diff --git a/config/crd/bases/eda.ansible.com_edas.yaml b/config/crd/bases/eda.ansible.com_edas.yaml
index 6acb3792..576a62f6 100644
--- a/config/crd/bases/eda.ansible.com_edas.yaml
+++ b/config/crd/bases/eda.ansible.com_edas.yaml
@@ -1476,6 +1476,9 @@ spec:
                       type: object
                     type: array
                 type: object
+              activation_job_namespace:
+                description: Namespace where activation job pods will run. Creates the namespace and grants required permissions automatically.
+                type: string
               activation_worker:
                 description: Defines desired state of eda-activation-worker resources
                 properties:
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 93ecaf59..067689a5 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -4,6 +4,13 @@ kind: Role
 metadata:
   name: eda-manager-role
 rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - create
   ##
   ## Base operator rules
   ##
diff --git a/roles/common/templates/service_account.yaml.j2 b/roles/common/templates/service_account.yaml.j2
index cad40fd6..b91e78e2 100644
--- a/roles/common/templates/service_account.yaml.j2
+++ b/roles/common/templates/service_account.yaml.j2
@@ -19,7 +19,8 @@ metadata:
   labels:
     {{ lookup("template", "../common/templates/labels/common.yaml.j2") | indent(width=4) | trim }}
 rules:
-- apiGroups: [""] # "" indicates the core API group
+{% if not activation_job_namespace %}
+- apiGroups: [""]
   resources: ["pods", "pods/log", "jobs", "secrets", "services"]
   verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
 - apiGroups: ["batch", "extensions"]
@@ -28,6 +29,7 @@ rules:
 - apiGroups: ["networking.k8s.io"]
   resources: ["ingresses"]
   verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+{% endif %}
 
 ---
 kind: RoleBinding
@@ -44,3 +46,51 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: '{{ ansible_operator_meta.name }}'
+
+{% if activation_job_namespace %}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: '{{ activation_job_namespace }}'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: '{{ ansible_operator_meta.name }}-job-execution'
+  namespace: '{{ activation_job_namespace }}'
+  labels:
+    {{ lookup("template", "../common/templates/labels/common.yaml.j2") | indent(width=4) | trim }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get"]
+- apiGroups: ["batch", "extensions"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "create", "delete"]
+- apiGroups: [""]
+  resources: ["services"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: '{{ ansible_operator_meta.name }}-job-execution'
+  namespace: '{{ activation_job_namespace }}'
+  labels:
+    {{ lookup("template", "../common/templates/labels/common.yaml.j2") | indent(width=4) | trim }}
+subjects:
+- kind: ServiceAccount
+  name: '{{ ansible_operator_meta.name }}'
+  namespace: '{{ ansible_operator_meta.namespace }}'
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: '{{ ansible_operator_meta.name }}-job-execution'
+{% endif %}
diff --git a/roles/eda/defaults/main.yml b/roles/eda/defaults/main.yml
index ac15f427..081cc546 100644
--- a/roles/eda/defaults/main.yml
+++ b/roles/eda/defaults/main.yml
@@ -26,6 +26,8 @@ _image_web_version: "{{ lookup('env', 'DEFAULT_EDA_UI_VERSION') or 'main' }}"
 #     kubernetes.io/arch: amd64
 #     kubernetes.io/os: linux
 
+activation_job_namespace: ''
+
 websocket_ssl_verify: false
 
 api: {}
diff --git a/roles/eda/templates/eda-activation-worker.deployment.yaml.j2 b/roles/eda/templates/eda-activation-worker.deployment.yaml.j2
index ed71fad7..c4df3099 100644
--- a/roles/eda/templates/eda-activation-worker.deployment.yaml.j2
+++ b/roles/eda/templates/eda-activation-worker.deployment.yaml.j2
@@ -251,6 +251,10 @@ spec:
         - name: EDA_EVENT_PERSISTENCE_PGSSLMODE
           value: '{{ event_persistence_postgres_sslmode }}'
 {% endif %}
+{% if activation_job_namespace %}
+        - name: EDA_ACTIVATION_JOB_NAMESPACE
+          value: '{{ activation_job_namespace }}'
+{% endif %}
 {% if combined_activation_worker.resource_requirements is defined %}
         resources: {{ combined_activation_worker.resource_requirements }}
 {% endif %}