diff --git a/awx/main/access.py b/awx/main/access.py
index 66e8e5e463..aefb6934a6 100644
--- a/awx/main/access.py
+++ b/awx/main/access.py
@@ -595,6 +595,8 @@ class CredentialAccess(BaseAccess):
 
     @check_superuser
     def can_change(self, obj, data):
+        if not self.can_add(data):
+            return False
         return self.user in obj.owner_role
 
     def can_delete(self, obj):