diff --git a/CHANGELOG.md b/CHANGELOG.md
index dc9863cf..e5cb6e2a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 # next version
 
+- Show UCP settings as read-only to viewers, let UCP editors save without sales-channel edit access, and require UCP view access for Agentic Commerce Insights.
 - Keep disabled Agentic Files disabled when activating UCP or saving its settings.
   Existing custom content is preserved, and missing default files are created.
 - Serve `robots.txt` again on Shopware `6.7.1.0` to `6.7.4.x` instead of answering `500`.
diff --git a/CHANGELOG_de-DE.md b/CHANGELOG_de-DE.md
index a7362ee6..bfd779e0 100644
--- a/CHANGELOG_de-DE.md
+++ b/CHANGELOG_de-DE.md
@@ -1,5 +1,8 @@
 # next version
 
+- UCP-Einstellungen werden für Benutzer mit Leserechten schreibgeschützt angezeigt.
+  Benutzer mit UCP-Bearbeitungsrechten können sie ohne Bearbeitungsrechte für Verkaufskanäle speichern.
+  Agentic-Commerce-Insights erfordern UCP-Leserechte.
 - Deaktivierte Agentic Files bleiben beim Aktivieren von UCP oder Speichern der UCP-Einstellungen deaktiviert.
   Bestehende eigene Inhalte bleiben erhalten, und fehlende Standarddateien werden angelegt.
 - Unter Shopware `6.7.1.0` bis `6.7.4.x` liefert der Shop `robots.txt` wieder aus, statt mit `500` zu antworten.
diff --git a/docs/manual-testing.md b/docs/manual-testing.md
index 84e29953..0b5c58c4 100644
--- a/docs/manual-testing.md
+++ b/docs/manual-testing.md
@@ -256,11 +256,14 @@ Expected result:
 - `SwagAgenticCommerce` administration assets exist under `public`
 - `/admin` still renders after the build
 
-The CI admin matrix runs Playwright automatically when `CI_ADMIN_BROWSER_VALIDATE=1` is set,
-covering UCP module render, overview, detail, the authenticated admin API
-list/detail/config/preview, and the signing-key lifecycle. The Playwright suite is the
-release-confidence check for those flows; the manual browser steps below are for exploratory UX
-review and for the ACL/UX matrix that CI cannot run (CI runs as a privileged user only).
+The CI admin matrix runs the legacy `test:e2e:admin` Playwright suite when
+`CI_ADMIN_BROWSER_VALIDATE=1` is set. It does not run the acceptance suite or the `@UcpAcl`
+permission matrix. Run the gating acceptance suite, including the `UcpAcl` project, with
+`npm run acceptance` from the plugin root after completing the acceptance setup described in
+[the acceptance README](../tests/acceptance/README.md).
+
+Use the manual browser steps below for exploratory UX review across the supported Administration
+builds.
 
 Install the local browser QA dependency before running it manually:
 
@@ -316,12 +319,14 @@ If needed, reset inside the lane:
 bin/console user:change-password admin --password 'shopware'
 ```
 
-The module render, overview, detail, save, signing-key actions, and profile preview are asserted by
-the Playwright admin suite. Use the manual open for exploratory UX review:
+The sales-channel detail, UCP configuration, and profile preview are asserted by the Playwright
+Administration suite. Signing-key commands are verified through the console. Use the manual open for
+exploratory UX review:
 
-- settings page shows the UCP entry in the expected settings group for the lane
-- direct route opens: `#/sw/settings/ucp/index`
-- overview renders real sales channels and the native sales-channel shortcut
+- Storefront and Headless channels show the UCP tab to users with `ucp.viewer`
+- users with `ucp.viewer` but without `ucp.editor` see a read-only banner and disabled controls
+- users with `ucp.editor` can save UCP configuration without `sales_channel.editor`
+- Agentic Commerce Insights remain hidden without `ucp.viewer`, including direct navigation
 - profile preview renders the lane-aware transports
 - browser console has no UCP runtime error
 - a Product Comparison and an Agentic Commerce channel show no UCP card, and saving their feed
@@ -331,6 +336,8 @@ the Playwright admin suite. Use the manual open for exploratory UX review:
   is accepted
 - `ucp:channels` lists no feed channel, and
   `ucp:config:set --sales-channel <feed-channel-id> --active 1` exits non-zero
+- signing keys are managed with `ucp:signing-keys:{generate,list,show-public,retire,delete}` through
+  `bin/console`; there is no Administration signing-key interface
 
 ## Storefront Build Validation
 
@@ -494,15 +501,18 @@ Steps:
 
 ### 4. Admin ACL / UX
 
-CI runs the admin suite as a privileged user only. Verify the role matrix by logging in as users
-that hold exactly one of the UCP ACL roles.
-
-- `ucp.viewer`: save and signing-key actions are disabled; a read-only banner is shown.
-- `ucp.key_rotator`: can create, retire, and delete signing keys, but cannot save config.
-- `ucp.editor`: can save config.
+The `UcpAcl` acceptance project verifies these role-specific behaviors. The gating acceptance suite
+runs with `npm run acceptance` from the plugin root; `CI_ADMIN_BROWSER_VALIDATE` runs only the
+legacy admin Playwright suite. Use manual accounts with the same role assignments when exploring the
+UI:
 
-Also visually verify the signing-key management UX: the algorithm select, the `kid` input, and the
-retire/delete confirmation dialogs.
+- `ucp.viewer` and `ucp.key_rotator`: configuration controls and Save are disabled, and the
+  read-only banner is shown.
+- `ucp.editor` without `sales_channel.editor`: Save on the UCP tab persists only UCP configuration.
+- Users without a UCP role do not see the UCP tab or list column, and cannot read or write UCP
+  configuration.
+- Agentic Commerce Insights require `ucp.viewer`; product-comparison Insights keep their core
+  permission behavior.
 
 Verify that Save applies pending changes across sales channel tabs:
 
@@ -601,7 +611,8 @@ A lane passes manual validation when all are true:
 
 - plugin installs through Composer and activates
 - admin build for the lane succeeds
-- UCP administration module renders in browser (exploratory)
+- Agentic Commerce sales-channel UCP settings render in browser (exploratory)
+- Storefront and Headless channels show the UCP tab to users with `ucp.viewer`
 - storefront build for the lane succeeds and the storefront UI renders
 - real-browser cross-origin iframe enforcement behaves correctly: embed renders
   - bridge works on an allowlisted origin, browser blocks the frame with a CSP violation on a
@@ -610,8 +621,7 @@ A lane passes manual validation when all are true:
   (scenario 2)
 - the remote-profile allowlist accepts an allowlisted external profile host and rejects a
   non-allowlisted one (scenario 3)
-- admin ACL/UX matrix is correct for `ucp.viewer`, `ucp.editor`, and `ucp.key_rotator`, and the
-  signing-key UX renders (scenario 4)
+- admin ACL/UX matrix is correct for `ucp.viewer`, `ucp.editor`, and `ucp.key_rotator` (scenario 4)
 - with a real tokenizing handler installed, the profile advertises it, `tokenize` returns a token,
   and a paid order completes (scenario 5)
 - concurrent `/complete` requests produce exactly one order with no duplicate and no `500`
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/acl/index.js b/src/Resources/app/administration/src/extension/sw-sales-channel/acl/index.js
index fbec29eb..142121c3 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/acl/index.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/acl/index.js
@@ -32,10 +32,9 @@ Shopware.Service('privileges').addPrivilegeMappingEntry({
     },
 });
 
-// UCP privileges (moved here from the removed sw-settings-ucp module). The
-// Agentic Commerce tab gates editing on `ucp.editor` and signing-key actions on
-// `ucp.key_rotator`; the parent is null since UCP config now lives on the sales
-// channel rather than a dedicated Settings module.
+// UCP config privileges. `ucp.key_rotator` currently adds only the viewer
+// dependency; signing keys are managed through console commands, not the UI.
+// The parent is null since UCP config lives on the sales channel.
 Shopware.Service('privileges').addPrivilegeMappingEntry({
     category: 'permissions',
     parent: null,
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/index.js b/src/Resources/app/administration/src/extension/sw-sales-channel/index.js
index 6230c5c3..deea6e34 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/index.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/index.js
@@ -10,5 +10,6 @@ import './view/sw-sales-channel-create-base';
 import './view/sw-sales-channel-detail-agentic-commerce';
 import './view/sw-sales-channel-detail-agentic-commerce-integration';
 import './view/sw-sales-channel-detail-agentic-commerce-statistics';
+import './view/sw-sales-channel-detail-product-export-insights';
 import './view/sw-sales-channel-detail-product-comparison';
 import './routes.init';
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/index.js b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/index.js
index 897edf28..da09eee2 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/index.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/index.js
@@ -2,6 +2,7 @@ import template from './sw-sales-channel-detail.html.twig';
 import './sw-sales-channel-detail.scss';
 import { coreShipsAgenticCommerce } from '../../../../core-feature';
 import { mergeAgenticFileDrafts, saveAgenticFileConfigurations } from '../../agentic-file-persistence';
+import { currentAdminVersion, isVersionAtLeast, useMtComponents } from '../../agentic-commerce/admin-version';
 import {
     defaultForm as ucpDefaultForm,
     normalizeConfig as ucpNormalizeConfig,
@@ -103,6 +104,19 @@ export const swSalesChannelDetailOverride = {
                 : 'sw.sales.channel.detail.agenticCommerceStatistics';
         },
 
+        canViewUcpInsights() {
+            return this.acl.can('ucp.viewer');
+        },
+
+        salesChannelDetailTabs() {
+            const tabs = this.$super('salesChannelDetailTabs');
+            if (!Array.isArray(tabs) || !this.isAgenticCommerce || this.canViewUcpInsights) {
+                return tabs;
+            }
+
+            return tabs.filter((tab) => tab.name !== 'sw.sales.channel.detail.productExportInsights');
+        },
+
         shouldRenderAgenticCommerceTab() {
             const typeId = this.salesChannel?.typeId ?? this.$route.params.typeId;
 
@@ -110,6 +124,34 @@ export const swSalesChannelDetailOverride = {
                 && (isTransactionalSalesChannelType(typeId) || this.ucpState.transactional);
         },
 
+        isUcpConfigRoute() {
+            return this.$route.name === 'sw.sales.channel.detail.agenticCommerce';
+        },
+
+        usesMeteorComponents() {
+            return useMtComponents();
+        },
+
+        supportsVueRouterViewSlot() {
+            // Vue Router 4 (Shopware 6.6+) supports the scoped router-view slot.
+            return isVersionAtLeast(currentAdminVersion(), 6, 6);
+        },
+
+        shouldRenderAgenticCommerceContent() {
+            return (!this.isAgenticCommerce
+                    || this.$route.name !== 'sw.sales.channel.detail.productExportInsights'
+                    || this.canViewUcpInsights)
+                && (this.$route.name !== 'sw.sales.channel.detail.agenticCommerce' || this.shouldRenderAgenticCommerceTab);
+        },
+
+        allowSaving() {
+            if (this.isUcpConfigRoute) {
+                return this.acl.can('ucp.editor') || this.acl.can('sales_channel.editor');
+            }
+
+            return this.$super('allowSaving');
+        },
+
         // Widened to include AC channels so they reuse the product-export blocks.
         // $super() is skipped — it is unreliable during the create flow in 6.5/6.6.
         isProductComparison() {
@@ -289,7 +331,7 @@ export const swSalesChannelDetailOverride = {
         // the page before this write, which replaces `ucpState.form` with the stored,
         // not yet updated config.
         async saveUcpState(salesChannelId, form) {
-            if (!form || !salesChannelId) {
+            if (!form || !salesChannelId || !this.acl.can('ucp.editor')) {
                 return true;
             }
 
@@ -421,7 +463,8 @@ export const swSalesChannelDetailOverride = {
             }
 
             if (this.pendingAgenticFilesReload
-                && this.pendingAgenticFilesReload === this.salesChannel?.id) {
+                && this.pendingAgenticFilesReload === this.salesChannel?.id
+                && this.acl.can('sales_channel.editor')) {
                 this.isLoading = true;
                 this.isSaveSuccessful = false;
                 try {
@@ -434,10 +477,40 @@ export const swSalesChannelDetailOverride = {
                 }
             }
 
+            if (this.isUcpConfigRoute && !this.acl.can('sales_channel.editor')) {
+                if (!this.acl.can('ucp.editor') || !this.ucpState.loaded) {
+                    return;
+                }
+
+                const salesChannelId = this.salesChannel?.id;
+                const form = ucpNormalizeConfig(this.ucpState.form);
+                const hasUcpChanges = JSON.stringify(form) !== JSON.stringify(ucpNormalizeConfig(this.ucpState.savedForm));
+                this.isSavingUcp = true;
+                this.isLoading = true;
+                this.isSaveSuccessful = false;
+
+                try {
+                    if (hasUcpChanges && !await this.saveUcpState(salesChannelId, form)) {
+                        return;
+                    }
+
+                    this.isSaveSuccessful = true;
+                    if (salesChannelId && hasUcpChanges) {
+                        this.refreshUcpPreview(salesChannelId);
+                    }
+                } finally {
+                    this.isSavingUcp = false;
+                    this.isLoading = false;
+                }
+
+                return;
+            }
+
             if (!this.isAgenticCommerce) {
                 const salesChannelId = this.salesChannel?.id;
                 const form = this.ucpState.loaded ? ucpNormalizeConfig(this.ucpState.form) : null;
                 const hasUcpChanges = form
+                    && this.acl.can('ucp.editor')
                     && JSON.stringify(form) !== JSON.stringify(ucpNormalizeConfig(this.ucpState.savedForm));
 
                 // Keep core validation and Storefront theme assignment in the save chain.
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-agentic-commerce-statistics-route.spec.js b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-agentic-commerce-statistics-route.spec.js
index 33d651dd..45746066 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-agentic-commerce-statistics-route.spec.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-agentic-commerce-statistics-route.spec.js
@@ -48,3 +48,42 @@ describe("sw-sales-channel-detail agenticCommerceStatisticsRoute", () => {
     );
   });
 });
+
+describe("sw-sales-channel-detail Insights ACL", () => {
+  const insight = { name: "sw.sales.channel.detail.productExportInsights" };
+  const base = { name: "sw.sales.channel.detail.base" };
+  const tabs = [base, insight];
+
+  it("hides core Insights for Agentic Commerce without ucp.viewer", () => {
+    const computed = loadComputed(true);
+    const actual = computed.salesChannelDetailTabs.call({
+      $super: () => tabs,
+      isAgenticCommerce: true,
+      canViewUcpInsights: false,
+    });
+
+    expect(actual).toEqual([base]);
+  });
+
+  it("preserves core Insights for Agentic Commerce with ucp.viewer", () => {
+    const computed = loadComputed(true);
+    const actual = computed.salesChannelDetailTabs.call({
+      $super: () => tabs,
+      isAgenticCommerce: true,
+      canViewUcpInsights: true,
+    });
+
+    expect(actual).toEqual(tabs);
+  });
+
+  it("leaves product-comparison Insights unchanged", () => {
+    const computed = loadComputed(true);
+    const actual = computed.salesChannelDetailTabs.call({
+      $super: () => tabs,
+      isAgenticCommerce: false,
+      canViewUcpInsights: false,
+    });
+
+    expect(actual).toBe(tabs);
+  });
+});
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-on-save.spec.js b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-on-save.spec.js
index f178aca9..ca341cf4 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-on-save.spec.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-on-save.spec.js
@@ -113,6 +113,7 @@ function buildContext({ saveSalesChannel, isSaveSuccessful = true } = {}) {
         isLoading: false,
         isAgenticCommerce: true,
         allowSaving: true,
+        acl: { can: jest.fn(() => true) },
         systemConfigApiService: { batchSave: jest.fn(() => Promise.resolve()) },
         validateAgenticCommerceExportConfig: jest.fn(() => true),
         ucpState: { loaded: false, form: {}, savedForm: {}, generation: 0 },
@@ -241,6 +242,34 @@ describe('sw-sales-channel-detail onSave — export configuration validation', (
 describe('sw-sales-channel-detail onSave — UCP config', () => {
     const UCP_FORM = { active: true, profileDomain: null, enabledCapabilities: ['cart', 'catalog'], enabledTransports: ['rest'] };
 
+    it('allows UCP editors to save on the UCP route without sales_channel.editor', () => {
+        expect(swSalesChannelDetailOverride.computed.allowSaving.call({
+            isUcpConfigRoute: true,
+            acl: { can: (privilege) => privilege === 'ucp.editor' },
+        })).toBe(true);
+    });
+
+    it('allows sales-channel editors to save file changes on the UCP route', () => {
+        expect(swSalesChannelDetailOverride.computed.allowSaving.call({
+            isUcpConfigRoute: true,
+            acl: { can: (privilege) => privilege === 'sales_channel.editor' },
+        })).toBe(true);
+    });
+
+    it.each(['ucp.viewer', 'ucp.key_rotator'])('does not allow %s to save without sales-channel edit permission', (role) => {
+        expect(swSalesChannelDetailOverride.computed.allowSaving.call({
+            isUcpConfigRoute: true,
+            acl: { can: (privilege) => privilege === role },
+        })).toBe(false);
+    });
+
+    it('uses the core save permission on other routes', () => {
+        const superMethod = jest.fn(() => false);
+
+        expect(swSalesChannelDetailOverride.computed.allowSaving.call({ isUcpConfigRoute: false, $super: superMethod })).toBe(false);
+        expect(superMethod).toHaveBeenCalledWith('allowSaving');
+    });
+
     it('writes the UCP form as it was when Save was clicked, although the legacy reload replaced it', async () => {
         const ctx = buildContext({ isSaveSuccessful: true });
         ctx.ucpState = { loaded: true, form: { ...UCP_FORM }, savedForm: {}, generation: 0 };
@@ -285,6 +314,7 @@ describe('sw-sales-channel-detail onSave — UCP config', () => {
         const ctx = {
             ucpState: { loaded: true, form: { active: false }, savedForm: { active: false }, generation: 3 },
             ucpAdminApiService: { saveConfig },
+            acl: { can: jest.fn(() => true) },
             createNotificationError: jest.fn(),
         };
         ctx.reloadAgenticFiles = swSalesChannelDetailOverride.methods.reloadAgenticFiles.bind(ctx);
@@ -309,6 +339,7 @@ describe('sw-sales-channel-detail onSave — UCP config', () => {
                 generation: 3,
             },
             ucpAdminApiService: { saveConfig },
+            acl: { can: jest.fn(() => true) },
             createNotificationError: jest.fn(),
             reloadAgenticFiles,
         };
@@ -580,6 +611,7 @@ describe('sw-sales-channel-detail onSave — UCP config', () => {
         const ctx = {
             ucpState: { loaded: true, form: { ...storedForm }, savedForm: { ...storedForm }, generation: 3 },
             ucpAdminApiService: { saveConfig },
+            acl: { can: jest.fn(() => true) },
             createNotificationError: jest.fn(),
         };
 
@@ -592,6 +624,38 @@ describe('sw-sales-channel-detail onSave — UCP config', () => {
         expect(ctx.ucpState.generation).toBe(4);
     });
 
+    it('lets a UCP viewer with sales-channel edit access save Agentic Files without writing UCP settings', async () => {
+        const file = createFileEntity('new-file', { fileName: 'agents.md' }, true);
+        const { repository: fileRepository } = createFileRepository([
+            { id: 'new-file', data: { fileName: 'agents.md' } },
+        ]);
+        const ctx = buildUcpContext();
+        ctx.acl.can.mockImplementation((privilege) => privilege === 'sales_channel.editor' || privilege === 'ucp.viewer');
+        ctx.ucpState = { loaded: true, form: { ...UCP_FORM }, savedForm: {}, generation: 0 };
+        ctx.salesChannel.salesChannelFiles = [file];
+        ctx.repositoryFactory = { create: jest.fn(() => fileRepository) };
+        ctx.ucpAdminApiService = { getProfilePreview: jest.fn(() => Promise.resolve({ data: { data: null } })) };
+
+        await swSalesChannelDetailOverride.methods.onSave.call(ctx);
+
+        expect(fileRepository.save).toHaveBeenCalledWith(file, Shopware.Context.api);
+        expect(ctx.saveUcpState).not.toHaveBeenCalled();
+        expect(ctx.isSaveSuccessful).toBe(true);
+    });
+
+    it('does not write UCP configuration from other tabs when the user lacks ucp.editor', async () => {
+        const ctx = {
+            ucpState: { loaded: true, form: { active: true }, savedForm: {}, generation: 0 },
+            acl: { can: jest.fn(() => false) },
+            ucpAdminApiService: { saveConfig: jest.fn() },
+        };
+
+        const saved = await swSalesChannelDetailOverride.methods.saveUcpState.call(ctx, 'channel-id', { active: true });
+
+        expect(saved).toBe(true);
+        expect(ctx.ucpAdminApiService.saveConfig).not.toHaveBeenCalled();
+    });
+
     it('saves the sales channel from the UCP tab before writing UCP and refreshing the preview', async () => {
         const draft = { ...UCP_FORM };
         const preview = { data: { data: { ucp: { version: '1.0' } } } };
@@ -667,6 +731,68 @@ describe('sw-sales-channel-detail onSave — UCP config', () => {
         expect(ctx.isSaveSuccessful).toBe(true);
     });
 
+    it('does not save Agentic Files without sales-channel edit permission', async () => {
+        const file = createFileEntity('draft-file', { fileName: 'agents.md' }, true);
+        const ctx = buildContext();
+        ctx.isUcpConfigRoute = true;
+        ctx.acl.can.mockImplementation((privilege) => privilege === 'ucp.editor');
+        ctx.ucpState = { loaded: true, form: { ...UCP_FORM }, savedForm: {}, generation: 0 };
+        ctx.pendingAgenticFilesReload = 'channel-id';
+        ctx.reloadAgenticFiles = jest.fn();
+        ctx.salesChannel.salesChannelFiles = [file];
+        ctx.saveAgenticFiles = jest.fn(() => Promise.resolve(true));
+        ctx.ucpAdminApiService = { getProfilePreview: jest.fn(() => Promise.resolve({ data: { data: null } })) };
+
+        await swSalesChannelDetailOverride.methods.onSave.call(ctx);
+
+        expect(ctx.saveUcpState).toHaveBeenCalledWith('channel-id', ctx.ucpState.form);
+        expect(ctx.$super).not.toHaveBeenCalled();
+        expect(ctx.saveAgenticCommerceExportConfig).not.toHaveBeenCalled();
+        expect(ctx.saveAgenticFiles).not.toHaveBeenCalled();
+        expect(ctx.reloadAgenticFiles).not.toHaveBeenCalled();
+        expect(ctx.isSaveSuccessful).toBe(true);
+    });
+
+    it('skips unchanged UCP settings without saving the sales channel for a UCP-only editor', async () => {
+        const ctx = buildUcpContext();
+        ctx.isUcpConfigRoute = true;
+        ctx.acl.can.mockImplementation((privilege) => privilege === 'ucp.editor');
+        ctx.ucpState = { loaded: true, form: { ...UCP_FORM }, savedForm: { ...UCP_FORM }, generation: 0 };
+        ctx.saveAgenticFiles = jest.fn();
+        ctx.ucpAdminApiService = { getProfilePreview: jest.fn() };
+
+        await swSalesChannelDetailOverride.methods.onSave.call(ctx);
+
+        expect(ctx.$super).not.toHaveBeenCalled();
+        expect(ctx.saveAgenticFiles).not.toHaveBeenCalled();
+        expect(ctx.saveUcpState).not.toHaveBeenCalled();
+        expect(ctx.ucpAdminApiService.getProfilePreview).not.toHaveBeenCalled();
+        expect(ctx.isSavingUcp).toBe(false);
+        expect(ctx.isSaveSuccessful).toBe(true);
+    });
+
+    it('releases the UCP-only save guard after a failed write so the draft can be retried', async () => {
+        const ctx = buildUcpContext();
+        ctx.isUcpConfigRoute = true;
+        ctx.acl.can.mockImplementation((privilege) => privilege === 'ucp.editor');
+        ctx.ucpState = { loaded: true, form: { ...UCP_FORM }, savedForm: {}, generation: 0 };
+        ctx.saveUcpState.mockResolvedValueOnce(false).mockResolvedValueOnce(true);
+        ctx.ucpAdminApiService = { getProfilePreview: jest.fn(async () => ({ data: { data: null } })) };
+
+        await swSalesChannelDetailOverride.methods.onSave.call(ctx);
+
+        expect(ctx.isSavingUcp).toBe(false);
+        expect(ctx.isLoading).toBe(false);
+        expect(ctx.isSaveSuccessful).toBe(false);
+        expect(ctx.ucpState.form).toEqual(UCP_FORM);
+
+        await swSalesChannelDetailOverride.methods.onSave.call(ctx);
+
+        expect(ctx.$super).not.toHaveBeenCalled();
+        expect(ctx.saveUcpState).toHaveBeenCalledTimes(2);
+        expect(ctx.isSaveSuccessful).toBe(true);
+    });
+
     it('does not create the same Agentic File again on a repeated save', async () => {
         const { repository: fileRepository } = createFileRepository();
         const ctx = buildContext();
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-save-ordinary.spec.js b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-save-ordinary.spec.js
index fa118c3e..f4d38c2b 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-save-ordinary.spec.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-save-ordinary.spec.js
@@ -196,6 +196,18 @@ describe('ordinary sales-channel saves', () => {
         expect(ctx.saveUcpState).not.toHaveBeenCalled();
     });
 
+    it('does not write UCP settings without UCP edit permission', async () => {
+        const ctx = createContext();
+        ctx.ucpState.form.active = true;
+        ctx.acl.can.mockReturnValue(false);
+
+        await swSalesChannelDetailOverride.methods.onSave.call(ctx);
+
+        expect(ctx.$super).toHaveBeenCalledWith('onSave');
+        expect(ctx.saveUcpState).not.toHaveBeenCalled();
+        expect(ctx.ucpAdminApiService.getProfilePreview).not.toHaveBeenCalled();
+    });
+
     it('does not write UCP settings that have not loaded', async () => {
         const ctx = createContext();
         ctx.ucpState.loaded = false;
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-template.spec.js b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-template.spec.js
index 9fb72561..4e85a1e8 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-template.spec.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail-template.spec.js
@@ -5,14 +5,132 @@
 const fs = require('fs');
 const path = require('path');
 
+global.Shopware = {
+    Component: { override: jest.fn() },
+    Service: jest.fn(() => ({})),
+    Utils: { object: {} },
+    Classes: { ShopwareError: class ShopwareError extends Error {} },
+    Context: { api: {} },
+    Defaults: {
+        productComparisonTypeId: 'product-comparison-type-id',
+        storefrontSalesChannelTypeId: 'storefront-type-id',
+        apiSalesChannelTypeId: 'api-type-id',
+        agenticCommerceTypeId: 'agentic-commerce-type-id',
+    },
+};
+
+const { swSalesChannelDetailOverride } = require('Resources/extension/sw-sales-channel/page/sw-sales-channel-detail');
+
 const template = fs.readFileSync(
     path.resolve(__dirname, './sw-sales-channel-detail.html.twig'),
     'utf8',
 );
 
 describe('sw-sales-channel-detail template override', () => {
-    // Replacing this block drops the props other plugins pass to the routed view, e.g. Social Shopping's network form.
-    it('leaves the routed content view to core', () => {
-        expect(template).not.toContain('{% block sw_sales_channel_detail_content_view %}');
+    it('keeps core routed-view props while hiding protected direct routes', () => {
+        expect(template).toContain('{% block sw_sales_channel_detail_content_view %}');
+        expect(template).toContain('v-if="shouldRenderAgenticCommerceContent"');
+        expect(template).toContain('{% parent %}');
+        expect(template).toContain(':sales-channel="salesChannel"');
+        expect(template).toContain(':product-export="productExport"');
+        expect(template).toContain(':agentic-commerce-export-config="agenticCommerceExportConfig"');
+        expect(template).toContain(':storefront-sales-channel-criteria="storefrontSalesChannelCriteria"');
+        expect(template).toContain(':custom-field-sets="customFieldSets"');
+        expect(template).toContain(':template-options="productComparison.templateOptions"');
+        expect(template).toContain('@template-modal-confirm="onTemplateModalConfirm"');
+    });
+
+    it('uses Vue Router 3 attribute forwarding on Shopware 6.5 and the scoped slot on 6.6+', () => {
+        expect(template).toContain('<template v-if="supportsVueRouterViewSlot">');
+        expect(template).toContain('v-slot="{ Component }"');
+
+        const scopedComponent = template.match(/<component\b([\s\S]*?)\/>/);
+        expect(scopedComponent).not.toBeNull();
+        expect(scopedComponent[1]).toContain(':sales-channel="salesChannel"');
+        expect(scopedComponent[1]).toContain(':product-export="productExport"');
+        expect(scopedComponent[1]).toContain(':agentic-commerce-export-config="agenticCommerceExportConfig"');
+        expect(scopedComponent[1]).toContain(':storefront-sales-channel-criteria="storefrontSalesChannelCriteria"');
+        expect(scopedComponent[1]).toContain(':custom-field-sets="customFieldSets"');
+        expect(scopedComponent[1]).toContain(':is-loading="isLoading"');
+        expect(scopedComponent[1]).toContain(':product-comparison-access-url="productComparison.productComparisonAccessUrl"');
+        expect(scopedComponent[1]).toContain(':template-options="productComparison.templateOptions"');
+        expect(scopedComponent[1]).toContain(':show-template-modal="productComparison.showTemplateModal"');
+        expect(scopedComponent[1]).toContain(':template-name="productComparison.templateName"');
+        expect(scopedComponent[1]).toContain('@template-selected="onTemplateSelected"');
+        expect(scopedComponent[1]).toContain('@access-key-changed="generateAccessUrl"');
+        expect(scopedComponent[1]).toContain('@domain-changed="generateAccessUrl"');
+        expect(scopedComponent[1]).toContain('@invalid-file-name="setInvalidFileName(true)"');
+        expect(scopedComponent[1]).toContain('@valid-file-name="setInvalidFileName(false)"');
+        expect(scopedComponent[1]).toContain('@template-modal-close="onTemplateModalClose"');
+        expect(scopedComponent[1]).toContain('@template-modal-confirm="onTemplateModalConfirm"');
+
+        const legacyRouterView = template.match(/<router-view\s+v-else([\s\S]*?)\/>/);
+        expect(legacyRouterView).not.toBeNull();
+        expect(legacyRouterView[1]).toContain(':sales-channel="salesChannel"');
+        expect(legacyRouterView[1]).toContain(':agentic-commerce-export-config="agenticCommerceExportConfig"');
+        expect(legacyRouterView[1]).toContain('@template-modal-confirm="onTemplateModalConfirm"');
+    });
+
+    it.each([
+        ['6.5.8.18', false],
+        ['6.6.0.0', true],
+    ])('selects the router-view mode for Shopware %s', (version, expected) => {
+        Shopware.Context.app = { config: { version } };
+
+        expect(swSalesChannelDetailOverride.computed.supportsVueRouterViewSlot()).toBe(expected);
+    });
+
+    it('shows a localized warning when the routed content gate denies access', () => {
+        expect(template).toContain('<template v-if="shouldRenderAgenticCommerceContent">');
+        expect(template).toContain('class="sw-sales-channel-detail__content-denied"');
+        expect(template).toContain('<mt-banner v-if="usesMeteorComponents" variant="attention">');
+        expect(template).toContain('<sw-alert v-else variant="info">');
+        expect(template).toContain("{{ $t('sw-sales-channel.detail.contentDenied') }}");
+
+        const shouldRenderContent = swSalesChannelDetailOverride.computed.shouldRenderAgenticCommerceContent;
+        const insightsRoute = 'sw.sales.channel.detail.productExportInsights';
+        const configRoute = 'sw.sales.channel.detail.agenticCommerce';
+
+        expect(shouldRenderContent.call({
+            isAgenticCommerce: true,
+            $route: { name: insightsRoute },
+            canViewUcpInsights: false,
+            shouldRenderAgenticCommerceTab: true,
+        })).toBe(false);
+        expect(shouldRenderContent.call({
+            isAgenticCommerce: true,
+            $route: { name: insightsRoute },
+            canViewUcpInsights: true,
+            shouldRenderAgenticCommerceTab: true,
+        })).toBe(true);
+        expect(shouldRenderContent.call({
+            isAgenticCommerce: true,
+            $route: { name: configRoute },
+            canViewUcpInsights: true,
+            shouldRenderAgenticCommerceTab: false,
+        })).toBe(false);
+        expect(shouldRenderContent.call({
+            isAgenticCommerce: true,
+            $route: { name: configRoute },
+            canViewUcpInsights: true,
+            shouldRenderAgenticCommerceTab: true,
+        })).toBe(true);
+    });
+});
+
+describe('denied-content notification compatibility', () => {
+    afterEach(() => {
+        delete Shopware.Context.app;
+    });
+
+    it.each([
+        ['6.5.8.18', false],
+        ['6.6.1.0', false],
+        ['6.6.2.0', true],
+        ['6.7.9999999.9999999-dev', true],
+    ])('uses the available notification component on %s', (version, expected) => {
+        Shopware.Context.app = { config: { version } };
+
+        expect(swSalesChannelDetailOverride.computed.usesMeteorComponents()).toBe(expected);
     });
 });
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.html.twig b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.html.twig
index b8d62a8b..4dd6318a 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.html.twig
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.html.twig
@@ -31,6 +31,86 @@
 {% block sw_sales_channel_detail_content_tab_product_export_insights %}{% endblock %}
 {% block sw_sales_channel_detail_content_tab_agentic_commerce_integration %}{% endblock %}
 
+{% block sw_sales_channel_detail_content_view %}
+<template v-if="isAgenticCommerce">
+    <template v-if="shouldRenderAgenticCommerceContent">
+        <template v-if="isLoading">
+            <sw-skeleton />
+            <sw-skeleton />
+        </template>
+
+        <template v-else>
+            <template v-if="supportsVueRouterViewSlot">
+                <router-view
+                    :key="$route.params.id"
+                    v-slot="{ Component }"
+                >
+                    <component
+                        :is="Component"
+                        :sales-channel="salesChannel"
+                        :product-export="productExport"
+                        :agentic-commerce-export-config="agenticCommerceExportConfig"
+                        :storefront-sales-channel-criteria="storefrontSalesChannelCriteria"
+                        :custom-field-sets="customFieldSets"
+                        :is-loading="isLoading"
+                        :product-comparison-access-url="productComparison.productComparisonAccessUrl"
+                        :template-options="productComparison.templateOptions"
+                        :show-template-modal="productComparison.showTemplateModal"
+                        :template-name="productComparison.templateName"
+                        @template-selected="onTemplateSelected"
+                        @access-key-changed="generateAccessUrl"
+                        @domain-changed="generateAccessUrl"
+                        @invalid-file-name="setInvalidFileName(true)"
+                        @valid-file-name="setInvalidFileName(false)"
+                        @template-modal-close="onTemplateModalClose"
+                        @template-modal-confirm="onTemplateModalConfirm"
+                    />
+                </router-view>
+            </template>
+
+            {# Vue Router 3 on Shopware 6.5 forwards router-view attributes/listeners to the route component. #}
+            <router-view
+                v-else
+                :key="$route.params.id"
+                :sales-channel="salesChannel"
+                :product-export="productExport"
+                :agentic-commerce-export-config="agenticCommerceExportConfig"
+                :storefront-sales-channel-criteria="storefrontSalesChannelCriteria"
+                :custom-field-sets="customFieldSets"
+                :is-loading="isLoading"
+                :product-comparison-access-url="productComparison.productComparisonAccessUrl"
+                :template-options="productComparison.templateOptions"
+                :show-template-modal="productComparison.showTemplateModal"
+                :template-name="productComparison.templateName"
+                @template-selected="onTemplateSelected"
+                @access-key-changed="generateAccessUrl"
+                @domain-changed="generateAccessUrl"
+                @invalid-file-name="setInvalidFileName(true)"
+                @valid-file-name="setInvalidFileName(false)"
+                @template-modal-close="onTemplateModalClose"
+                @template-modal-confirm="onTemplateModalConfirm"
+            />
+        </template>
+    </template>
+
+    <div
+        v-else
+        class="sw-sales-channel-detail__content-denied"
+        :class="{ 'sw-sales-channel-detail__content-denied--legacy': !usesMeteorComponents }"
+    >
+        <mt-banner v-if="usesMeteorComponents" variant="attention">
+            {{ $t('sw-sales-channel.detail.contentDenied') }}
+        </mt-banner>
+        <sw-alert v-else variant="info">
+            {{ $t('sw-sales-channel.detail.contentDenied') }}
+        </sw-alert>
+    </div>
+</template>
+<template v-else>
+    {% parent %}
+</template>
+{% endblock %}
+
 {% block sw_sales_channel_detail_content_tab_product_comparison %}
 <sw-tabs-item
     v-if="isAgenticCommerce && !isLoading"
@@ -41,7 +121,7 @@
 </sw-tabs-item>
 
 <sw-tabs-item
-    v-if="isAgenticCommerce && !isLoading && Boolean(salesChannel?.id)"
+    v-if="isAgenticCommerce && canViewUcpInsights && !isLoading && Boolean(salesChannel?.id)"
     :route="{ name: agenticCommerceStatisticsRoute, params: { id: $route.params.id } }"
     :title="$t('sw-sales-channel.detail.productExport.tabInsights')"
 >
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.scss b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.scss
index 8b107e1e..92e5f841 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.scss
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.scss
@@ -13,3 +13,16 @@
         display: none !important;
     }
 }
+
+.sw-sales-channel-detail__content-denied {
+    width: 100%;
+    max-width: 960px;
+    margin-left: auto;
+    margin-right: auto;
+
+    @media (max-width: 1360px) {
+        &--legacy {
+            max-width: 770px;
+        }
+    }
+}
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.spec.js b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.spec.js
index 9c55d1cb..1f11fc4d 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.spec.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/page/sw-sales-channel-detail/sw-sales-channel-detail.spec.js
@@ -33,7 +33,7 @@ global.Shopware = {
 const { swSalesChannelDetailOverride } = require('Resources/extension/sw-sales-channel/page/sw-sales-channel-detail');
 
 const { syncExportFileName } = swSalesChannelDetailOverride.methods;
-const { shouldRenderAgenticCommerceTab } = swSalesChannelDetailOverride.computed;
+const { shouldRenderAgenticCommerceTab, shouldRenderAgenticCommerceContent } = swSalesChannelDetailOverride.computed;
 
 describe('sw-sales-channel-detail syncExportFileName', () => {
     it.each([
@@ -136,3 +136,43 @@ describe('sw-sales-channel-detail shouldRenderAgenticCommerceTab', () => {
         expect(shouldRenderAgenticCommerceTab.call(context)).toBe(true);
     });
 });
+
+describe('sw-sales-channel-detail shouldRenderAgenticCommerceContent', () => {
+    it('renders ordinary Agentic Commerce routes', () => {
+        expect(shouldRenderAgenticCommerceContent.call({
+            $route: { name: 'sw.sales.channel.detail.base' },
+            canViewUcpInsights: false,
+            shouldRenderAgenticCommerceTab: false,
+        })).toBe(true);
+    });
+
+    it('allows UCP Insights only to users with ucp.viewer', () => {
+        const context = {
+            isAgenticCommerce: true,
+            $route: { name: 'sw.sales.channel.detail.productExportInsights' },
+            canViewUcpInsights: false,
+            shouldRenderAgenticCommerceTab: true,
+        };
+
+        expect(shouldRenderAgenticCommerceContent.call(context)).toBe(false);
+        expect(shouldRenderAgenticCommerceContent.call({ ...context, canViewUcpInsights: true })).toBe(true);
+    });
+
+    it('keeps product-comparison Insights visible without ucp.viewer', () => {
+        expect(shouldRenderAgenticCommerceContent.call({
+            isAgenticCommerce: false,
+            $route: { name: 'sw.sales.channel.detail.productExportInsights' },
+            canViewUcpInsights: false,
+            shouldRenderAgenticCommerceTab: false,
+        })).toBe(true);
+    });
+
+    it('hides UCP configuration when the user cannot see the UCP tab', () => {
+        expect(shouldRenderAgenticCommerceContent.call({
+            isAgenticCommerce: true,
+            $route: { name: 'sw.sales.channel.detail.agenticCommerce' },
+            canViewUcpInsights: true,
+            shouldRenderAgenticCommerceTab: false,
+        })).toBe(false);
+    });
+});
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/snippet/de.json b/src/Resources/app/administration/src/extension/sw-sales-channel/snippet/de.json
index e696688e..4beea75d 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/snippet/de.json
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/snippet/de.json
@@ -1,4 +1,11 @@
 {
+  "sw-privileges": {
+    "permissions": {
+      "ucp": {
+        "label": "UCP (Universal Commerce Protocol)"
+      }
+    }
+  },
   "swagAgenticCommerce": {
     "modalGrid": {
       "agenticCommerceBadge": "Neu"
@@ -14,9 +21,11 @@
       "messageNoProductStreams": "Um Produktvergleichs- oder Agentic-Commerce-Verkaufskanäle zu erstellen, musst Du zunächst eine dynamische Produktgruppe erstellen."
     },
     "detail": {
+      "contentDenied": "Du hast keine Berechtigung, diesen Inhalt anzusehen.",
       "agenticCommerce": {
         "tabAgenticCommerce": "Agentic Commerce",
         "ucp": {
+          "readOnlyMessage": "Du kannst diese Konfiguration ansehen. Ändern und speichern können nur Benutzer mit UCP-Bearbeitungsrechten.",
           "cardTitle": "UCP",
           "cardIntro": "Lege fest, wie dieser Verkaufskanal KI-Agenten über das Universal Commerce Protocol (UCP) bereitgestellt wird: welche Fähigkeiten Agenten nutzen dürfen, wie Anfragen abgesichert werden und welches Profil sie finden.",
           "exposeLabel": "Über UCP bereitstellen",
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/snippet/en.json b/src/Resources/app/administration/src/extension/sw-sales-channel/snippet/en.json
index 2a03609d..dd2d9dbe 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/snippet/en.json
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/snippet/en.json
@@ -1,4 +1,11 @@
 {
+  "sw-privileges": {
+    "permissions": {
+      "ucp": {
+        "label": "UCP (Universal Commerce Protocol)"
+      }
+    }
+  },
   "swagAgenticCommerce": {
     "modalGrid": {
       "agenticCommerceBadge": "New"
@@ -14,9 +21,11 @@
       "messageNoProductStreams": "In order to create product comparison or agentic commerce sales channels, a dynamic product group has to be created first."
     },
     "detail": {
+      "contentDenied": "You do not have permission to view this content.",
       "agenticCommerce": {
         "tabAgenticCommerce": "Agentic Commerce",
         "ucp": {
+          "readOnlyMessage": "You can view this configuration, but only users with UCP edit permission can change and save it.",
           "cardTitle": "UCP",
           "cardIntro": "Configure how this sales channel is exposed to AI agents over the Universal Commerce Protocol (UCP): which capabilities agents may use, how requests are secured, and which profile they discover.",
           "exposeLabel": "Expose via UCP",
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/index.js b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/index.js
index b4308e53..403b272b 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/index.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/index.js
@@ -40,6 +40,10 @@ registerOrOverride('sw-sales-channel-detail-agentic-commerce-statistics', {
     },
 
     computed: {
+        canViewInsights() {
+            return this.acl.can('ucp.viewer');
+        },
+
         orderRepository() {
             return this.repositoryFactory.create('order');
         },
@@ -162,11 +166,20 @@ registerOrOverride('sw-sales-channel-detail-agentic-commerce-statistics', {
     },
 
     created() {
-        this.fetchData();
+        if (this.canViewInsights) {
+            this.fetchData();
+        } else {
+            this.isLoading = false;
+        }
     },
 
     methods: {
         async fetchData() {
+            if (!this.canViewInsights) {
+                this.isLoading = false;
+                return;
+            }
+
             this.isLoading = true;
 
             const promises = [];
@@ -324,4 +337,4 @@ registerOrOverride('sw-sales-channel-detail-agentic-commerce-statistics', {
             return this.getTimeUnitInterval(range) === 'hour' ? 'dd MMM HH:mm' : 'dd MMM';
         },
     },
-});
\ No newline at end of file
+});
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/sw-sales-channel-detail-agentic-commerce-statistics.html.twig b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/sw-sales-channel-detail-agentic-commerce-statistics.html.twig
index fd7dc3fd..d6b3a9b7 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/sw-sales-channel-detail-agentic-commerce-statistics.html.twig
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/sw-sales-channel-detail-agentic-commerce-statistics.html.twig
@@ -1,5 +1,5 @@
 {% block sw_sales_channel_detail_agentic_commerce_statistics %}
-<sw-container class="sw-sales-channel-detail-agentic-commerce-statistics">
+<sw-container v-if="canViewInsights" class="sw-sales-channel-detail-agentic-commerce-statistics">
 
     {% block sw_sales_channel_detail_agentic_commerce_statistics_orders_card %}
     <template v-if="acl.can('order.viewer')">
@@ -100,4 +100,4 @@
     </template>
     {% endblock %}
 </sw-container>
-{% endblock %}
\ No newline at end of file
+{% endblock %}
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/sw-sales-channel-detail-agentic-commerce-statistics.spec.js b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/sw-sales-channel-detail-agentic-commerce-statistics.spec.js
index 4a1999f8..d2830370 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/sw-sales-channel-detail-agentic-commerce-statistics.spec.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce-statistics/sw-sales-channel-detail-agentic-commerce-statistics.spec.js
@@ -67,7 +67,7 @@ describe('sw-sales-channel-detail-agentic-commerce-statistics', () => {
     });
 
     function createInstance({
-        privileges = [],
+        privileges = ['ucp.viewer'],
         orderSearch = jest.fn(() => Promise.resolve([])),
         customerSearch = jest.fn(() => Promise.resolve([])),
     } = {}) {
@@ -90,12 +90,12 @@ describe('sw-sales-channel-detail-agentic-commerce-statistics', () => {
     }
 
     it('loads order statistics only for order viewers and customer statistics only for customer viewers', async () => {
-        const orderViewer = createInstance({ privileges: ['order.viewer'] });
+        const orderViewer = createInstance({ privileges: ['ucp.viewer', 'order.viewer'] });
         await orderViewer.fetchData();
         expect(orderViewer.orderRepository.search).toHaveBeenCalledTimes(2);
         expect(orderViewer.customerRepository.search).not.toHaveBeenCalled();
 
-        const customerViewer = createInstance({ privileges: ['customer.viewer'] });
+        const customerViewer = createInstance({ privileges: ['ucp.viewer', 'customer.viewer'] });
         await customerViewer.fetchData();
         expect(customerViewer.orderRepository.search).not.toHaveBeenCalled();
         expect(customerViewer.customerRepository.search).toHaveBeenCalledTimes(1);
@@ -107,7 +107,7 @@ describe('sw-sales-channel-detail-agentic-commerce-statistics', () => {
         const customers = [{ id: 'customer' }];
         const isPaidQuery = (criteria) => criteria.filters.some((filter) => filter.field === 'transactions.stateMachineState.technicalName');
         const instance = createInstance({
-            privileges: ['order.viewer', 'customer.viewer'],
+            privileges: ['ucp.viewer', 'order.viewer', 'customer.viewer'],
             orderSearch: jest.fn((criteria) => Promise.resolve(isPaidQuery(criteria) ? paidOrders : allOrders)),
             customerSearch: jest.fn(() => Promise.resolve(customers)),
         });
@@ -124,7 +124,7 @@ describe('sw-sales-channel-detail-agentic-commerce-statistics', () => {
 
     it('stops loading when a statistics request fails', async () => {
         const instance = createInstance({
-            privileges: ['order.viewer', 'customer.viewer'],
+            privileges: ['ucp.viewer', 'order.viewer', 'customer.viewer'],
             orderSearch: jest.fn(() => Promise.reject(new Error('Request failed'))),
         });
 
@@ -146,6 +146,18 @@ describe('sw-sales-channel-detail-agentic-commerce-statistics', () => {
         expect(instance.orderCountCriteria.filters).not.toContainEqual(expect.objectContaining({ field: 'transactions.stateMachineState.technicalName' }));
     });
 
+    it('does not request statistics without ucp.viewer', async () => {
+        const orderSearch = jest.fn(() => Promise.resolve([]));
+        const customerSearch = jest.fn(() => Promise.resolve([]));
+        const instance = createInstance({ privileges: ['order.viewer', 'customer.viewer'], orderSearch, customerSearch });
+
+        await instance.fetchData();
+
+        expect(orderSearch).not.toHaveBeenCalled();
+        expect(customerSearch).not.toHaveBeenCalled();
+        expect(instance.isLoading).toBe(false);
+    });
+
     it.each([
         ['30Days', new Date(2026, 8, 7)],
         ['yesterday', new Date(2026, 9, 6)],
@@ -234,4 +246,4 @@ describe('sw-sales-channel-detail-agentic-commerce-statistics', () => {
         ]);
         expect(instance.orderSumTotal).toBe(125);
     });
-});
\ No newline at end of file
+});
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce-test-hooks.spec.js b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce-test-hooks.spec.js
index abd6dfc4..779d2213 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce-test-hooks.spec.js
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce-test-hooks.spec.js
@@ -12,6 +12,7 @@ import { resolve } from 'node:path';
 const HOOKS = [
     'data-testid="ac-ucp"',
     'data-testid="ac-ucp__unsaved-banner"',
+    'data-testid="ac-ucp__read-only-banner"',
     'data-testid="ac-ucp__expose-switch"',
     ':data-testid="`ac-ucp__capability--${capability.value}`"',
     ':data-testid="`ac-ucp__transport--${transport.value}`"',
@@ -55,4 +56,4 @@ describe('sw-sales-channel-detail-agentic-commerce test hooks', () => {
 
         expect(isPlainOrForwarding(tagCarrying(template, 'data-testid="ac-export__template-select"'))).toBe(true);
     });
-});
\ No newline at end of file
+});
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.mt.html.twig b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.mt.html.twig
index a374a0f7..eccb5111 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.mt.html.twig
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.mt.html.twig
@@ -3,7 +3,6 @@
     class="sw-sales-channel-detail-agentic-commerce"
     data-testid="ac-ucp"
 >
-
     {% block sw_sales_channel_detail_agentic_commerce_loading %}
     <sw-skeleton v-if="isUcpLoading" />
     {% endblock %}
@@ -12,6 +11,16 @@
        so we must NOT nest another one here — a second sw-card-view is
        position:absolute with its own 40px padding and shifts the cards. #}
     <template v-else>
+        <div
+            v-if="!canEditConfig"
+            class="sw-sales-channel-detail-agentic-commerce__read-only-banner"
+            data-testid="ac-ucp__read-only-banner"
+        >
+            <mt-banner variant="attention">
+                {{ $t('sw-sales-channel.detail.agenticCommerce.ucp.readOnlyMessage') }}
+            </mt-banner>
+        </div>
+
         {% block sw_sales_channel_detail_agentic_commerce_unsaved_banner %}
         {# Always-visible unsaved-changes notice — visible from any sub-tab. #}
         <mt-banner
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.scss b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.scss
index 5448f5ac..fd681f4a 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.scss
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.scss
@@ -28,15 +28,21 @@
         line-height: var(--font-line-height-xs, 22px);
     }
 
-    // Align the top unsaved-changes banner with the mt-card column below it
-    // (mt-card caps at 960px and centres inside the sw-card-view column).
-    &__unsaved-banner {
+    &__unsaved-banner,
+    &__read-only-banner {
         width: 100%;
         max-width: 960px;
         margin-left: auto;
         margin-right: auto;
     }
 
+    @media (max-width: 1360px) {
+        // Legacy sw-card-view narrows its cards at this breakpoint.
+        &__read-only-banner--legacy {
+            max-width: 770px;
+        }
+    }
+
     &__section-label {
         margin-top: var(--scale-size-20, 20px);
         margin-bottom: var(--scale-size-8, 8px);
@@ -160,7 +166,6 @@
         }
     }
 
-
     // Mirrors the &__keys column template (keep in sync) so the New key id
     // input lands under "Key ID", the Algorithm select spans the Algorithm +
     // Status columns, and the Create button fills the Actions column.
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.sw.html.twig b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.sw.html.twig
index 98a630ff..6ca79c63 100644
--- a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.sw.html.twig
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-agentic-commerce/sw-sales-channel-detail-agentic-commerce.sw.html.twig
@@ -7,6 +7,16 @@
     <sw-skeleton v-if="isUcpLoading" />
 
     <template v-else>
+        <div
+            v-if="!canEditConfig"
+            class="sw-sales-channel-detail-agentic-commerce__read-only-banner sw-sales-channel-detail-agentic-commerce__read-only-banner--legacy"
+            data-testid="ac-ucp__read-only-banner"
+        >
+            <sw-alert variant="info">
+                {{ $t('sw-sales-channel.detail.agenticCommerce.ucp.readOnlyMessage') }}
+            </sw-alert>
+        </div>
+
         <sw-alert
             v-if="isDirty"
             variant="warning"
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-product-export-insights/index.js b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-product-export-insights/index.js
new file mode 100644
index 00000000..3add9ea2
--- /dev/null
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-product-export-insights/index.js
@@ -0,0 +1,30 @@
+import { registerOrOverride } from '../../../../helper/register-or-override';
+
+const { Defaults } = Shopware;
+
+/**
+ * The core Insights page also serves ordinary product-comparison channels.
+ * Restrict only Agentic Commerce statistics and keep core behavior elsewhere.
+ */
+export const productExportInsightsOverride = {
+    inject: ['acl'],
+
+    computed: {
+        isAgenticCommerceChannel() {
+            return this.salesChannel?.typeId === Defaults.agenticCommerceTypeId;
+        },
+    },
+
+    methods: {
+        async fetchData() {
+            if (this.isAgenticCommerceChannel && !this.acl.can('ucp.viewer')) {
+                this.isLoading = false;
+                return;
+            }
+
+            return this.$super('fetchData');
+        },
+    },
+};
+
+registerOrOverride('sw-sales-channel-detail-product-export-insights', productExportInsightsOverride);
diff --git a/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-product-export-insights/sw-sales-channel-detail-product-export-insights.spec.js b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-product-export-insights/sw-sales-channel-detail-product-export-insights.spec.js
new file mode 100644
index 00000000..edf00b39
--- /dev/null
+++ b/src/Resources/app/administration/src/extension/sw-sales-channel/view/sw-sales-channel-detail-product-export-insights/sw-sales-channel-detail-product-export-insights.spec.js
@@ -0,0 +1,54 @@
+const Shopware = {
+    Component: { override: jest.fn(), getComponentRegistry: () => ({ has: () => true }) },
+    Defaults: { agenticCommerceTypeId: 'agentic-commerce' },
+};
+
+global.Shopware = Shopware;
+
+const { productExportInsightsOverride } = require('./index');
+
+describe('core product export Insights ACL extension', () => {
+    it('does not load statistics for an Agentic Commerce channel without ucp.viewer', async () => {
+        const ctx = {
+            salesChannel: { typeId: 'agentic-commerce' },
+            isAgenticCommerceChannel: true,
+            acl: { can: jest.fn(() => false) },
+            isLoading: true,
+            $super: jest.fn(),
+        };
+
+        await productExportInsightsOverride.methods.fetchData.call(ctx);
+
+        expect(ctx.acl.can).toHaveBeenCalledWith('ucp.viewer');
+        expect(ctx.$super).not.toHaveBeenCalled();
+        expect(ctx.isLoading).toBe(false);
+    });
+
+    it('keeps core Insights loading for product-comparison channels', async () => {
+        const ctx = {
+            salesChannel: { typeId: 'product-comparison' },
+            isAgenticCommerceChannel: false,
+            acl: { can: jest.fn() },
+            $super: jest.fn(() => Promise.resolve()),
+        };
+
+        await productExportInsightsOverride.methods.fetchData.call(ctx);
+
+        expect(ctx.acl.can).not.toHaveBeenCalled();
+        expect(ctx.$super).toHaveBeenCalledWith('fetchData');
+    });
+
+    it('keeps Agentic Commerce Insights available to ucp.viewer', async () => {
+        const ctx = {
+            salesChannel: { typeId: 'agentic-commerce' },
+            isAgenticCommerceChannel: true,
+            acl: { can: jest.fn(() => true) },
+            $super: jest.fn(() => Promise.resolve()),
+        };
+
+        await productExportInsightsOverride.methods.fetchData.call(ctx);
+
+        expect(ctx.acl.can).toHaveBeenCalledWith('ucp.viewer');
+        expect(ctx.$super).toHaveBeenCalledWith('fetchData');
+    });
+});
diff --git a/tests/acceptance/README.md b/tests/acceptance/README.md
index 5438cb14..7e819790 100644
--- a/tests/acceptance/README.md
+++ b/tests/acceptance/README.md
@@ -197,6 +197,15 @@ logs in a user with only `sales_channel.viewer`. `asFreshAdmin()` logs in a full
 own, for specs that change what the Administration stores per user, such as list filters; the
 worker's `AdminPage` user is shared with every test of the worker.
 
+`asWithCoreRoles()` creates a sales-channel viewer with additional role keys for comparisons that
+hold core card permissions constant and vary only `ucp.viewer`.
+
+`tests/UcpAcl/ucp-acl.spec.ts` gates the permission matrix. It checks read-only viewer and
+key-rotator UI, UCP-only saves by an editor without `sales_channel.editor`, authenticated direct API
+requests, the UCP list column and tab, and Insights visibility and loading. Direct API requests use
+the restricted user's own `loginService` token; privileged fixture requests are reserved for setup
+and independent state readback.
+
 **`UcpConsole`** (worker scope) runs `ucp:signing-keys:{generate,list,show-public,retire,delete}`,
 the only signing-key management surface, through the lane's `bin/console`. Nothing else passes its
 allow-list. Before the first command it probes the real prefix once. When that probe fails, the key
diff --git a/tests/acceptance/fixtures/UcpAclUsers.ts b/tests/acceptance/fixtures/UcpAclUsers.ts
index 325f8c33..1630f806 100644
--- a/tests/acceptance/fixtures/UcpAclUsers.ts
+++ b/tests/acceptance/fixtures/UcpAclUsers.ts
@@ -20,6 +20,9 @@ export interface UcpAclUsers {
     /** One Administration user per UCP role, created and logged in on first use. */
     as(role: UcpRole): Promise<UcpAclUser>
 
+    /** A sales-channel viewer with additional role keys, used to compare UCP visibility. */
+    asWithCoreRoles(roleKeys: string[]): Promise<Page>
+
     /**
      * A full admin of the test's own, logged in. The worker's `AdminPage` user is shared by every
      * test of the worker and its retries, so state the Administration stores per user, such as list
@@ -102,6 +105,12 @@ export const test = base.extend<FixtureTypes & UcpTestDataFixtureTypes & UcpAclU
 
                 return pending;
             },
+            asWithCoreRoles: async (roleKeys) => {
+                const { page } = await createUser('core-roles', ['sales_channel.viewer', ...roleKeys]);
+                otherPages.push(Promise.resolve(page));
+
+                return page;
+            },
             asFreshAdmin: freshAdmin,
             asSalesChannelViewer: () => {
                 const pending = createUser('sales_channel.viewer', ['sales_channel.viewer']).then(({ page }) => page);
diff --git a/tests/acceptance/page-objects/UcpSalesChannelDetail.ts b/tests/acceptance/page-objects/UcpSalesChannelDetail.ts
index cec13185..6535f9be 100644
--- a/tests/acceptance/page-objects/UcpSalesChannelDetail.ts
+++ b/tests/acceptance/page-objects/UcpSalesChannelDetail.ts
@@ -17,6 +17,7 @@ const ucpApiPath = (salesChannelId: string, suffix = '') => `/api/_admin/ucp/sal
 export class UcpSalesChannelDetail {
     readonly agenticCommerceTab: Locator;
     readonly unsavedBanner: Locator;
+    readonly readOnlyBanner: Locator;
     readonly exposeSwitch: Locator;
     readonly preview: Locator;
     readonly saveButton: Locator;
@@ -24,6 +25,7 @@ export class UcpSalesChannelDetail {
     constructor(public readonly page: Page) {
         this.agenticCommerceTab = page.getByTestId('ac-ucp');
         this.unsavedBanner = page.getByTestId('ac-ucp__unsaved-banner');
+        this.readOnlyBanner = page.getByTestId('ac-ucp__read-only-banner');
         this.exposeSwitch = this.checkboxInput('ac-ucp__expose-switch');
         this.preview = page.getByTestId('ac-ucp__preview');
         this.saveButton = page.locator('.sw-sales-channel-detail__save-action');
diff --git a/tests/acceptance/tests/UcpAcl/ucp-acl.spec.ts b/tests/acceptance/tests/UcpAcl/ucp-acl.spec.ts
new file mode 100644
index 00000000..b01039f3
--- /dev/null
+++ b/tests/acceptance/tests/UcpAcl/ucp-acl.spec.ts
@@ -0,0 +1,189 @@
+import { expect, test } from '@fixtures/AcceptanceTest';
+import type { Page } from '@playwright/test';
+import { UcpSalesChannelDetail } from '@page-objects/UcpSalesChannelDetail';
+import { goToAdminRoute } from '@page-objects/adminRoute';
+import type { UcpConfigPayload } from '../../services/UcpTestDataService';
+
+const ucpApiPath = (salesChannelId: string, suffix = '') => `/api/_admin/ucp/sales-channels/${salesChannelId}${suffix}`;
+const listRoute = (term: string) => `/sw/sales/channel/list?term=${encodeURIComponent(term)}`;
+const insightsTab = (page: Page, salesChannelId: string) => page.locator([
+    `a[href$="/detail/${salesChannelId}/product-export-insights"]`,
+    `a[href$="/detail/${salesChannelId}/agentic-commerce-statistics"]`,
+].join(', '));
+const insightsCards = (page: Page) => page.locator([
+    '.sw-chart-card',
+    '.sw-sales-channel-detail-agentic-commerce-statistics__orders',
+    '.sw-sales-channel-detail-agentic-commerce-statistics__customers',
+    '.sw-sales-channel-detail-agentic-commerce-statistics__turnover',
+].join(', '));
+
+type AdminGlobal = typeof globalThis & {
+    Shopware: {
+        Service(name: string): { getToken(): string }
+    }
+};
+
+async function authenticatedApiUrl(page: Page, path: string): Promise<{ url: string, headers: Record<string, string> }> {
+    const token = await page.evaluate(() => (globalThis as AdminGlobal).Shopware.Service('loginService').getToken());
+    const appUrl = process.env.APP_URL;
+    if (!appUrl) {
+        throw new Error('APP_URL must be set for authenticated API requests.');
+    }
+
+    return {
+        url: new URL(path, appUrl).toString(),
+        headers: { Authorization: `Bearer ${token}` },
+    };
+}
+
+async function directConfigPut(page: Page, salesChannelId: string, config: Record<string, unknown>) {
+    const auth = await authenticatedApiUrl(page, ucpApiPath(salesChannelId, '/config'));
+
+    return page.request.put(auth.url, { headers: auth.headers, data: config });
+}
+
+async function directConfigGet(page: Page, salesChannelId: string) {
+    const auth = await authenticatedApiUrl(page, ucpApiPath(salesChannelId, '/config'));
+
+    return page.request.get(auth.url, { headers: auth.headers });
+}
+
+test.describe('UCP Administration ACL @UcpAcl', () => {
+    for (const role of ['ucp.viewer', 'ucp.key_rotator'] as const) {
+        test(`${role} can view the configuration but cannot edit or save it`, async ({ TestDataService, UcpAclUsers }) => {
+            const { salesChannel } = await TestDataService.createStorefrontSalesChannel();
+            await TestDataService.activateUcp(salesChannel.id);
+            const before = await TestDataService.getUcpConfig(salesChannel.id);
+            const { page } = await UcpAclUsers.as(role);
+            const detail = new UcpSalesChannelDetail(page);
+
+            await detail.openAgenticCommerceTab(salesChannel.id);
+
+            await expect(detail.readOnlyBanner).toBeVisible();
+            await expect(detail.exposeSwitch).toBeDisabled();
+            await expect(page.locator('[data-testid^="ac-ucp__capability--"] input[type="checkbox"]').first()).toBeDisabled();
+            await expect(page.locator('[data-testid^="ac-ucp__transport--"] input[type="checkbox"]').first()).toBeDisabled();
+            await expect(detail.saveButton).toBeDisabled();
+
+            const readable = await directConfigGet(page, salesChannel.id);
+            expect(readable.status(), await readable.text()).toBe(200);
+            expect(((await readable.json()) as { data: UcpConfigPayload }).data).toMatchObject({ ...before });
+
+            const denied = await directConfigPut(page, salesChannel.id, { enabledCapabilities: ['catalog'] });
+            expect(denied.status(), await denied.text()).toBe(403);
+            expect(await TestDataService.getUcpConfig(salesChannel.id)).toEqual(before);
+        });
+    }
+
+    test('ucp.editor saves only UCP settings without sales_channel.editor', async ({ TestDataService, UcpAclUsers }) => {
+        const { salesChannel } = await TestDataService.createStorefrontSalesChannel();
+        await TestDataService.activateUcp(salesChannel.id);
+        const editor = await UcpAclUsers.as('ucp.editor');
+        expect(editor.privileges).not.toContain('sales_channel:update');
+
+        const detail = new UcpSalesChannelDetail(editor.page);
+        await detail.openAgenticCommerceTab(salesChannel.id);
+        await expect(detail.readOnlyBanner).toBeHidden();
+        await expect(detail.saveButton).toBeEnabled();
+
+        await detail.capability('discount').uncheck();
+        const requests: Array<{ method: string, pathname: string }> = [];
+        editor.page.on('request', (request) => {
+            requests.push({
+                method: request.method(),
+                pathname: new URL(request.url()).pathname,
+            });
+        });
+        await detail.saveUcpConfig(salesChannel.id);
+        expect((await TestDataService.getUcpConfig(salesChannel.id)).enabledCapabilities).not.toContain('discount');
+        expect(requests.filter(({ method, pathname }) =>
+            method !== 'GET'
+            && (pathname.endsWith('/api/sales-channel') || pathname.endsWith('/api/_action/sync')),
+        )).toEqual([]);
+        await detail.reload(salesChannel.id);
+        await expect(detail.capability('discount')).not.toBeChecked();
+
+        const directWrite = await directConfigPut(editor.page, salesChannel.id, { enabledTransports: ['rest', 'embedded'] });
+        expect(directWrite.status(), await directWrite.text()).toBe(200);
+        expect((await TestDataService.getUcpConfig(salesChannel.id)).enabledTransports).toEqual(['rest', 'embedded']);
+    });
+
+    test('a user without a UCP role has no UCP list column or tab and cannot access configuration', async ({ TestDataService, UcpAclUsers }) => {
+        const { salesChannel } = await TestDataService.createStorefrontSalesChannel();
+        await TestDataService.activateUcp(salesChannel.id);
+        const page = await UcpAclUsers.asSalesChannelViewer();
+
+        await goToAdminRoute(page, listRoute(salesChannel.name));
+        const row = page.locator('.sw-data-grid__row').filter({ hasText: salesChannel.name });
+        await expect(row).toBeVisible();
+        await expect(page.locator('[data-testid^="ac-sales-channel-list__ucp-status"]')).toHaveCount(0);
+
+        await goToAdminRoute(page, `/sw/sales/channel/detail/${salesChannel.id}/base`);
+        await expect(page.locator(`a[href$="/detail/${salesChannel.id}/agentic-commerce"]`)).toHaveCount(0);
+
+        const read = await directConfigGet(page, salesChannel.id);
+        expect(read.status(), await read.text()).toBe(403);
+        const write = await directConfigPut(page, salesChannel.id, { active: false });
+        expect(write.status(), await write.text()).toBe(403);
+    });
+
+    test('Insights cards require ucp.viewer while core card permissions stay the same', async ({ TestDataService, UcpAclUsers }) => {
+        const { salesChannel } = await TestDataService.createFeedSalesChannelWithExport();
+        const coreCardRoles = ['order.viewer', 'customer.viewer'];
+        const withoutUcpViewer = await UcpAclUsers.asWithCoreRoles(coreCardRoles);
+        const withUcpViewer = await UcpAclUsers.asWithCoreRoles([...coreCardRoles, 'ucp.viewer']);
+
+        await goToAdminRoute(withUcpViewer, `/sw/sales/channel/detail/${salesChannel.id}/base`);
+        const insightTab = insightsTab(withUcpViewer, salesChannel.id).first();
+        await expect(insightTab).toBeVisible();
+        await insightTab.click();
+        await expect(withUcpViewer).toHaveURL(/product-export-insights|agentic-commerce-statistics/);
+        const insightsRoute = new URL(withUcpViewer.url()).hash.slice(1);
+        await expect(insightsCards(withUcpViewer).first()).toBeVisible();
+
+        await goToAdminRoute(withoutUcpViewer, `/sw/sales/channel/detail/${salesChannel.id}/base`);
+        await expect(insightsTab(withoutUcpViewer, salesChannel.id)).toHaveCount(0);
+        const statisticsSearchPaths = new Set([
+            '/api/search/order',
+            '/api/search/customer',
+            '/api/search/sales-channel-tracking-order',
+            '/api/search/sales-channel-tracking-customer',
+        ]);
+        const requests: Array<{ method: string, pathname: string }> = [];
+        withoutUcpViewer.on('request', (request) => {
+            requests.push({
+                method: request.method(),
+                pathname: new URL(request.url()).pathname,
+            });
+        });
+
+        await goToAdminRoute(withoutUcpViewer, insightsRoute);
+        await expect(insightsCards(withoutUcpViewer)).toHaveCount(0);
+        expect(requests.filter(({ pathname }) => statisticsSearchPaths.has(pathname))).toEqual([]);
+    });
+
+    test('a ucp.viewer sees exposed and disabled channels in the UCP list column', async ({ TestDataService, UcpAclUsers }) => {
+        const exposed = await TestDataService.createStorefrontSalesChannel();
+        await TestDataService.activateUcp(exposed.salesChannel.id);
+        const notExposed = await TestDataService.createStorefrontSalesChannel();
+        const { page } = await UcpAclUsers.as('ucp.viewer');
+        const rowOf = (name: string) => page.locator('.sw-data-grid__row').filter({ hasText: name });
+
+        await goToAdminRoute(page, listRoute(exposed.salesChannel.name));
+        await expect(rowOf(exposed.salesChannel.name).getByTestId('ac-sales-channel-list__ucp-status--exposed')).toBeVisible();
+        await goToAdminRoute(page, listRoute(notExposed.salesChannel.name));
+        await expect(rowOf(notExposed.salesChannel.name).getByTestId('ac-sales-channel-list__ucp-status--off')).toBeVisible();
+        await expect(rowOf(notExposed.salesChannel.name).getByTestId('ac-sales-channel-list__ucp-status--exposed')).toHaveCount(0);
+    });
+
+    test('users without ucp.viewer do not see the UCP list column', async ({ TestDataService, UcpAclUsers }) => {
+        const exposed = await TestDataService.createStorefrontSalesChannel();
+        await TestDataService.activateUcp(exposed.salesChannel.id);
+        const page = await UcpAclUsers.asSalesChannelViewer();
+
+        await goToAdminRoute(page, listRoute(exposed.salesChannel.name));
+        const row = page.locator('.sw-data-grid__row').filter({ hasText: exposed.salesChannel.name });
+        await expect(row).toBeVisible();
+        await expect(page.locator('[data-testid^="ac-sales-channel-list__ucp-status"]')).toHaveCount(0);
+    });
+});
diff --git a/tests/acceptance/tests/UcpAdmin/sales-channel-surfaces.spec.ts b/tests/acceptance/tests/UcpAdmin/sales-channel-surfaces.spec.ts
index 9deb11dc..99f912f9 100644
--- a/tests/acceptance/tests/UcpAdmin/sales-channel-surfaces.spec.ts
+++ b/tests/acceptance/tests/UcpAdmin/sales-channel-surfaces.spec.ts
@@ -39,33 +39,6 @@ async function chooseEntity(field: Locator, search: string): Promise<void> {
 }
 
 test.describe('Sales channel surfaces of the plugin @UcpAdmin', () => {
-    test('a ucp.viewer sees which channels are exposed via UCP in the list', async ({ TestDataService, UcpAclUsers }) => {
-        const exposed = await TestDataService.createStorefrontSalesChannel();
-        await TestDataService.activateUcp(exposed.salesChannel.id);
-        const notExposed = await TestDataService.createStorefrontSalesChannel();
-        const { page } = await UcpAclUsers.as('ucp.viewer');
-
-        const rowOf = (name: string) => page.locator('.sw-data-grid__row').filter({ hasText: name });
-
-        await goToAdminRoute(page, listRoute(exposed.salesChannel.name));
-        await expect(rowOf(exposed.salesChannel.name).getByTestId('ac-sales-channel-list__ucp-status--exposed')).toBeVisible();
-
-        await goToAdminRoute(page, listRoute(notExposed.salesChannel.name));
-        await expect(rowOf(notExposed.salesChannel.name).getByTestId('ac-sales-channel-list__ucp-status--off')).toBeVisible();
-        await expect(rowOf(notExposed.salesChannel.name).getByTestId('ac-sales-channel-list__ucp-status--exposed')).toHaveCount(0);
-    });
-
-    test('a user without ucp.viewer sees the list without the UCP column', async ({ TestDataService, UcpAclUsers }) => {
-        const exposed = await TestDataService.createStorefrontSalesChannel();
-        await TestDataService.activateUcp(exposed.salesChannel.id);
-        const page = await UcpAclUsers.asSalesChannelViewer();
-
-        await goToAdminRoute(page, listRoute(exposed.salesChannel.name));
-        const row = page.locator('.sw-data-grid__row').filter({ hasText: exposed.salesChannel.name });
-        await expect(row).toBeVisible();
-        await expect(page.locator('[data-testid^="ac-sales-channel-list__ucp-status"]')).toHaveCount(0);
-    });
-
     test('an Agentic Commerce channel created from the modal is saved with the prefilled feed export', async ({ TestDataService, AdminPage, DefaultSalesChannel }) => {
         const productStream = await TestDataService.createProductStream();
         const name = `${TestDataService.namePrefix}UCP-created-${Date.now()}`;