--- a/src/support/nfs_creds.c
+++ b/src/support/nfs_creds.c
@@ -674,6 +674,8 @@ fsal_errors_t nfs_access_op(struct fsal_obj_handle *obj,
 	fsal_accessflags_t access_allowed;
 	fsal_accessflags_t access_denied;
 	uint32_t granted_mask = requested_access;
+	bool client_rw = (op_ctx->export_perms->options &
+			  EXPORT_OPTION_WRITE_ACCESS);
 
 	access_mask = 0;
 	*granted_access = 0;
@@ -771,7 +773,7 @@ fsal_errors_t nfs_access_op(struct fsal_obj_handle *obj,
 		if (access_allowed & FSAL_R_OK)
 			*granted_access |= ACCESS3_READ;
 
-		if (access_allowed & FSAL_W_OK)
+		if ((access_allowed & FSAL_W_OK) && client_rw)
 			*granted_access |=
 			    ACCESS3_MODIFY | ACCESS3_EXTEND | ACCESS3_DELETE;
 
@@ -783,20 +785,25 @@ fsal_errors_t nfs_access_op(struct fsal_obj_handle *obj,
 			*granted_access |= ACCESS3_READ;
 
 		if (obj->type == DIRECTORY) {
-			if (access_allowed & FSAL_ACE_PERM_DELETE_CHILD)
+			if ((access_allowed & FSAL_ACE_PERM_DELETE_CHILD) &&
+			    client_rw)
 				*granted_access |=
 				    ACCESS3_MODIFY | ACCESS3_DELETE;
 
-			if (access_allowed & FSAL_ACE_PERM_ADD_FILE)
+			if ((access_allowed & FSAL_ACE_PERM_ADD_FILE) &&
+			    client_rw)
 				*granted_access |= ACCESS3_EXTEND;
 
-			if (access_allowed & FSAL_ACE_PERM_ADD_SUBDIRECTORY)
+			if ((access_allowed & FSAL_ACE_PERM_ADD_SUBDIRECTORY) &&
+			    client_rw)
 				*granted_access |= ACCESS3_EXTEND;
 		} else {
-			if (access_allowed & FSAL_ACE_PERM_WRITE_DATA)
+			if ((access_allowed & FSAL_ACE_PERM_WRITE_DATA) &&
+			    client_rw)
 				*granted_access |= ACCESS3_MODIFY;
 
-			if (access_allowed & FSAL_ACE_PERM_APPEND_DATA)
+			if ((access_allowed & FSAL_ACE_PERM_APPEND_DATA) &&
+			    client_rw)
 				*granted_access |= ACCESS3_EXTEND;
 		}