diff --git a/ui/src/components/COMPONENT_README.md b/ui/src/components/COMPONENT_README.md
index fbd7c3a3f77..7f6135a6c9a 100644
--- a/ui/src/components/COMPONENT_README.md
+++ b/ui/src/components/COMPONENT_README.md
@@ -357,12 +357,12 @@ Dialog、Drawer、Popover、嵌套区域等其他大、小表格均禁止开启
 
 手动导入 `@/components/mk-edit-avatar/index.vue`，不参与全局注册。字符串 `v-model` 为当前
 自定义头像 URL，空字符串表示使用默认图标；不再接收 `defaultIcon`。
-`size` 默认为 `32`（px），控制触发区传给插槽的尺寸；弹层预览和上传区域固定为 80px。
+`size` 默认为 `32`（px），只设置 `referenceRef` 触发容器的宽高；弹层预览和上传区域固定为 80px。
 `editable` 默认为 `true`，设为 `false` 时仅展示头像。
 
-必填默认插槽同时渲染触发区和默认 Logo 预览，透出 `{ icon, size }`。触发区传入当前头像
-（空值转为 `undefined`）和 `props.size`；默认预览始终传入 `icon: undefined`、固定的 `size: 80`，不读取组件的
-`props.size`。插槽参数由调用方按需使用，不会自动覆盖插槽内组件的尺寸。
+必填默认插槽同时渲染触发区和默认 Logo 预览，只透出 `{ icon }`。触发区传入当前头像
+（空值转为 `undefined`）；默认预览始终传入 `icon: undefined`。两处容器通过样式让插槽的
+直接子元素填满各自宽高，不向插槽传递 `size`，也不修改插槽组件的 Props。
 调用方必须使用插槽的 `icon`，由 `PortalIcon`、`ToolIcon` 等资源组件自行展示默认图标，
 不要在插槽内直接绑定外部头像值。
 触发区由 `MkEditAvatar` 的 `span` 容器承载，统一处理悬停，插槽内只放展示内容。
@@ -384,8 +384,8 @@ const avatar = ref('')
 
 <template>
   <MkEditAvatar v-model="avatar">
-    <template #default="{ icon, size: previewSize }">
-      <PortalIcon :icon="icon" :size="previewSize" />
+    <template #default="{ icon }">
+      <PortalIcon :icon="icon" />
     </template>
   </MkEditAvatar>
 </template>
diff --git a/ui/src/components/mk-edit-avatar/index.vue b/ui/src/components/mk-edit-avatar/index.vue
index 5c6c86805e7..4b099664871 100644
--- a/ui/src/components/mk-edit-avatar/index.vue
+++ b/ui/src/components/mk-edit-avatar/index.vue
@@ -11,7 +11,7 @@ const props = withDefaults(defineProps<{ editable?: boolean; size?: number }>(),
 })
 const avatar = defineModel<string>({ default: '' })
 const emit = defineEmits<{ change: [icon: string, file: File | null] }>()
-defineSlots<{ default(props: { icon: string | undefined; size: number }): unknown }>()
+defineSlots<{ default(props: { icon: string | undefined }): unknown }>()
 
 // 头像编辑草稿：确认前不修改外部值。
 const visible = ref(false)
@@ -101,8 +101,14 @@ onBeforeUnmount(() => fileReader?.abort())
   <el-popover :visible="visible" :width="414" placement="bottom-start" @after-leave="clearDraft">
     <template #reference>
       <!-- 悬停修改头像 -->
-      <span ref="referenceRef" class="inline-flex" :class="{ 'cursor-pointer': props.editable }" @mouseenter="open">
-        <slot :icon="avatar || undefined" :size="props.size" />
+      <span
+        ref="referenceRef"
+        class="inline-flex shrink-0 [&>*]:h-full! [&>*]:w-full!"
+        :class="{ 'cursor-pointer': props.editable }"
+        :style="{ width: `${props.size}px`, height: `${props.size}px` }"
+        @mouseenter="open"
+      >
+        <slot :icon="avatar || undefined" />
       </span>
     </template>
 
@@ -112,8 +118,8 @@ onBeforeUnmount(() => fileReader?.abort())
         <el-radio value="default">默认 Logo</el-radio>
         <el-radio value="custom">自定义上传</el-radio>
       </el-radio-group>
-      <div v-if="logoMode === 'default'">
-        <slot :icon="undefined" :size="80" />
+      <div v-if="logoMode === 'default'" class="h-20 w-20 [&>*]:h-full! [&>*]:w-full!">
+        <slot :icon="undefined" />
       </div>
 
       <div v-else>
@@ -128,7 +134,7 @@ onBeforeUnmount(() => fileReader?.abort())
           :on-change="selectImage"
         >
           <el-avatar v-if="draftIcon" :size="80" shape="square">
-            <img :src="draftIcon" alt="自定义头像预览" class="object-cover" />
+            <img :src="draftIcon" class="object-cover" />
           </el-avatar>
 
           <div v-else class="flex-center h-20 w-20 rounded-md border border-dashed bg-N200 hover:border-primary">
diff --git a/ui/src/views/VIEW_README.md b/ui/src/views/VIEW_README.md
index 7007c1eb400..0c4669e9c99 100644
--- a/ui/src/views/VIEW_README.md
+++ b/ui/src/views/VIEW_README.md
@@ -419,7 +419,9 @@ Dialog。新增或重命名文件时，应同步更新所有导入和页面功
 ## 备注要求
 
 门户设置的 `components/ButtonEditPortal.vue`、`ButtonPortalAuthSetting.vue` 和
-`ButtonPortalCorsSetting.vue` 分别封装对应按钮、浮层及表单状态。认证组件使用 `MkDrawer`，
+`ButtonPortalCorsSetting.vue` 分别封装对应按钮、浮层及表单状态，通过 `disabled` 接收页面统一的
+编辑限制。页面使用 `perm.system.portal.edit()` 判断门户编辑权限，无权限时禁用配置、复制按钮、
+访问开关及浮层表单和按钮，保存入口同步校验权限。认证组件使用 `MkDrawer`，
 打开时与系统 `LoginSetting` 共用 `AuthSettingApi.getLoginSetting()`，通过返回的 `login_methods`
 生成登录方式选项，复用登录方式标签，初始保留账号登录。提供默认登录方式及验证码与账号锁定设置；默认方式
 仅可选已勾选项，取消勾选当前默认项时回退到首个可选项。认证组件暴露 `open()` 供首次开启认证
diff --git a/ui/src/views/system/chat-management/portal-setting/PortalSettingView.vue b/ui/src/views/system/chat-management/portal-setting/PortalSettingView.vue
index 2db449aa1a2..791241acae9 100644
--- a/ui/src/views/system/chat-management/portal-setting/PortalSettingView.vue
+++ b/ui/src/views/system/chat-management/portal-setting/PortalSettingView.vue
@@ -6,6 +6,7 @@ import LogoIcon from '@/components/mk-logo/LogoIcon.vue'
 import { copyText } from '@/utils/clipboard'
 import { resetUrl } from '@/utils/icon'
 import { MsgSuccess } from '@/utils/message'
+import { perm } from '@/permission'
 import PortalPreview from './components/PortalPreview.vue'
 import ButtonEditPortal from './components/ButtonEditPortal.vue'
 import ButtonPortalAuthSetting from './components/ButtonPortalAuthSetting.vue'
@@ -49,6 +50,8 @@ function loadPortalSetting() {
 
 /* 保存门户配置：接口返回完整配置，成功后整体回填作为页面唯一数据来源 */
 function savePortalSetting(payload: PortalSettingPayload | FormData): Promise<void> {
+  if (!canEditPortal.value || saving.value) return Promise.resolve()
+
   saving.value = true
   return PortalApi.putPortalSetting(payload)
     .then((setting) => {
@@ -61,7 +64,7 @@ function savePortalSetting(payload: PortalSettingPayload | FormData): Promise<vo
 }
 
 function handleAccessChange(field: AccessField, value: string | number | boolean) {
-  if (saving.value) return
+  if (!canEditPortal.value || saving.value) return
   if (field === 'enable_auth' && value && !portalSetting.auth_config.login_value?.length) {
     handleOpenAuthSetting(true)
     return
@@ -81,6 +84,8 @@ function savePortalCorsSetting(origins: string[]) {
 }
 
 function handleOpenAuthSetting(enableAfterSave = false) {
+  if (!canEditPortal.value || saving.value) return
+
   authSettingButtonRef.value?.open(enableAfterSave)
 }
 
@@ -97,6 +102,9 @@ const previewName = computed(() => portalSetting.name)
 const previewLogo = computed(() => resetUrl(portalSetting.logo))
 
 onMounted(() => loadPortalSetting())
+
+// 权限 控制
+const canEditPortal = computed(() => perm.system.portal.edit())
 </script>
 
 <template>
@@ -111,7 +119,7 @@ onMounted(() => loadPortalSetting())
               <h4 class="truncate" :title="previewName">{{ previewName }}</h4>
             </div>
             <!-- 编辑门户名称与 Logo -->
-            <ButtonEditPortal :setting="portalSetting" :save="savePortalSetting" />
+            <ButtonEditPortal :setting="portalSetting" :saving="saving" :disabled="!canEditPortal" :save="savePortalSetting" />
           </div>
         </el-card>
         <el-card shadow="never">
@@ -122,15 +130,16 @@ onMounted(() => loadPortalSetting())
               <div class="flex-between mb-2 gap-2">
                 <span>门户公开访问链接</span>
                 <el-switch
+                  :disabled="!canEditPortal || saving"
                   :model-value="portalSetting.enable_public_access"
                   size="small"
                   @change="handleAccessChange('enable_public_access', $event)"
                 />
               </div>
-              <el-input :model-value="portalAccessUrl">
+              <el-input :model-value="portalAccessUrl" readonly>
                 <template #suffix>
                   <!-- 复制门户公开访问链接 -->
-                  <el-button text @click="copyText(portalAccessUrl)" class="-mr-1">
+                  <el-button text :disabled="!canEditPortal" @click="copyText(portalAccessUrl)" class="-mr-1">
                     <MkIcon name="icon_copy_outlined" class="text-N600" />
                   </el-button>
                 </template>
@@ -140,12 +149,17 @@ onMounted(() => loadPortalSetting())
             <div>
               <div class="flex-between mb-2 gap-2">
                 <span>智能体后端 API 访问</span>
-                <el-switch :model-value="portalSetting.enable_api" size="small" @change="handleAccessChange('enable_api', $event)" />
+                <el-switch
+                  :disabled="!canEditPortal || saving"
+                  :model-value="portalSetting.enable_api"
+                  size="small"
+                  @change="handleAccessChange('enable_api', $event)"
+                />
               </div>
-              <el-input :model-value="portalApiUrl">
+              <el-input :model-value="portalApiUrl" readonly>
                 <template #suffix>
                   <!-- 复制智能体后端 API 访问 -->
-                  <el-button text @click="copyText(portalApiUrl)" class="-mr-1">
+                  <el-button text :disabled="!canEditPortal" @click="copyText(portalApiUrl)" class="-mr-1">
                     <MkIcon name="icon_copy_outlined" class="text-N600" />
                   </el-button>
                 </template>
@@ -156,15 +170,16 @@ onMounted(() => loadPortalSetting())
               <div class="flex-between mb-2 gap-2">
                 <span>知识库后端 API 检索</span>
                 <el-switch
+                  :disabled="!canEditPortal || saving"
                   :model-value="portalSetting.enable_knowledge_base_api"
                   size="small"
                   @change="handleAccessChange('enable_knowledge_base_api', $event)"
                 />
               </div>
-              <el-input :model-value="portalApiUrl">
+              <el-input :model-value="portalApiUrl" readonly>
                 <template #suffix>
                   <!-- 复制知识库后端 API 检索 -->
-                  <el-button text @click="copyText(portalApiUrl)" class="-mr-1">
+                  <el-button text :disabled="!canEditPortal" @click="copyText(portalApiUrl)" class="-mr-1">
                     <MkIcon name="icon_copy_outlined" class="text-N600" />
                   </el-button>
                 </template>
@@ -174,16 +189,32 @@ onMounted(() => loadPortalSetting())
               <span>身份认证</span>
               <div class="flex-align-center gap-2">
                 <!-- 配置身份认证 -->
-                <ButtonPortalAuthSetting ref="authSettingButtonRef" :setting="portalSetting" :saving="saving" :save="savePortalAuthSetting" />
-                <el-switch :model-value="portalSetting.enable_auth" size="small" @change="handleAccessChange('enable_auth', $event)" />
+                <ButtonPortalAuthSetting
+                  ref="authSettingButtonRef"
+                  :setting="portalSetting"
+                  :saving="saving"
+                  :disabled="!canEditPortal"
+                  :save="savePortalAuthSetting"
+                />
+                <el-switch
+                  :disabled="!canEditPortal || saving"
+                  :model-value="portalSetting.enable_auth"
+                  size="small"
+                  @change="handleAccessChange('enable_auth', $event)"
+                />
               </div>
             </div>
             <div class="flex-between gap-2">
               <span>跨域设置</span>
               <div class="flex-align-center gap-2">
                 <!-- 配置跨域地址 -->
-                <ButtonPortalCorsSetting v-model="portalCorsOrigins" :saving="saving" :save="savePortalCorsSetting" />
-                <el-switch :model-value="portalSetting.enable_cors" size="small" @change="handleAccessChange('enable_cors', $event)" />
+                <ButtonPortalCorsSetting v-model="portalCorsOrigins" :saving="saving" :disabled="!canEditPortal" :save="savePortalCorsSetting" />
+                <el-switch
+                  :disabled="!canEditPortal || saving"
+                  :model-value="portalSetting.enable_cors"
+                  size="small"
+                  @change="handleAccessChange('enable_cors', $event)"
+                />
               </div>
             </div>
           </div>
diff --git a/ui/src/views/system/chat-management/portal-setting/components/ButtonEditPortal.vue b/ui/src/views/system/chat-management/portal-setting/components/ButtonEditPortal.vue
index f7a4db218c5..aed22807cc6 100644
--- a/ui/src/views/system/chat-management/portal-setting/components/ButtonEditPortal.vue
+++ b/ui/src/views/system/chat-management/portal-setting/components/ButtonEditPortal.vue
@@ -4,7 +4,7 @@ import type { FormInstance, FormRules } from 'element-plus'
 import type { PortalSetting } from '@/api/types'
 import MkEditAvatar from '@/components/mk-edit-avatar/index.vue'
 
-const props = defineProps<{ setting: PortalSetting; save: (payload: FormData) => Promise<void> }>()
+const props = defineProps<{ disabled: boolean; setting: PortalSetting; saving: boolean; save: (payload: FormData) => Promise<void> }>()
 
 /* 门户名称与 Logo */
 const editVisible = ref(false)
@@ -17,6 +17,8 @@ const portalRules: FormRules = {
 }
 
 function handleOpenPortalEdit() {
+  if (props.disabled || props.saving) return
+
   handleClosePortalEdit()
   portalForm.name = props.setting.name
   portalForm.logo = props.setting.logo || ''
@@ -31,8 +33,9 @@ function handleLogoChange(icon: string, file: File | null) {
 }
 
 function handleSavePortalInfo() {
+  if (props.disabled || props.saving) return
   portalFormRef.value?.validate((valid) => {
-    if (!valid) return
+    if (!valid || props.disabled || props.saving) return
     const payload = new FormData()
     payload.append('name', portalForm.name.trim())
     if (logoChanged.value) payload.append('logo', logoFile.value || '')
@@ -53,14 +56,22 @@ function handleClosePortalEdit() {
 
 <template>
   <!-- 编辑门户名称与 Logo -->
-  <el-button text @click="handleOpenPortalEdit">
+  <el-button text :disabled="disabled || saving" @click="handleOpenPortalEdit">
     <MkIcon name="icon_edit_outlined" />
   </el-button>
   <MkDialog v-model="editVisible" title="编辑" @closed="handleClosePortalEdit">
-    <el-form ref="portalFormRef" :model="portalForm" :rules="portalRules" label-position="top" require-asterisk-position="right" @submit.prevent>
+    <el-form
+      v-loading="saving"
+      ref="portalFormRef"
+      :model="portalForm"
+      :rules="portalRules"
+      label-position="top"
+      require-asterisk-position="right"
+      @submit.prevent
+    >
       <el-form-item label="名称" prop="name">
         <div class="flex-align-center w-full gap-3">
-          <MkEditAvatar v-model="portalForm.logo" @change="handleLogoChange" :size="32">
+          <MkEditAvatar :editable="!saving" v-model="portalForm.logo" @change="handleLogoChange" :size="32">
             <template #default="{ icon }">
               <PortalIcon :icon="icon" />
             </template>
@@ -71,9 +82,9 @@ function handleClosePortalEdit() {
     </el-form>
     <template #footer>
       <!-- 取消编辑 -->
-      <el-button plain @click="editVisible = false">取消</el-button>
+      <el-button plain :disabled="saving" @click="editVisible = false">取消</el-button>
       <!-- 保存门户信息 -->
-      <el-button type="primary" @click="handleSavePortalInfo">保存</el-button>
+      <el-button type="primary" :loading="saving" @click="handleSavePortalInfo">保存</el-button>
     </template>
   </MkDialog>
 </template>
diff --git a/ui/src/views/system/chat-management/portal-setting/components/ButtonPortalAuthSetting.vue b/ui/src/views/system/chat-management/portal-setting/components/ButtonPortalAuthSetting.vue
index 4da5dce39d7..0271bf7b424 100644
--- a/ui/src/views/system/chat-management/portal-setting/components/ButtonPortalAuthSetting.vue
+++ b/ui/src/views/system/chat-management/portal-setting/components/ButtonPortalAuthSetting.vue
@@ -6,7 +6,7 @@ import AuthSettingApi from '@/api/admin/system/settings/auth-setting'
 import type { LoginMethod, PortalSetting, PortalSettingPayload } from '@/api/types'
 import { LOGIN_METHOD_LABELS } from '@/constants/auth'
 
-const props = defineProps<{ setting: PortalSetting; saving: boolean; save: (payload: PortalSettingPayload) => Promise<void> }>()
+const props = defineProps<{ disabled: boolean; setting: PortalSetting; saving: boolean; save: (payload: PortalSettingPayload) => Promise<void> }>()
 
 /* 登录方式与默认登录方式 */
 const loginMethodOptions = ref<string[]>([LOGIN_METHOD.LOCAL])
@@ -37,6 +37,8 @@ const authRules: FormRules<typeof authForm> = {
 
 /* 抽屉回填与重置，草稿不直接修改门户配置 */
 function open(enableAfterSave = false) {
+  if (props.disabled || props.saving) return
+
   enableAuthAfterSave.value = enableAfterSave
   const config = props.setting.auth_config
   Object.assign(authForm, {
@@ -66,8 +68,10 @@ function handleClosed() {
 
 /* 保存认证配置，仅提交后端读取的字段并保留其余配置 */
 function handleSaveAuthSetting() {
+  if (props.disabled || props.saving || loginMethodsLoading.value) return
+
   authFormRef.value?.validate((valid) => {
-    if (!valid || props.saving || loginMethodsLoading.value) return
+    if (!valid || props.disabled || props.saving || loginMethodsLoading.value) return
     return props
       .save({
         ...(enableAuthAfterSave.value ? { enable_auth: true } : {}),
@@ -90,12 +94,12 @@ defineExpose({ open })
 
 <template>
   <!-- 配置身份认证 -->
-  <el-button text type="primary" title="身份认证设置" :disabled="saving" @click="handleOpenAuthSetting">
+  <el-button text type="primary" title="身份认证设置" :disabled="disabled || saving" @click="handleOpenAuthSetting">
     <MkIcon name="icon_setting" />
   </el-button>
   <MkDrawer v-model="authVisible" title="身份认证设置" @closed="handleClosed">
     <el-form
-      v-loading="loginMethodsLoading"
+      v-loading="loginMethodsLoading || saving"
       ref="authFormRef"
       :model="authForm"
       :rules="authRules"
diff --git a/ui/src/views/system/chat-management/portal-setting/components/ButtonPortalCorsSetting.vue b/ui/src/views/system/chat-management/portal-setting/components/ButtonPortalCorsSetting.vue
index 2e56facccc6..37b0553bd57 100644
--- a/ui/src/views/system/chat-management/portal-setting/components/ButtonPortalCorsSetting.vue
+++ b/ui/src/views/system/chat-management/portal-setting/components/ButtonPortalCorsSetting.vue
@@ -1,7 +1,7 @@
 <script setup lang="ts">
 import { ref } from 'vue'
 
-const props = defineProps<{ saving?: boolean; save: (origins: string[]) => Promise<void> }>()
+const props = defineProps<{ disabled: boolean; saving?: boolean; save: (origins: string[]) => Promise<void> }>()
 const allowedOrigins = defineModel<string[]>({ default: () => [] })
 
 /* 跨域地址草稿，取消不修改已保存配置。 */
@@ -11,6 +11,8 @@ const corsAddressPlaceholder =
   '请输入允许的跨域地址，开启后不输入跨域地址则不限制。\n跨域地址一行一个，如：\nhttp://127.0.0.1:5678\nhttps://dataease.io'
 
 function handleOpenCorsSetting() {
+  if (props.disabled || props.saving) return
+
   corsAddressDraft.value = allowedOrigins.value.join('\n')
   corsVisible.value = true
 }
@@ -25,7 +27,7 @@ function parseCorsOrigins(value: string) {
 }
 
 function handleSaveCorsSetting() {
-  if (props.saving) return
+  if (props.disabled || props.saving) return
   return props.save(parseCorsOrigins(corsAddressDraft.value)).then(() => {
     corsVisible.value = false
   })
@@ -38,7 +40,7 @@ function handleClosed() {
 
 <template>
   <!-- 配置跨域地址 -->
-  <el-button text type="primary" title="跨域设置" @click="handleOpenCorsSetting">
+  <el-button text type="primary" title="跨域设置" :disabled="disabled || saving" @click="handleOpenCorsSetting">
     <MkIcon name="icon_setting" />
   </el-button>
   <MkDialog v-model="corsVisible" title="跨域设置" @closed="handleClosed">
diff --git a/ui/src/views/system/chat-management/portal-setting/components/PortalPreview.vue b/ui/src/views/system/chat-management/portal-setting/components/PortalPreview.vue
index e55c46de7de..f468da1870d 100644
--- a/ui/src/views/system/chat-management/portal-setting/components/PortalPreview.vue
+++ b/ui/src/views/system/chat-management/portal-setting/components/PortalPreview.vue
@@ -25,7 +25,7 @@ defineProps<{ name: string; logo: string | null }>()
         <el-avatar :size="32" class="shrink-0 bg-primary-gradient!">
           <img src="@/assets/mk_icon_user_gradient.svg" alt="" style="width: 54%" />
         </el-avatar>
-        <span>用户名</span>
+        <span>姓名</span>
       </div>
     </div>
     <div class="min-w-0 flex-1 p-6">
diff --git a/ui/src/views/system/identity/resource-authorization/ResourceAuthorizationView.vue b/ui/src/views/system/identity/resource-authorization/ResourceAuthorizationView.vue
index 69700fc26f9..a7a8eee1f16 100644
--- a/ui/src/views/system/identity/resource-authorization/ResourceAuthorizationView.vue
+++ b/ui/src/views/system/identity/resource-authorization/ResourceAuthorizationView.vue
@@ -1,13 +1,22 @@
 <script setup lang="ts">
-import { onMounted, ref } from 'vue'
+import { computed, onMounted, ref } from 'vue'
 import { useRoute } from 'vue-router'
 import WorkspaceApi from '@/api/admin/system/workspace'
 import CommonSystemApi from '@/api/admin/system/common'
 import UserGroupsApi from '@/api/admin/system/user-groups'
 import ResourceAuthorizationApi from '@/api/admin/system/resource-authorization'
 import { RESOURCE_TYPE, RESOURCE_PERMISSION } from '@/api/enums'
-import type { ResourceAuthorizationType, ResourcePermissionItem, ResourcePermissionPayload, CommonUserOption, OptionItem, SystemUserGroup, WorkspaceItem } from '@/api/types'
+import type {
+  ResourceAuthorizationType,
+  ResourcePermissionItem,
+  ResourcePermissionPayload,
+  CommonUserOption,
+  OptionItem,
+  SystemUserGroup,
+  WorkspaceItem,
+} from '@/api/types'
 import { useStore } from '@/stores'
+import { perm } from '@/permission'
 import { MsgSuccess } from '@/utils/message'
 import WorkspaceDropdown from '@/components/business/workspace-dropdown/index.vue'
 import PermissionTable from './components/PermissionTable.vue'
@@ -19,7 +28,12 @@ const { auth } = useStore()
 const route = useRoute()
 
 const resourceType = ref<ResourceAuthorizationType>((route.meta.resource as ResourceAuthorizationType) ?? RESOURCE_TYPE.APPLICATION)
-const resourceTypeOptions: OptionItem<ResourceAuthorizationType>[] = [RESOURCE_TYPE.APPLICATION, RESOURCE_TYPE.KNOWLEDGE, RESOURCE_TYPE.TOOL, RESOURCE_TYPE.MODEL].map((value) => ({
+const resourceTypeOptions: OptionItem<ResourceAuthorizationType>[] = [
+  RESOURCE_TYPE.APPLICATION,
+  RESOURCE_TYPE.KNOWLEDGE,
+  RESOURCE_TYPE.TOOL,
+  RESOURCE_TYPE.MODEL,
+].map((value) => ({
   label: RESOURCE_AUTHORIZATION_LABELS[value],
   value,
 }))
@@ -51,7 +65,10 @@ const selectedUserGroupId = ref('')
 const selectedUserId = ref('')
 
 function loadAuthorizationTargets() {
-  return Promise.all([UserGroupsApi.getSystemUserGroups(selectedWorkspaceId.value), CommonSystemApi.getWorkspaceMembers(selectedWorkspaceId.value)]).then(([groups, users]) => {
+  return Promise.all([
+    UserGroupsApi.getSystemUserGroups(selectedWorkspaceId.value),
+    CommonSystemApi.getWorkspaceMembers(selectedWorkspaceId.value),
+  ]).then(([groups, users]) => {
     userGroups.value = groups
     workspaceMembers.value = users
     selectedUserGroupId.value = groups[0]?.id ?? ''
@@ -75,6 +92,7 @@ function handleUserSelect(user: CommonUserOption) {
 }
 
 /* 资源权限 */
+
 const loadingPermissions = ref(false)
 const resourcePermissions = ref<ResourcePermissionItem[]>([])
 
@@ -129,6 +147,8 @@ function buildResourceTree(resourceItems: ResourcePermissionItem[]) {
 /* 保存权限 */
 
 function handlePermissionsSubmit(permissions: ResourcePermissionPayload[]) {
+  if (!canEditResourcePermission.value || loadingPermissions.value) return
+
   const targetId = targetType.value === 'user-group' ? selectedUserGroupId.value : selectedUserId.value
 
   if (!targetId) return
@@ -155,6 +175,15 @@ onMounted(() => {
     loadingView.value = false
   })
 })
+
+// 权限
+const resourceEditPermissions: Record<ResourceAuthorizationType, () => boolean> = {
+  [RESOURCE_TYPE.APPLICATION]: perm.system.authorization.application.edit,
+  [RESOURCE_TYPE.KNOWLEDGE]: perm.system.authorization.knowledge.edit,
+  [RESOURCE_TYPE.TOOL]: perm.system.authorization.tool.edit,
+  [RESOURCE_TYPE.MODEL]: perm.system.authorization.model.edit,
+}
+const canEditResourcePermission = computed(() => resourceEditPermissions[resourceType.value]())
 </script>
 
 <template>
@@ -171,7 +200,12 @@ onMounted(() => {
         </el-tabs>
       </component>
 
-      <UserGroupAuthorizationList v-if="targetType === 'user-group'" :active-id="selectedUserGroupId" :user-groups="userGroups" @select="handleUserGroupSelect" />
+      <UserGroupAuthorizationList
+        v-if="targetType === 'user-group'"
+        :active-id="selectedUserGroupId"
+        :user-groups="userGroups"
+        @select="handleUserGroupSelect"
+      />
       <UserAuthorizationList v-else :active-id="selectedUserId" :users="workspaceMembers" @select="handleUserSelect" />
     </template>
 
@@ -180,12 +214,23 @@ onMounted(() => {
         <div class="w-full">
           <h4 class="mb-4">资源权限配置</h4>
           <el-tabs v-model="resourceType" class="w-full" @tab-change="loadResourcePermissions">
-            <el-tab-pane v-for="resourceTypeOption in resourceTypeOptions" :key="resourceTypeOption.value" :label="resourceTypeOption.label" :name="resourceTypeOption.value" />
+            <el-tab-pane
+              v-for="resourceTypeOption in resourceTypeOptions"
+              :key="resourceTypeOption.value"
+              :label="resourceTypeOption.label"
+              :name="resourceTypeOption.value"
+            />
           </el-tabs>
         </div>
       </component>
 
-      <PermissionTable v-loading="loadingPermissions" :data="resourcePermissions" :resource-type="resourceType" @submit="handlePermissionsSubmit" />
+      <PermissionTable
+        v-loading="loadingPermissions"
+        :data="resourcePermissions"
+        :resource-type="resourceType"
+        :disabled="!canEditResourcePermission || loadingPermissions"
+        @submit="handlePermissionsSubmit"
+      />
     </template>
   </MkViewLayout>
 </template>
diff --git a/ui/src/views/system/identity/resource-authorization/components/PermissionTable.vue b/ui/src/views/system/identity/resource-authorization/components/PermissionTable.vue
index 1bcf4cf70a1..f56a77f2422 100644
--- a/ui/src/views/system/identity/resource-authorization/components/PermissionTable.vue
+++ b/ui/src/views/system/identity/resource-authorization/components/PermissionTable.vue
@@ -16,7 +16,7 @@ import BatchSetPermissionDialog from '../dialog/BatchSetPermissionDialog.vue'
 
 defineOptions({ name: 'ResourcePermissionTable' })
 
-const props = defineProps<{ data: ResourcePermissionItem[]; resourceType: ResourceAuthorizationType }>()
+const props = defineProps<{ data: ResourcePermissionItem[]; resourceType: ResourceAuthorizationType; disabled: boolean }>()
 const emit = defineEmits<{ submit: [permissions: ResourcePermissionPayload[]] }>()
 
 const permissionSearchFields = computed<OptionItem<string>[]>(() => [
@@ -99,6 +99,8 @@ function buildPermissionPayload(permission: ResourcePermission, resource: Resour
 }
 
 function handlePermissionChange(permission: ResourcePermission, resource: ResourcePermissionItem) {
+  if (props.disabled) return
+
   emit('submit', [...buildPermissionPayload(permission, resource).values()])
 }
 
@@ -113,10 +115,14 @@ function handleSelectionChange(selection: unknown[]) {
 const batchPermissionDialogRef = useTemplateRef<InstanceType<typeof BatchSetPermissionDialog>>('batchPermissionDialogRef')
 
 function handleOpenBatchDialog() {
+  if (props.disabled || !batchSelectedResources.value.length) return
+
   batchPermissionDialogRef.value?.open()
 }
 
 function handleBatchSubmit(permission: ResourcePermission) {
+  if (props.disabled || !batchSelectedResources.value.length) return
+
   const payloadMap = new Map<string, ResourcePermissionPayload>()
   batchSelectedResources.value.forEach((resource) => {
     buildPermissionPayload(permission, resource).forEach((payload, id) => {
@@ -128,6 +134,15 @@ function handleBatchSubmit(permission: ResourcePermission) {
   batchSelectedResources.value = []
 }
 
+watch(
+  () => props.resourceType,
+  () => {
+    tableRef.value?.clearSelection()
+    batchSelectedResources.value = []
+    batchPermissionDialogRef.value?.close()
+  },
+)
+
 /* 模型供应商图标 */
 const modelProviders = ref<ModelProviderItem[]>([])
 function getModelProviderIcon(resource: ResourcePermissionItem) {
@@ -150,8 +165,8 @@ watch(
   <div class="flex-column min-h-0 flex-1">
     <div class="mb-4 flex-between">
       <div>
-        <!-- 配置权限 -->
-        <el-button type="primary" :disabled="batchSelectedResources.length === 0" @click="handleOpenBatchDialog">
+        <!-- 批量配置权限 -->
+        <el-button type="primary" :disabled="disabled || batchSelectedResources.length === 0" @click="handleOpenBatchDialog">
           <MkIcon name="icon-lock" />
           <span>配置权限</span>
         </el-button>
@@ -168,7 +183,7 @@ watch(
       show-overflow-tooltip
       @selection-change="handleSelectionChange"
     >
-      <el-table-column type="selection" width="40" reserve-selection />
+      <el-table-column type="selection" width="40" reserve-selection :selectable="() => !disabled" />
       <el-table-column class-name="resource-name-column" label="名称" min-width="260" prop="name">
         <template #default="{ row }: { row: ResourcePermissionItem }">
           <div class="flex-align-center min-w-0 flex-1 gap-2">
@@ -185,7 +200,7 @@ watch(
       </el-table-column>
       <el-table-column label="操作权限" width="450">
         <template #default="{ row }: { row: ResourcePermissionItem }">
-          <el-radio-group :model-value="row.permission" @change="handlePermissionChange($event as ResourcePermission, row)">
+          <el-radio-group :model-value="row.permission" :disabled="disabled" @change="handlePermissionChange($event as ResourcePermission, row)">
             <template v-for="permissionOption in getPermissionOptions()" :key="permissionOption.value">
               <el-radio :value="permissionOption.value">{{ permissionOption.label }}</el-radio>
             </template>
@@ -194,7 +209,7 @@ watch(
       </el-table-column>
     </MkTable>
 
-    <BatchSetPermissionDialog ref="batchPermissionDialogRef" @submit="handleBatchSubmit" />
+    <BatchSetPermissionDialog ref="batchPermissionDialogRef" :disabled="disabled" @submit="handleBatchSubmit" />
   </div>
 </template>
 
diff --git a/ui/src/views/system/identity/resource-authorization/dialog/BatchSetPermissionDialog.vue b/ui/src/views/system/identity/resource-authorization/dialog/BatchSetPermissionDialog.vue
index cd1b570344c..a4035add2e6 100644
--- a/ui/src/views/system/identity/resource-authorization/dialog/BatchSetPermissionDialog.vue
+++ b/ui/src/views/system/identity/resource-authorization/dialog/BatchSetPermissionDialog.vue
@@ -5,32 +5,39 @@ import { getPermissionOptions } from '../constants'
 
 defineOptions({ name: 'BatchSetPermissionDialog' })
 
+const props = defineProps<{ disabled: boolean }>()
 const emit = defineEmits<{ submit: [permission: ResourcePermission] }>()
 
 const visible = ref(false)
 const permission = ref<ResourcePermission>()
 
 function open() {
+  if (props.disabled) return
+
   visible.value = true
 }
 
+function close() {
+  visible.value = false
+}
+
 function resetData() {
   permission.value = undefined
 }
 
 function handleSubmit() {
-  if (!permission.value) return
+  if (props.disabled || !permission.value) return
 
   emit('submit', permission.value)
   visible.value = false
 }
 
-defineExpose({ open })
+defineExpose({ open, close })
 </script>
 
 <template>
   <MkDialog v-model="visible" title="配置权限" @closed="resetData">
-    <el-radio-group v-model="permission" class="vertical-radio-group">
+    <el-radio-group v-model="permission" class="vertical-radio-group" :disabled="disabled">
       <el-radio v-for="permissionOption in getPermissionOptions()" :key="permissionOption.value" :value="permissionOption.value">
         <p>{{ permissionOption.label }}</p>
         <p v-if="permissionOption.description" class="text-N500 mt-1">
@@ -39,8 +46,10 @@ defineExpose({ open })
       </el-radio>
     </el-radio-group>
     <template #footer>
+      <!-- 取消批量配置 -->
       <el-button plain @click="visible = false">取消</el-button>
-      <el-button type="primary" :disabled="!permission" @click="handleSubmit">确认</el-button>
+      <!-- 确认批量配置 -->
+      <el-button type="primary" :disabled="disabled || !permission" @click="handleSubmit">确认</el-button>
     </template>
   </MkDialog>
 </template>