+    membershipRole: effectiveRole,
+    profile: {
+      image: team.parent
+        ? getPlaceholderAvatar(team.parent.logoUrl, team.parent.name)
+        : getPlaceholderAvatar(team.logoUrl, team.name),
+      name: team.name,
+      slug: teamSlug,
+    },
+    metadata: {
+      membershipCount: 0,
+      readOnly: !permissions.canEdit,
+    },
+  };
+}
+
+export function createProfilesWithPermissions(
+  eventTypeGroups: EventTypeGroup[],
+  teamPermissionsMap: Map<number, TeamPermissions>
+): ProfileWithPermissions[] {
+  return eventTypeGroups.map((group) => {
+    let canCreateEventTypes: boolean | undefined = undefined;
+    let canUpdateEventTypes: boolean | undefined = undefined;
+    let canDeleteEventTypes: boolean | undefined = undefined;
+
+    if (group.teamId) {
+      const permissions = teamPermissionsMap.get(group.teamId);
+      canCreateEventTypes = permissions?.canCreate;
+      canUpdateEventTypes = permissions?.canEdit;
+      canDeleteEventTypes = permissions?.canDelete;
+    }
+
+    return {
+      ...group.profile,
+      ...group.metadata,
+      teamId: group.teamId,
+      membershipRole: group.membershipRole,
+      canCreateEventTypes,
+      canUpdateEventTypes,
+      canDeleteEventTypes,
+    };
+  });
+}
diff --git a/packages/trpc/server/routers/viewer/workflows/activateEventType.handler.ts b/packages/trpc/server/routers/viewer/workflows/activateEventType.handler.ts
index 20bac521c8..6e6f32988f 100644
--- a/packages/trpc/server/routers/viewer/workflows/activateEventType.handler.ts
+++ b/packages/trpc/server/routers/viewer/workflows/activateEventType.handler.ts
@@ -1,6 +1,7 @@
 import { scheduleEmailReminder } from "@calcom/features/ee/workflows/lib/reminders/emailReminderManager";
 import { scheduleSMSReminder } from "@calcom/features/ee/workflows/lib/reminders/smsReminderManager";
 import { scheduleWhatsappReminder } from "@calcom/features/ee/workflows/lib/reminders/whatsappReminderManager";
+import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
 import { getBookerBaseUrl } from "@calcom/lib/getBookerUrl/server";
 import { WorkflowRepository } from "@calcom/lib/server/repository/workflow";
 import { getTimeFormatStringFromUserTimeFormat } from "@calcom/lib/timeFormat";
@@ -37,9 +38,6 @@ export const activateEventTypeHandler = async ({ ctx, input }: ActivateEventType
               some: {
                 userId: ctx.user.id,
                 accepted: true,
-                NOT: {
-                  role: MembershipRole.MEMBER,
-                },
               },
             },
           },
@@ -97,6 +95,21 @@ export const activateEventTypeHandler = async ({ ctx, input }: ActivateEventType
   if (!eventType)
     throw new TRPCError({ code: "UNAUTHORIZED", message: "Not authorized to edit this event type" });
 
+  if (eventType.teamId) {
+    const permissionCheckService = new PermissionCheckService();
+
+    const hasPermissionToActivate = await permissionCheckService.checkPermission({
+      userId: ctx.user.id,
+      teamId: eventType.teamId,
+      permission: "eventType.update",
+      fallbackRoles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+    });
+
+    if (!hasPermissionToActivate) {
+      throw new TRPCError({ code: "UNAUTHORIZED", message: "Not authorized to edit this event type" });
+    }
+  }
+
   // at this point we know that the event type belongs to the user or team
   // so we don't use OR, we use logic.
   const whereClause = eventType.teamId ? { teamId: eventType.teamId } : { userId: ctx.user.id };
diff --git a/packages/trpc/server/routers/viewer/workflows/getAllActiveWorkflows.handler.ts b/packages/trpc/server/routers/viewer/workflows/getAllActiveWorkflows.handler.ts
index d580cf3416..e1b17fa9d2 100644
--- a/packages/trpc/server/routers/viewer/workflows/getAllActiveWorkflows.handler.ts
+++ b/packages/trpc/server/routers/viewer/workflows/getAllActiveWorkflows.handler.ts
@@ -1,5 +1,6 @@
 import { eventTypeMetaDataSchemaWithTypedApps } from "@calcom/app-store/zod-utils";
-import { isTeamMember } from "@calcom/lib/server/queries/teams";
+import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
+import { MembershipRole } from "@calcom/prisma/enums";
 import type { TrpcSessionUser } from "@calcom/trpc/server/types";
 
 import { TRPCError } from "@trpc/server";
@@ -25,20 +26,39 @@ export const getAllActiveWorkflowsHandler = async ({ input, ctx }: GetAllActiveW
     metadata: eventType.metadata,
   };
 
-  if (eventType.userId && eventType.userId !== ctx.user.id) {
+  if (
+    eventType.userId &&
+    eventType.userId !== ctx.user.id &&
+    !eventType.teamId &&
+    !eventType.parent?.teamId
+  ) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
     });
   }
 
+  const permissionCheckService = new PermissionCheckService();
+
   if (eventType.teamId) {
-    const team = await isTeamMember(ctx.user?.id, eventType.teamId);
-    if (!team) throw new TRPCError({ code: "UNAUTHORIZED" });
+    const hasPermissionToViewWorkflows = await permissionCheckService.checkPermission({
+      userId: ctx.user.id,
+      teamId: eventType.teamId,
+      permission: "workflow.read",
+      fallbackRoles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+    });
+
+    if (!hasPermissionToViewWorkflows) throw new TRPCError({ code: "UNAUTHORIZED" });
   }
 
   if (eventType.parent?.teamId) {
-    const team = await isTeamMember(ctx.user?.id, eventType.parent?.teamId);
-    if (!team) throw new TRPCError({ code: "UNAUTHORIZED" });
+    const hasPermissionToViewWorkflows = await permissionCheckService.checkPermission({
+      userId: ctx.user.id,
+      teamId: eventType.parent?.teamId,
+      permission: "workflow.read",
+      fallbackRoles: [MembershipRole.ADMIN, MembershipRole.OWNER],
+    });
+
+    if (!hasPermissionToViewWorkflows) throw new TRPCError({ code: "UNAUTHORIZED" });
   }
 
   const allActiveWorkflows = await getAllWorkflowsFromEventType(
diff --git a/packages/trpc/server/routers/viewer/workflows/list.handler.ts b/packages/trpc/server/routers/viewer/workflows/list.handler.ts
index 67c1f58ee6..ba2a159f66 100644
--- a/packages/trpc/server/routers/viewer/workflows/list.handler.ts
+++ b/packages/trpc/server/routers/viewer/workflows/list.handler.ts
@@ -1,7 +1,9 @@
 import type { WorkflowType } from "@calcom/features/ee/workflows/components/WorkflowListPage";
 // import dayjs from "@calcom/dayjs";
 // import { getErrorFromUnknown } from "@calcom/lib/errors";
+import { addPermissionsToWorkflows } from "@calcom/lib/server/repository/workflow-permissions";
 import { prisma } from "@calcom/prisma";
+import type { PrismaClient } from "@calcom/prisma";
 import { MembershipRole } from "@calcom/prisma/enums";
 import type { TrpcSessionUser } from "@calcom/trpc/server/types";
 
@@ -10,6 +12,7 @@ import type { TListInputSchema } from "./list.schema";
 type ListOptions = {
   ctx: {
     user: NonNullable<TrpcSessionUser>;
+    prisma: PrismaClient;
   };
   input: TListInputSchema;
 };
@@ -156,7 +159,13 @@ export const listHandler = async ({ ctx, input }: ListOptions) => {
 
     workflows.push(...workflowsWithReadOnly);
 
-    return { workflows };
+    // Add permissions to each workflow
+    const workflowsWithPermissions = await addPermissionsToWorkflows(workflows, ctx.user.id);
+
+    // Filter workflows based on view permission
+    const filteredWorkflows = workflowsWithPermissions.filter((workflow) => workflow.permissions.canView);
+
+    return { workflows: filteredWorkflows };
   }
 
   if (input && input.userId) {
@@ -198,7 +207,13 @@ export const listHandler = async ({ ctx, input }: ListOptions) => {
 
     workflows.push(...userWorkflows);
 
-    return { workflows };
+    // Add permissions to each workflow
+    const workflowsWithPermissions = await addPermissionsToWorkflows(workflows, ctx.user.id);
+
+    // Filter workflows based on view permission
+    const filteredWorkflows = workflowsWithPermissions.filter((workflow) => workflow.permissions.canView);
+
+    return { workflows: filteredWorkflows };
   }
 
   const allWorkflows = await prisma.workflow.findMany({
@@ -259,5 +274,11 @@ export const listHandler = async ({ ctx, input }: ListOptions) => {
 
   workflows.push(...workflowsWithReadOnly);
 
-  return { workflows };
+  // Add permissions to each workflow
+  const workflowsWithPermissions = await addPermissionsToWorkflows(workflows, ctx.user.id);
+
+  // Filter workflows based on view permission
+  const filteredWorkflows = workflowsWithPermissions.filter((workflow) => workflow.permissions.canView);
+
+  return { workflows: filteredWorkflows };
 };