diff --git a/server/src/__tests__/invite-join-grants.test.ts b/server/src/__tests__/invite-join-grants.test.ts
index 427fef0fa6..7016a6ff88 100644
--- a/server/src/__tests__/invite-join-grants.test.ts
+++ b/server/src/__tests__/invite-join-grants.test.ts
@@ -74,7 +74,10 @@ describe("human invite roles", () => {
       { permissionKey: "users:invite", scope: null },
       { permissionKey: "users:manage_permissions", scope: null },
       { permissionKey: "tasks:assign", scope: null },
+      { permissionKey: "tasks:manage_active_checkouts", scope: null },
       { permissionKey: "joins:approve", scope: null },
+      { permissionKey: "pipelines:write", scope: null },
+      { permissionKey: "audit:view_agent_actions", scope: null },
       { permissionKey: "tools:manage_connections", scope: null },
       { permissionKey: "tools:manage_runtime", scope: null },
       { permissionKey: "tools:use", scope: null },
@@ -90,7 +93,10 @@ describe("human invite roles", () => {
       { permissionKey: "environments:manage", scope: null },
       { permissionKey: "users:invite", scope: null },
       { permissionKey: "tasks:assign", scope: null },
+      { permissionKey: "tasks:manage_active_checkouts", scope: null },
       { permissionKey: "joins:approve", scope: null },
+      { permissionKey: "pipelines:write", scope: null },
+      { permissionKey: "audit:view_agent_actions", scope: null },
       { permissionKey: "tools:manage_connections", scope: null },
       { permissionKey: "tools:manage_runtime", scope: null },
       { permissionKey: "tools:use", scope: null },
diff --git a/server/src/services/board-auth.test.ts b/server/src/services/board-auth.test.ts
index f0883ae991..f90c2e2e27 100644
--- a/server/src/services/board-auth.test.ts
+++ b/server/src/services/board-auth.test.ts
@@ -6,6 +6,8 @@ import {
   principalPermissionGrants,
   type Db,
 } from "@paperclipai/db";
+import { BOARD_API_KEY_SCOPE_PRESETS } from "@paperclipai/shared";
+import { grantsForHumanRole } from "./company-member-roles.js";
 import { boardAuthService } from "./board-auth.js";
 
 describe("boardAuthService touchBoardApiKey", () => {
@@ -58,7 +60,7 @@ describe("boardAuthService createNamedBoardApiKey", () => {
 
   function creationDb(options: {
     instanceAdmin?: boolean;
-    membershipRole?: "viewer" | "operator";
+    membershipRole?: "viewer" | "operator" | "admin" | "owner";
     grants?: string[];
   }) {
     const insert = vi.fn((table: unknown) => {
@@ -139,4 +141,25 @@ describe("boardAuthService createNamedBoardApiKey", () => {
     })).rejects.toMatchObject({ status: 403 });
     expect(insert).not.toHaveBeenCalled();
   });
+
+  it("accepts the recommended company-automation preset for a default owner", async () => {
+    const { db, insert } = creationDb({
+      membershipRole: "owner",
+      grants: grantsForHumanRole("owner").map((grant) => grant.permissionKey),
+    });
+    const service = boardAuthService(db);
+
+    await expect(service.createNamedBoardApiKey({
+      userId,
+      name: "automation",
+      scopeConfig: {
+        version: 1,
+        kind: "scoped",
+        companyIds: [companyId],
+        permissions: [...BOARD_API_KEY_SCOPE_PRESETS.company_automation.permissions],
+        instanceCapabilities: [],
+      },
+    })).resolves.toMatchObject({ id: "key-1" });
+    expect(insert).toHaveBeenCalledOnce();
+  });
 });
diff --git a/server/src/services/company-member-roles.ts b/server/src/services/company-member-roles.ts
index 2a9d781734..3f7097a7af 100644
--- a/server/src/services/company-member-roles.ts
+++ b/server/src/services/company-member-roles.ts
@@ -34,7 +34,10 @@ export function grantsForHumanRole(
         { permissionKey: "users:invite", scope: null },
         { permissionKey: "users:manage_permissions", scope: null },
         { permissionKey: "tasks:assign", scope: null },
+        { permissionKey: "tasks:manage_active_checkouts", scope: null },
         { permissionKey: "joins:approve", scope: null },
+        { permissionKey: "pipelines:write", scope: null },
+        { permissionKey: "audit:view_agent_actions", scope: null },
         { permissionKey: "tools:manage_connections", scope: null },
         { permissionKey: "tools:manage_runtime", scope: null },
         { permissionKey: "tools:use", scope: null },
@@ -48,7 +51,10 @@ export function grantsForHumanRole(
         { permissionKey: "environments:manage", scope: null },
         { permissionKey: "users:invite", scope: null },
         { permissionKey: "tasks:assign", scope: null },
+        { permissionKey: "tasks:manage_active_checkouts", scope: null },
         { permissionKey: "joins:approve", scope: null },
+        { permissionKey: "pipelines:write", scope: null },
+        { permissionKey: "audit:view_agent_actions", scope: null },
         { permissionKey: "tools:manage_connections", scope: null },
         { permissionKey: "tools:manage_runtime", scope: null },
         { permissionKey: "tools:use", scope: null },