diff --git a/deploy.module b/deploy.module
index f4c4f28..93ddaa2 100644
--- a/deploy.module
+++ b/deploy.module
@@ -14,11 +14,11 @@ function deploy_toolbar() {
   $user = \Drupal::currentUser();
   $items['deploy'] = [
     '#type' => 'toolbar_item',
-    '#access' => \Drupal::entityTypeManager()->getAccessControlHandler('replication')->createAccess('', $user),
     'tab' => [
       '#type' => 'link',
       '#title' => t('Deploy'),
       '#url' => Url::fromRoute('entity.replication.add_form'),
+      '#access' => \Drupal::entityTypeManager()->getAccessControlHandler('replication')->createAccess('', $user),
       '#attributes' => [
         'title' => t('Deploy'),
         'class' => ['toolbar-icon', 'toolbar-icon-deploy', 'use-ajax'],
diff --git a/src/ReplicationAccessControlHandler.php b/src/ReplicationAccessControlHandler.php
index 273ae50..6dcb3bc 100644
--- a/src/ReplicationAccessControlHandler.php
+++ b/src/ReplicationAccessControlHandler.php
@@ -59,12 +59,18 @@ class ReplicationAccessControlHandler extends EntityAccessControlHandler impleme
     return parent::checkFieldAccess($operation, $field_definition, $account, $items);
   }
 
+  /**
+   * {@inheritdoc}
+   */
   protected function checkCreateAccess(AccountInterface $account, array $context, $entity_bundle = NULL) {
     $access = parent::checkCreateAccess($account, $context, $entity_bundle);
     $active_workspace = $this->workspaceManager->getActiveWorkspace();
     $upstream_workspace_pointer = $active_workspace->upstream->entity;
-    if (!$account->hasPermission('Deploy to ' . $upstream_workspace_pointer->label()) ) {
-      $access->isForbidden();
+
+    // When no upstream workspace pointer is set or when the user doesn't have
+    // the permissions to deploy to the upstream, the access is forbidden.
+    if (!$upstream_workspace_pointer || !$account->hasPermission('Deploy to ' . $upstream_workspace_pointer->label()) ) {
+      $access = AccessResult::forbidden();
     }
     return $access;
   }
diff --git a/tests/src/Functional/DeploymentAccessTest.php b/tests/src/Functional/DeploymentAccessTest.php
index e69de29..5ca9193 100644
--- a/tests/src/Functional/DeploymentAccessTest.php
+++ b/tests/src/Functional/DeploymentAccessTest.php
@@ -0,0 +1,65 @@
+<?php
+
+namespace Drupal\Tests\deploy\Functional;
+
+use Drupal\Tests\BrowserTestBase;
+use Drupal\user\Entity\Role;
+
+/**
+ * Tests access for creating deployments.
+ *
+ * @group workspace
+ */
+class DeploymentAccessTest extends BrowserTestBase {
+
+  public static $modules = [
+    'user',
+    'deploy',
+    'toolbar',
+  ];
+
+  /**
+   * Test deployment access.
+   */
+  public function testDeploymentAccess() {
+    $web_assert = $this->assertSession();
+
+    // Create and login a user with limited permissions.
+    $permissions = [
+      'access administration pages',
+      'administer workspaces',
+      'access toolbar',
+    ];
+    $test_user = $this->drupalCreateUser($permissions);
+    $this->drupalLogin($test_user);
+
+    // Check the user can't access the deploy link or the deploy page for Live.
+    $this->drupalGet('<front>');
+    $web_assert->linkExists('Live');
+    $web_assert->linkNotExists('Deploy');
+    $this->drupalGet('/admin/structure/deployment/add');
+    $web_assert->statusCodeEquals('403');
+
+    // Switch to the stage workspace.
+    $this->drupalPostForm('/admin/structure/workspace/2/activate', [], 'Activate');
+
+    // Check ther use can't access the deploy link or the deploy page for Stage.
+    $this->drupalGet('<front>');
+    $web_assert->linkExists('Stage');
+    $web_assert->linkNotExists('Deploy');
+    $this->drupalGet('/admin/structure/deployment/add');
+    $web_assert->statusCodeEquals('403');
+
+    // Give the user access to deploy to live.
+    $test_user_roles = $test_user->getRoles();
+    $this->grantPermissions(Role::load(reset($test_user_roles)), ['Deploy to Live']);
+
+    // Check the use can access the deploy link or the deploy page for Stage.
+    $this->drupalGet('<front>');
+    $web_assert->linkExists('Stage');
+    $web_assert->linkExists('Deploy');
+    $this->drupalGet('/admin/structure/deployment/add');
+    $web_assert->statusCodeEquals('200');
+  }
+
+}