diff --git a/common/lib/user.js b/common/lib/user.js
index 509f4d2fa..78ffd94f5 100644
--- a/common/lib/user.js
+++ b/common/lib/user.js
@@ -1,3 +1,5 @@
+const { uniq } = require('lodash')
+
 function User({ fullname, roles = [], locations = [] } = {}) {
   this.fullname = fullname
   this.permissions = this.getPermissions(roles)
@@ -10,21 +12,27 @@ User.prototype = {
 
     if (roles.includes('ROLE_PECS_POLICE')) {
       permissions.push(
-        ...[
-          'moves:view:by_location',
-          'moves:download:by_location',
-          'move:view',
-          'move:create',
-          'move:cancel',
-        ]
+        'moves:view:by_location',
+        'moves:download:by_location',
+        'move:view',
+        'move:create',
+        'move:cancel'
+      )
+    }
+
+    if (roles.includes('ROLE_PECS_PRISON')) {
+      permissions.push(
+        'moves:view:by_location',
+        'moves:download:by_location',
+        'move:view'
       )
     }
 
     if (roles.includes('ROLE_PECS_SUPPLIER')) {
-      permissions.push(...['moves:view:all', 'moves:download:all'])
+      permissions.push('moves:view:all', 'moves:download:all')
     }
 
-    return permissions
+    return uniq(permissions)
   },
 }
 
diff --git a/common/lib/user.test.js b/common/lib/user.test.js
index 5d7137bca..557842a26 100644
--- a/common/lib/user.test.js
+++ b/common/lib/user.test.js
@@ -97,6 +97,20 @@ describe('User class', function() {
       })
     })
 
+    context('when user has ROLE_PECS_PRISON', function() {
+      beforeEach(function() {
+        permissions = user.getPermissions(['ROLE_PECS_PRISON'])
+      })
+
+      it('should contain correct permission', function() {
+        expect(permissions).to.deep.equal([
+          'moves:view:by_location',
+          'moves:download:by_location',
+          'move:view',
+        ])
+      })
+    })
+
     context('when user has ROLE_PECS_SUPPLIER role', function() {
       beforeEach(function() {
         permissions = user.getPermissions(['ROLE_PECS_SUPPLIER'])
@@ -110,28 +124,26 @@ describe('User class', function() {
       })
     })
 
-    context(
-      'when user has both ROLE_PECS_POLICE and ROLE_PECS_SUPPLIER roles',
-      function() {
-        beforeEach(function() {
-          permissions = user.getPermissions([
-            'ROLE_PECS_POLICE',
-            'ROLE_PECS_SUPPLIER',
-          ])
-        })
-
-        it('should contain correct permission', function() {
-          expect(permissions).to.deep.equal([
-            'moves:view:by_location',
-            'moves:download:by_location',
-            'move:view',
-            'move:create',
-            'move:cancel',
-            'moves:view:all',
-            'moves:download:all',
-          ])
-        })
-      }
-    )
+    context('when user has all roles', function() {
+      beforeEach(function() {
+        permissions = user.getPermissions([
+          'ROLE_PECS_POLICE',
+          'ROLE_PECS_PRISON',
+          'ROLE_PECS_SUPPLIER',
+        ])
+      })
+
+      it('should contain correct permission', function() {
+        expect(permissions).to.deep.equal([
+          'moves:view:by_location',
+          'moves:download:by_location',
+          'move:view',
+          'move:create',
+          'move:cancel',
+          'moves:view:all',
+          'moves:download:all',
+        ])
+      })
+    })
   })
 })