diff --git a/src/api/vm.js b/src/api/vm.js
index 9f4b70051..001997514 100644
--- a/src/api/vm.js
+++ b/src/api/vm.js
@@ -48,7 +48,7 @@ const extract = (obj, prop) => {
 export async function create (params) {
   const { user } = this
   const resourceSet = extract(params, 'resourceSet')
-  if (resourceSet !== undefined && user.permission !== 'admin') {
+  if (resourceSet === undefined && user.permission !== 'admin') {
     throw unauthorized()
   }