diff --git a/addons/mail/security/ir.model.access.csv b/addons/mail/security/ir.model.access.csv
index 5158c30bae2..cc467cc9b15 100644
--- a/addons/mail/security/ir.model.access.csv
+++ b/addons/mail/security/ir.model.access.csv
@@ -13,7 +13,8 @@ access_mail_notification_portal,mail.notification.portal,model_mail_notification
 access_mail_notification_user,mail.notification.user,model_mail_notification,base.group_user,1,1,1,0
 access_mail_notification_system, mail.notification.system,model_mail_notification,base.group_system,1,1,1,1
 access_mail_channel_all,mail.group.all,model_mail_channel,,1,0,0,0
-access_mail_channel_user,mail.group.user,model_mail_channel,base.group_user,1,1,1,1
+access_mail_channel_user,mail.group.user,model_mail_channel,base.group_user,1,1,1,0
+access_mail_channel_admin,mail.group.system,model_mail_channel,base.group_system,1,1,1,1
 access_mail_channel_partner_public,mail.channel.partner.public,model_mail_channel_partner,base.group_public,1,0,0,0
 access_mail_channel_partner_portal,mail.channel.partner.portal,model_mail_channel_partner,base.group_portal,1,1,1,1
 access_mail_channel_partner_user,mail.channel.partner.user,model_mail_channel_partner,base.group_user,1,1,1,1
diff --git a/addons/mail/security/mail_security.xml b/addons/mail/security/mail_security.xml
index 1c5fd4a30eb..cc6fca4671a 100644
--- a/addons/mail/security/mail_security.xml
+++ b/addons/mail/security/mail_security.xml
@@ -13,6 +13,13 @@
             <field name="perm_create" eval="False"/>
         </record>
 
+        <record id="mail_channel_admin" model="ir.rule">
+            <field name="name">Mail.channel: admin full access</field>
+            <field name="model_id" ref="model_mail_channel"/>
+            <field name="groups" eval="[Command.link(ref('base.group_system'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+        </record>
+
         <record id="ir_rule_mail_channel_partner_group_user" model="ir.rule">
             <field name="name">mail.channel.partner: write its own entries</field>
             <field name="model_id" ref="model_mail_channel_partner"/>
@@ -27,6 +34,13 @@
             <field name="perm_unlink" eval="True"/>
         </record>
 
+        <record id="ir_rule_mail_channel_partner_group_system" model="ir.rule">
+            <field name="name">mail.channel.partner: admin can manipulate all entries</field>
+            <field name="model_id" ref="model_mail_channel_partner"/>
+            <field name="groups" eval="[Command.link(ref('base.group_system'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+        </record>
+
         <record id="ir_rule_mail_notifications_group_user" model="ir.rule">
             <field name="name">mail.notifications: group_user: write its own entries</field>
             <field name="model_id" ref="model_mail_notification"/>
diff --git a/addons/mail/tests/test_mail_channel.py b/addons/mail/tests/test_mail_channel.py
index c5c404b1848..a7f49bdd67e 100644
--- a/addons/mail/tests/test_mail_channel.py
+++ b/addons/mail/tests/test_mail_channel.py
@@ -85,8 +85,9 @@ class TestChannelAccessRights(MailCommon):
         # Employee update employee-based group: ok
         group_groups.write({'name': 'modified'})
 
-        # Employee unlink employee-based group: ok
-        group_groups.unlink()
+        # Employee unlink employee-based group: ko
+        with self.assertRaises(AccessError):
+            group_groups.unlink()
 
         # Employee cannot read a private group
         with self.assertRaises(AccessError):
diff --git a/addons/test_discuss_full/tests/test_performance.py b/addons/test_discuss_full/tests/test_performance.py
index f430c8e5892..95ef678e4cd 100644
--- a/addons/test_discuss_full/tests/test_performance.py
+++ b/addons/test_discuss_full/tests/test_performance.py
@@ -60,7 +60,7 @@ class TestDiscussFullPerformance(TransactionCase):
     def test_init_messaging(self):
         """Test performance of `_init_messaging`."""
         channel_general = self.env.ref('mail.channel_all_employees')  # Unfortunately #general cannot be deleted. Assertions below assume data from a fresh db with demo.
-        self.env['mail.channel'].search([('id', '!=', channel_general.id)]).unlink()
+        self.env['mail.channel'].sudo().search([('id', '!=', channel_general.id)]).unlink()
         user_root = self.env.ref('base.user_root')
         # create public channels
         channel_channel_public_1 = self.env['mail.channel'].browse(self.env['mail.channel'].channel_create(name='public 1', privacy='public')['id'])
diff --git a/addons/test_mail/tests/test_mail_thread_internals.py b/addons/test_mail/tests/test_mail_thread_internals.py
index a86f2b30bb4..5d351c3a2ec 100644
--- a/addons/test_mail/tests/test_mail_thread_internals.py
+++ b/addons/test_mail/tests/test_mail_thread_internals.py
@@ -273,7 +273,7 @@ class TestDiscuss(TestMailCommon, TestRecipients):
         channel_message = self.env['mail.message'].sudo().search([('model', '=', 'mail.channel'), ('res_id', 'in', channel.ids)])
         self.assertEqual(len(channel_message), 1, "Test message should have been posted")
 
-        channel.unlink()
+        channel.sudo().unlink()
         remaining_message = channel_message.exists()
         self.assertEqual(len(remaining_message), 0, "Test message should have been deleted")