diff --git a/coderd/aibridgedserver/notifications.go b/coderd/aibridgedserver/notifications.go
index 14c7c54a252..8e8c6e540c7 100644
--- a/coderd/aibridgedserver/notifications.go
+++ b/coderd/aibridgedserver/notifications.go
@@ -104,10 +104,7 @@ func (s *Server) detectBudgetThresholdCrossings(ctx context.Context, tx database
 // notifyBudgetThresholdCrossing enqueues the notification for the user who
 // crossed the threshold.
 func (s *Server) notifyBudgetThresholdCrossing(ctx context.Context, crossing budgetThresholdCrossing) error {
-	//nolint:gocritic // The interception context is scoped to AI Bridge; reading the group and enqueuing need system access.
-	sysCtx := dbauthz.AsSystemRestricted(ctx)
-
-	group, err := s.store.GetGroupByID(sysCtx, crossing.groupID)
+	group, err := s.store.GetGroupByID(ctx, crossing.groupID)
 	if err != nil {
 		return xerrors.Errorf("look up group %q: %w", crossing.groupID, err)
 	}
@@ -118,7 +115,8 @@ func (s *Server) notifyBudgetThresholdCrossing(ctx context.Context, crossing bud
 		"group_name": group.Name,
 	}
 
-	if _, err := s.notifEnqueuer.EnqueueWithData(sysCtx, crossing.userID, crossing.template,
+	//nolint:gocritic // Enqueuing notifications requires the notifier actor.
+	if _, err := s.notifEnqueuer.EnqueueWithData(dbauthz.AsNotifier(ctx), crossing.userID, crossing.template,
 		labels, nil, budgetNotificationsCreatedBy,
 		crossing.groupID,
 	); err != nil {
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 3161f3c3e9d..ca771572672 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -696,6 +696,7 @@ var (
 					rbac.ResourceAiModelPrice.Type:         {policy.ActionRead, policy.ActionUpdate}, // Read: per-interception cost lookup. Update: startup price seeder.
 					rbac.ResourceAiSeat.Type:               {policy.ActionCreate},                    // Required for UpsertAISeatState.
 					rbac.ResourceAIProvider.Type:           {policy.ActionRead},                      // Required to load the provider snapshot (and per-provider keys) at startup.
+					rbac.ResourceGroup.Type:                {policy.ActionRead},                      // Required to read the effective group.
 				}),
 				User:    []rbac.Permission{},
 				ByOrgID: map[string]rbac.OrgPermissions{},