diff --git a/api/handlers/service_offering_test.go b/api/handlers/service_offering_test.go
index 33f306d02..2877256ef 100644
--- a/api/handlers/service_offering_test.go
+++ b/api/handlers/service_offering_test.go
@@ -291,7 +291,7 @@ var _ = Describe("ServiceOffering", func() {
 			Expect(rr).To(HaveHTTPStatus(http.StatusNoContent))
 		})
 
-		When("getting the service offering fails with not found", func() {
+		When("deleting the service offering fails with not found", func() {
 			BeforeEach(func() {
 				serviceOfferingRepo.DeleteOfferingReturns(apierrors.NewNotFoundError(nil, repositories.ServiceOfferingResourceType))
 			})
diff --git a/api/repositories/service_offering_repository_test.go b/api/repositories/service_offering_repository_test.go
index 5d55caaf8..9f9459dce 100644
--- a/api/repositories/service_offering_repository_test.go
+++ b/api/repositories/service_offering_repository_test.go
@@ -331,7 +331,7 @@ var _ = Describe("ServiceOfferingRepo", func() {
 		})
 	})
 
-	Describe("Delete", func() {
+	Describe("Delete-off", func() {
 		var (
 			plan      *korifiv1alpha1.CFServicePlan
 			offering  *korifiv1alpha1.CFServiceOffering
@@ -379,11 +379,20 @@ var _ = Describe("ServiceOfferingRepo", func() {
 			}
 			Expect(k8sClient.Create(ctx, plan)).To(Succeed())
 
-			instance = createServiceInstanceCR(ctx, k8sClient, uuid.NewString(), space.Name, "my-service-instance", "secret-name")
-			instance.Spec.PlanGUID = plan.Name
-			instance.Finalizers = append(instance.Finalizers, korifiv1alpha1.CFManagedServiceInstanceFinalizerName)
-
-			Expect(k8sClient.Update(ctx, instance)).To(Succeed())
+			instance = &korifiv1alpha1.CFServiceInstance{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: space.Name,
+					Name:      uuid.NewString(),
+					Finalizers: []string{
+						korifiv1alpha1.CFManagedServiceInstanceFinalizerName,
+					},
+				},
+				Spec: korifiv1alpha1.CFServiceInstanceSpec{
+					PlanGUID: plan.Name,
+					Type:     "user-provided",
+				},
+			}
+			Expect(k8sClient.Create(ctx, instance)).To(Succeed())
 
 			binding = &korifiv1alpha1.CFServiceBinding{
 				ObjectMeta: metav1.ObjectMeta{
@@ -392,6 +401,9 @@ var _ = Describe("ServiceOfferingRepo", func() {
 					Labels: map[string]string{
 						korifiv1alpha1.PlanGUIDLabelKey: plan.Name,
 					},
+					Finalizers: []string{
+						korifiv1alpha1.CFServiceBindingFinalizerName,
+					},
 				},
 				Spec: korifiv1alpha1.CFServiceBindingSpec{
 					Service: corev1.ObjectReference{
@@ -404,15 +416,15 @@ var _ = Describe("ServiceOfferingRepo", func() {
 					},
 				},
 			}
-
-			binding.Finalizers = append(binding.Finalizers, korifiv1alpha1.CFServiceBindingFinalizerName)
 			Expect(k8sClient.Create(ctx, binding)).To(Succeed())
 
+			createRoleBinding(ctx, userName, spaceDeveloperRole.Name, space.Name)
+			createRoleBinding(ctx, userName, adminRole.Name, rootNamespace)
+
 			message = repositories.DeleteServiceOfferingMessage{GUID: offering.Name}
 		})
 
 		JustBeforeEach(func() {
-			createRoleBinding(ctx, userName, spaceDeveloperRole.Name, space.Name)
 			deleteErr = repo.DeleteOffering(ctx, authInfo, message)
 		})
 
diff --git a/controllers/controllers/services/brokers/controller.go b/controllers/controllers/services/brokers/controller.go
index 3712fd333..9181600eb 100644
--- a/controllers/controllers/services/brokers/controller.go
+++ b/controllers/controllers/services/brokers/controller.go
@@ -102,8 +102,8 @@ func (r *Reconciler) secretToServiceBroker(ctx context.Context, o client.Object)
 
 //+kubebuilder:rbac:groups=korifi.cloudfoundry.org,resources=cfservicebrokers,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=korifi.cloudfoundry.org,resources=cfservicebrokers/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups=korifi.cloudfoundry.org,resources=cfserviceofferings,verbs=get;list;watch;create;update;patch
-//+kubebuilder:rbac:groups=korifi.cloudfoundry.org,resources=cfserviceplans,verbs=get;list;watch;create;update;patch
+//+kubebuilder:rbac:groups=korifi.cloudfoundry.org,resources=cfserviceofferings,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=korifi.cloudfoundry.org,resources=cfserviceplans,verbs=get;list;watch;create;update;patch;delete
 
 func (r *Reconciler) ReconcileResource(ctx context.Context, cfServiceBroker *korifiv1alpha1.CFServiceBroker) (ctrl.Result, error) {
 	log := logr.FromContextOrDiscard(ctx).WithValues("broker-id", cfServiceBroker.Name)
diff --git a/helm/korifi/controllers/cf_roles/cf_admin.yaml b/helm/korifi/controllers/cf_roles/cf_admin.yaml
index 6eaf7c7e7..18b16e020 100644
--- a/helm/korifi/controllers/cf_roles/cf_admin.yaml
+++ b/helm/korifi/controllers/cf_roles/cf_admin.yaml
@@ -207,6 +207,7 @@ rules:
   - list
   - get
   - patch
+  - delete
 
 - apiGroups:
   - rbac.authorization.k8s.io
diff --git a/helm/korifi/controllers/cf_roles/cf_root_namespace_user.yaml b/helm/korifi/controllers/cf_roles/cf_root_namespace_user.yaml
index 418cea270..dbdae539f 100644
--- a/helm/korifi/controllers/cf_roles/cf_root_namespace_user.yaml
+++ b/helm/korifi/controllers/cf_roles/cf_root_namespace_user.yaml
@@ -46,7 +46,6 @@ rules:
   - cfservicebrokers
   verbs:
   - list
-  - delete
 
 - apiGroups:
   - korifi.cloudfoundry.org
diff --git a/helm/korifi/controllers/role.yaml b/helm/korifi/controllers/role.yaml
index aa003ebb7..a93ccf049 100644
--- a/helm/korifi/controllers/role.yaml
+++ b/helm/korifi/controllers/role.yaml
@@ -110,6 +110,8 @@ rules:
   - cfservicebindings
   - cfservicebrokers
   - cfserviceinstances
+  - cfserviceofferings
+  - cfserviceplans
   - cfspaces
   - cftasks
   verbs:
@@ -204,18 +206,6 @@ rules:
   - get
   - patch
   - update
-- apiGroups:
-  - korifi.cloudfoundry.org
-  resources:
-  - cfserviceofferings
-  - cfserviceplans
-  verbs:
-  - create
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - kpack.io
   resources:
diff --git a/tests/e2e/apps_test.go b/tests/e2e/apps_test.go
index a7a0ded11..c7fa27cc5 100644
--- a/tests/e2e/apps_test.go
+++ b/tests/e2e/apps_test.go
@@ -420,7 +420,6 @@ var _ = Describe("Apps", func() {
 			It("succeeds", func() {
 				Expect(resp).To(HaveRestyStatusCode(http.StatusOK))
 				Expect(resultList.Resources[0].GUID).To(Equal(buildGUID))
-
 			})
 		})