diff --git a/descarteslabs/core/catalog/catalog_base.py b/descarteslabs/core/catalog/catalog_base.py
index d4d2adf1..bc90a7d1 100644
--- a/descarteslabs/core/catalog/catalog_base.py
+++ b/descarteslabs/core/catalog/catalog_base.py
@@ -1106,7 +1106,7 @@ def user_is_owner(self, auth=None):
         if auth is None:
             auth = self._client.auth
 
-        return "descarteslabs:platform-admin" in auth.payload.get("groups", []) or bool(
+        return "internal:platform-admin" in auth.payload.get("groups", []) or bool(
             set(self.owners) & auth.all_owner_acl_subjects_as_set
         )
 
@@ -1155,7 +1155,7 @@ def user_can_read(self, auth=None):
             auth = self._client.auth
 
         return (
-            "descarteslabs:platform-ro" in auth.payload.get("groups", [])
+            "internal:platform-ro" in auth.payload.get("groups", [])
             or self.user_can_write(auth)
             or bool(set(self.readers) & auth.all_acl_subjects_as_set)
         )
diff --git a/descarteslabs/core/catalog/event_api_destination.py b/descarteslabs/core/catalog/event_api_destination.py
index 6dce49e1..841d21d9 100644
--- a/descarteslabs/core/catalog/event_api_destination.py
+++ b/descarteslabs/core/catalog/event_api_destination.py
@@ -125,7 +125,7 @@ class EventApiDestination(AuthCatalogObject):
 
         A core event api destination is an event api destination that is fully managed by Descartes Labs.  By
         default this value is ``False`` and you must have a special permission
-        (``descarteslabs:core:create``) to set it to ``True``.
+        (``internal:core:create``) to set it to ``True``.
 
         *Filterable, sortable*.
         """
diff --git a/descarteslabs/core/catalog/event_rule.py b/descarteslabs/core/catalog/event_rule.py
index 7244f25d..c9a723e3 100644
--- a/descarteslabs/core/catalog/event_rule.py
+++ b/descarteslabs/core/catalog/event_rule.py
@@ -196,7 +196,7 @@ class EventRule(AuthCatalogObject):
 
         A core event rule is an event rule that is fully managed by Descartes Labs.  By
         default this value is ``False`` and you must have a special permission
-        (``descarteslabs:core:create``) to set it to ``True``.
+        (``internal:core:create``) to set it to ``True``.
 
         *Filterable, sortable*.
         """
diff --git a/descarteslabs/core/catalog/product.py b/descarteslabs/core/catalog/product.py
index 93ebc6cd..7aa4d016 100644
--- a/descarteslabs/core/catalog/product.py
+++ b/descarteslabs/core/catalog/product.py
@@ -89,7 +89,7 @@ class Product(AuthCatalogObject):
 
         A core product is a product that is fully supported by Descartes Labs.  By
         default this value is ``False`` and you must have a special permission
-        (``descarteslabs:core:create``) to set it to ``True``.
+        (``internal:core:create``) to set it to ``True``.
 
         *Filterable, sortable*.
         """