diff --git a/clients/cli/general.c b/clients/cli/general.c
index b919ccb54..50e5eeb98 100644
--- a/clients/cli/general.c
+++ b/clients/cli/general.c
@@ -437,6 +437,8 @@ permission_to_string (NMClientPermission perm)
 		return NM_AUTH_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS;
 	case NM_CLIENT_PERMISSION_RELOAD:
 		return NM_AUTH_PERMISSION_RELOAD;
+	case NM_CLIENT_PERMISSION_CHECKPOINT_ROLLBACK:
+		return NM_AUTH_PERMISSION_CHECKPOINT_ROLLBACK;
 	default:
 		return _("unknown");
 	}
diff --git a/libnm-glib/nm-client.c b/libnm-glib/nm-client.c
index bf3191f5b..a78c601a1 100644
--- a/libnm-glib/nm-client.c
+++ b/libnm-glib/nm-client.c
@@ -238,6 +238,8 @@ nm_permission_to_client (const char *nm)
 		return NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS;
 	else if (!strcmp (nm, NM_AUTH_PERMISSION_RELOAD))
 		return NM_CLIENT_PERMISSION_RELOAD;
+	else if (!strcmp (nm, NM_AUTH_PERMISSION_CHECKPOINT_ROLLBACK))
+		return NM_CLIENT_PERMISSION_CHECKPOINT_ROLLBACK;
 
 	return NM_CLIENT_PERMISSION_NONE;
 }
diff --git a/libnm-glib/nm-client.h b/libnm-glib/nm-client.h
index 50a5c762d..a5cfcca0f 100644
--- a/libnm-glib/nm-client.h
+++ b/libnm-glib/nm-client.h
@@ -88,6 +88,7 @@ G_BEGIN_DECLS
  *  DNS configuration
  * @NM_CLIENT_PERMISSION_RELOAD: controls access to Reload.
  *  persistent hostname can be changed
+ * @NM_CLIENT_PERMISSION_CHECKPOINT_ROLLBACK: permission to create checkpoints.
  * @NM_CLIENT_PERMISSION_LAST: a reserved boundary value
  *
  * #NMClientPermission values indicate various permissions that NetworkManager
@@ -108,8 +109,9 @@ typedef enum {
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME = 11,
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS = 12,
 	NM_CLIENT_PERMISSION_RELOAD = 13,
+	NM_CLIENT_PERMISSION_CHECKPOINT_ROLLBACK = 14,
 
-	NM_CLIENT_PERMISSION_LAST = 13,
+	NM_CLIENT_PERMISSION_LAST = 14,
 } NMClientPermission;
 
 /**
diff --git a/libnm/nm-client.h b/libnm/nm-client.h
index a496d9ad2..e2a18b617 100644
--- a/libnm/nm-client.h
+++ b/libnm/nm-client.h
@@ -97,6 +97,7 @@ G_BEGIN_DECLS
  * @NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS: modify persistent global
  *  DNS configuration
  * @NM_CLIENT_PERMISSION_RELOAD: controls access to Reload.
+ * @NM_CLIENT_PERMISSION_CHECKPOINT_ROLLBACK: permission to create checkpoints.
  * @NM_CLIENT_PERMISSION_LAST: a reserved boundary value
  *
  * #NMClientPermission values indicate various permissions that NetworkManager
@@ -117,8 +118,9 @@ typedef enum {
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME = 11,
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS = 12,
 	NM_CLIENT_PERMISSION_RELOAD = 13,
+	NM_CLIENT_PERMISSION_CHECKPOINT_ROLLBACK = 14,
 
-	NM_CLIENT_PERMISSION_LAST = 13,
+	NM_CLIENT_PERMISSION_LAST = 14,
 } NMClientPermission;
 
 /**
diff --git a/libnm/nm-manager.c b/libnm/nm-manager.c
index 27bd4ca67..4156f651b 100644
--- a/libnm/nm-manager.c
+++ b/libnm/nm-manager.c
@@ -232,6 +232,8 @@ nm_permission_to_client (const char *nm)
 		return NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS;
 	else if (!strcmp (nm, NM_AUTH_PERMISSION_RELOAD))
 		return NM_CLIENT_PERMISSION_RELOAD;
+	else if (!strcmp (nm, NM_AUTH_PERMISSION_CHECKPOINT_ROLLBACK))
+		return NM_CLIENT_PERMISSION_CHECKPOINT_ROLLBACK;
 
 	return NM_CLIENT_PERMISSION_NONE;
 }
diff --git a/src/nm-manager.c b/src/nm-manager.c
index e94659b02..88723e029 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -4414,6 +4414,7 @@ get_permissions_done_cb (NMAuthChain *chain,
 		get_perm_add_result (self, chain, &results, NM_AUTH_PERMISSION_SETTINGS_MODIFY_HOSTNAME);
 		get_perm_add_result (self, chain, &results, NM_AUTH_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS);
 		get_perm_add_result (self, chain, &results, NM_AUTH_PERMISSION_RELOAD);
+		get_perm_add_result (self, chain, &results, NM_AUTH_PERMISSION_CHECKPOINT_ROLLBACK);
 
 		g_dbus_method_invocation_return_value (context,
 		                                       g_variant_new ("(a{ss})", &results));
@@ -4453,6 +4454,7 @@ impl_manager_get_permissions (NMManager *self,
 	nm_auth_chain_add_call (chain, NM_AUTH_PERMISSION_SETTINGS_MODIFY_HOSTNAME, FALSE);
 	nm_auth_chain_add_call (chain, NM_AUTH_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS, FALSE);
 	nm_auth_chain_add_call (chain, NM_AUTH_PERMISSION_RELOAD, FALSE);
+	nm_auth_chain_add_call (chain, NM_AUTH_PERMISSION_CHECKPOINT_ROLLBACK, FALSE);
 }
 
 static void