diff --git a/app/server/appsmith-server/src/main/java/com/appsmith/server/repositories/ce/BaseAppsmithRepositoryCEImpl.java b/app/server/appsmith-server/src/main/java/com/appsmith/server/repositories/ce/BaseAppsmithRepositoryCEImpl.java
index 7d131e95b48..8a297df4bf0 100644
--- a/app/server/appsmith-server/src/main/java/com/appsmith/server/repositories/ce/BaseAppsmithRepositoryCEImpl.java
+++ b/app/server/appsmith-server/src/main/java/com/appsmith/server/repositories/ce/BaseAppsmithRepositoryCEImpl.java
@@ -416,7 +416,8 @@ public Mono<T> setUserPermissionsInObject(T obj, Set<String> permissionGroups) {
         Set<String> permissions = new HashSet<>();
         obj.setUserPermissions(permissions);
 
-        Set<Policy> policies = new HashSet<>(obj.getPolicies());
+        Set<Policy> existingPolicies = obj.getPolicies();
+        final Set<Policy> policies = new HashSet<>(existingPolicies == null ? Set.of() : existingPolicies);
         if (CollectionUtils.isEmpty(policies) || permissionGroups.isEmpty()) {
             return Mono.just(obj);
         }
diff --git a/app/server/appsmith-server/src/main/java/com/appsmith/server/solutions/ce/PolicySolutionCEImpl.java b/app/server/appsmith-server/src/main/java/com/appsmith/server/solutions/ce/PolicySolutionCEImpl.java
index 031b938313e..8617fbf739d 100644
--- a/app/server/appsmith-server/src/main/java/com/appsmith/server/solutions/ce/PolicySolutionCEImpl.java
+++ b/app/server/appsmith-server/src/main/java/com/appsmith/server/solutions/ce/PolicySolutionCEImpl.java
@@ -69,7 +69,8 @@ public <T extends BaseDomain> T addPoliciesToExistingObject(@NonNull Map<String,
             policyMap1.put(entry.getKey(), policy);
         }
 
-        final Set<Policy> policies = new HashSet<>(obj.getPolicies());
+        Set<Policy> existingPolicies = obj.getPolicies();
+        final Set<Policy> policies = new HashSet<>(existingPolicies == null ? Set.of() : existingPolicies);
 
         // Append the user to the existing permission policy if it already exists.
         for (Policy policy : policies) {
@@ -102,7 +103,8 @@ public <T extends BaseDomain> T removePoliciesFromExistingObject(Map<String, Pol
             policyMap1.put(entry.getKey(), entry.getValue());
         }
 
-        Set<Policy> policies = new HashSet<>(obj.getPolicies());
+        Set<Policy> existingPolicies = obj.getPolicies();
+        final Set<Policy> policies = new HashSet<>(existingPolicies == null ? Set.of() : existingPolicies);
         // Remove the user from the existing permission policy if it exists.
         for (Policy policy : policies) {
             String permission = policy.getPermission();
diff --git a/app/server/appsmith-server/src/test/java/com/appsmith/server/repositories/ce/BaseAppsmithRepositoryImplTest.java b/app/server/appsmith-server/src/test/java/com/appsmith/server/repositories/ce/BaseAppsmithRepositoryImplTest.java
new file mode 100644
index 00000000000..4678384ff29
--- /dev/null
+++ b/app/server/appsmith-server/src/test/java/com/appsmith/server/repositories/ce/BaseAppsmithRepositoryImplTest.java
@@ -0,0 +1,52 @@
+package com.appsmith.server.repositories.ce;
+
+import com.appsmith.external.models.BaseDomain;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.util.HashSet;
+import java.util.Set;
+import java.util.UUID;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+class BaseAppsmithRepositoryImplTest {
+
+    BaseAppsmithRepositoryCEImpl<TestClass> baseAppsmithRepositoryImpl;
+
+    @BeforeEach
+    public void setup() {
+        baseAppsmithRepositoryImpl = new BaseAppsmithRepositoryCEImpl<>() {};
+    }
+
+    class TestClass extends BaseDomain {}
+
+    @Test
+    void testSetUserPermissionsInObject_whenPoliciesIsEmptySet_emptyCollectionValueIsSet() {
+        // Test the method setPoliciesInObject when the policies are null
+        // The method should set an empty collection value in the object
+        // The method should return the object
+        TestClass obj = baseAppsmithRepositoryImpl
+                .setUserPermissionsInObject(new TestClass(), null)
+                .block();
+        assertNotNull(obj);
+        Assertions.assertEquals(0, obj.getPolicies().size());
+    }
+
+    @Test
+    void testSetUserPermissionsInObject_whenPoliciesIsNull_nullPoliciesAreSet() {
+        // Test the method setPoliciesInObject when the policies are empty
+        // The method should set an empty collection value in the object
+        // The method should return the object
+        TestClass obj = new TestClass();
+        obj.setPolicies(null);
+        Set<String> permissionGroups = new HashSet<>();
+        permissionGroups.add(UUID.randomUUID().toString());
+        obj = baseAppsmithRepositoryImpl
+                .setUserPermissionsInObject(obj, permissionGroups)
+                .block();
+        assertNotNull(obj);
+        Assertions.assertNull(obj.getPolicies());
+    }
+}
diff --git a/app/server/appsmith-server/src/test/java/com/appsmith/server/solutions/ce/PolicySolutionCEImplTest.java b/app/server/appsmith-server/src/test/java/com/appsmith/server/solutions/ce/PolicySolutionCEImplTest.java
index 8adbefd23b6..fde23ba9fad 100644
--- a/app/server/appsmith-server/src/test/java/com/appsmith/server/solutions/ce/PolicySolutionCEImplTest.java
+++ b/app/server/appsmith-server/src/test/java/com/appsmith/server/solutions/ce/PolicySolutionCEImplTest.java
@@ -32,6 +32,18 @@ private static class TestClass extends BaseDomain {
         TestClass() {}
     }
 
+    @Test
+    void testAddNewPoliciesToNullPoliciesObject() {
+        TestClass obj = new TestClass();
+        obj.setPolicies(null);
+        Map<String, Policy> policyMap = new HashMap<>();
+        policyMap.put("read", new Policy("read", new HashSet<>(Set.of("group1"))));
+
+        BaseDomain result = policySolution.addPoliciesToExistingObject(policyMap, obj);
+
+        assertTrue(result.getPolicies().containsAll(policyMap.values()));
+    }
+
     @Test
     void testAddNewPoliciesToEmptyObject() {
         BaseDomain obj = new TestClass(); // Assuming BaseDomain has a default empty set of policies.