diff --git a/apps/application/chat_pipeline/step/search_dataset_step/impl/base_search_dataset_step.py b/apps/application/chat_pipeline/step/search_dataset_step/impl/base_search_dataset_step.py
index e57eebd9f65..a1f429e6509 100644
--- a/apps/application/chat_pipeline/step/search_dataset_step/impl/base_search_dataset_step.py
+++ b/apps/application/chat_pipeline/step/search_dataset_step/impl/base_search_dataset_step.py
@@ -16,7 +16,7 @@
 from application.chat_pipeline.I_base_chat_pipeline import ParagraphPipelineModel
 from application.chat_pipeline.step.search_dataset_step.i_search_dataset_step import ISearchDatasetStep
 from common.config.embedding_config import VectorStore, ModelManage
-from common.constants.permission_constants import RoleConstants
+from common.auth.constants.role_constants import RoleConstants
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.db.search import native_search
 from common.utils.common import get_file_content
diff --git a/apps/application/flow/step_node/search_document_node/impl/base_search_document_node.py b/apps/application/flow/step_node/search_document_node/impl/base_search_document_node.py
index 1d85cff5331..d118baa9424 100644
--- a/apps/application/flow/step_node/search_document_node/impl/base_search_document_node.py
+++ b/apps/application/flow/step_node/search_document_node/impl/base_search_document_node.py
@@ -7,7 +7,7 @@
 
 from application.flow.i_step_node import NodeResult
 from application.flow.step_node.search_document_node.i_search_document_node import ISearchDocumentStepNode
-from common.constants.permission_constants import RoleConstants
+from common.auth.constants.role_constants import RoleConstants
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.utils.shared_resource_auth import filter_authorized_ids
 from knowledge.models import Document, DocumentTag, Knowledge
diff --git a/apps/application/flow/step_node/search_knowledge_node/impl/base_search_knowledge_node.py b/apps/application/flow/step_node/search_knowledge_node/impl/base_search_knowledge_node.py
index 35a6fbd19b3..dc17dfc5f27 100644
--- a/apps/application/flow/step_node/search_knowledge_node/impl/base_search_knowledge_node.py
+++ b/apps/application/flow/step_node/search_knowledge_node/impl/base_search_knowledge_node.py
@@ -15,7 +15,7 @@
 from application.flow.i_step_node import NodeResult
 from application.flow.step_node.search_knowledge_node.i_search_knowledge_node import ISearchKnowledgeStepNode
 from common.config.embedding_config import VectorStore
-from common.constants.permission_constants import RoleConstants
+from common.auth.constants.role_constants import RoleConstants
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.db.search import native_search
 from common.utils.common import get_file_content
diff --git a/apps/application/serializers/application_chat_record.py b/apps/application/serializers/application_chat_record.py
index 5ff202a26eb..3222916d996 100644
--- a/apps/application/serializers/application_chat_record.py
+++ b/apps/application/serializers/application_chat_record.py
@@ -16,7 +16,10 @@
 from application.serializers.common import ChatInfo
 from common.auth.authentication import get_is_permissions
 from common.chunk import text_to_chunk
-from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.db.search import page_search
 from common.exception.app_exception import AppApiException, AppUnauthorizedFailed
 from common.utils.common import post
@@ -344,7 +347,7 @@ def post_improve(self, instance: Dict, request=None, scope="WORKSPACE", with_val
                 ViewPermission(
                     [RoleConstants.USER.get_workspace_role()],
                     [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                    CompareConstants.AND,
+                    compare=CompareConstants.AND,
                 ),
             )
         else:
@@ -483,7 +486,7 @@ def improve(self, instance: Dict, request=None, scope="WORKSPACE", with_valid=Tr
                 ViewPermission(
                     [RoleConstants.USER.get_workspace_role()],
                     [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                    CompareConstants.AND,
+                    compare=CompareConstants.AND,
                 ),
             )
         else:
@@ -564,7 +567,7 @@ def delete(self, request=None, scope="WORKSPACE", with_valid=True):
                         ViewPermission(
                             [RoleConstants.USER.get_workspace_role()],
                             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                            CompareConstants.AND,
+                            compare=CompareConstants.AND,
                         ),
                     )
                 else:
diff --git a/apps/application/views/application.py b/apps/application/views/application.py
index 5f5058bca4d..7f2a28f20e9 100644
--- a/apps/application/views/application.py
+++ b/apps/application/views/application.py
@@ -23,7 +23,10 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions, get_is_permissions, check_batch_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from tools.api.tool import GetInternalToolAPI
 
@@ -151,7 +154,7 @@ class Export(APIView):
                          PermissionConstants.APPLICATION_EXPORT.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Application', operate="Export Application",
              get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')),
@@ -178,7 +181,7 @@ class Operate(APIView):
                          PermissionConstants.APPLICATION_DELETE.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Application', operate='Deleting application',
              get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')),
@@ -204,7 +207,7 @@ def delete(self, request: Request, workspace_id: str, application_id: str):
                          PermissionConstants.APPLICATION_EDIT.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Application', operate="Modify the application",
              get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')),
@@ -230,7 +233,7 @@ def put(self, request: Request, workspace_id: str, application_id: str):
                          PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, application_id: str):
             return result.success(ApplicationOperateSerializer(
@@ -254,7 +257,7 @@ class Move(APIView):
                          PermissionConstants.APPLICATION_EDIT.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Application', operate='Move an application',
              get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')))
@@ -281,7 +284,7 @@ class Publish(APIView):
                          PermissionConstants.APPLICATION_PUBLISH.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Application', operate='Publishing an application',
              get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')))
@@ -333,17 +336,18 @@ def put(self, request: Request, workspace_id: str):
                  PermissionConstants.APPLICATION_DELETE.get_workspace_permission_workspace_manage_role(),
                  ViewPermission([RoleConstants.USER.get_workspace_role()],
                                 [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                CompareConstants.AND),
+                                compare=CompareConstants.AND),
                  RoleConstants.WORKSPACE_MANAGE.get_workspace_role()), workspace_id=workspace_id
             )
+
             @log(menu='Application', operate='Batch delete applications',
                  get_operation_object=lambda r, k: get_application_operation_object_batch(permitted_ids))
-            def inner(view,r, **kwargs):
+            def inner(view, r, **kwargs):
                 return ApplicationBatchOperateSerializer(
                     data={'workspace_id': workspace_id, 'user_id': request.user.id}
                 ).batch_delete({'id_list': permitted_ids})
 
-            return result.success(inner(self,request, workspace_id=workspace_id))
+            return result.success(inner(self, request, workspace_id=workspace_id))
 
     class BatchMove(APIView):
         authentication_classes = [TokenAuth]
@@ -370,19 +374,19 @@ def put(self, request: Request, workspace_id: str):
                  PermissionConstants.APPLICATION_EDIT.get_workspace_permission_workspace_manage_role(),
                  ViewPermission([RoleConstants.USER.get_workspace_role()],
                                 [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                CompareConstants.AND),
+                                compare=CompareConstants.AND),
                  RoleConstants.WORKSPACE_MANAGE.get_workspace_role()),
                 workspace_id=workspace_id
             )
 
             @log(menu='Application', operate='Batch move applications',
                  get_operation_object=lambda r, k: get_application_operation_object_batch(permitted_ids))
-            def inner(view,r, **kwargs):
+            def inner(view, r, **kwargs):
                 return ApplicationBatchOperateSerializer(
                     data={'workspace_id': workspace_id, 'user_id': request.user.id}
                 ).batch_move({'id_list': permitted_ids, 'folder_id': request.data.get('folder_id')})
 
-            return result.success(inner(self,request, workspace_id=workspace_id))
+            return result.success(inner(self, request, workspace_id=workspace_id))
 
     class BatchCleanTime(APIView):
         authentication_classes = [TokenAuth]
@@ -409,14 +413,14 @@ def put(self, request: Request, workspace_id: str):
                  PermissionConstants.APPLICATION_CHAT_LOG_CLEAR_POLICY.get_workspace_permission_workspace_manage_role(),
                  ViewPermission([RoleConstants.USER.get_workspace_role()],
                                 [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                CompareConstants.AND),
+                                compare=CompareConstants.AND),
                  RoleConstants.WORKSPACE_MANAGE.get_workspace_role()),
                 workspace_id=workspace_id
             )
 
             @log(menu='Application', operate='Batch update application chat log clear policy',
                  get_operation_object=lambda r, k: get_application_operation_object_batch(permitted_ids))
-            def inner(view,r, **kwargs):
+            def inner(view, r, **kwargs):
                 return ApplicationBatchOperateSerializer(
                     data={'workspace_id': workspace_id, 'user_id': request.user.id}
                 ).batch_clean_time({
@@ -425,7 +429,8 @@ def inner(view,r, **kwargs):
                     'file_clean_time': request.data.get('file_clean_time')
                 })
 
-            return result.success(inner(self,request, workspace_id=workspace_id))
+            return result.success(inner(self, request, workspace_id=workspace_id))
+
 
 class McpServers(APIView):
     authentication_classes = [TokenAuth]
@@ -444,7 +449,7 @@ class McpServers(APIView):
                      PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                    compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def post(self, request: Request, workspace_id, application_id: str):
         return result.success(ApplicationOperateSerializer(
@@ -470,7 +475,7 @@ class SpeechToText(APIView):
                      PermissionConstants.APPLICATION_EDIT.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                    compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def post(self, request: Request, workspace_id: str, application_id: str):
         return result.success(
@@ -496,7 +501,7 @@ class TextToSpeech(APIView):
                      PermissionConstants.APPLICATION_EDIT.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                    compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def post(self, request: Request, workspace_id: str, application_id: str):
         byte_data = ApplicationOperateSerializer(
@@ -523,7 +528,7 @@ class PlayDemoText(APIView):
                      PermissionConstants.APPLICATION_EDIT.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                    compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     @log(menu='Application', operate="trial listening",
          get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')))
diff --git a/apps/application/views/application_access_token.py b/apps/application/views/application_access_token.py
index f7dc6bcaf83..ebf7da12e9f 100644
--- a/apps/application/views/application_access_token.py
+++ b/apps/application/views/application_access_token.py
@@ -18,7 +18,10 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 
 def get_application_operation_object(application_id):
@@ -49,7 +52,7 @@ class AccessToken(APIView):
                      PermissionConstants.APPLICATION_OVERVIEW_ACCESS.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def put(self, request: Request, workspace_id: str, application_id: str):
         return result.success(
@@ -68,7 +71,7 @@ def put(self, request: Request, workspace_id: str, application_id: str):
                      PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role()
                      )
     def get(self, request: Request, workspace_id: str, application_id: str):
diff --git a/apps/application/views/application_api_key.py b/apps/application/views/application_api_key.py
index 213c8fe7221..bd07d07a44f 100644
--- a/apps/application/views/application_api_key.py
+++ b/apps/application/views/application_api_key.py
@@ -9,7 +9,11 @@
 from application.serializers.application_api_key import ApplicationKeySerializer
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
+
 from common.log.log import log
 from common.result import result, DefaultResultSerializer
 
@@ -42,8 +46,9 @@ class ApplicationKey(APIView):
     @has_permissions(PermissionConstants.APPLICATION_OVERVIEW_API_KEY.get_workspace_application_permission(),
                      PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
-                                    [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                    [
+                                        PermissionConstants.APPLICATION.get_workspace_application_permission()],
+                                    compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role()
                      )
     def post(self, request: Request, workspace_id: str, application_id: str):
@@ -67,7 +72,7 @@ class Page(APIView):
                          PermissionConstants.APPLICATION_OVERVIEW_API_KEY.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, application_id: str, current_page: int, page_size: int):
             return result.success(ApplicationKeySerializer(
@@ -92,7 +97,7 @@ class Operate(APIView):
                          PermissionConstants.APPLICATION_OVERVIEW_API_KEY.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Application', operate="Modify application API_KEY",
              get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')),
@@ -118,7 +123,7 @@ def put(self, request: Request, workspace_id: str, application_id: str, api_key_
                          PermissionConstants.APPLICATION_OVERVIEW_API_KEY.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Application', operate="Delete application API_KEY",
              get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')),
diff --git a/apps/application/views/application_chat.py b/apps/application/views/application_chat.py
index 06e622e5320..6ee7befddfe 100644
--- a/apps/application/views/application_chat.py
+++ b/apps/application/views/application_chat.py
@@ -22,7 +22,10 @@
 from chat.serializers.chat import OpenChatSerializers, DebugChatSerializers, PromptGenerateSerializer, ResumeSerializers
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log, _get_ip_address
 from common.result import result
 from common.utils.common import query_params_to_single_dict
@@ -54,7 +57,7 @@ class ApplicationChat(APIView):
                      PermissionConstants.APPLICATION_CHAT_LOG_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id: str, application_id: str):
         return result.success(ApplicationChatQuerySerializers(
@@ -79,7 +82,7 @@ class Page(APIView):
                          PermissionConstants.APPLICATION_CHAT_LOG_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, application_id: str, current_page: int, page_size: int):
             return result.success(ApplicationChatQuerySerializers(
@@ -105,7 +108,7 @@ class Export(APIView):
                          PermissionConstants.APPLICATION_CHAT_LOG_EXPORT.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                         compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def post(self, request: Request, workspace_id: str, application_id: str):
             return ApplicationChatQuerySerializers(
@@ -130,7 +133,7 @@ class OpenView(APIView):
                      PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id: str, application_id: str):
         ip_address = _get_ip_address(request)
@@ -160,7 +163,7 @@ class ChatView(APIView):
                      PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def post(self, request: Request, workspace_id: str, application_id: str, chat_id: str):
         return DebugChatSerializers(data={'chat_id': chat_id}).chat(request.data)
@@ -180,7 +183,7 @@ class CancelWorkflowView(APIView):
                      PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def post(self, request: Request, workspace_id: str, application_id: str, chat_id: str):
         from application.workflow.workflow_run_registry import WorkflowRunRegistry, CancelResult
@@ -207,7 +210,7 @@ class ResumeStreamView(APIView):
                      PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def post(self, request: Request, workspace_id: str, application_id: str, chat_id: str, chat_record_id: str):
         return ResumeSerializers(data={'chat_id': chat_id, 'chat_record_id': chat_record_id}).resume(request)
@@ -230,7 +233,7 @@ class PromptGenerateView(APIView):
                      PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     @log(menu='Application', operate='Generate prompt',
          get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')))
@@ -258,7 +261,7 @@ class PageView(APIView):
                          PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                         compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, application_id: str, current_page: int, page_size: int):
             from chat.serializers.chat_record import HistoricalConversationSerializer
@@ -284,7 +287,7 @@ class RecordPageView(APIView):
                          PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                         compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, application_id: str, chat_id: str, current_page: int,
                 page_size: int):
diff --git a/apps/application/views/application_chat_record.py b/apps/application/views/application_chat_record.py
index 3d693f049e7..91213efcc32 100644
--- a/apps/application/views/application_chat_record.py
+++ b/apps/application/views/application_chat_record.py
@@ -10,7 +10,10 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.utils.common import query_params_to_single_dict
 from django.utils.translation import gettext_lazy as _
 from drf_spectacular.utils import extend_schema
@@ -50,7 +53,7 @@ class ApplicationChatRecord(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
     )
@@ -85,18 +88,16 @@ class Page(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                CompareConstants.AND,
-            ),
-            RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
-        )
+                compare=CompareConstants.AND, ),
+            RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(
-            self,
-            request: Request,
-            workspace_id: str,
-            application_id: str,
-            chat_id: str,
-            current_page: int,
-            page_size: int,
+                self,
+                request: Request,
+                workspace_id: str,
+                application_id: str,
+                chat_id: str,
+                current_page: int,
+                page_size: int,
         ):
             return result.success(
                 ApplicationChatRecordQuerySerializers(
@@ -131,7 +132,7 @@ class ApplicationChatRecordOperateAPI(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
     )
@@ -167,7 +168,7 @@ class ApplicationChatRecordAddKnowledge(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
     )
@@ -200,7 +201,7 @@ class ApplicationChatRecordImprove(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
     )
@@ -236,19 +237,19 @@ class ApplicationChatRecordImproveParagraph(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
     )
     def put(
-        self,
-        request: Request,
-        workspace_id: str,
-        application_id: str,
-        chat_id: str,
-        chat_record_id: str,
-        knowledge_id: str,
-        document_id: str,
+            self,
+            request: Request,
+            workspace_id: str,
+            application_id: str,
+            chat_id: str,
+            chat_record_id: str,
+            knowledge_id: str,
+            document_id: str,
     ):
         return result.success(
             ApplicationChatRecordImproveSerializer(
@@ -282,20 +283,20 @@ class Operate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
         )
         def delete(
-            self,
-            request: Request,
-            workspace_id: str,
-            application_id: str,
-            chat_id: str,
-            chat_record_id: str,
-            knowledge_id: str,
-            document_id: str,
-            paragraph_id: str,
+                self,
+                request: Request,
+                workspace_id: str,
+                application_id: str,
+                chat_id: str,
+                chat_record_id: str,
+                knowledge_id: str,
+                document_id: str,
+                paragraph_id: str,
         ):
             return result.success(
                 ApplicationChatRecordImproveSerializer.Operate(
diff --git a/apps/application/views/application_stats.py b/apps/application/views/application_stats.py
index 4567156175e..c4fbe65bf9b 100644
--- a/apps/application/views/application_stats.py
+++ b/apps/application/views/application_stats.py
@@ -17,7 +17,10 @@
 from django.utils.translation import gettext_lazy as _
 
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 
 
 class ApplicationStats(APIView):
@@ -36,7 +39,7 @@ class ApplicationStats(APIView):
                      PermissionConstants.APPLICATION_OVERVIEW_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id: str, application_id: str):
         return result.success(
@@ -64,7 +67,7 @@ class TokenUsageStatistics(APIView):
                          PermissionConstants.APPLICATION_OVERVIEW_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                         compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, application_id: str):
             return result.success(
@@ -91,7 +94,7 @@ class TopQuestionsStatistics(APIView):
                          PermissionConstants.APPLICATION_OVERVIEW_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                         compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, application_id: str):
             return result.success(
diff --git a/apps/application/views/application_version.py b/apps/application/views/application_version.py
index 3a87a1533f0..ad3c3db9797 100644
--- a/apps/application/views/application_version.py
+++ b/apps/application/views/application_version.py
@@ -18,7 +18,10 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 
 
@@ -38,7 +41,7 @@ class ApplicationVersionView(APIView):
                      PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                    CompareConstants.AND),
+                                     compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id, application_id: str):
         return result.success(
@@ -62,7 +65,7 @@ class Page(APIView):
                          PermissionConstants.APPLICATION_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                         compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, application_id: str, current_page: int, page_size: int):
             return result.success(
@@ -87,7 +90,7 @@ class Operate(APIView):
                          PermissionConstants.APPLICATION_EDIT.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                         compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, application_id: str, application_version_id: str):
             return result.success(
@@ -109,7 +112,7 @@ def get(self, request: Request, workspace_id: str, application_id: str, applicat
                          PermissionConstants.APPLICATION_EDIT.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.APPLICATION.get_workspace_application_permission()],
-                                        CompareConstants.AND),
+                                         compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Application', operate="Modify application version information",
              get_operation_object=lambda r, k: get_application_operation_object(k.get('application_id')),
diff --git a/apps/chat/views/chat.py b/apps/chat/views/chat.py
index adaac498f10..fa93ae03a5f 100644
--- a/apps/chat/views/chat.py
+++ b/apps/chat/views/chat.py
@@ -31,7 +31,7 @@
 from common.auth.common import FileToken
 from common.constants.authentication_type import AuthenticationType
 from common.constants.cache_version import Cache_Version
-from common.constants.permission_constants import ChatAuth
+from common.auth.common import ChatAuthentication
 from common.exception.app_exception import AppAuthenticationFailed, AppApiException
 from common.log.log import _get_ip_address, log
 from common.result import result
@@ -157,7 +157,7 @@ class ApplicationProfile(APIView):
         tags=[_('Chat')]  # type: ignore
     )
     def get(self, request: Request):
-        if isinstance(request.auth, ChatAuth):
+        if isinstance(request.auth, ChatAuthentication):
             return result.success(ApplicationProfileSerializer(
                 data={'application_id': request.auth.application_id}).profile())
         raise AppAuthenticationFailed(401, "身份异常")
diff --git a/apps/common/auth/authenticate.py b/apps/common/auth/authenticate.py
index 71ee51bf1f6..9bf27c420aa 100644
--- a/apps/common/auth/authenticate.py
+++ b/apps/common/auth/authenticate.py
@@ -50,9 +50,30 @@ def new_instance_by_class_path(class_path: str):
     return HandlerClass()
 
 
-handles = [new_instance_by_class_path(class_path) for class_path in settings.AUTH_HANDLES]
-chat_handles = [new_instance_by_class_path(class_path) for class_path in settings.CHAT_AUTH_HANDLES]
-all_handles = handles + chat_handles
+handles = None
+chat_handles = None
+all_handles = None
+
+
+def get_handles():
+    global handles
+    if handles is None:
+        handles = [new_instance_by_class_path(class_path) for class_path in settings.AUTH_HANDLES]
+    return handles
+
+
+def get_chat_handles():
+    global chat_handles
+    if chat_handles is None:
+        chat_handles = [new_instance_by_class_path(class_path) for class_path in settings.CHAT_AUTH_HANDLES]
+    return chat_handles
+
+
+def get_all_handles():
+    global all_handles
+    if all_handles is None:
+        all_handles = get_handles() + get_chat_handles()
+    return all_handles
 
 
 class TokenDetails:
@@ -85,7 +106,7 @@ def authenticate(self, request):
         try:
             token = auth[7:]
             token_details = TokenDetails(token)
-            for handle in handles:
+            for handle in get_handles():
                 if handle.support(request, token, token_details.get_token_details):
                     return handle.handle(request, token, token_details.get_token_details)
             raise AppAuthenticationFailed(1002, _('Authentication information is incorrect! illegal user'))
@@ -111,7 +132,7 @@ def authenticate(self, request):
         try:
             token = auth[7:]
             token_details = TokenDetails(token)
-            for handle in chat_handles:
+            for handle in get_chat_handles():
                 if handle.support(request, token, token_details.get_token_details):
                     return handle.handle(request, token, token_details.get_token_details)
             raise AppAuthenticationFailed(1002, _('Authentication information is incorrect! illegal user'))
@@ -137,7 +158,7 @@ def authenticate(self, request):
         try:
             token = auth[7:]
             token_details = TokenDetails(token)
-            for handle in all_handles:
+            for handle in get_all_handles():
                 if handle.support(request, token, token_details.get_token_details):
                     return handle.handle(request, token, token_details.get_token_details)
             raise AppAuthenticationFailed(1002, _('Authentication information is incorrect! illegal user'))
diff --git a/apps/common/auth/authentication.py b/apps/common/auth/authentication.py
index 8ee80f324f5..9bfc1203233 100644
--- a/apps/common/auth/authentication.py
+++ b/apps/common/auth/authentication.py
@@ -1,140 +1,62 @@
 # coding=utf-8
 """
     @project: MaxKB
-    @Author：虎虎
     @file： authentication.py
-    @date：2025/4/15 20:12
-    @desc:
+    @desc: 适配层,复用 AggregatePermission
 """
-from typing import List
 
 from django.utils.translation import gettext_lazy as _
-from rest_framework.request import Request
-
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants, \
-    Permission, Role
-from common.exception.app_exception import AppUnauthorizedFailed
-
-
-def exist_permissions_by_permission_constants(user_permission: List[PermissionConstants],
-                                              permission_list: List[PermissionConstants]):
-    """
-    用户是否拥有 permission_list的权限
-    :param user_permission:  用户权限
-    :param permission_list:  需要的权限
-    :return: 是否拥有
-    """
-    return any(list(map(lambda up: permission_list.__contains__(up), user_permission)))
-
-
-def exist_role_by_role_constants(user_role: List[RoleConstants],
-                                 role_list: List[RoleConstants]):
-    """
-    用户是否拥有这个角色
-    :param user_role: 用户角色
-    :param role_list: 需要拥有的角色
-    :return:  是否拥有
-    """
-    return any([True for role in role_list if user_role.__contains__(role.value.__str__())])
 
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import AggregatePermission
+from common.auth.struct.permission import Role
 
-def exist_permissions_by_view_permission(user_role: List[RoleConstants],
-                                         user_permission: List[PermissionConstants | object],
-                                         permission: ViewPermission, request, **kwargs):
-    """
-    用户是否存在这些权限
-    :param request:
-    :param user_role:        用户角色
-    :param user_permission:  用户权限
-    :param permission:       所属权限
-    :return:                 是否存在 True False
-    """
-
-    role_list = [user_r(request, kwargs) if callable(user_r) else user_r for user_r in
-                 permission.roleList]
-    role_ok = any(list(map(lambda up: role_list.__contains__(up),
-                           user_role)))
-    permission_list = [user_p(request, kwargs) if callable(user_p) else user_p for user_p in
-                       permission.permissionList
-                       ]
-    permission_ok = any(list(map(lambda up: permission_list.__contains__(up),
-                                 user_permission)))
-    return role_ok | permission_ok if permission.compare == CompareConstants.OR else role_ok & permission_ok
-
-
-def exist_permissions(user_role: List[RoleConstants], user_permission: List[PermissionConstants], permission, request,
-                      **kwargs):
-    if isinstance(permission, ViewPermission):
-        return exist_permissions_by_view_permission(user_role, user_permission, permission, request, **kwargs)
-    if isinstance(permission, RoleConstants):
-        return exist_role_by_role_constants(user_role, [permission])
-    if isinstance(permission, PermissionConstants):
-        return exist_permissions_by_permission_constants(user_permission, [permission])
-    if isinstance(permission, Permission):
-        return user_permission.__contains__(permission)
-    if isinstance(permission, Role):
-        return user_role.__contains__(permission.__str__())
-    return False
+from common.exception.app_exception import AppUnauthorizedFailed
 
 
-def exist(user_role: List[RoleConstants], user_permission: List[PermissionConstants], permission, request, **kwargs):
-    if callable(permission):
-        p = permission(request, kwargs)
-        return exist_permissions(user_role, user_permission, p, request, **kwargs)
-    return exist_permissions(user_role, user_permission, permission, request, **kwargs)
+def _build(items, request, kwargs, compare) -> AggregatePermission:
+    roles, permissions, aggregates = [], [], []
+    for it in items:
+        if callable(it) and not isinstance(it, AggregatePermission):
+            it = it(request, kwargs)
+        if isinstance(it, AggregatePermission):
+            aggregates.append(it)
+        elif isinstance(it, (RoleConstants, Role)):
+            roles.append(it)
+        else:
+            permissions.append(it)
+    return AggregatePermission(roles=roles, permissions=permissions,
+                               aggregatePermissions=aggregates, compare=compare)
 
 
 def get_is_permissions(request, **kwargs):
     def is_permissions(*permission, compare=CompareConstants.OR):
-        exit_list = list(
-            map(lambda p: exist(request.auth.role_list, request.auth.permission_list, p, request, **kwargs),
-                permission))
-        return any(exit_list) if compare == CompareConstants.OR else all(exit_list)
+        return _build(permission, request, kwargs, compare).hasPermission(request, **kwargs)
 
     return is_permissions
 
-def check_batch_permissions(request: Request, id_list: List[str], id_key: str, permissions: tuple,
-                            compare=CompareConstants.OR, **kwargs) -> List[str]:
 
+def check_batch_permissions(request, id_list, id_key, permissions, compare=CompareConstants.OR, **kwargs):
     if not id_list:
         return []
-
-    # workspace manager 直接放行
-    # 预检
     kwargs[id_key] = '__workspace_level_pre_check__'
-    pre_check = list(
-            map(lambda p: exist(request.auth.role_list, request.auth.permission_list, p, request, **kwargs),
-                permissions)
-        )
-    if any(pre_check) if compare == CompareConstants.OR else all(pre_check):
+    if _build(permissions, request, kwargs, compare).hasPermission(request, **kwargs):
         return list(id_list)
-    # 逐个资源校验
     result_list = []
     for resource_id in id_list:
         kwargs[id_key] = resource_id
-        exit_list = list(
-            map(lambda p: exist(request.auth.role_list, request.auth.permission_list, p, request, **kwargs),
-                permissions)
-        )
-        if any(exit_list) if compare == CompareConstants.OR else all(exit_list):
+        if _build(permissions, request, kwargs, compare).hasPermission(request, **kwargs):
             result_list.append(resource_id)
     return result_list
 
+
 def has_permissions(*permission, compare=CompareConstants.OR):
-    """
-    权限 role or permission
-    :param compare:    比较符号
-    :param permission: 如果是角色 role:roleId
-    :return: 权限装饰器函数,用于判断用户是否有权限访问当前接口
-    """
+    """接口权限装饰器"""
 
     def inner(func):
         def run(view, request, **kwargs):
-            exit_list = list(
-                map(lambda p: exist(request.auth.role_list, request.auth.permission_list, p, request, **kwargs),
-                    permission))
-            # 判断是否有权限
-            if any(exit_list) if compare == CompareConstants.OR else all(exit_list):
+            if _build(permission, request, kwargs, compare).hasPermission(request, **kwargs):
                 return func(view, request, **kwargs)
             raise AppUnauthorizedFailed(403, _('No permission to access'))
 
diff --git a/apps/common/auth/constants/category_constants.py b/apps/common/auth/constants/category_constants.py
new file mode 100644
index 00000000000..734a2cefb20
--- /dev/null
+++ b/apps/common/auth/constants/category_constants.py
@@ -0,0 +1,36 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： category_constants.py
+    @date：2026/8/3 17:31
+    @desc: 一级目录分类常量（最顶层分类）
+"""
+from enum import Enum
+from django.utils.translation import gettext_lazy as _
+
+
+class Category(Enum):
+    """
+    一级目录（最顶层分类），用于在 parent_group 之上再加一层分类
+    """
+    # 身份与权限
+    IAM = ("IAM", _("IAM"))
+    # 资源管理
+    RESOURCE = ("RESOURCE", _("Resource"))
+    # 共享资源
+    SHARED = ("SHARED", _("Shared"))
+    # 对话客户端
+    CHAT_CLIENT = ("CHAT_CLIENT", _("Chat Client"))
+    # 操作日志
+    OPERATION_LOG = ("OPERATION_LOG", _("Operation Log"))
+    # 系统设置
+    SYSTEM_SETTING = ("SYSTEM_SETTING", _("System Setting"))
+    # 工作空间
+    WORKSPACE = ("WORKSPACE", _("Workspace"))
+    # 其他
+    OTHER = ("OTHER", _("Other"))
+
+    def __init__(self, value, label):
+        self._value_ = value
+        self.label = label
diff --git a/apps/common/auth/constants/compare_constants.py b/apps/common/auth/constants/compare_constants.py
new file mode 100644
index 00000000000..7c6a34dd0c7
--- /dev/null
+++ b/apps/common/auth/constants/compare_constants.py
@@ -0,0 +1,16 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： compare_constants.py
+    @date：2026/8/5 10:42
+    @desc:
+"""
+from enum import Enum
+
+
+class CompareConstants(Enum):
+    # 或者
+    OR = "OR"
+    # 并且
+    AND = "AND"
diff --git a/apps/common/auth/constants/group_constants.py b/apps/common/auth/constants/group_constants.py
new file mode 100644
index 00000000000..2ac397ca6de
--- /dev/null
+++ b/apps/common/auth/constants/group_constants.py
@@ -0,0 +1,117 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： group_constants.py
+    @date：2026/8/3 17:31
+    @desc: 权限分组常量，用于菜单和权限分类
+"""
+from enum import Enum
+
+from django.utils.translation import gettext_lazy as _
+
+
+class Group(Enum):
+    """
+    权限组 一个组一般对应前端一个菜单
+    使用方式：
+    - 无子分组: group=Group.TOOL, sub_group=Group.TOOL
+    - 有子分组: group=Group.TOOL, sub_group=Group.FOLDER
+    """
+
+    # 用户管理
+    USER = ("USER_MANAGEMENT", _("User Management"))
+
+    # 资源主分组
+    APPLICATION = ("APPLICATION", _("Application"))
+    KNOWLEDGE = ("KNOWLEDGE", _("Knowledge"))
+    MODEL = ("MODEL", _("Model"))
+    TOOL = ("TOOL", _("Tool"))
+    TRIGGER = ("TRIGGER", _("Trigger"))
+
+    # 子分组 - 文件夹
+    FOLDER = ("FOLDER", _("Folder"))
+
+    # 子分组 - 知识库
+    DOCUMENT = ("DOCUMENT", _("Document"))
+    WORKFLOW = ("WORKFLOW", _("Workflow"))
+    TAG = ("TAG", _("Tag"))
+    PROBLEM = ("PROBLEM", _("Problem"))
+    TERMBASE = ("TERMBASE", _("Termbase"))
+    HIT_TEST = ("HIT_TEST", _("Hit-Test"))
+
+    # 子分组 - 应用
+    OVERVIEW = ("OVERVIEW", _("Overview"))
+    ACCESS = ("ACCESS", _("Application Access"))
+    CHAT_LOG = ("CHAT_LOG", _("Conversation log"))
+    CHAT_USER = ("CHAT_USER", _("Dialogue users"))
+
+    # 子分组 - 对话用户（知识库）
+    KNOWLEDGE_CHAT_USER = ("KNOWLEDGE_CHAT_USER", _("Dialogue users"))
+
+    # 系统功能分组
+    ROLE = ("ROLE", _("Role Management"))
+    WORKSPACE = ("WORKSPACE", _("Workspace"))
+    USER_GROUP = ("USER_GROUP", _("User Group"))
+    EMAIL_SETTING = ("EMAIL_SETTING", _("Email Setting"))
+    LOGIN_AUTH = ("LOGIN_AUTH", _("Login Auth"))
+    APPEARANCE_SETTINGS = ("APPEARANCE_SETTINGS", _("Appearance Settings"))
+    DISPLAY_SETTINGS = ("DISPLAY_SETTINGS", _("Display Settings"))
+
+    # 对话相关
+    CHAT_USER_GROUP = ("CHAT_USER_GROUP", _("Chat User Group"))
+    CHAT_USER_AUTH = ("CHAT_USER_AUTH", _("Chat User Auth"))
+
+    # 其他
+    OTHER = ("OTHER", _("Other"))
+    HOMEPAGE = ("HOMEPAGE", _("Home page"))
+    OPERATION_LOG = ("OPERATION_LOG", _("Operation Log"))
+
+    # 资源授权分组
+    RESOURCE_PERMISSION = ("RESOURCE_PERMISSION", _("Resource Permission"))
+
+    # 工作空间分组
+    WORKSPACE_ROLE = ("WORKSPACE_ROLE", _("Role Management"))
+    WORKSPACE_WORKSPACE = ("WORKSPACE_WORKSPACE", _("Workspace"))
+    WORKSPACE_USER_GROUP = ("WORKSPACE_USER_GROUP", _("User Group"))
+    WORKSPACE_RESOURCE_PERMISSION = ("WORKSPACE_RESOURCE_PERMISSION", _("Resource Permission"))
+    WORKSPACE_CHAT_USER = ("WORKSPACE_CHAT_USER", _("Chat User"))
+    WORKSPACE_CHAT_USER_GROUP = ("WORKSPACE_CHAT_USER_GROUP", _("Chat User Group"))
+
+    # 用户级分组
+    USER_HOMEPAGE = ("USER_HOMEPAGE", _("Home page"))
+    USER_APPLICATION = ("USER_APPLICATION", _("Application"))
+    USER_KNOWLEDGE = ("USER_KNOWLEDGE", _("Knowledge"))
+    USER_MODEL = ("USER_MODEL", _("Model"))
+    USER_TOOL = ("USER_TOOL", _("Tool"))
+    USER_OTHER = ("USER_OTHER", _("Other"))
+
+    # 共享资源分组
+    SYSTEM_KNOWLEDGE = ("SYSTEM_KNOWLEDGE", _("Knowledge"))
+    SYSTEM_MODEL = ("SYSTEM_MODEL", _("Model"))
+    SYSTEM_TOOL = ("SYSTEM_TOOL", _("Tool"))
+
+    # 资源管理分组
+    SYSTEM_RES_APPLICATION = ("SYSTEM_RESOURCE_APPLICATION", _("Application"))
+    SYSTEM_RES_KNOWLEDGE = ("SYSTEM_RESOURCE_KNOWLEDGE", _("Knowledge"))
+    SYSTEM_RES_TOOL = ("SYSTEM_RESOURCE_TOOL", _("Tool"))
+    SYSTEM_RES_MODEL = ("SYSTEM_RESOURCE_MODEL", _("Model"))
+
+    # 系统资源子分组
+    SYSTEM_DOCUMENT = ("SYSTEM_DOCUMENT", _("Document"))
+    SYSTEM_WORKFLOW = ("SYSTEM_WORKFLOW", _("Workflow"))
+    SYSTEM_TAG = ("SYSTEM_TAG", _("Tag"))
+    SYSTEM_PROBLEM = ("SYSTEM_PROBLEM", _("Problem"))
+    SYSTEM_TERMBASE = ("SYSTEM_TERMBASE", _("Termbase"))
+    SYSTEM_HIT_TEST = ("SYSTEM_HIT_TEST", _("Hit-Test"))
+    SYSTEM_CHAT_USER = ("SYSTEM_CHAT_USER", _("Dialogue users"))
+    SYSTEM_OVERVIEW = ("SYSTEM_OVERVIEW", _("Overview"))
+    SYSTEM_ACCESS = ("SYSTEM_ACCESS", _("Application Access"))
+    SYSTEM_CHAT_LOG = ("SYSTEM_CHAT_LOG", _("Conversation log"))
+
+    def __init__(self, value, label):
+        self._value_ = value
+        self.label = label
+
+    def __str__(self):
+        return self.value
diff --git a/apps/common/auth/constants/operate_constants.py b/apps/common/auth/constants/operate_constants.py
new file mode 100644
index 00000000000..b84b6952a11
--- /dev/null
+++ b/apps/common/auth/constants/operate_constants.py
@@ -0,0 +1,72 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： operate_constants.py
+    @date：2026/8/3 17:32
+    @desc: 操作权限常量
+"""
+from enum import Enum
+from django.utils.translation import gettext_lazy as _
+
+
+class Operate(Enum):
+    """
+     一个权限组的操作权限
+    """
+    SELF = ("", "")
+    READ = ("READ", _("Read"))
+    EDIT = ("READ+EDIT", _("Edit"))
+    CREATE = ("READ+CREATE", _("Create"))
+    DELETE = ("READ+DELETE", _("Delete"))
+    """
+    使用权限
+    """
+    USE = ("USE", _("Use"))
+    IMPORT = ("READ+IMPORT", _("Import"))
+    EXPORT = ("READ+EXPORT", _("Export"))
+    PUBLISH = ("READ+PUBLISH", _("Publish"))
+    SYNC = ("READ+SYNC", _("Sync"))
+    GENERATE = ("READ+GENERATE", _("Generate"))
+    ADD_MEMBER = ("READ+ADD_MEMBER", _("Add Member"))
+    REMOVE_MEMBER = ("READ+REMOVE_MEMBER", _("Remove Member"))
+    VECTOR = ("READ+VECTOR", _("Vector"))
+    MIGRATE = ("READ+MIGRATE", _("Migrate"))
+    RELATE = ("READ+RELATE", _("Relate"))
+    USER_GROUP = ("READ+USER_GROUP", _("User Group"))
+    ANNOTATION = ("READ+ANNOTATION", _("Annotation"))
+    CLEAR_POLICY = ("READ+CLEAR_POLICY", _("Clear Policy"))
+    EMBED = ("READ+EMBED", _("Embed third party"))
+    ACCESS = ("READ+ACCESS", _("Access restrictions"))
+    DISPLAY = ("READ+DISPLAY", _("Display Settings"))
+    API_KEY = ("READ+API_KEY", _("API KEY"))
+    PUBLIC_ACCESS = ("READ+PUBLIC_ACCESS", _("Public access link"))
+    Q_WEIXIN = ("READ+Q_WEIXIN", _("Enterprise WeiXin"))
+    FEISHU = ("READ+FEISHU", _("Feishu"))
+    DD = ("READ+DD", _("Dingding"))
+    WEIXIN_PUBLIC_ACCOUNT = ("READ+WEIXIN_PUBLIC_ACCOUNT", _("Weixin Public Account"))
+    SLACK = ("READ+SLACK", _("Slack"))
+    ADD_KNOWLEDGE = ("READ+ADD_KNOWLEDGE", _("Add to Knowledge Base"))
+    TO_CHAT = ("READ+TO_CHAT", _("To Chat"))
+    SETTING = ("READ+SETTING", _("Setting"))
+    DOWNLOAD = ("READ+DOWNLOAD", _("Download Original Document"))
+    COPY = ("READ+COPY", _("Copy"))
+    AUTH = ("READ+AUTH", _("resource authorization"))
+    TAG = ("READ+TAG", _("Tag Setting"))
+    REPLACE = ("READ+REPLACE", _("Replace Original Document"))
+    UPDATE = ("READ+UPDATE", _("Update License"))
+    RELATE_VIEW = ("READ+RELATE_VIEW", _("View related resources"))
+    RECORD = ("READ+RECORD", _("Read execute record"))
+    TRIGGER_READ = ("READ+TRIGGER_READ", _("Read Trigger"))
+    TRIGGER_EDIT = ("READ+TRIGGER_EDIT", _("Edit Trigger"))
+    TRIGGER_CREATE = ("READ+TRIGGER_CREATE", _("Create Trigger"))
+    TRIGGER_DELETE = ("READ+TRIGGER_DELETE", _("Delete Trigger"))
+    BATCH_DELETE = ("READ+BATCH_DELETE", _("Batch delete"))
+    BATCH_MOVE = ("READ+BATCH_MOVE", _("Batch move"))
+    TOKEN = ("READ+TOKEN", _("Token Index"))
+    TO_WORKSPACE = ("READ+TO_WORKSPACE", _("Authorize to Workspace"))
+    SET_ROLE = ("READ+SET_ROLE", _("Set Role"))
+
+    def __init__(self, value, label):
+        self._value_ = value
+        self.label = label
diff --git a/apps/common/auth/constants/permission_constants.py b/apps/common/auth/constants/permission_constants.py
new file mode 100644
index 00000000000..f306f9aa156
--- /dev/null
+++ b/apps/common/auth/constants/permission_constants.py
@@ -0,0 +1,1813 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： permission_constants.py
+    @date：2026/8/3 17:28
+    @desc: 权限枚举常量（新格式）
+"""
+from enum import Enum
+from typing import List, Dict
+
+from common.auth.constants.category_constants import Category
+from common.auth.constants.group_constants import Group
+from common.auth.constants.operate_constants import Operate
+from common.auth.constants.permission_scope_constants import PermissionScopeConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.permission import Permission, PermissionMeta
+
+
+class ResourcePermissionGroup:
+    """资源权限组"""
+
+    def __init__(self, resource: Group, permission: str):
+        self.resource = resource
+        self.permission = permission
+
+    def __eq__(self, other):
+        return str(self.permission) == str(other.permission) and str(self.resource) == str(other.resource)
+
+    def __str__(self):
+        return f"{self.resource}_{self.permission}"
+
+    def __hash__(self):
+        return hash((self.resource, self.permission))
+
+
+class ResourcePermissionConst:
+    """资源权限常量"""
+    # 知识库
+    KNOWLEDGE_VIEW = ResourcePermissionGroup(Group.KNOWLEDGE, "VIEW")
+    KNOWLEDGE_MANAGE = ResourcePermissionGroup(Group.KNOWLEDGE, "MANAGE")
+    KNOWLEDGE_FOLDER_VIEW = ResourcePermissionGroup(Group.KNOWLEDGE, "FOLDER_VIEW")
+    KNOWLEDGE_FOLDER_MANAGE = ResourcePermissionGroup(Group.KNOWLEDGE, "FOLDER_MANAGE")
+
+    # 应用
+    APPLICATION_VIEW = ResourcePermissionGroup(Group.APPLICATION, "VIEW")
+    APPLICATION_MANAGE = ResourcePermissionGroup(Group.APPLICATION, "MANAGE")
+    APPLICATION_FOLDER_VIEW = ResourcePermissionGroup(Group.APPLICATION, "FOLDER_VIEW")
+    APPLICATION_FOLDER_MANAGE = ResourcePermissionGroup(Group.APPLICATION, "FOLDER_MANAGE")
+
+    # 工具
+    TOOL_VIEW = ResourcePermissionGroup(Group.TOOL, "VIEW")
+    TOOL_MANAGE = ResourcePermissionGroup(Group.TOOL, "MANAGE")
+    TOOL_FOLDER_VIEW = ResourcePermissionGroup(Group.TOOL, "FOLDER_VIEW")
+    TOOL_FOLDER_MANAGE = ResourcePermissionGroup(Group.TOOL, "FOLDER_MANAGE")
+
+    # 模型
+    MODEL_VIEW = ResourcePermissionGroup(Group.MODEL, "VIEW")
+    MODEL_MANAGE = ResourcePermissionGroup(Group.MODEL, "MANAGE")
+
+
+class PermissionConstants(Enum):
+    """
+     权限枚举
+    """
+    # ==================== 首页 ====================
+    HOMEPAGE_READ = (Permission(
+        group=Group.HOMEPAGE, sub_group=Group.HOMEPAGE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.WORKSPACE))
+
+    HOMEPAGE_EXPORT = (Permission(
+        group=Group.HOMEPAGE, sub_group=Group.HOMEPAGE, operate=Operate.EXPORT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.WORKSPACE))
+
+    # ==================== 资源主分组（无子分组） ====================
+    KNOWLEDGE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.SELF, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE))
+
+    APPLICATION = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.SELF, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE))
+
+    MODEL = (Permission(
+        group=Group.MODEL, sub_group=Group.MODEL, operate=Operate.SELF, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE))
+
+    TOOL = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.SELF, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE))
+
+    # ==================== 用户管理 ====================
+    USER_READ = (Permission(
+        group=Group.USER, sub_group=Group.USER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.IAM))
+
+    USER_CREATE = (Permission(
+        group=Group.USER, sub_group=Group.USER, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    USER_EDIT = (Permission(
+        group=Group.USER, sub_group=Group.USER, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    USER_DELETE = (Permission(
+        group=Group.USER, sub_group=Group.USER, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    USER_SET_ROLE = (Permission(
+        group=Group.USER, sub_group=Group.USER, operate=Operate.SET_ROLE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, is_ee=True))
+
+    USER_IMPORT = (Permission(
+        group=Group.USER, sub_group=Group.USER, operate=Operate.IMPORT, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    # ==================== 系统用户组 ====================
+    SYSTEM_USER_GROUP_READ = (Permission(
+        group=Group.USER_GROUP, sub_group=Group.USER_GROUP, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    SYSTEM_USER_GROUP_CREATE = (Permission(
+        group=Group.USER_GROUP, sub_group=Group.USER_GROUP, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    SYSTEM_USER_GROUP_EDIT = (Permission(
+        group=Group.USER_GROUP, sub_group=Group.USER_GROUP, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    SYSTEM_USER_GROUP_DELETE = (Permission(
+        group=Group.USER_GROUP, sub_group=Group.USER_GROUP, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    SYSTEM_USER_GROUP_ADD_MEMBER = (Permission(
+        group=Group.USER_GROUP, sub_group=Group.USER_GROUP, operate=Operate.ADD_MEMBER, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    SYSTEM_USER_GROUP_REMOVE_MEMBER = (Permission(
+        group=Group.USER_GROUP, sub_group=Group.USER_GROUP, operate=Operate.REMOVE_MEMBER, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    # ==================== 模型 ====================
+    MODEL_READ = (Permission(
+        group=Group.MODEL, sub_group=Group.MODEL, operate=Operate.READ, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.MODEL_VIEW]))
+
+    MODEL_CREATE = (Permission(
+        group=Group.MODEL, sub_group=Group.MODEL, operate=Operate.CREATE, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.MODEL_MANAGE]))
+
+    MODEL_EDIT = (Permission(
+        group=Group.MODEL, sub_group=Group.MODEL, operate=Operate.EDIT, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.MODEL_MANAGE]))
+
+    MODEL_DELETE = (Permission(
+        group=Group.MODEL, sub_group=Group.MODEL, operate=Operate.DELETE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.MODEL_MANAGE]))
+
+    MODEL_RESOURCE_AUTHORIZATION = (Permission(
+        group=Group.MODEL, sub_group=Group.MODEL, operate=Operate.AUTH, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.MODEL_MANAGE]))
+
+    MODEL_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.MODEL, sub_group=Group.MODEL, operate=Operate.RELATE_VIEW, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.MODEL_MANAGE]))
+
+    # ==================== 触发器 ====================
+    TRIGGER_READ = (Permission(
+        group=Group.TRIGGER, sub_group=Group.TRIGGER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.WORKSPACE))
+
+    TRIGGER_CREATE = (Permission(
+        group=Group.TRIGGER, sub_group=Group.TRIGGER, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.WORKSPACE))
+
+    TRIGGER_EDIT = (Permission(
+        group=Group.TRIGGER, sub_group=Group.TRIGGER, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.WORKSPACE))
+
+    TRIGGER_DELETE = (Permission(
+        group=Group.TRIGGER, sub_group=Group.TRIGGER, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.WORKSPACE))
+
+    TRIGGER_RECORD = (Permission(
+        group=Group.TRIGGER, sub_group=Group.TRIGGER, operate=Operate.RECORD, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.WORKSPACE))
+
+    # ==================== 工具 ====================
+    TOOL_READ = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.READ, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_VIEW]))
+
+    TOOL_CREATE = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.CREATE, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_BATCH_MOVE = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.BATCH_MOVE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_BATCH_DELETE = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.BATCH_DELETE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_EDIT = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.EDIT, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_DELETE = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.DELETE, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_IMPORT = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.IMPORT, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_EXPORT = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.EXPORT, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_RESOURCE_AUTHORIZATION = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.AUTH, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.RELATE_VIEW, bit_index=10
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_PUBLISH = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.PUBLISH, bit_index=11
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_EXECUTE_RECORD = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.RECORD, bit_index=12
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    # 工具触发器
+    TOOL_TRIGGER_READ = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.TRIGGER_READ, bit_index=13
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_TRIGGER_CREATE = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.TRIGGER_CREATE, bit_index=14
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_VIEW]))
+
+    TOOL_TRIGGER_EDIT = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.TRIGGER_EDIT, bit_index=15
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_VIEW]))
+
+    TOOL_TRIGGER_DELETE = (Permission(
+        group=Group.TOOL, sub_group=Group.TOOL, operate=Operate.TRIGGER_DELETE, bit_index=16
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_VIEW]))
+
+    # ==================== 工具文件夹 ====================
+    TOOL_FOLDER_READ = (Permission(
+        group=Group.TOOL, sub_group=Group.FOLDER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_VIEW]))
+
+    TOOL_FOLDER_CREATE = (Permission(
+        group=Group.TOOL, sub_group=Group.FOLDER, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_FOLDER_EDIT = (Permission(
+        group=Group.TOOL, sub_group=Group.FOLDER, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_FOLDER_DELETE = (Permission(
+        group=Group.TOOL, sub_group=Group.FOLDER, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    TOOL_FOLDER_AUTH = (Permission(
+        group=Group.TOOL, sub_group=Group.FOLDER, operate=Operate.AUTH, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.TOOL_MANAGE]))
+
+    # ==================== 知识库 ====================
+    KNOWLEDGE_READ = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.READ, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    KNOWLEDGE_CREATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.CREATE, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    KNOWLEDGE_EDIT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.EDIT, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DELETE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.DELETE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_SYNC = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.SYNC, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_EXPORT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.EXPORT, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_VECTOR = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.VECTOR, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_GENERATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.GENERATE, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_BATCH_DELETE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.BATCH_DELETE, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_BATCH_MOVE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.BATCH_MOVE, bit_index=10
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_RESOURCE_AUTHORIZATION = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.AUTH, bit_index=11
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.RELATE_VIEW, bit_index=12
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    # ==================== 知识库文件夹 ====================
+    KNOWLEDGE_FOLDER_READ = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.FOLDER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    KNOWLEDGE_FOLDER_CREATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.FOLDER, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_FOLDER_EDIT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.FOLDER, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_FOLDER_DELETE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.FOLDER, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_FOLDER_AUTH = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.FOLDER, operate=Operate.AUTH, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    # ==================== 知识库工作流 ====================
+    KNOWLEDGE_WORKFLOW_READ = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.WORKFLOW, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    KNOWLEDGE_WORKFLOW_EDIT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.WORKFLOW, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_WORKFLOW_EXPORT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.WORKFLOW, operate=Operate.EXPORT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_WORKFLOW_PUBLISH = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.WORKFLOW, operate=Operate.PUBLISH, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    # ==================== 知识库文档 ====================
+    KNOWLEDGE_DOCUMENT_READ = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    KNOWLEDGE_DOCUMENT_CREATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_EDIT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_DELETE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_SYNC = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.SYNC, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_EXPORT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.EXPORT, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_DOWNLOAD_SOURCE_FILE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.DOWNLOAD, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_GENERATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.GENERATE, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_VECTOR = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.VECTOR, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_MIGRATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.MIGRATE, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_TAG = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.TAG, bit_index=10
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_REPLACE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.REPLACE, bit_index=11
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_DOCUMENT_TOKEN = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.DOCUMENT, operate=Operate.TOKEN, bit_index=12
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    # ==================== 知识库命中测试 ====================
+    KNOWLEDGE_HIT_TEST = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.HIT_TEST, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    # ==================== 知识库问题 ====================
+    KNOWLEDGE_PROBLEM_READ = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.PROBLEM, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    KNOWLEDGE_PROBLEM_CREATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.PROBLEM, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_PROBLEM_EDIT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.PROBLEM, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_PROBLEM_DELETE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.PROBLEM, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_PROBLEM_RELATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.PROBLEM, operate=Operate.RELATE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    # ==================== 知识库术语库 ====================
+    KNOWLEDGE_TERMBASE_READ = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.TERMBASE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    KNOWLEDGE_TERMBASE_CREATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.TERMBASE, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_TERMBASE_EDIT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.TERMBASE, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_TERMBASE_DELETE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.TERMBASE, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    # ==================== 知识库标签 ====================
+    KNOWLEDGE_TAG_READ = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.TAG, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_TAG_CREATE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.TAG, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_TAG_EDIT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.TAG, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    KNOWLEDGE_TAG_DELETE = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.TAG, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    # ==================== 知识库对话用户 ====================
+    KNOWLEDGE_CHAT_USER_READ = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.CHAT_USER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_VIEW]))
+
+    KNOWLEDGE_CHAT_USER_EDIT = (Permission(
+        group=Group.KNOWLEDGE, sub_group=Group.CHAT_USER, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE]))
+
+    # ==================== 资源授权 ====================
+    APPLICATION_WORKSPACE_USER_RESOURCE_PERMISSION_READ = (Permission(
+        group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    APPLICATION_WORKSPACE_USER_RESOURCE_PERMISSION_EDIT = (Permission(
+        group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    KNOWLEDGE_WORKSPACE_USER_RESOURCE_PERMISSION_READ = (Permission(
+        group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    KNOWLEDGE_WORKSPACE_USER_RESOURCE_PERMISSION_EDIT = (Permission(
+        group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    TOOL_WORKSPACE_USER_RESOURCE_PERMISSION_READ = (Permission(
+        group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    TOOL_WORKSPACE_USER_RESOURCE_PERMISSION_EDIT = (Permission(
+        group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    MODEL_WORKSPACE_USER_RESOURCE_PERMISSION_READ = (Permission(
+        group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    MODEL_WORKSPACE_USER_RESOURCE_PERMISSION_EDIT = (Permission(
+        group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE], category=Category.IAM))
+
+    # ==================== 邮件设置 ====================
+    EMAIL_SETTING_READ = (Permission(
+        group=Group.EMAIL_SETTING, sub_group=Group.EMAIL_SETTING, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SYSTEM_SETTING))
+
+    EMAIL_SETTING_EDIT = (Permission(
+        group=Group.EMAIL_SETTING, sub_group=Group.EMAIL_SETTING, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SYSTEM_SETTING))
+
+    # ==================== 角色管理 ====================
+    ROLE_READ = (Permission(
+        group=Group.ROLE, sub_group=Group.ROLE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.IAM))
+
+    ROLE_CREATE = (Permission(
+        group=Group.ROLE, sub_group=Group.ROLE, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    ROLE_EDIT = (Permission(
+        group=Group.ROLE, sub_group=Group.ROLE, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    ROLE_DELETE = (Permission(
+        group=Group.ROLE, sub_group=Group.ROLE, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    ROLE_ADD_MEMBER = (Permission(
+        group=Group.ROLE, sub_group=Group.ROLE, operate=Operate.ADD_MEMBER, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    ROLE_REMOVE_MEMBER = (Permission(
+        group=Group.ROLE, sub_group=Group.ROLE, operate=Operate.REMOVE_MEMBER, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    # ==================== 工作空间角色管理 ====================
+    WORKSPACE_ROLE_READ = (Permission(
+        group=Group.WORKSPACE_ROLE, sub_group=Group.WORKSPACE_ROLE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    WORKSPACE_ROLE_ADD_MEMBER = (Permission(
+        group=Group.WORKSPACE_ROLE, sub_group=Group.WORKSPACE_ROLE, operate=Operate.ADD_MEMBER, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    WORKSPACE_ROLE_REMOVE_MEMBER = (Permission(
+        group=Group.WORKSPACE_ROLE, sub_group=Group.WORKSPACE_ROLE, operate=Operate.REMOVE_MEMBER, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    # ==================== 工作空间管理 ====================
+    WORKSPACE_READ = (Permission(
+        group=Group.WORKSPACE, sub_group=Group.WORKSPACE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.IAM, is_ee=True))
+
+    WORKSPACE_CREATE = (Permission(
+        group=Group.WORKSPACE, sub_group=Group.WORKSPACE, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, is_ee=True))
+
+    WORKSPACE_EDIT = (Permission(
+        group=Group.WORKSPACE, sub_group=Group.WORKSPACE, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, is_ee=True))
+
+    WORKSPACE_DELETE = (Permission(
+        group=Group.WORKSPACE, sub_group=Group.WORKSPACE, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, is_ee=True))
+
+    WORKSPACE_ADD_MEMBER = (Permission(
+        group=Group.WORKSPACE, sub_group=Group.WORKSPACE, operate=Operate.ADD_MEMBER, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, is_ee=True))
+
+    WORKSPACE_REMOVE_MEMBER = (Permission(
+        group=Group.WORKSPACE, sub_group=Group.WORKSPACE, operate=Operate.REMOVE_MEMBER, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, is_ee=True))
+
+    WORKSPACE_WORKSPACE_READ = (Permission(
+        group=Group.WORKSPACE_WORKSPACE, sub_group=Group.WORKSPACE_WORKSPACE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, is_ee=True))
+
+    WORKSPACE_WORKSPACE_ADD_MEMBER = (Permission(
+        group=Group.WORKSPACE_WORKSPACE, sub_group=Group.WORKSPACE_WORKSPACE, operate=Operate.ADD_MEMBER, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, is_ee=True))
+
+    WORKSPACE_WORKSPACE_REMOVE_MEMBER = (Permission(
+        group=Group.WORKSPACE_WORKSPACE, sub_group=Group.WORKSPACE_WORKSPACE, operate=Operate.REMOVE_MEMBER, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM, is_ee=True))
+
+    # ==================== 登录认证 ====================
+    LOGIN_AUTH_READ = (Permission(
+        group=Group.LOGIN_AUTH, sub_group=Group.LOGIN_AUTH, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SYSTEM_SETTING))
+
+    LOGIN_AUTH_EDIT = (Permission(
+        group=Group.LOGIN_AUTH, sub_group=Group.LOGIN_AUTH, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SYSTEM_SETTING))
+
+    # ==================== 应用 ====================
+    APPLICATION_READ = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.READ, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_VIEW]))
+
+    APPLICATION_CREATE = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.CREATE, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_COPY = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.COPY, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_EDIT = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.EDIT, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_DELETE = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.DELETE, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_IMPORT = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.IMPORT, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_EXPORT = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.EXPORT, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_PUBLISH = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.PUBLISH, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_BATCH_DELETE = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.BATCH_DELETE, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_BATCH_MOVE = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.BATCH_MOVE, bit_index=10
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_RESOURCE_AUTHORIZATION = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.AUTH, bit_index=11
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.RELATE_VIEW, bit_index=12
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    # 应用触发器
+    APPLICATION_TRIGGER_READ = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.TRIGGER_READ, bit_index=13
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE))
+
+    APPLICATION_TRIGGER_CREATE = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.TRIGGER_CREATE, bit_index=14
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE))
+
+    APPLICATION_TRIGGER_EDIT = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.TRIGGER_EDIT, bit_index=15
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE))
+
+    APPLICATION_TRIGGER_DELETE = (Permission(
+        group=Group.APPLICATION, sub_group=Group.APPLICATION, operate=Operate.TRIGGER_DELETE, bit_index=16
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE))
+
+    # ==================== 应用文件夹 ====================
+    APPLICATION_FOLDER_READ = (Permission(
+        group=Group.APPLICATION, sub_group=Group.FOLDER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_VIEW]))
+
+    APPLICATION_FOLDER_CREATE = (Permission(
+        group=Group.APPLICATION, sub_group=Group.FOLDER, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_FOLDER_EDIT = (Permission(
+        group=Group.APPLICATION, sub_group=Group.FOLDER, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_FOLDER_DELETE = (Permission(
+        group=Group.APPLICATION, sub_group=Group.FOLDER, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_FOLDER_AUTH = (Permission(
+        group=Group.APPLICATION, sub_group=Group.FOLDER, operate=Operate.AUTH, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    # ==================== 应用概览 ====================
+    APPLICATION_OVERVIEW_READ = (Permission(
+        group=Group.APPLICATION, sub_group=Group.OVERVIEW, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_VIEW]))
+
+    APPLICATION_OVERVIEW_EMBED = (Permission(
+        group=Group.APPLICATION, sub_group=Group.OVERVIEW, operate=Operate.EMBED, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_OVERVIEW_ACCESS = (Permission(
+        group=Group.APPLICATION, sub_group=Group.OVERVIEW, operate=Operate.ACCESS, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_OVERVIEW_DISPLAY = (Permission(
+        group=Group.APPLICATION, sub_group=Group.OVERVIEW, operate=Operate.DISPLAY, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_OVERVIEW_API_KEY = (Permission(
+        group=Group.APPLICATION, sub_group=Group.OVERVIEW, operate=Operate.API_KEY, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_OVERVIEW_PUBLIC = (Permission(
+        group=Group.APPLICATION, sub_group=Group.OVERVIEW, operate=Operate.PUBLIC_ACCESS, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    # ==================== 应用接入 ====================
+    APPLICATION_ACCESS_READ = (Permission(
+        group=Group.APPLICATION, sub_group=Group.ACCESS, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_VIEW]))
+
+    APPLICATION_ACCESS_EDIT = (Permission(
+        group=Group.APPLICATION, sub_group=Group.ACCESS, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    # ==================== 应用对话用户 ====================
+    APPLICATION_CHAT_USER_READ = (Permission(
+        group=Group.APPLICATION, sub_group=Group.CHAT_USER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_VIEW]))
+
+    APPLICATION_CHAT_USER_EDIT = (Permission(
+        group=Group.APPLICATION, sub_group=Group.CHAT_USER, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    # ==================== 应用对话日志 ====================
+    APPLICATION_CHAT_LOG_READ = (Permission(
+        group=Group.APPLICATION, sub_group=Group.CHAT_LOG, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_VIEW]))
+
+    APPLICATION_CHAT_LOG_ANNOTATION = (Permission(
+        group=Group.APPLICATION, sub_group=Group.CHAT_LOG, operate=Operate.ANNOTATION, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_CHAT_LOG_EXPORT = (Permission(
+        group=Group.APPLICATION, sub_group=Group.CHAT_LOG, operate=Operate.EXPORT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_CHAT_LOG_CLEAR_POLICY = (Permission(
+        group=Group.APPLICATION, sub_group=Group.CHAT_LOG, operate=Operate.CLEAR_POLICY, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    APPLICATION_CHAT_LOG_ADD_KNOWLEDGE = (Permission(
+        group=Group.APPLICATION, sub_group=Group.CHAT_LOG, operate=Operate.ADD_KNOWLEDGE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.RESOURCE,
+                      scope=PermissionScopeConstants.WORKSPACE_RESOURCE,
+                      resource_permission_group_list=[ResourcePermissionConst.APPLICATION_MANAGE]))
+
+    # ==================== 其他 ====================
+    ABOUT_READ = (Permission(
+        group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.SYSTEM_SETTING))
+
+    ABOUT_UPDATE = (Permission(
+        group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.UPDATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SYSTEM_SETTING))
+
+    SWITCH_LANGUAGE = (Permission(
+        group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.SYSTEM_SETTING))
+
+    CHANGE_PASSWORD = (Permission(
+        group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.CREATE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.SYSTEM_SETTING))
+
+    SYSTEM_API_KEY_EDIT = (Permission(
+        group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.DELETE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN, RoleConstants.USER], category=Category.SYSTEM_SETTING))
+
+    # ==================== 外观设置 ====================
+    APPEARANCE_SETTINGS_READ = (Permission(
+        group=Group.APPEARANCE_SETTINGS, sub_group=Group.APPEARANCE_SETTINGS, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SYSTEM_SETTING))
+
+    APPEARANCE_SETTINGS_EDIT = (Permission(
+        group=Group.APPEARANCE_SETTINGS, sub_group=Group.APPEARANCE_SETTINGS, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SYSTEM_SETTING))
+
+    # ==================== 对话用户 ====================
+    CHAT_USER_READ = (Permission(
+        group=Group.CHAT_USER, sub_group=Group.CHAT_USER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    CHAT_USER_CREATE = (Permission(
+        group=Group.CHAT_USER, sub_group=Group.CHAT_USER, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    CHAT_USER_SYNC = (Permission(
+        group=Group.CHAT_USER, sub_group=Group.CHAT_USER, operate=Operate.SYNC, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    CHAT_USER_EDIT = (Permission(
+        group=Group.CHAT_USER, sub_group=Group.CHAT_USER, operate=Operate.EDIT, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    CHAT_USER_DELETE = (Permission(
+        group=Group.CHAT_USER, sub_group=Group.CHAT_USER, operate=Operate.DELETE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    CHAT_USER_GROUP = (Permission(
+        group=Group.CHAT_USER, sub_group=Group.CHAT_USER, operate=Operate.USER_GROUP, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    # ==================== 对话用户组 ====================
+    USER_GROUP_READ = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    USER_GROUP_CREATE = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    USER_GROUP_EDIT = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    USER_GROUP_DELETE = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    USER_GROUP_ADD_MEMBER = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.ADD_MEMBER, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    USER_GROUP_REMOVE_MEMBER = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.REMOVE_MEMBER, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    CHAT_USER_AUTH_READ = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.READ, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    # ==================== 对话用户认证 ====================
+    CHAT_USER_AUTH_EDIT = (Permission(
+        group=Group.CHAT_USER_AUTH, sub_group=Group.CHAT_USER_AUTH, operate=Operate.EDIT, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    # ==================== 工作空间对话用户 ====================
+    WORKSPACE_CHAT_USER_READ = (Permission(
+        group=Group.WORKSPACE_CHAT_USER, sub_group=Group.WORKSPACE_CHAT_USER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    WORKSPACE_CHAT_USER_CREATE = (Permission(
+        group=Group.WORKSPACE_CHAT_USER, sub_group=Group.WORKSPACE_CHAT_USER, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    WORKSPACE_CHAT_USER_EDIT = (Permission(
+        group=Group.WORKSPACE_CHAT_USER, sub_group=Group.WORKSPACE_CHAT_USER, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    WORKSPACE_CHAT_USER_DELETE = (Permission(
+        group=Group.WORKSPACE_CHAT_USER, sub_group=Group.WORKSPACE_CHAT_USER, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    WORKSPACE_CHAT_USER_GROUP = (Permission(
+        group=Group.WORKSPACE_CHAT_USER, sub_group=Group.WORKSPACE_CHAT_USER, operate=Operate.USER_GROUP, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    # ==================== 工作空间对话用户组 ====================
+    WORKSPACE_USER_GROUP_READ = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.READ, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    WORKSPACE_USER_GROUP_CREATE = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.CREATE, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    WORKSPACE_USER_GROUP_EDIT = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.EDIT, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    WORKSPACE_USER_GROUP_DELETE = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.DELETE, bit_index=10
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    WORKSPACE_USER_GROUP_ADD_MEMBER = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.ADD_MEMBER, bit_index=11
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    WORKSPACE_USER_GROUP_REMOVE_MEMBER = (Permission(
+        group=Group.CHAT_USER_GROUP, sub_group=Group.CHAT_USER_GROUP, operate=Operate.REMOVE_MEMBER, bit_index=12
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.CHAT_CLIENT))
+
+    # ==================== 工作空间用户组 ====================
+    WORKSPACE_SYSTEM_USER_GROUP_READ = (Permission(
+        group=Group.WORKSPACE_USER_GROUP, sub_group=Group.WORKSPACE_USER_GROUP, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    WORKSPACE_SYSTEM_USER_GROUP_CREATE = (Permission(
+        group=Group.WORKSPACE_USER_GROUP, sub_group=Group.WORKSPACE_USER_GROUP, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    WORKSPACE_SYSTEM_USER_GROUP_EDIT = (Permission(
+        group=Group.WORKSPACE_USER_GROUP, sub_group=Group.WORKSPACE_USER_GROUP, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    WORKSPACE_SYSTEM_USER_GROUP_DELETE = (Permission(
+        group=Group.WORKSPACE_USER_GROUP, sub_group=Group.WORKSPACE_USER_GROUP, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    WORKSPACE_SYSTEM_USER_GROUP_ADD_MEMBER = (Permission(
+        group=Group.WORKSPACE_USER_GROUP, sub_group=Group.WORKSPACE_USER_GROUP, operate=Operate.ADD_MEMBER, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    WORKSPACE_SYSTEM_USER_GROUP_REMOVE_MEMBER = (Permission(
+        group=Group.WORKSPACE_USER_GROUP, sub_group=Group.WORKSPACE_USER_GROUP, operate=Operate.REMOVE_MEMBER,
+        bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.IAM))
+
+    # ==================== 共享工具 ====================
+    SHARED_TOOL_READ = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_TOOL_CREATE = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_TOOL_EDIT = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_TOOL_DELETE = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_TOOL_IMPORT = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.IMPORT, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_TOOL_EXPORT = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.EXPORT, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_TOOL_PUBLISH = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.PUBLISH, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_TOOL_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.RELATE_VIEW, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_TOOL_EXECUTE_RECORD = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.RECORD, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_TOOL_TO_WORKSPACE = (Permission(
+        group=Group.SYSTEM_TOOL, sub_group=Group.SYSTEM_TOOL, operate=Operate.TO_WORKSPACE, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # ==================== 共享知识库 ====================
+    SHARED_KNOWLEDGE_READ = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_CREATE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_EDIT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_SYNC = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.SYNC, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_VECTOR = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.VECTOR, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_EXPORT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.EXPORT, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_GENERATE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.GENERATE, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DELETE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.DELETE, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.RELATE_VIEW, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_TO_WORKSPACE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_KNOWLEDGE, operate=Operate.TO_WORKSPACE, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # 共享知识库工作流
+    SHARED_KNOWLEDGE_WORKFLOW_READ = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_WORKFLOW, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_WORKFLOW_EDIT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_WORKFLOW, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_WORKFLOW_EXPORT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_WORKFLOW, operate=Operate.EXPORT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_WORKFLOW_PUBLISH = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_WORKFLOW, operate=Operate.PUBLISH, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # 共享知识库文档
+    SHARED_KNOWLEDGE_DOCUMENT_READ = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_CREATE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_EDIT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_DELETE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_SYNC = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.SYNC, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_EXPORT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.EXPORT, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_DOWNLOAD_SOURCE_FILE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.DOWNLOAD, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_GENERATE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.GENERATE, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_VECTOR = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.VECTOR, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_MIGRATE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.MIGRATE, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_TAG = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.TAG, bit_index=10
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_REPLACE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.REPLACE, bit_index=11
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_DOCUMENT_TOKEN = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.TOKEN, bit_index=12
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # 共享知识库标签
+    SHARED_KNOWLEDGE_TAG_READ = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_TAG, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_TAG_CREATE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_TAG, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_TAG_EDIT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_TAG, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_TAG_DELETE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_TAG, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # 共享知识库问题
+    SHARED_KNOWLEDGE_PROBLEM_READ = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_PROBLEM_CREATE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_PROBLEM_EDIT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_PROBLEM_DELETE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_PROBLEM_RELATE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.RELATE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # 共享知识库术语库
+    SHARED_KNOWLEDGE_TERMBASE_READ = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_TERMBASE_CREATE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_TERMBASE_EDIT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_TERMBASE_DELETE = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_TERMBASE_EXPORT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.EXPORT, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # 共享知识库命中测试
+    SHARED_KNOWLEDGE_HIT_TEST = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_HIT_TEST, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # 共享知识库对话用户
+    SHARED_KNOWLEDGE_CHAT_USER_READ = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_CHAT_USER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_KNOWLEDGE_CHAT_USER_EDIT = (Permission(
+        group=Group.SYSTEM_KNOWLEDGE, sub_group=Group.SYSTEM_CHAT_USER, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # ==================== 共享模型 ====================
+    SHARED_MODEL_READ = (Permission(
+        group=Group.SYSTEM_MODEL, sub_group=Group.SYSTEM_MODEL, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_MODEL_CREATE = (Permission(
+        group=Group.SYSTEM_MODEL, sub_group=Group.SYSTEM_MODEL, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_MODEL_EDIT = (Permission(
+        group=Group.SYSTEM_MODEL, sub_group=Group.SYSTEM_MODEL, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_MODEL_DELETE = (Permission(
+        group=Group.SYSTEM_MODEL, sub_group=Group.SYSTEM_MODEL, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_MODEL_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.SYSTEM_MODEL, sub_group=Group.SYSTEM_MODEL, operate=Operate.RELATE_VIEW, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    SHARED_MODEL_TO_WORKSPACE = (Permission(
+        group=Group.SYSTEM_MODEL, sub_group=Group.SYSTEM_MODEL, operate=Operate.TO_WORKSPACE, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.SHARED, is_ee=True))
+
+    # ==================== 资源管理 - 应用 ====================
+    RESOURCE_APPLICATION_READ = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_EDIT = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_DELETE = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.DELETE, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_EXPORT = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.EXPORT, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_COPY = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.COPY, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_AUTH = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.AUTH, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_PUBLISH = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.PUBLISH, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_TRIGGER_READ = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.TRIGGER_READ,
+        bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_TRIGGER_CREATE = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.TRIGGER_CREATE,
+        bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_TRIGGER_EDIT = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.TRIGGER_EDIT,
+        bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_TRIGGER_DELETE = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.TRIGGER_DELETE,
+        bit_index=10
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_RES_APPLICATION, operate=Operate.RELATE_VIEW,
+        bit_index=11
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 应用概览
+    RESOURCE_APPLICATION_OVERVIEW_READ = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_OVERVIEW, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_OVERVIEW_EMBED = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_OVERVIEW, operate=Operate.EMBED, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_OVERVIEW_ACCESS = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_OVERVIEW, operate=Operate.ACCESS, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_OVERVIEW_DISPLAY = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_OVERVIEW, operate=Operate.DISPLAY, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_OVERVIEW_API_KEY = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_OVERVIEW, operate=Operate.API_KEY, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_OVERVIEW_PUBLIC = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_OVERVIEW, operate=Operate.PUBLIC_ACCESS, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 应用接入
+    RESOURCE_APPLICATION_ACCESS_READ = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_ACCESS, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_ACCESS_EDIT = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_ACCESS, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 应用对话用户
+    RESOURCE_APPLICATION_CHAT_USER_READ = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_CHAT_USER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_CHAT_USER_EDIT = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_CHAT_USER, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 应用对话日志
+    RESOURCE_APPLICATION_CHAT_LOG_READ = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_CHAT_LOG, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_CHAT_LOG_ADD_KNOWLEDGE = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_CHAT_LOG, operate=Operate.ADD_KNOWLEDGE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_CHAT_LOG_ANNOTATION = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_CHAT_LOG, operate=Operate.ANNOTATION, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_CHAT_LOG_EXPORT = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_CHAT_LOG, operate=Operate.EXPORT, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_APPLICATION_CHAT_LOG_CLEAR_POLICY = (Permission(
+        group=Group.SYSTEM_RES_APPLICATION, sub_group=Group.SYSTEM_CHAT_LOG, operate=Operate.CLEAR_POLICY, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # ==================== 资源管理 - 知识库 ====================
+    RESOURCE_KNOWLEDGE_READ = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_EDIT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DELETE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.DELETE, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_SYNC = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.SYNC, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_EXPORT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.EXPORT, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_PUBLISH = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.PUBLISH, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_VECTOR = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.VECTOR, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_GENERATE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.GENERATE, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_AUTH = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.AUTH, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_RES_KNOWLEDGE, operate=Operate.RELATE_VIEW, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 知识库工作流
+    RESOURCE_KNOWLEDGE_WORKFLOW_READ = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_WORKFLOW, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_WORKFLOW_EDIT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_WORKFLOW, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_WORKFLOW_EXPORT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_WORKFLOW, operate=Operate.EXPORT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_WORKFLOW_PUBLISH = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_WORKFLOW, operate=Operate.PUBLISH, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 知识库文档
+    RESOURCE_KNOWLEDGE_DOCUMENT_READ = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_CREATE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_EDIT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_DELETE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_SYNC = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.SYNC, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_EXPORT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.EXPORT, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_DOWNLOAD_SOURCE_FILE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.DOWNLOAD, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_GENERATE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.GENERATE, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_VECTOR = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.VECTOR, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_MIGRATE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.MIGRATE, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_TAG = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.TAG, bit_index=10
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_REPLACE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.REPLACE, bit_index=11
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_DOCUMENT_TOKEN = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_DOCUMENT, operate=Operate.TOKEN, bit_index=12
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 知识库命中测试
+    RESOURCE_KNOWLEDGE_HIT_TEST = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_HIT_TEST, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 知识库问题
+    RESOURCE_KNOWLEDGE_PROBLEM_READ = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_PROBLEM_CREATE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_PROBLEM_EDIT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_PROBLEM_DELETE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_PROBLEM_RELATE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_PROBLEM, operate=Operate.RELATE, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 知识库术语库
+    RESOURCE_KNOWLEDGE_TERMBASE_READ = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_TERMBASE_CREATE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_TERMBASE_EDIT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_TERMBASE_DELETE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_TERMBASE_EXPORT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_TERMBASE, operate=Operate.EXPORT, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 知识库标签
+    RESOURCE_KNOWLEDGE_TAG_READ = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_TAG, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_TAG_CREATE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_TAG, operate=Operate.CREATE, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_TAG_EDIT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_TAG, operate=Operate.EDIT, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_TAG_DELETE = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_TAG, operate=Operate.DELETE, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # 资源管理 - 知识库对话用户
+    RESOURCE_KNOWLEDGE_CHAT_USER_READ = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_CHAT_USER, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_KNOWLEDGE_CHAT_USER_EDIT = (Permission(
+        group=Group.SYSTEM_RES_KNOWLEDGE, sub_group=Group.SYSTEM_CHAT_USER, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # ==================== 资源管理 - 工具 ====================
+    RESOURCE_TOOL_READ = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_EDIT = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_DELETE = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.DELETE, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_EXPORT = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.EXPORT, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_PUBLISH = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.PUBLISH, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_AUTH = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.AUTH, bit_index=5
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.RELATE_VIEW, bit_index=6
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_EXECUTE_RECORD = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.RECORD, bit_index=7
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_TRIGGER_READ = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.TRIGGER_READ, bit_index=8
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_TRIGGER_CREATE = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.TRIGGER_CREATE, bit_index=9
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_TRIGGER_EDIT = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.TRIGGER_EDIT, bit_index=10
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_TOOL_TRIGGER_DELETE = (Permission(
+        group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.TRIGGER_DELETE, bit_index=11
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # ==================== 资源管理 - 模型 ====================
+    RESOURCE_MODEL_READ = (Permission(
+        group=Group.SYSTEM_RES_MODEL, sub_group=Group.SYSTEM_RES_MODEL, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_MODEL_EDIT = (Permission(
+        group=Group.SYSTEM_RES_MODEL, sub_group=Group.SYSTEM_RES_MODEL, operate=Operate.EDIT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_MODEL_DELETE = (Permission(
+        group=Group.SYSTEM_RES_MODEL, sub_group=Group.SYSTEM_RES_MODEL, operate=Operate.DELETE, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_MODEL_AUTH = (Permission(
+        group=Group.SYSTEM_RES_MODEL, sub_group=Group.SYSTEM_RES_MODEL, operate=Operate.AUTH, bit_index=3
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    RESOURCE_MODEL_RELATE_RESOURCE_VIEW = (Permission(
+        group=Group.SYSTEM_RES_MODEL, sub_group=Group.SYSTEM_RES_MODEL, operate=Operate.RELATE_VIEW, bit_index=4
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.RESOURCE, is_ee=True))
+
+    # ==================== 操作日志 ====================
+    OPERATION_LOG_READ = (Permission(
+        group=Group.OPERATION_LOG, sub_group=Group.OPERATION_LOG, operate=Operate.READ, bit_index=0
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.OPERATION_LOG))
+
+    OPERATION_LOG_EXPORT = (Permission(
+        group=Group.OPERATION_LOG, sub_group=Group.OPERATION_LOG, operate=Operate.EXPORT, bit_index=1
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.OPERATION_LOG))
+
+    OPERATION_LOG_CLEAR_POLICY = (Permission(
+        group=Group.OPERATION_LOG, sub_group=Group.OPERATION_LOG, operate=Operate.CLEAR_POLICY, bit_index=2
+    ), PermissionMeta(role_list=[RoleConstants.ADMIN], category=Category.OPERATION_LOG))
+
+    def __init__(self, value, meta):
+        self._value_ = value
+        self.meta = meta
+
+    def _build_workspace_permission(self, resource_id_key=None):
+        def permission_factory(_, kwargs):
+            return Permission(group=self.value.group,
+                              sub_group=self.value.sub_group,
+                              operate=self.value.operate,
+                              bit_index=self.value.bit_index,
+                              workspace_id=kwargs.get('workspace_id'),
+                              resource_id=kwargs.get(resource_id_key) if resource_id_key else None)
+
+        return permission_factory
+
+    def get_workspace_application_permission(self):
+        return self._build_workspace_permission(resource_id_key="application_id")
+
+    def get_workspace_knowledge_permission(self):
+        return self._build_workspace_permission(resource_id_key="knowledge_id")
+
+    def get_workspace_model_permission(self):
+        return self._build_workspace_permission(resource_id_key="model_id")
+
+    def get_workspace_tool_permission(self):
+        return self._build_workspace_permission(resource_id_key="tool_id")
+
+    def get_workspace_permission(self):
+        return self._build_workspace_permission()
+
+    def get_workspace_permission_workspace_manage_role(self):
+        """
+        工作空间管理员的特权权限
+        @return:  工作空间管理员特权权限
+        """
+
+        def permission_factory(_, kwargs):
+            return Permission(group=self.value.group,
+                              sub_group=self.value.sub_group,
+                              operate=self.value.operate,
+                              bit_index=self.value.bit_index,
+                              workspace_id=kwargs.get('workspace_id'),
+                              flag=RoleConstants.WORKSPACE_MANAGE.value)
+
+        return permission_factory
+
+
+def group_by_all_resource_permissions() -> Dict[str, List[Permission]]:
+    grouped = {}
+
+    for _permission in PermissionConstants:
+        meta = _permission.meta
+        if meta.resource_permission_group_list:
+            for group in meta.resource_permission_group_list:
+                _array = grouped.get(str(group)) or []
+                _array.append(_permission)
+                grouped[str(group)] = _array
+    return dict(grouped)
+
+
+def group_permissions_by_scope() -> Dict[str, List[Permission]]:
+    grouped = {}
+
+    for _permission in PermissionConstants:
+        permission = _permission.value
+        meta = _permission.meta
+        if meta.scope:
+            _array = grouped.get(meta.scope) or []
+            _array.append(_permission)
+            grouped[meta.scope] = _array
+    return dict(grouped)
+
+
+# 权限字符串与权限对象的Map
+PERMISSION_STR_MAP = {
+    _permission.value.__str__(): _permission for _permission in PermissionConstants
+}
+
+# 资源组Map
+RESOURCE_PERMISSION_MAP = group_by_all_resource_permissions()
+
+# 权限 SCOPE Map
+SCOPE_PERMISSION_MAP = group_permissions_by_scope()
diff --git a/apps/common/auth/constants/permission_scope_constants.py b/apps/common/auth/constants/permission_scope_constants.py
new file mode 100644
index 00000000000..122057f7825
--- /dev/null
+++ b/apps/common/auth/constants/permission_scope_constants.py
@@ -0,0 +1,15 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： permission_scope_constants.py
+    @date：2026/8/4 11:50
+    @desc:
+"""
+from enum import Enum
+
+
+class PermissionScopeConstants(Enum):
+    SYSTEM = 'SYSTEM'
+    WORKSPACE = 'WORKSPACE'
+    WORKSPACE_RESOURCE = 'WORKSPACE_RESOURCE'
diff --git a/apps/common/auth/constants/resource_auth_type_constants.py b/apps/common/auth/constants/resource_auth_type_constants.py
new file mode 100644
index 00000000000..c8079fa0eca
--- /dev/null
+++ b/apps/common/auth/constants/resource_auth_type_constants.py
@@ -0,0 +1,21 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： resource_auth_type_constants.py
+    @date：2026/8/4 15:31
+    @desc:
+"""
+
+from django.db import models
+
+
+class ResourceAuthType(models.TextChoices):
+    """
+    资源授权类型
+    """
+    "当授权类型是Role时候"
+    ROLE = "ROLE"
+
+    """资源权限组"""
+    RESOURCE_PERMISSION_GROUP = "RESOURCE_PERMISSION_GROUP"
diff --git a/apps/common/auth/constants/role_constants.py b/apps/common/auth/constants/role_constants.py
new file mode 100644
index 00000000000..94b250b9522
--- /dev/null
+++ b/apps/common/auth/constants/role_constants.py
@@ -0,0 +1,34 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： role_constants.py
+    @date：2026/8/4 9:50
+    @desc:
+"""
+from enum import Enum
+
+from common.auth.constants.role_group import RoleGroup
+from common.auth.struct.permission import Role, RoleMeta
+
+
+class RoleConstants(Enum):
+    ADMIN = (Role("ADMIN"), RoleMeta('系统管理员', RoleGroup.SYSTEM_USER))
+    WORKSPACE_MANAGE = (Role("WORKSPACE_MANAGE"), RoleMeta('工作空间管理员', RoleGroup.SYSTEM_USER))
+    USER = (Role("USER"), RoleMeta('普通用户', RoleGroup.SYSTEM_USER))
+    EXTENDS_ADMIN = (Role("EXTENDS_ADMIN"), RoleMeta('继承系统管理员', RoleGroup.SYSTEM_USER))
+    EXTENDS_WORKSPACE_MANAGE = (Role("EXTENDS_WORKSPACE_MANAGE"), RoleMeta('继承工作空间管理员', RoleGroup.SYSTEM_USER))
+    EXTENDS_USER = (Role("EXTENDS_USER"), RoleMeta('继承普通用户', RoleGroup.SYSTEM_USER))
+
+    CHAT_ANONYMOUS_USER = (Role("CHAT_ANONYMOUS_USER"), RoleMeta('对话匿名用户', RoleGroup.CHAT_USER))
+    CHAT_USER = (Role("CHAT_USER"), RoleMeta('对话用户', RoleGroup.CHAT_USER))
+
+    def __init__(self, value, meta):
+        self._value_ = value
+        self.meta = meta
+
+    def __str__(self):
+        return self.value.__str__()
+
+    def get_workspace_role(self):
+        return lambda r, kwargs: Role(self.value.name, kwargs.get('workspace_id'))
diff --git a/apps/common/auth/constants/role_group.py b/apps/common/auth/constants/role_group.py
new file mode 100644
index 00000000000..95abccd2ef1
--- /dev/null
+++ b/apps/common/auth/constants/role_group.py
@@ -0,0 +1,16 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： role_group.py
+    @date：2026/8/4 9:57
+    @desc:
+"""
+from enum import Enum
+
+
+class RoleGroup(Enum):
+    # 系统用户
+    SYSTEM_USER = "SYSTEM_USER"
+    # 对话用户
+    CHAT_USER = "CHAT_USER"
diff --git a/apps/common/auth/handle/impl/application_key.py b/apps/common/auth/handle/impl/application_key.py
index 259f21b872d..bd5cbd074b4 100644
--- a/apps/common/auth/handle/impl/application_key.py
+++ b/apps/common/auth/handle/impl/application_key.py
@@ -12,7 +12,7 @@
 
 from application.models import ApplicationApiKey, ChatUserType, ApplicationAccessToken
 from common.auth.handle.auth_base_handle import AuthBaseHandle
-from common.constants.permission_constants import Permission, Group, Operate, RoleConstants, ChatAuth
+from common.auth.struct.auth import Principal, Auth
 from common.exception.app_exception import AppAuthenticationFailed
 
 
@@ -32,14 +32,7 @@ def handle(self, request, token: str, get_token_details):
                 if application_access_token.authentication_value.get('type',
                                                                      'password') != 'password':
                     raise AppAuthenticationFailed(1002, _('Authentication information is incorrect'))
-        return None, ChatAuth(
-            current_role_list=[RoleConstants.CHAT_ANONYMOUS_USER],
-            permission_list=[
-                Permission(group=Group.APPLICATION,
-                           operate=Operate.READ)],
-            application_id=application_api_key.application_id,
-            chat_user_id=str(application_api_key.id),
-            chat_user_type=ChatUserType.APPLICATION_API_KEY.value)
+        return Principal(str(application_api_key.id), ChatUserType.APPLICATION_API_KEY), Auth(set(), {})
 
     def support(self, request, token: str, get_token_details):
         return str(token).startswith("application-") or str(token).startswith('agent-')
diff --git a/apps/common/auth/handle/impl/chat_anonymous_user_token.py b/apps/common/auth/handle/impl/chat_anonymous_user_token.py
index 7d8cc56e533..9810f9ebae4 100644
--- a/apps/common/auth/handle/impl/chat_anonymous_user_token.py
+++ b/apps/common/auth/handle/impl/chat_anonymous_user_token.py
@@ -12,9 +12,8 @@
 from application.models import ApplicationAccessToken
 from common.auth.common import ChatUserToken
 from common.auth.handle.auth_base_handle import AuthBaseHandle
-from common.constants.authentication_type import AuthenticationType
-from common.constants.permission_constants import RoleConstants, Permission, Group, Operate, ChatAuth
-from common.database_model_manage.database_model_manage import DatabaseModelManage
+from common.auth.struct.auth import Principal, Auth
+from common.constants.authentication_type import AuthenticationType, ChatUserType
 from common.exception.app_exception import AppAuthenticationFailed
 from maxkb.settings import edition
 
@@ -46,11 +45,5 @@ def handle(self, request, token: str, get_token_details):
             if chat_user_token.authentication.auth_type != application_access_token.authentication_value.get('type',
                                                                                                              ''):
                 raise AppAuthenticationFailed(1002, _('Authentication information is incorrect'))
-        return None, ChatAuth(
-            current_role_list=[RoleConstants.CHAT_ANONYMOUS_USER],
-            permission_list=[
-                Permission(group=Group.APPLICATION,
-                           operate=Operate.USE)],
-            application_id=application_access_token.application_id,
-            chat_user_id=chat_user_token.chat_user_id,
-            chat_user_type=chat_user_token.chat_user_type)
+
+        return Principal(chat_user_token.chat_user_id, ChatUserType.ANONYMOUS_USER), Auth(set(), {})
diff --git a/apps/common/auth/handle/impl/user_token.py b/apps/common/auth/handle/impl/user_token.py
index 18dd9d074df..7e7beaca19e 100644
--- a/apps/common/auth/handle/impl/user_token.py
+++ b/apps/common/auth/handle/impl/user_token.py
@@ -7,171 +7,46 @@
     @desc:  用户认证
 """
 from functools import reduce
-from typing import List
 
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.utils.translation import gettext_lazy as _
 
+from common.auth.constants.permission_constants import RESOURCE_PERMISSION_MAP, PERMISSION_STR_MAP
+from common.auth.constants.permission_scope_constants import PermissionScopeConstants
+from common.constants.resource_permission_constants import ResourceAuthType
+from common.auth.constants.role_constants import RoleConstants
 from common.auth.handle.auth_base_handle import AuthBaseHandle
-from common.constants.authentication_type import AuthenticationType
+from common.auth.struct.auth import Auth, Principal
+from common.constants.authentication_type import AuthenticationType, UserType
 from common.constants.cache_version import Cache_Version
-from common.constants.permission_constants import Auth, PermissionConstants, ResourcePermissionGroup, \
-    get_permission_list_by_resource_group, ResourceAuthType, \
-    ResourcePermissionRole, get_default_role_permission_mapping_list, get_default_workspace_user_role_mapping_list, \
-    RoleConstants, ResourcePermission, Resource, WorkspaceGroup
+
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.exception.app_exception import AppAuthenticationFailed
-from common.utils.common import group_by
+from common.utils.common import group_by, flat_map
 from maxkb.const import CONFIG
+from system_manage.models.workspace_user_group_permission import WorkspaceUserGroupResourcePermission
 from system_manage.models.workspace_user_permission import WorkspaceUserResourcePermission
 from users.models import User
 
-permission_constants_dict = {p.value.__str__(): p for p in PermissionConstants}
-
-def get_permission(permission_id):
-    """
-    获取权限字符串
-    @param permission_id: 权限id
-    @return:  权限字符串
-    """
-    if isinstance(permission_id, PermissionConstants):
-        permission_id = permission_id.value
-    return f"{permission_id}"
-
-
-def get_workspace_permission(permission_id, workspace_id, role=None):
-    """
-    获取工作空间权限字符串
-    @param permission_id: 权限id
-    @param workspace_id:  工作空间id
-    @param role:     角色
-    @return:
-    """
-    if isinstance(permission_id, PermissionConstants):
-        permission_id = permission_id.value
-    if role and role.type == RoleConstants.WORKSPACE_MANAGE.value.__str__():
-        return [f"{permission_id}:/WORKSPACE/{workspace_id}:ROLE/{role.type}",
-                f"{permission_id}:/WORKSPACE/{workspace_id}"]
-    return [f"{permission_id}:/WORKSPACE/{workspace_id}"]
-
-
-def get_role_permission(role, workspace_id):
-    """
-    获取工作空间角色
-    @param role:  角色
-    @param workspace_id: 工作空间id
-    @return:
-    """
-    if isinstance(role, RoleConstants):
-        role = role.value
-    return f"{role}:/WORKSPACE/{workspace_id}"
-
-
-def get_workspace_permission_list(role_permission_mapping_dict, workspace_user_role_mapping_list, role_model_dict):
-    """
-    获取工作空间下所有的权限
-    @param role_permission_mapping_dict:   角色权限关联字典
-    @param workspace_user_role_mapping_list: 工作空间用户角色关联列表
-    @param role_model_dict:         角色字典
-    @return: 工作空间下的权限
-    """
-    workspace_permission_list = [
-        [get_workspace_permission(role_permission_mapping.permission_id, w_u_r.workspace_id,
-                                  role_model_dict.get(w_u_r.role_id, None)) for role_permission_mapping
-         in
-         role_permission_mapping_dict.get(w_u_r.role_id, [])] for w_u_r in workspace_user_role_mapping_list]
-    return reduce(lambda x, y: [*x, *y], reduce(lambda x, y: [*x, *y], workspace_permission_list, []), [])
 
-
-def get_workspace_resource_permission_list(
-        workspace_user_resource_permission_list: List[WorkspaceUserResourcePermission],
-        role_permission_mapping_dict,
-        workspace_user_role_mapping_dict):
-    """
-
-    @param workspace_user_resource_permission_list: 工作空间用户资源权限列表
-    @param role_permission_mapping_dict:            角色权限关联字典        key为role_id
-    @param workspace_user_role_mapping_dict:        工作空间用户角色映射字典  key为role_id
-    @return: 工作空间资源权限列表
-    """
-    resource_permission_list = [
-        get_workspace_resource_permission_list_by_workspace_user_permission(workspace_user_resource_permission,
-                                                                            role_permission_mapping_dict,
-                                                                            workspace_user_role_mapping_dict) for
-        workspace_user_resource_permission in workspace_user_resource_permission_list]
-    # 将二维数组扁平为一维
-    return reduce(lambda x, y: [*x, *y], resource_permission_list, [])
-
-
-def get_workspace_resource_permission_list_by_workspace_user_permission(
-        workspace_user_resource_permission: WorkspaceUserResourcePermission,
-        role_permission_mapping_dict,
-        workspace_user_role_mapping_dict):
-    """
-
-    @param workspace_user_resource_permission: 工作空间用户资源权限对象
-    @param role_permission_mapping_dict:       角色权限关联字典            key为role_id
-    @param workspace_user_role_mapping_dict:   工作空间用户角色关联字典  key为role_id
-    @return: 工作空间用户资源的权限列表
-    """
-    # 判断用户在当前工作空间是否为内置USER
-    workspace_role_ids = [
-        wur.role_id
-        for wur in
-        workspace_user_role_mapping_dict.get(workspace_user_resource_permission.workspace_id,[])
-    ]
-    is_builtin_user = RoleConstants.USER.value.__str__() in workspace_role_ids
-
-    role_permission_mapping_list = [role_permission_mapping_dict.get(workspace_user_role_mapping.role_id, []) for
-                                    workspace_user_role_mapping in
-                                    workspace_user_role_mapping_dict.get(
-                                        workspace_user_resource_permission.workspace_id)]
-    role_permission_mapping_list = reduce(lambda x, y: [*x, *y], role_permission_mapping_list, [])
-    # 如果是根据角色
-    if (workspace_user_resource_permission.auth_type == ResourceAuthType.ROLE
-            and workspace_user_resource_permission.permission_list.__contains__(
-                ResourcePermissionRole.ROLE)):
-        per_op_permissions = [
-            f"{role_permission_mapping.permission_id}:/WORKSPACE/{workspace_user_resource_permission.workspace_id}/{workspace_user_resource_permission.auth_target_type}/{workspace_user_resource_permission.target}"
-            for role_permission_mapping in role_permission_mapping_list if (permission_constants_dict.get(role_permission_mapping.permission_id).value.parent_group or []).__contains__(
-                                        WorkspaceGroup(workspace_user_resource_permission.auth_target_type))]
-        if is_builtin_user:
-            per_op_permissions.append(
-                f"{workspace_user_resource_permission.auth_target_type}:/WORKSPACE/{workspace_user_resource_permission.workspace_id}/{workspace_user_resource_permission.auth_target_type}/{workspace_user_resource_permission.target}"
-            )
-        return per_op_permissions
-    elif workspace_user_resource_permission.auth_type == ResourceAuthType.RESOURCE_PERMISSION_GROUP:
-        resource_permission_list = [
-            [
-                f"{permission}:/WORKSPACE/{workspace_user_resource_permission.workspace_id}/{workspace_user_resource_permission.auth_target_type}/{workspace_user_resource_permission.target}"
-                for permission in get_permission_list_by_resource_group(
-                ResourcePermissionGroup(Resource(workspace_user_resource_permission.auth_target_type),
-                                        ResourcePermission(resource_permission)))]
-            for resource_permission in workspace_user_resource_permission.permission_list if
-            ResourcePermission.values.__contains__(resource_permission)]
-        # 将二维数组扁平为一维
-        return reduce(lambda x, y: [*x, *y], resource_permission_list, [])
-    return []
-
-
-def get_permission_list(user,
-                        workspace_user_role_mapping_model,
-                        workspace_model,
-                        role_model,
-                        role_permission_mapping_model):
+def get_permissions(user,
+                    workspace_user_role_mapping_model,
+                    workspace_model,
+                    role_model,
+                    role_permission_mapping_model):
     user_id = user.id
     version = Cache_Version.PERMISSION_LIST.get_version()
     key = Cache_Version.PERMISSION_LIST.get_key(user_id=user_id)
     # 获取权限列表
     is_query_model = workspace_user_role_mapping_model is not None and workspace_model is not None and role_model is not None and role_permission_mapping_model is not None
-    permission_list = cache.get(key, version=version)
-    if permission_list is None:
+    permission_map = cache.get(key, version=version)
+    if permission_map is None:
+        permission_map = {}
         if is_query_model:
             # 获取工作空间 用户 角色映射数据
             workspace_user_role_mapping_list = QuerySet(workspace_user_role_mapping_model).filter(user_id=user_id)
-            workspace_user_role_mapping_dict = group_by(workspace_user_role_mapping_list,
-                                                        lambda item: item.workspace_id)
+
             role_id_list = list(set([workspace_user_role_mapping.role_id for workspace_user_role_mapping in
                                      workspace_user_role_mapping_list]))
             # 获取角色权限映射数据
@@ -182,7 +57,7 @@ def get_permission_list(user,
             role_model_dict = {role_model.id: role_model for role_model in role_model_list}
 
             role_permission_mapping_dict = group_by(
-                role_permission_mapping_list, lambda item: item.role_id)
+                role_permission_mapping_list, lambda item: str(item.role_id))
 
             workspace_user_permission_list = QuerySet(WorkspaceUserResourcePermission).filter(
                 workspace_id__in=[workspace_user_role.workspace_id for workspace_user_role in
@@ -191,39 +66,91 @@ def get_permission_list(user,
                                    role_model_dict.get(workspace_user_role.role_id) else False)],
                 user_id=user_id)
 
-            # 资源权限
-            workspace_resource_permission_list = get_workspace_resource_permission_list(workspace_user_permission_list,
-                                                                                        role_permission_mapping_dict,
-                                                                                        workspace_user_role_mapping_dict)
-
-            workspace_permission_list = get_workspace_permission_list(role_permission_mapping_dict,
-                                                                      workspace_user_role_mapping_list, role_model_dict)
-            # 系统权限
-            system_permission_list = [role_permission_mapping.permission_id for role_permission_mapping in
-                                      role_permission_mapping_list]
-            # 合并权限
-            permission_list = system_permission_list + workspace_permission_list + workspace_resource_permission_list
-            permission_list = list(set(permission_list))
-            cache.set(key, permission_list, version=version)
+            workspace_user_group_resource_permission_list = QuerySet(WorkspaceUserGroupResourcePermission).filter(
+                user_group__systemusergrouprelation__user_id=user_id
+            ).select_related('user_group').distinct()
+            "----------------------处理资源权限--------------------------------------------------"
+            for _ in list(workspace_user_permission_list) + list(workspace_user_group_resource_permission_list):
+                if _.auth_type == ResourceAuthType.RESOURCE_PERMISSION_GROUP:
+                    all_permissions = flat_map(
+                        [RESOURCE_PERMISSION_MAP.get(f'{_.auth_target_type}_{_resource_permission}') for
+                         _resource_permission
+                         in
+                         _.permission_list if _resource_permission in ['VIEW', 'MANAGE']])
+                    for group, permissions in group_by(all_permissions, lambda _permission: _permission.group).items():
+                        k = f"{group}:{_.workspace_id}:{_.target}"
+                        bits = reduce(lambda x, y: x | y,
+                                      [_permission.value.bit() for
+                                       _permission in
+                                       permissions], 0)
+                        permission_map[k] = permission_map.get(k, 0) | bits
+                elif _.auth_type == ResourceAuthType.ROLE:
+                    role_ids = [m.role_id for m in workspace_user_role_mapping_list
+                                if m.workspace_id == _.workspace_id]
+
+                    permissions = []
+                    for role_id in role_ids:
+                        for m in (role_permission_mapping_dict.get(str(role_id)) or []):
+                            p = PERMISSION_STR_MAP.get(m.permission_id)
+                            if p.meta.scope == PermissionScopeConstants.WORKSPACE:
+                                permissions.append(p)
+
+                    for group, ps in group_by(permissions, lambda p: p.meta.group).items():
+                        k = f"{group}:{_.workspace_id}:{_.target}"
+                        bits = reduce(lambda x, y: x | y, [p.value.bit() for p in ps], 0)
+                        permission_map[k] = permission_map.get(k, 0) | bits
+
+            "----------------------处理工作空间权限--------------------------------------------------"
+            for _ in workspace_user_role_mapping_list:
+                _role_permission_mapping_list = role_permission_mapping_dict.get(str(_.role_id)) or []
+                permissions = [PERMISSION_STR_MAP.get(_role_permission_mapping.permission_id) for
+                               _role_permission_mapping in
+                               _role_permission_mapping_list]
+                # 过滤工作空间权限
+                permissions = [_permission for _permission in permissions if
+                               _permission.meta.scope == PermissionScopeConstants.WORKSPACE]
+                for group, ps in group_by(permissions, lambda p: p.meta.group).items():
+                    k = f"{group}:{_.workspace_id}"
+                    bits = reduce(lambda x, y: x | y, [p.value.bit() for p in ps], 0)
+                    permission_map[k] = permission_map.get(k, 0) | bits
+            "----------------------处理系统权限--------------------------------------------------"
+            system_permissions = [PERMISSION_STR_MAP.get(_role_permission_mapping.permission_id) for
+                                  _role_permission_mapping in
+                                  role_permission_mapping_list]
+            system_permissions = [_permission for _permission in system_permissions if
+                                  _permission.meta.scope == PermissionScopeConstants.SYSTEM]
+            for group, permissions in group_by(system_permissions,
+                                               lambda _permission: _permission.meta.group).items():
+                permission_map[f"{group}"] = reduce(lambda x, y: x | y,
+                                                    [_permission.value.bit() for
+                                                     _permission in
+                                                     permissions], 0)
+            cache.set(key, permission_map, version=version)
         else:
             workspace_id_list = ['default']
-            workspace_user_resource_permission_list = QuerySet(WorkspaceUserResourcePermission).filter(
+            workspace_user_permission_list = QuerySet(WorkspaceUserResourcePermission).filter(
                 workspace_id__in=workspace_id_list, user_id=user_id)
-            role_permission_mapping_list = get_default_role_permission_mapping_list()
-            role_permission_mapping_dict = group_by(role_permission_mapping_list, lambda item: item.role_id)
-            workspace_user_role_mapping_list = get_default_workspace_user_role_mapping_list([user.role])
-            workspace_user_role_mapping_dict = group_by(workspace_user_role_mapping_list,
-                                                        lambda item: item.workspace_id)
-            # 资源权限
-            workspace_resource_permission_list = get_workspace_resource_permission_list(
-                workspace_user_resource_permission_list,
-                role_permission_mapping_dict,
-                workspace_user_role_mapping_dict)
-            # 合并权限
-            permission_list = workspace_resource_permission_list
-            permission_list = list(set(permission_list))
-            cache.set(key, permission_list, version=version)
-    return permission_list
+            workspace_user_group_resource_permission_list = QuerySet(
+                WorkspaceUserGroupResourcePermission).filter(
+                user_group__systemusergrouprelation__user_id=user_id
+            ).select_related('user_group').distinct()
+
+            for _ in list(workspace_user_permission_list) + list(workspace_user_group_resource_permission_list):
+                if _.auth_type == ResourceAuthType.RESOURCE_PERMISSION_GROUP:
+                    all_permissions = flat_map(
+                        [RESOURCE_PERMISSION_MAP.get(f'{_.auth_target_type}_{_resource_permission}') for
+                         _resource_permission
+                         in
+                         _.permission_list if _resource_permission in ['VIEW', 'MANAGE']])
+                    for group, permissions in group_by(all_permissions,
+                                                       lambda _permission: _permission.value.group).items():
+                        permission_map[f"{group}:{_.workspace_id}:{_.target}"] = reduce(lambda x, y: x | y,
+                                                                                        [_permission.value.bit() for
+                                                                                         _permission in
+                                                                                         permissions], 0)
+            cache.set(key, permission_map, version=version)
+
+    return permission_map
 
 
 system_role_list = [RoleConstants.ADMIN.value.name, RoleConstants.WORKSPACE_MANAGE.value.name,
@@ -241,11 +168,11 @@ def reset_workspace_role(role_id, workspace_id, role_dict):
     else:
         r = role_dict.get(role_id)
         if r is None:
-            return ''
+            return []
         role_type = role_dict.get(role_id).type
         if system_role == role_type:
             return [RoleConstants.EXTENDS_ADMIN.value.name]
-        return [f"EXTENDS_{role_type}:/WORKSPACE/{workspace_id}", f"EXTENDS_{role_type}"]
+        return [f"EXTENDS_{role_type}:/WORKSPACE/{workspace_id}"]
 
 
 def get_role_list(user,
@@ -277,9 +204,9 @@ def get_role_list(user,
             cache.set(key, role_list, version=version)
         else:
             if user.role == RoleConstants.ADMIN.value.__str__():
-                role_list = [user.role, get_role_permission(RoleConstants.WORKSPACE_MANAGE, 'default')]
+                role_list = [user.role, f'{RoleConstants.WORKSPACE_MANAGE}:default']
             else:
-                role_list = [user.role, get_role_permission(RoleConstants.USER, 'default')]
+                role_list = [user.role, f'{RoleConstants.USER}:default']
             cache.set(key, role_list, version=version)
     return role_list
 
@@ -290,11 +217,11 @@ def get_auth(user):
     role_model = DatabaseModelManage.get_model("role_model")
     role_permission_mapping_model = DatabaseModelManage.get_model("role_permission_mapping_model")
 
-    permission_list = get_permission_list(user, workspace_user_role_mapping_model, workspace_model,
-                                          role_model, role_permission_mapping_model)
+    permissions = get_permissions(user, workspace_user_role_mapping_model, workspace_model,
+                                  role_model, role_permission_mapping_model)
     role_list = get_role_list(user, workspace_user_role_mapping_model, workspace_model,
                               role_model, role_permission_mapping_model)
-    return Auth(role_list, permission_list)
+    return Auth(set(role_list), permissions)
 
 
 class UserToken(AuthBaseHandle):
@@ -316,4 +243,4 @@ def handle(self, request, token: str, get_token_details):
         if not user.is_active or user.password != cache_token.password:
             raise AppAuthenticationFailed(1002, _('Authentication information is incorrect'))
         auth = get_auth(user)
-        return user, auth
+        return Principal(user.id, UserType.SYSTEM_USER, user), auth
diff --git a/apps/common/auth/struct/aggregate_permission.py b/apps/common/auth/struct/aggregate_permission.py
new file mode 100644
index 00000000000..8edeea3dba8
--- /dev/null
+++ b/apps/common/auth/struct/aggregate_permission.py
@@ -0,0 +1,84 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： aggregate_permission.py
+    @date：2026/8/5 10:11
+    @desc:
+"""
+
+from typing import Protocol, List, Union
+
+from rest_framework.request import Request
+
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.permission import Role, Permission
+
+
+class RoleFunc(Protocol):
+    def __call__(self, request: Request, **kwargs) -> RoleConstants | Role: ...
+
+
+class PermissionFunc(Protocol):
+    def __call__(self, request: Request, **kwargs) -> PermissionConstants | Permission: ...
+
+
+class AggregatePermission:
+    def __init__(self,
+                 roles: List[Union[RoleConstants, RoleFunc]] = None,
+                 permissions: List[Union[PermissionConstants, PermissionFunc]] = None,
+                 aggregatePermissions: List['AggregatePermission'] = None,
+                 compare: CompareConstants = CompareConstants.OR):
+        # 不能用可变默认值；原 stub 的 `= list` 其实是把类型对象赋进去了
+        self.roles = roles if roles is not None else []
+        self.permissions = permissions if permissions is not None else []
+        self.aggregatePermissions = aggregatePermissions if aggregatePermissions is not None else []
+        self.compare = compare
+
+    def hasPermission(self, request: Request, **kwargs) -> bool:
+        user_roles = request.auth.roles
+        user_permissions = request.auth.permissions
+
+        # 无任何约束 => 放行（对应 Java 里五个集合全空的判断）
+        if not (self.roles or self.permissions or self.aggregatePermissions):
+            return True
+
+        is_and = self.compare == CompareConstants.AND
+
+        # 惰性产出每一项的命中结果，保证 OR/AND 的短路语义
+        # （return 后生成器不再前进，后面的 permission/role 不会被求值）
+        def results():
+            for role in self.roles:
+                resolved = role(request, **kwargs) if callable(role) else role
+                yield self._match_role(resolved, user_roles)
+            for permission in self.permissions:
+                resolved = permission(request, **kwargs) if callable(permission) else permission
+                yield self._match_permission(resolved, user_permissions)
+            for aggregate in self.aggregatePermissions:
+                yield aggregate.hasPermission(request, **kwargs)
+
+        for has in results():
+            if has and not is_and:  # OR：命中一个即通过
+                return True
+            if not has and is_and:  # AND：缺一个即失败
+                return False
+
+        # AND 全部通过 => True；OR 一个都没命中 => False
+        return is_and
+
+    @staticmethod
+    def _match_permission(permission: Union[PermissionConstants, Permission],
+                          user_permissions: dict) -> bool:
+        p = permission.value if isinstance(permission, PermissionConstants) else permission
+        key = p.get_resource_permission_key(p.resource_id) if p.resource_id else str(p)
+        return key in user_permissions and (user_permissions[key] & p.bit()) > 0
+
+    @staticmethod
+    def _match_role(role: Union[RoleConstants, Role], user_roles) -> bool:
+        r = role.value if isinstance(role, RoleConstants) else role
+        return str(r) in user_roles
+
+
+ViewPermission = AggregatePermission
diff --git a/apps/common/auth/struct/auth.py b/apps/common/auth/struct/auth.py
new file mode 100644
index 00000000000..03c2f99c86d
--- /dev/null
+++ b/apps/common/auth/struct/auth.py
@@ -0,0 +1,37 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： auth.py
+    @date：2026/8/5 9:45
+    @desc:
+"""
+from typing import Dict
+
+from application.models import ChatUserType
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.permission import Role
+from common.constants.authentication_type import UserType
+
+
+class Auth:
+    """
+     用于存储当前用户的角色和权限
+    """
+
+    def __init__(self,
+                 roles: set[RoleConstants | Role | str],
+                 permissions: Dict[str, int],
+                 **keywords):
+        # 权限列表
+        self.permissions = permissions
+        # 角色列表
+        self.roles = roles
+        self.keywords = keywords
+
+
+class Principal:
+    def __init__(self, _id, _type: UserType | ChatUserType, profile=None):
+        self.id = _id
+        self.type = _type
+        self.profile = profile
diff --git a/apps/common/auth/struct/permission.py b/apps/common/auth/struct/permission.py
new file mode 100644
index 00000000000..266a73b0f6f
--- /dev/null
+++ b/apps/common/auth/struct/permission.py
@@ -0,0 +1,68 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： permission.py
+    @date：2026/8/3 17:29
+    @desc:
+"""
+from dataclasses import dataclass, field
+from typing import Optional
+
+from common.auth.constants.category_constants import Category
+from common.auth.constants.group_constants import Group
+from common.auth.constants.operate_constants import Operate
+from common.auth.constants.permission_scope_constants import PermissionScopeConstants
+from common.auth.constants.role_group import RoleGroup
+
+
+@dataclass(frozen=True)
+class Permission:
+    """
+    权限信息
+    """
+    group: Group
+    sub_group: Group
+    operate: Operate
+    bit_index: int
+    workspace_id: Optional[str] = None
+    resource_id: Optional[str] = None
+    flag: str = None
+
+    def bit(self):
+        return 1 << self.bit_index
+
+    def get_resource_permission_key(self, resource_id):
+        return f"{self.group}:{resource_id}"
+
+    def __str__(self):
+        sub = f"_{self.sub_group}" if self.sub_group != self.group else ""
+        flag = f"_{self.flag}" if self.flag else ""
+        return f"{self.group}{sub}_{self.operate}{flag}"
+
+
+@dataclass
+class PermissionMeta:
+    role_list: list = field(default_factory=list)
+    category: Optional[Category] = None
+    resource_permission_group_list: Optional[list] = None
+    scope: Optional[PermissionScopeConstants] = None
+    is_ee: bool = True
+
+
+@dataclass(frozen=True)
+class Role:
+    name: str
+    workspace_id: str = None
+
+    def __str__(self):
+        return f"{self.name}{(':' + self.workspace_id) if self.workspace_id else ''}"
+
+    def __eq__(self, other):
+        return str(self) == str(other)
+
+
+@dataclass(frozen=True)
+class RoleMeta:
+    desc: str
+    group: RoleGroup
diff --git a/apps/common/constants/authentication_type.py b/apps/common/constants/authentication_type.py
index 1880fe4d3cd..fe0696363ad 100644
--- a/apps/common/constants/authentication_type.py
+++ b/apps/common/constants/authentication_type.py
@@ -8,13 +8,15 @@
 """
 from enum import Enum
 
+from django.db import models
+
 
 class AuthenticationType(Enum):
     # 系统用户
     SYSTEM_USER = "SYSTEM_USER"
     # 对话用户
     CHAT_USER = "CHAT_USER"
-    # 对话匿名用户
-    CHAT_ANONYMOUS_USER = "CHAT_ANONYMOUS_USER"
-    # APIKEY
-    API_KEY = "API_KEY"
+
+
+class UserType(models.TextChoices):
+    SYSTEM_USER = "SYSTEM_USER", '系统用户'
diff --git a/apps/common/constants/resource_permission_constants.py b/apps/common/constants/resource_permission_constants.py
new file mode 100644
index 00000000000..a692f72d5f4
--- /dev/null
+++ b/apps/common/constants/resource_permission_constants.py
@@ -0,0 +1,43 @@
+# coding=utf-8
+"""
+    @project: MaxKB
+    @Author：虎虎虎
+    @file： resource_permission_constants.py
+    @date：2026/8/4 15:38
+    @desc:
+"""
+from django.db import models
+
+
+class ResourcePermissionConstants(models.TextChoices):
+    """
+    资源权限组
+    """
+    # 查看
+    VIEW = "VIEW"
+    # 管理
+    MANAGE = "MANAGE"
+    # 角色
+    ROLE = "ROLE"
+
+    def __eq__(self, other):
+        return str(self) == str(other)
+
+
+class ResourceAuthType(models.TextChoices):
+    """
+    资源授权类型
+    """
+    "当授权类型是Role时候"
+    ROLE = "ROLE"
+
+    """资源权限组"""
+    RESOURCE_PERMISSION_GROUP = "RESOURCE_PERMISSION_GROUP"
+
+
+class AuthTargetType(models.TextChoices):
+    """授权目标"""
+    KNOWLEDGE = 'KNOWLEDGE', '知识库'
+    APPLICATION = 'APPLICATION', '应用'
+    TOOL = 'TOOL', '工具'
+    MODEL = 'MODEL', '模型'
diff --git a/apps/common/middleware/doc_headers_middleware.py b/apps/common/middleware/doc_headers_middleware.py
index 5f1884e7731..5afa66a523c 100644
--- a/apps/common/middleware/doc_headers_middleware.py
+++ b/apps/common/middleware/doc_headers_middleware.py
@@ -10,7 +10,7 @@
 from django.http import HttpResponse
 from django.utils.deprecation import MiddlewareMixin
 
-from common.auth import TokenDetails, handles
+from common.auth import TokenDetails, get_handles
 from maxkb.const import CONFIG
 
 content = """
@@ -126,7 +126,7 @@ def process_response(self, request, response):
                 try:
                     token = auth[7:]
                     token_details = TokenDetails(token)
-                    for handle in handles:
+                    for handle in get_handles():
                         if handle.support(request, token, token_details.get_token_details):
                             handle.handle(request, token, token_details.get_token_details)
                             return response
diff --git a/apps/folders/serializers/folder.py b/apps/folders/serializers/folder.py
index 1f68cbcba14..9d27b42a135 100644
--- a/apps/folders/serializers/folder.py
+++ b/apps/folders/serializers/folder.py
@@ -10,7 +10,9 @@
 from application.models.application import Application, ApplicationFolder
 from application.serializers.application import ApplicationOperateSerializer
 from application.serializers.application_folder import ApplicationFolderTreeSerializer
-from common.constants.permission_constants import Group, ResourcePermission, ResourcePermissionRole, RoleConstants
+from common.auth.constants.group_constants import Group
+from common.auth.constants.role_constants import RoleConstants
+from common.constants.resource_permission_constants import ResourcePermissionConstants
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.exception.app_exception import AppApiException
 from folders.api.folder import FolderCreateRequest
@@ -278,7 +280,7 @@ def delete(self):
                         Q(user_id=self.data.get('user_id')) &
                         Q(auth_target_type=self.data.get('source')) &
                         Q(target__in=source_ids) &
-                        Q(permission_list__overlap=[ResourcePermission.MANAGE, ResourcePermissionRole.ROLE])
+                        Q(permission_list__overlap=[ResourcePermissionConstants.MANAGE, ResourcePermissionConstants.ROLE])
                     ).count()
                     if auth_list != len(source_ids):
                         raise AppApiException(500, _('This folder contains resources that you dont have permission'))
diff --git a/apps/folders/views/folder.py b/apps/folders/views/folder.py
index 942137e5ae9..7f895db15fb 100644
--- a/apps/folders/views/folder.py
+++ b/apps/folders/views/folder.py
@@ -6,8 +6,13 @@
 
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import Permission, Group, Operate, RoleConstants, ViewPermission, \
-    PermissionConstants, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.group_constants import Group
+from common.auth.constants.operate_constants import Operate
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
+from common.auth.struct.permission import Permission
 from common.log.log import log
 from common.result import result
 from folders.api.folder import FolderCreateAPI, FolderEditAPI, FolderReadAPI, FolderTreeReadAPI, FolderDeleteAPI
@@ -47,7 +52,7 @@ class FolderView(APIView):
                                          [Permission(group=Group(kwargs.get('source')),
                                                      operate=Operate.SELF,
                                                      resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('source')}/{r.data.get('parent_id')}"
-                                                     )], CompareConstants.AND),
+                                                     )], compare=CompareConstants.AND),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role()
     )
     @log(
@@ -109,7 +114,7 @@ class Operate(APIView):
                                              [Permission(group=Group(kwargs.get('source')),
                                                          operate=Operate.SELF,
                                                          resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('source')}/{kwargs.get('folder_id')}"
-                                                         )], CompareConstants.AND),
+                                                         )], compare=CompareConstants.AND),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role()
         )
         @log(
@@ -161,7 +166,7 @@ def get(self, request: Request, workspace_id: str, source: str, folder_id: str):
                                              [Permission(group=Group(kwargs.get('source')),
                                                          operate=Operate.SELF,
                                                          resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('source')}/{kwargs.get('folder_id')}"
-                                                         )], CompareConstants.AND),
+                                                         )], compare=CompareConstants.AND),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role()
         )
         @log(
diff --git a/apps/homepage/serializers/homepage.py b/apps/homepage/serializers/homepage.py
index e240a3beb91..c5a05794706 100644
--- a/apps/homepage/serializers/homepage.py
+++ b/apps/homepage/serializers/homepage.py
@@ -22,7 +22,7 @@
 from rest_framework import serializers
 
 from application.models import Application, ApplicationChatUserStats, Chat, ChatRecord
-from common.constants.permission_constants import RoleConstants
+from common.auth.constants.role_constants import RoleConstants
 from common.db.search import native_search, get_dynamics_model, page_search
 from common.utils.common import get_file_content
 from knowledge.models import Knowledge
diff --git a/apps/homepage/views/homepage.py b/apps/homepage/views/homepage.py
index 0cb04f68afa..ae7ee8b4cf3 100644
--- a/apps/homepage/views/homepage.py
+++ b/apps/homepage/views/homepage.py
@@ -14,7 +14,8 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
 from homepage.api.home_page_api import ApplicationTokensRankingAPI, ApplicationQuestionRankingAPI, UserTokensRankingAPI, \
     ApplicationAggregationAPI, KnowledgeAggregationAPI, ToolAggregationAPI, ModelAggregationAPI, \
     ApplicationMonitoringAPI, RankingBaseAPI, TokensAggregationAPI, RankingBaseExportAPI
diff --git a/apps/knowledge/views/document.py b/apps/knowledge/views/document.py
index 1984ed4b54a..1b5bd9f5cdb 100644
--- a/apps/knowledge/views/document.py
+++ b/apps/knowledge/views/document.py
@@ -1,6 +1,9 @@
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from common.result import result
 from django.utils.translation import gettext_lazy as _
@@ -65,7 +68,7 @@ class DocumentView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     @log(
@@ -98,7 +101,7 @@ def post(self, request: Request, workspace_id: str, knowledge_id: str):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     def get(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -138,7 +141,7 @@ class Operate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
@@ -164,7 +167,7 @@ def get(self, request: Request, workspace_id: str, knowledge_id: str, document_i
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -197,7 +200,7 @@ def put(self, request: Request, workspace_id: str, knowledge_id: str, document_i
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -236,7 +239,7 @@ class Split(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def post(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -299,7 +302,7 @@ class BatchEditHitHandling(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -337,7 +340,7 @@ class SyncWeb(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -375,7 +378,7 @@ class Refresh(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -413,7 +416,7 @@ class Tokenize(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -450,7 +453,7 @@ class CancelTask(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -487,7 +490,7 @@ class BatchCancelTask(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -527,7 +530,7 @@ class BatchCreate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -567,7 +570,7 @@ class BatchSync(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -607,7 +610,7 @@ class BatchDelete(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -646,7 +649,7 @@ class BatchRefresh(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -683,7 +686,7 @@ class BatchTokenize(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -720,7 +723,7 @@ class BatchAddTag(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -760,7 +763,7 @@ class BatchGenerateRelated(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -788,7 +791,7 @@ class BatchExport(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -814,7 +817,7 @@ class BatchExportZip(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -849,7 +852,7 @@ class Page(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, current_page: int, page_size: int):
@@ -894,7 +897,7 @@ class Export(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -927,7 +930,7 @@ class ExportZip(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -960,7 +963,7 @@ class DownloadSourceFile(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
@@ -985,7 +988,7 @@ class ReplaceSourceFile(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def post(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
@@ -1018,7 +1021,7 @@ class Tags(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
@@ -1048,7 +1051,7 @@ def get(self, request: Request, workspace_id: str, knowledge_id: str, document_i
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def post(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
@@ -1082,7 +1085,7 @@ class BatchDelete(APIView):
                 ViewPermission(
                     [RoleConstants.USER.get_workspace_role()],
                     [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                    CompareConstants.AND,
+                    compare=CompareConstants.AND,
                 ),
             )
             @log(
@@ -1123,7 +1126,7 @@ class BatchDeleteDocsTag(APIView):
                 ViewPermission(
                     [RoleConstants.USER.get_workspace_role()],
                     [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                    CompareConstants.AND,
+                    compare=CompareConstants.AND,
                 ),
             )
             @log(
@@ -1163,7 +1166,7 @@ class Migrate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -1207,7 +1210,7 @@ class WebDocumentView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     @log(
@@ -1249,7 +1252,7 @@ class QaDocumentView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     @log(
@@ -1291,7 +1294,7 @@ class TableDocumentView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     @log(
diff --git a/apps/knowledge/views/knowledge.py b/apps/knowledge/views/knowledge.py
index ed69d88d7e9..109d5d6af6b 100644
--- a/apps/knowledge/views/knowledge.py
+++ b/apps/knowledge/views/knowledge.py
@@ -6,7 +6,10 @@
 
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions, check_batch_permissions, get_is_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from common import result
 from knowledge.api.knowledge import KnowledgeBaseCreateAPI, KnowledgeWebCreateAPI, KnowledgeTreeReadAPI, \
@@ -75,7 +78,7 @@ class Operate(APIView):
             PermissionConstants.KNOWLEDGE_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Knowledge Base', operate="Modify knowledge base information",
@@ -102,7 +105,7 @@ def put(self, request: Request, workspace_id: str, knowledge_id: str):
             PermissionConstants.KNOWLEDGE_DELETE.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Knowledge Base', operate="Delete knowledge base",
@@ -128,7 +131,7 @@ def delete(self, request: Request, workspace_id: str, knowledge_id: str):
             PermissionConstants.KNOWLEDGE_READ.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str):
             return result.success(KnowledgeSerializer.Operate(
@@ -259,7 +262,7 @@ class SyncWeb(APIView):
             PermissionConstants.KNOWLEDGE_SYNC.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Knowledge Base', operate="Synchronize the knowledge base of the website",
@@ -294,7 +297,7 @@ class HitTest(APIView):
             PermissionConstants.KNOWLEDGE_HIT_TEST.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         def post(self, request: Request, workspace_id: str, knowledge_id: str):
             return result.success(KnowledgeSerializer.HitTest(
@@ -344,7 +347,7 @@ class Embedding(APIView):
             PermissionConstants.KNOWLEDGE_VECTOR.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Knowledge Base', operate='Re-vectorize',
@@ -371,7 +374,7 @@ class Export(APIView):
             PermissionConstants.KNOWLEDGE_EXPORT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Knowledge Base', operate="Export knowledge base",
@@ -398,7 +401,7 @@ class ExportZip(APIView):
             PermissionConstants.KNOWLEDGE_EXPORT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Knowledge Base', operate="Export knowledge base containing images",
@@ -425,7 +428,7 @@ class ExportKnowledge(APIView):
             PermissionConstants.KNOWLEDGE_EXPORT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Knowledge Base', operate="Export knowledge bundle",
@@ -492,7 +495,7 @@ class GenerateRelated(APIView):
             PermissionConstants.KNOWLEDGE_GENERATE.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='document', operate='Generate related documents',
@@ -551,7 +554,7 @@ class TransformWorkflow(APIView):
             PermissionConstants.KNOWLEDGE_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Knowledge Base', operate="Modify knowledge base information",
diff --git a/apps/knowledge/views/knowledge_workflow.py b/apps/knowledge/views/knowledge_workflow.py
index 8a6f23861f7..43e33107937 100644
--- a/apps/knowledge/views/knowledge_workflow.py
+++ b/apps/knowledge/views/knowledge_workflow.py
@@ -3,7 +3,10 @@
 from application.api.application_api import SpeechToTextAPI
 from common.auth import TokenAuth
 from common.auth.authentication import get_is_permissions, has_permissions
-from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from common.result import DefaultResultSerializer, result
 from django.utils.translation import gettext_lazy as _
@@ -36,7 +39,7 @@ class KnowledgeDatasourceFormListView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     def post(self, request: Request, workspace_id: str, knowledge_id: str, type: str, id: str):
@@ -57,7 +60,7 @@ class KnowledgeDatasourceView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     def post(self, request: Request, workspace_id: str, knowledge_id: str, type: str, id: str, function_name: str):
@@ -88,7 +91,7 @@ class KnowledgeWorkflowUploadDocumentView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     def post(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -122,7 +125,7 @@ class KnowledgeWorkflowActionView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     def post(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -152,7 +155,7 @@ class Page(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, current_page: int, page_size: int):
@@ -181,7 +184,7 @@ class Operate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request, workspace_id: str, knowledge_id: str, knowledge_action_id: str):
@@ -210,7 +213,7 @@ class Cancel(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def post(self, request, workspace_id: str, knowledge_id: str, knowledge_action_id: str):
@@ -264,7 +267,7 @@ class Publish(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
         )
@@ -304,7 +307,7 @@ class Export(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -337,7 +340,7 @@ class Import(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -378,7 +381,7 @@ class Operate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -409,7 +412,7 @@ def put(self, request: Request, workspace_id: str, knowledge_id: str):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -439,7 +442,7 @@ class KnowledgeWorkflowVersionView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     def get(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -469,7 +472,7 @@ class McpServers(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
     )
diff --git a/apps/knowledge/views/knowledge_workflow_version.py b/apps/knowledge/views/knowledge_workflow_version.py
index 6202b7b8397..f976bada97c 100644
--- a/apps/knowledge/views/knowledge_workflow_version.py
+++ b/apps/knowledge/views/knowledge_workflow_version.py
@@ -15,7 +15,10 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from knowledge.api.knowledge_version import KnowledgeVersionListAPI, KnowledgeVersionPageAPI, \
     KnowledgeVersionOperateAPI
@@ -48,7 +51,7 @@ class KnowledgeWorkflowVersionView(APIView):
                      PermissionConstants.KNOWLEDGE_WORKFLOW_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                                    CompareConstants.AND),
+                                    compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id, knowledge_id: str):
         return result.success(
@@ -72,7 +75,7 @@ class Page(APIView):
                          PermissionConstants.KNOWLEDGE_WORKFLOW_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, knowledge_id: str, current_page: int, page_size: int):
             return result.success(
@@ -97,7 +100,7 @@ class Operate(APIView):
                          PermissionConstants.KNOWLEDGE_WORKFLOW_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, knowledge_id: str, knowledge_version_id: str):
             return result.success(
@@ -119,7 +122,7 @@ def get(self, request: Request, workspace_id: str, knowledge_id: str, knowledge_
                          PermissionConstants.KNOWLEDGE_WORKFLOW_EDIT.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Knowledge', operate="Modify knowledge version information",
              get_operation_object=lambda r, k: get_knowledge_operation_object(k.get('knowledge_id')),
diff --git a/apps/knowledge/views/paragraph.py b/apps/knowledge/views/paragraph.py
index ada0883e300..5f48df5c2e1 100644
--- a/apps/knowledge/views/paragraph.py
+++ b/apps/knowledge/views/paragraph.py
@@ -5,7 +5,10 @@
 
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from common.result import result
 from common.utils.common import query_params_to_single_dict
@@ -33,7 +36,7 @@ class ParagraphView(APIView):
         PermissionConstants.KNOWLEDGE_DOCUMENT_READ.get_workspace_permission_workspace_manage_role(),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
         ViewPermission([RoleConstants.USER.get_workspace_role()],
-                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
     )
     def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
         q = ParagraphSerializers.Query(
@@ -59,7 +62,7 @@ def get(self, request: Request, workspace_id: str, knowledge_id: str, document_i
         PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
         ViewPermission([RoleConstants.USER.get_workspace_role()],
-                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
     )
     @log(
         menu='Paragraph', operate='Create Paragraph',
@@ -91,7 +94,7 @@ class BatchDelete(APIView):
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         def put(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
             return result.success(ParagraphSerializers.Batch(
@@ -114,7 +117,7 @@ class BatchMigrate(APIView):
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Paragraph', operate='Migrate paragraphs in batches',
@@ -153,7 +156,7 @@ class BatchGenerateRelated(APIView):
             PermissionConstants.KNOWLEDGE_DOCUMENT_GENERATE.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Paragraph', operate='Batch generate related',
@@ -185,7 +188,7 @@ class Operate(APIView):
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Paragraph', operate='Modify paragraph data',
@@ -220,7 +223,7 @@ def put(self, request: Request, workspace_id: str, knowledge_id: str, document_i
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str, paragraph_id: str):
             o = ParagraphSerializers.Operate(
@@ -247,7 +250,7 @@ def get(self, request: Request, workspace_id: str, knowledge_id: str, document_i
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Paragraph', operate='Delete paragraph',
@@ -286,7 +289,7 @@ class Problem(APIView):
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Paragraph', operate='Add associated questions',
@@ -319,7 +322,7 @@ def post(self, request: Request, workspace_id: str, knowledge_id: str, document_
             PermissionConstants.KNOWLEDGE_PROBLEM_READ.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str, paragraph_id: str):
             return result.success(ParagraphSerializers.Problem(
@@ -349,7 +352,7 @@ class UnAssociation(APIView):
             PermissionConstants.KNOWLEDGE_PROBLEM_RELATE.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Paragraph', operate='Disassociation issue',
@@ -387,7 +390,7 @@ class Association(APIView):
             PermissionConstants.KNOWLEDGE_PROBLEM_RELATE.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='Paragraph', operate='Related questions',
@@ -424,7 +427,7 @@ class Page(APIView):
             PermissionConstants.KNOWLEDGE_DOCUMENT_READ.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         def get(self, request: Request,
                 workspace_id: str, knowledge_id: str, document_id: str, current_page: int, page_size: int):
@@ -456,7 +459,7 @@ class AdjustPosition(APIView):
             PermissionConstants.KNOWLEDGE_DOCUMENT_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         def put(self, request: Request, workspace_id: str, knowledge_id: str, document_id: str):
             return result.success(ParagraphSerializers.AdjustPosition(
diff --git a/apps/knowledge/views/problem.py b/apps/knowledge/views/problem.py
index cfff9b4457d..0e2667a73f5 100644
--- a/apps/knowledge/views/problem.py
+++ b/apps/knowledge/views/problem.py
@@ -5,7 +5,10 @@
 
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from common.result import result
 from common.utils.common import query_params_to_single_dict
@@ -32,7 +35,7 @@ class ProblemView(APIView):
         PermissionConstants.KNOWLEDGE_PROBLEM_READ.get_workspace_permission_workspace_manage_role(),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
         ViewPermission([RoleConstants.USER.get_workspace_role()],
-                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
     )
     def get(self, request: Request, workspace_id: str, knowledge_id: str):
         q = ProblemSerializers.Query(
@@ -60,7 +63,7 @@ def get(self, request: Request, workspace_id: str, knowledge_id: str):
         PermissionConstants.KNOWLEDGE_PROBLEM_CREATE.get_workspace_permission_workspace_manage_role(),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
         ViewPermission([RoleConstants.USER.get_workspace_role()],
-                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
     )
     @log(
         menu='problem', operate='Create question',
@@ -88,7 +91,7 @@ class Paragraph(APIView):
             PermissionConstants.KNOWLEDGE_PROBLEM_READ.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, problem_id: str):
             return result.success(ProblemSerializers.Operate(
@@ -117,7 +120,7 @@ class BatchAssociation(APIView):
             PermissionConstants.KNOWLEDGE_PROBLEM_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='problem', operate='Batch associated paragraphs',
@@ -147,7 +150,7 @@ class BatchDelete(APIView):
             PermissionConstants.KNOWLEDGE_PROBLEM_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='problem', operate='Batch deletion issues',
@@ -176,7 +179,7 @@ class Operate(APIView):
             PermissionConstants.KNOWLEDGE_PROBLEM_DELETE.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='problem', operate='Delete question',
@@ -208,7 +211,7 @@ def delete(self, request: Request, workspace_id: str, knowledge_id: str, problem
             PermissionConstants.KNOWLEDGE_PROBLEM_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='problem', operate='Modify question',
@@ -243,7 +246,7 @@ class Page(APIView):
             PermissionConstants.KNOWLEDGE_DOCUMENT_READ.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, current_page, page_size):
             d = ProblemSerializers.Query(
diff --git a/apps/knowledge/views/tag.py b/apps/knowledge/views/tag.py
index 99bde42973e..2721dffbb60 100644
--- a/apps/knowledge/views/tag.py
+++ b/apps/knowledge/views/tag.py
@@ -5,7 +5,10 @@
 
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from common.result import result
 from knowledge.api.tag import TagCreateAPI, TagDeleteAPI, TagEditAPI
@@ -29,7 +32,7 @@ class KnowledgeTagView(APIView):
         PermissionConstants.KNOWLEDGE_TAG_CREATE.get_workspace_permission_workspace_manage_role(),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
         ViewPermission([RoleConstants.USER.get_workspace_role()],
-                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
     )
     @log(
         menu='tag', operate="Create a knowledge tag",
@@ -53,7 +56,7 @@ def post(self, request: Request, workspace_id: str, knowledge_id: str):
         PermissionConstants.KNOWLEDGE_TAG_READ.get_workspace_permission_workspace_manage_role(),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
         ViewPermission([RoleConstants.USER.get_workspace_role()],
-                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                       [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
     )
     @log(
         menu='tag', operate="Create a knowledge tag",
@@ -82,7 +85,7 @@ class Operate(APIView):
             PermissionConstants.KNOWLEDGE_TAG_EDIT.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='tag', operate="Update a knowledge tag",
@@ -109,7 +112,7 @@ class Delete(APIView):
             PermissionConstants.KNOWLEDGE_TAG_DELETE.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='tag', operate="Delete a knowledge tag",
@@ -136,7 +139,7 @@ class BatchDelete(APIView):
             PermissionConstants.KNOWLEDGE_TAG_DELETE.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission([RoleConstants.USER.get_workspace_role()],
-                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], CompareConstants.AND),
+                           [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()], compare=CompareConstants.AND),
         )
         @log(
             menu='tag', operate="Batch Delete knowledge tag",
diff --git a/apps/knowledge/views/termbase.py b/apps/knowledge/views/termbase.py
index 1969dee3cde..53798e611cc 100644
--- a/apps/knowledge/views/termbase.py
+++ b/apps/knowledge/views/termbase.py
@@ -1,6 +1,9 @@
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from common.result import result
 from common.utils.common import query_params_to_single_dict
@@ -39,7 +42,7 @@ class TermbaseView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     def get(self, request: Request, workspace_id: str, knowledge_id: str):
@@ -70,7 +73,7 @@ def get(self, request: Request, workspace_id: str, knowledge_id: str):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     @log(
@@ -105,7 +108,7 @@ class BatchDelete(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -140,7 +143,7 @@ class BatchExport(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -174,7 +177,7 @@ class Operate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -211,7 +214,7 @@ def delete(self, request: Request, workspace_id: str, knowledge_id: str, termbas
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -251,7 +254,7 @@ class Page(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.KNOWLEDGE.get_workspace_knowledge_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, knowledge_id: str, current_page, page_size):
diff --git a/apps/models_provider/serializers/model_serializer.py b/apps/models_provider/serializers/model_serializer.py
index 72f3baba537..5e1da5e546f 100644
--- a/apps/models_provider/serializers/model_serializer.py
+++ b/apps/models_provider/serializers/model_serializer.py
@@ -8,7 +8,7 @@
 import uuid_utils.compat as uuid
 from common.config.embedding_config import ModelManage
 from common.constants.cache_version import Cache_Version
-from common.constants.permission_constants import ResourceAuthType, ResourcePermission
+from common.constants.resource_permission_constants import ResourceAuthType
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.db.search import native_search
 from common.exception.app_exception import AppApiException
diff --git a/apps/models_provider/views/model.py b/apps/models_provider/views/model.py
index fd0171a2063..61a12a15633 100644
--- a/apps/models_provider/views/model.py
+++ b/apps/models_provider/views/model.py
@@ -9,7 +9,10 @@
 
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from common.result import result
 from common.utils.common import query_params_to_single_dict
@@ -133,7 +136,7 @@ class Operate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.MODEL.get_workspace_model_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -165,7 +168,7 @@ def put(self, request: Request, workspace_id, model_id: str):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.MODEL.get_workspace_model_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -196,7 +199,7 @@ def delete(self, request: Request, workspace_id: str, model_id: str):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.MODEL.get_workspace_model_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, model_id: str):
@@ -252,7 +255,7 @@ def get(self, request: Request, workspace_id: str, model_id: str):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.MODEL.get_workspace_model_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -287,7 +290,7 @@ class ModelMeta(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.MODEL.get_workspace_model_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, model_id: str):
@@ -315,7 +318,7 @@ class PauseDownload(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.MODEL.get_workspace_model_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def put(self, request: Request, workspace_id: str, model_id: str):
diff --git a/apps/models_provider/views/provide.py b/apps/models_provider/views/provide.py
index 882f3fca5c0..7e7ce5aadcb 100644
--- a/apps/models_provider/views/provide.py
+++ b/apps/models_provider/views/provide.py
@@ -3,7 +3,7 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants
+from common.auth.constants.permission_constants import PermissionConstants
 from django.utils.translation import gettext_lazy as _
 from drf_spectacular.utils import extend_schema
 from models_provider.api.provide import ProvideApi
diff --git a/apps/oss/views/file.py b/apps/oss/views/file.py
index 9a8d5ff4e6b..6c2641839d4 100644
--- a/apps/oss/views/file.py
+++ b/apps/oss/views/file.py
@@ -1,15 +1,18 @@
 # coding=utf-8
-from common.auth import AllTokenAuth, TokenAuth
+
+from django.utils.translation import gettext_lazy as _
+from drf_spectacular.utils import extend_schema
+from rest_framework.parsers import MultiPartParser
+from rest_framework.views import APIView, Request
+
+from common.auth import TokenAuth, AllTokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import ChatAuth, RoleConstants
+from common.auth.common import ChatAuthentication
+from common.auth.constants.role_constants import RoleConstants
 from common.log.log import log
 from common.result import result
-from django.utils.translation import gettext_lazy as _
-from drf_spectacular.utils import extend_schema
 from knowledge.api.file import FileGetAPI, FileUploadAPI, GetUrlContentAPI
 from oss.serializers.file import FileSerializer, get_url_content
-from rest_framework.parsers import MultiPartParser
-from rest_framework.views import APIView, Request
 
 
 class FileRetrievalView(APIView):
@@ -86,7 +89,7 @@ class GetUrlView(APIView):
         tags=[_('Chat')]  # type: ignore
     )
     def get(self, request: Request, application_id: str):
-        if isinstance(request.auth, ChatAuth) and request.auth.application_id and str(
+        if isinstance(request.auth, ChatAuthentication) and request.auth.application_id and str(
                 request.auth.application_id) != application_id:
             return result.error(_('No permission'))
         url = request.query_params.get('url')
diff --git a/apps/system_manage/migrations/0003_alter_workspaceuserresourcepermission_target.py b/apps/system_manage/migrations/0003_alter_workspaceuserresourcepermission_target.py
index 42b2630428e..d1acf040386 100644
--- a/apps/system_manage/migrations/0003_alter_workspaceuserresourcepermission_target.py
+++ b/apps/system_manage/migrations/0003_alter_workspaceuserresourcepermission_target.py
@@ -5,7 +5,6 @@
 from django.db import migrations, models
 from django.db.models import QuerySet
 
-from common.constants.permission_constants import WorkspaceUserRoleMapping
 from common.utils.common import group_by
 
 
@@ -16,22 +15,34 @@ def workspace_user_role_mapping_model_exists(workspace_user_role_mapping_model):
         return False
     return False
 
-def delete_auth(apps,folder_model):
+
+def delete_auth(apps, folder_model):
     workspace_user_resource_permission_model = apps.get_model('system_manage', 'WorkspaceUserResourcePermission')
-    QuerySet(workspace_user_resource_permission_model).filter(target__in=QuerySet(folder_model).values_list('id')).delete()
+    QuerySet(workspace_user_resource_permission_model).filter(
+        target__in=QuerySet(folder_model).values_list('id')).delete()
 
 
-def get_workspace_user_resource_permission_list(apps, auth_target_type, workspace_user_role_mapping_model_workspace_dict,
+def get_workspace_user_resource_permission_list(apps, auth_target_type,
+                                                workspace_user_role_mapping_model_workspace_dict,
                                                 folder_model):
     workspace_user_resource_permission_model = apps.get_model('system_manage', 'WorkspaceUserResourcePermission')
     return reduce(lambda x, y: [*x, *y], [
         [workspace_user_resource_permission_model(target=f.id, workspace_id=f.workspace_id, user_id=wurm.user_id,
-                                         auth_target_type=auth_target_type, auth_type="RESOURCE_PERMISSION_GROUP",
-                                         permission_list=['VIEW','MANAGE'] if wurm.user_id == f.user_id else ['VIEW']) for wurm in
+                                                  auth_target_type=auth_target_type,
+                                                  auth_type="RESOURCE_PERMISSION_GROUP",
+                                                  permission_list=['VIEW', 'MANAGE'] if wurm.user_id == f.user_id else [
+                                                      'VIEW']) for wurm in
          workspace_user_role_mapping_model_workspace_dict.get(f.workspace_id, [])] for f in
         QuerySet(folder_model).all()], [])
 
 
+class WorkspaceUserRoleMapping:
+    def __init__(self, workspace_id, role_id, user_id):
+        self.workspace_id = workspace_id
+        self.role_id = role_id
+        self.user_id = user_id
+
+
 def auth_folder(apps, schema_editor):
     from common.database_model_manage.database_model_manage import DatabaseModelManage
     DatabaseModelManage.init()
@@ -59,20 +70,20 @@ def auth_folder(apps, schema_editor):
                          QuerySet(workspace_user_role_mapping_model)}.values()],
             lambda item: item.workspace_id)
 
-    workspace_user_resource_permission_list = get_workspace_user_resource_permission_list(apps,"APPLICATION",
+    workspace_user_resource_permission_list = get_workspace_user_resource_permission_list(apps, "APPLICATION",
                                                                                           workspace_user_role_mapping_model_workspace_dict,
                                                                                           application_folder_model)
 
-    workspace_user_resource_permission_list += get_workspace_user_resource_permission_list(apps,"TOOL",
+    workspace_user_resource_permission_list += get_workspace_user_resource_permission_list(apps, "TOOL",
                                                                                            workspace_user_role_mapping_model_workspace_dict,
                                                                                            tool_folder_model)
 
-    workspace_user_resource_permission_list += get_workspace_user_resource_permission_list(apps,"KNOWLEDGE",
+    workspace_user_resource_permission_list += get_workspace_user_resource_permission_list(apps, "KNOWLEDGE",
                                                                                            workspace_user_role_mapping_model_workspace_dict,
                                                                                            knowledge_folder_model)
-    delete_auth(apps,application_folder_model)
-    delete_auth(apps,knowledge_folder_model)
-    delete_auth(apps,tool_folder_model)
+    delete_auth(apps, application_folder_model)
+    delete_auth(apps, knowledge_folder_model)
+    delete_auth(apps, tool_folder_model)
     QuerySet(workspace_user_resource_permission_model).bulk_create(workspace_user_resource_permission_list)
 
 
diff --git a/apps/system_manage/migrations/0007_workspaceusergroupresourcepermission.py b/apps/system_manage/migrations/0007_workspaceusergroupresourcepermission.py
new file mode 100644
index 00000000000..e81ae7c6255
--- /dev/null
+++ b/apps/system_manage/migrations/0007_workspaceusergroupresourcepermission.py
@@ -0,0 +1,35 @@
+# Generated by Django 5.2.14 on 2026-08-05 07:06
+
+import django.contrib.postgres.fields
+import django.db.models.deletion
+import uuid_utils.compat
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('system_manage', '0006_alter_chatuser_nick_name_chatuserapikey'),
+        ('users', '0003_systemusergroup_systemusergrouprelation'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='WorkspaceUserGroupResourcePermission',
+            fields=[
+                ('id', models.UUIDField(default=uuid_utils.compat.uuid7, editable=False, primary_key=True, serialize=False, verbose_name='主键id')),
+                ('workspace_id', models.CharField(db_index=True, default='default', max_length=128, verbose_name='工作空间id')),
+                ('auth_target_type', models.CharField(choices=[('KNOWLEDGE', '知识库'), ('APPLICATION', '应用'), ('TOOL', '工具'), ('MODEL', '模型')], db_index=True, default='KNOWLEDGE', max_length=128, verbose_name='授权目标')),
+                ('target', models.CharField(db_index=True, max_length=128, verbose_name='知识库/应用id')),
+                ('auth_type', models.CharField(choices=[('ROLE', 'Role'), ('RESOURCE_PERMISSION_GROUP', 'Resource Permission Group')], db_default='ROLE', db_index=True, default=False, verbose_name='授权类型')),
+                ('permission_list', django.contrib.postgres.fields.ArrayField(base_field=models.CharField(blank=True, choices=[('VIEW', 'View'), ('MANAGE', 'Manage'), ('ROLE', 'Role')], default='VIEW', max_length=256), default=list, size=None, verbose_name='权限列表')),
+                ('create_time', models.DateTimeField(auto_now_add=True, db_index=True, verbose_name='创建时间')),
+                ('update_time', models.DateTimeField(auto_now=True, db_index=True, verbose_name='修改时间')),
+                ('user_group', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='users.systemusergroup', verbose_name='用户组id')),
+            ],
+            options={
+                'db_table': 'workspace_user_group_resource_permission',
+                'unique_together': {('workspace_id', 'user_group', 'auth_target_type', 'target')},
+            },
+        ),
+    ]
diff --git a/apps/system_manage/models/chat_user.py b/apps/system_manage/models/chat_user.py
index 2d22d4413f3..9d1d28ed3c1 100644
--- a/apps/system_manage/models/chat_user.py
+++ b/apps/system_manage/models/chat_user.py
@@ -9,8 +9,6 @@
 import uuid_utils.compat as uuid
 from django.db import models
 
-from common.constants.permission_constants import Group
-
 
 class ChatUser(models.Model):
     id = models.UUIDField(primary_key=True, max_length=128, default=uuid.uuid7, editable=False, verbose_name="主键id")
@@ -50,8 +48,8 @@ class Meta:
 
 class ResourceType(models.TextChoices):
     """资源类型"""
-    KNOWLEDGE = Group.KNOWLEDGE.value, '知识库'
-    APPLICATION = Group.APPLICATION.value, '应用'
+    KNOWLEDGE = 'KNOWLEDGE', '知识库'
+    APPLICATION = 'APPLICATION', '应用'
 
 
 class ResourceChatUserAuthorize(models.Model):
@@ -97,4 +95,4 @@ class ChatUserApiKey(models.Model):
     create_time = models.DateTimeField(verbose_name="创建时间", auto_now_add=True, null=True, db_index=True)
 
     class Meta:
-        db_table = "chat_user_api_key"
\ No newline at end of file
+        db_table = "chat_user_api_key"
diff --git a/apps/system_manage/models/resource_mapping.py b/apps/system_manage/models/resource_mapping.py
index 5d38092a886..03cbedbb7ae 100644
--- a/apps/system_manage/models/resource_mapping.py
+++ b/apps/system_manage/models/resource_mapping.py
@@ -9,7 +9,7 @@
 from django.db import models
 import uuid_utils.compat as uuid
 
-from common.constants.permission_constants import Group
+from common.auth.constants.group_constants import Group
 from common.mixins.app_model_mixin import AppModelMixin
 
 
diff --git a/apps/system_manage/models/workspace_user_group_permission.py b/apps/system_manage/models/workspace_user_group_permission.py
index 24421f3e5d0..033f48e4c1d 100644
--- a/apps/system_manage/models/workspace_user_group_permission.py
+++ b/apps/system_manage/models/workspace_user_group_permission.py
@@ -11,10 +11,10 @@
 from django.contrib.postgres.fields import ArrayField
 from django.db import models
 
-from common.constants.permission_constants import ResourceAuthType, ResourcePermissionRole, ResourcePermission
-from users.models.user_group import SystemUserGroup
+from common.constants.resource_permission_constants import ResourceAuthType, ResourcePermissionConstants, \
+    AuthTargetType
 
-from .workspace_user_permission import AuthTargetType
+from users.models.user_group import SystemUserGroup
 
 
 class WorkspaceUserGroupResourcePermission(models.Model):
@@ -41,8 +41,8 @@ class WorkspaceUserGroupResourcePermission(models.Model):
                                  default=list,
                                  base_field=models.CharField(max_length=256,
                                                              blank=True,
-                                                             choices=ResourcePermission.choices + ResourcePermissionRole.choices,
-                                                             default=ResourcePermission.VIEW))
+                                                             choices=ResourcePermissionConstants.choices,
+                                                             default=ResourcePermissionConstants.VIEW))
 
     create_time = models.DateTimeField(verbose_name="创建时间", auto_now_add=True, db_index=True)
 
diff --git a/apps/system_manage/models/workspace_user_permission.py b/apps/system_manage/models/workspace_user_permission.py
index eb52fddc4a2..973c3188407 100644
--- a/apps/system_manage/models/workspace_user_permission.py
+++ b/apps/system_manage/models/workspace_user_permission.py
@@ -11,18 +11,11 @@
 from django.contrib.postgres.fields import ArrayField
 from django.db import models
 
-from common.constants.permission_constants import Group, ResourceAuthType, ResourcePermissionRole, ResourcePermission
+from common.constants.resource_permission_constants import ResourceAuthType, ResourcePermissionConstants, \
+    AuthTargetType
 from users.models import User
 
 
-class AuthTargetType(models.TextChoices):
-    """授权目标"""
-    KNOWLEDGE = Group.KNOWLEDGE.value, '知识库'
-    APPLICATION = Group.APPLICATION.value, '应用'
-    TOOL = Group.TOOL.value, '工具'
-    MODEL = Group.MODEL.value, '模型'
-
-
 class WorkspaceUserResourcePermission(models.Model):
     """
     工作空间用户资源权限表
@@ -47,8 +40,8 @@ class WorkspaceUserResourcePermission(models.Model):
                                  default=list,
                                  base_field=models.CharField(max_length=256,
                                                              blank=True,
-                                                             choices=ResourcePermission.choices + ResourcePermissionRole.choices,
-                                                             default=ResourcePermission.VIEW))
+                                                             choices=ResourcePermissionConstants.choices,
+                                                             default=ResourcePermissionConstants.VIEW))
 
     create_time = models.DateTimeField(verbose_name="创建时间", auto_now_add=True, db_index=True)
 
diff --git a/apps/system_manage/serializers/user_group_resource_permission.py b/apps/system_manage/serializers/user_group_resource_permission.py
index 2a13a01c8af..bd25e266725 100644
--- a/apps/system_manage/serializers/user_group_resource_permission.py
+++ b/apps/system_manage/serializers/user_group_resource_permission.py
@@ -18,8 +18,8 @@
 
 from application.models import Application
 from common.constants.cache_version import Cache_Version
-from common.constants.permission_constants import RoleConstants, \
-    ResourcePermission, ResourcePermissionRole, ResourceAuthType
+from common.auth.constants.role_constants import RoleConstants
+from common.constants.resource_permission_constants import ResourceAuthType, ResourcePermissionConstants
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.db.search import native_search, native_page_search, get_dynamics_model
 from common.db.sql_execute import select_list
@@ -152,9 +152,9 @@ def auth_resource_batch(self, resource_id_list: list):
         workspace_user_resource_permission = [WorkspaceUserResourcePermission(
             target=resource_id,
             auth_target_type=auth_target_type,
-            permission_list=[ResourcePermission.VIEW,
-                             ResourcePermission.MANAGE] if auth_type == ResourceAuthType.RESOURCE_PERMISSION_GROUP else [
-                ResourcePermissionRole.ROLE],
+            permission_list=[ResourcePermissionConstants.VIEW,
+                             ResourcePermissionConstants.MANAGE] if auth_type == ResourceAuthType.RESOURCE_PERMISSION_GROUP else [
+                ResourcePermissionConstants.ROLE],
             workspace_id=workspace_id,
             user_id=user_id,
             auth_type=auth_type
@@ -175,8 +175,8 @@ def auth_resource(self, resource_id: str, is_folder=False):
         WorkspaceUserResourcePermission(
             target=resource_id,
             auth_target_type=auth_target_type,
-            permission_list=[ResourcePermission.VIEW,
-                             ResourcePermission.MANAGE],
+            permission_list=[ResourcePermissionConstants.VIEW,
+                             ResourcePermissionConstants.MANAGE],
             workspace_id=workspace_id,
             user_id=user_id,
             auth_type=ResourceAuthType.RESOURCE_PERMISSION_GROUP
diff --git a/apps/system_manage/serializers/user_resource_permission.py b/apps/system_manage/serializers/user_resource_permission.py
index ac6a232a42b..a95d1f0c53a 100644
--- a/apps/system_manage/serializers/user_resource_permission.py
+++ b/apps/system_manage/serializers/user_resource_permission.py
@@ -19,8 +19,8 @@
 
 from application.models import Application
 from common.constants.cache_version import Cache_Version
-from common.constants.permission_constants import get_default_workspace_user_role_mapping_list, RoleConstants, \
-    ResourcePermission, ResourcePermissionRole, ResourceAuthType
+from common.auth.constants.role_constants import RoleConstants
+from common.constants.resource_permission_constants import ResourceAuthType, ResourcePermissionConstants
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.db.search import native_search, native_page_search, get_dynamics_model
 from common.db.sql_execute import select_list
@@ -167,7 +167,7 @@ def is_auth(self, resource_id: str):
             else:
                 return False
         else:
-            return wurp.permission_list.__contains__(ResourcePermission.VIEW.value)
+            return wurp.permission_list.__contains__(ResourcePermissionConstants.VIEW.value)
 
     def auth_resource_batch(self, resource_id_list: list):
         self.is_valid(raise_exception=True)
@@ -181,9 +181,9 @@ def auth_resource_batch(self, resource_id_list: list):
         workspace_user_resource_permission = [WorkspaceUserResourcePermission(
             target=resource_id,
             auth_target_type=auth_target_type,
-            permission_list=[ResourcePermission.VIEW,
-                             ResourcePermission.MANAGE] if auth_type == ResourceAuthType.RESOURCE_PERMISSION_GROUP else [
-                ResourcePermissionRole.ROLE],
+            permission_list=[ResourcePermissionConstants.VIEW,
+                             ResourcePermissionConstants.MANAGE] if auth_type == ResourceAuthType.RESOURCE_PERMISSION_GROUP else [
+                ResourcePermissionConstants.ROLE],
             workspace_id=workspace_id,
             user_id=user_id,
             auth_type=auth_type
@@ -204,8 +204,8 @@ def auth_resource(self, resource_id: str, is_folder=False):
         WorkspaceUserResourcePermission(
             target=resource_id,
             auth_target_type=auth_target_type,
-            permission_list=[ResourcePermission.VIEW,
-                             ResourcePermission.MANAGE],
+            permission_list=[ResourcePermissionConstants.VIEW,
+                             ResourcePermissionConstants.MANAGE],
             workspace_id=workspace_id,
             user_id=user_id,
             auth_type=ResourceAuthType.RESOURCE_PERMISSION_GROUP
diff --git a/apps/system_manage/views/email_setting.py b/apps/system_manage/views/email_setting.py
index f386bb6e816..0dc281b8828 100644
--- a/apps/system_manage/views/email_setting.py
+++ b/apps/system_manage/views/email_setting.py
@@ -12,7 +12,8 @@
 
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
 
 from django.utils.translation import gettext_lazy as _
 
diff --git a/apps/system_manage/views/resource_mapping.py b/apps/system_manage/views/resource_mapping.py
index ff3c71d303d..d71fe06714a 100644
--- a/apps/system_manage/views/resource_mapping.py
+++ b/apps/system_manage/views/resource_mapping.py
@@ -15,8 +15,12 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import Permission, Group, Operate, RoleConstants, ViewPermission, \
-    CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.group_constants import Group
+from common.auth.constants.operate_constants import Operate
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
+from common.auth.struct.permission import Permission
 from system_manage.api.resource_mapping import ResourceMappingAPI
 from system_manage.serializers.resource_mapping_serializers import ResourceMappingSerializer, MappingResourceSerializer
 
@@ -43,7 +47,7 @@ class ResourceMappingView(APIView):
                        [lambda r, kwargs: Permission(group=Group(kwargs.get('resource')),
                                                      operate=Operate.SELF,
                                                      resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource')}/{kwargs.get('resource_id')}")],
-                       CompareConstants.AND),
+                       compare=CompareConstants.AND),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id: str, resource: str, resource_id: str, current_page, page_size):
         return result.success(ResourceMappingSerializer({
@@ -77,7 +81,7 @@ class MappingResourceView(APIView):
                        [lambda r, kwargs: Permission(group=Group(kwargs.get('resource')),
                                                      operate=Operate.SELF,
                                                      resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource')}/{kwargs.get('resource_id')}")],
-                       CompareConstants.AND),
+                       compare=CompareConstants.AND),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id: str, resource: str, resource_id: str, current_page, page_size):
         return result.success(MappingResourceSerializer({
diff --git a/apps/system_manage/views/system_chat_user.py b/apps/system_manage/views/system_chat_user.py
index c03ad64cdb4..234c77592fe 100644
--- a/apps/system_manage/views/system_chat_user.py
+++ b/apps/system_manage/views/system_chat_user.py
@@ -6,7 +6,8 @@
 
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
 from common.log.log import log
 from common.result import result
 from models_provider.api.model import DefaultModelResponse
diff --git a/apps/system_manage/views/user_group_resource_permission.py b/apps/system_manage/views/user_group_resource_permission.py
index 2a71c4c654e..dd80a7b3a08 100644
--- a/apps/system_manage/views/user_group_resource_permission.py
+++ b/apps/system_manage/views/user_group_resource_permission.py
@@ -15,8 +15,12 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import RoleConstants, Permission, Group, Operate, ViewPermission, \
-    CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.group_constants import Group
+from common.auth.constants.operate_constants import Operate
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
+from common.auth.struct.permission import Permission
 from common.log.log import log
 from system_manage.api.user_resource_permission import UserResourcePermissionAPI, EditUserResourcePermissionAPI, \
     ResourceUserPermissionAPI, ResourceUserPermissionPageAPI, ResourceUserPermissionEditAPI, \
@@ -125,7 +129,7 @@ class WorkspaceResourceUserGroupPermissionView(APIView):
                        [lambda r, kwargs: Permission(group=Group(kwargs.get('resource').replace('_FOLDER', '')),
                                                      operate=Operate.SELF,
                                                      resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource').replace('_FOLDER', '')}/{kwargs.get('target')}")],
-                       CompareConstants.AND),
+                       compare=CompareConstants.AND),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id: str, target: str, resource: str):
         return result.success(UserGroupResourcePermissionSerializer(
@@ -159,7 +163,7 @@ def get(self, request: Request, workspace_id: str, target: str, resource: str):
                        [lambda r, kwargs: Permission(group=Group(kwargs.get('resource').replace('_FOLDER', '')),
                                                      operate=Operate.SELF,
                                                      resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource').replace('_FOLDER', '')}/{kwargs.get('target')}")],
-                       CompareConstants.AND),
+                       compare=CompareConstants.AND),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def put(self, request: Request, workspace_id: str, target: str, resource: str):
         return result.success(ResourceUserGroupPermissionSerializer(
@@ -190,7 +194,7 @@ class Page(APIView):
                            [lambda r, kwargs: Permission(group=Group(kwargs.get('resource').replace('_FOLDER', '')),
                                                          operate=Operate.SELF,
                                                          resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource').replace('_FOLDER', '')}/{kwargs.get('target')}")],
-                           CompareConstants.AND),
+                           compare=CompareConstants.AND),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, target: str, resource: str, current_page: int,
                 page_size: int):
diff --git a/apps/system_manage/views/user_resource_permission.py b/apps/system_manage/views/user_resource_permission.py
index 8f03327eaff..185a3eddd5c 100644
--- a/apps/system_manage/views/user_resource_permission.py
+++ b/apps/system_manage/views/user_resource_permission.py
@@ -15,8 +15,12 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import RoleConstants, Permission, Group, Operate, ViewPermission, \
-    CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.group_constants import Group
+from common.auth.constants.operate_constants import Operate
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
+from common.auth.struct.permission import Permission
 from common.log.log import log
 from system_manage.api.user_resource_permission import UserResourcePermissionAPI, EditUserResourcePermissionAPI, \
     ResourceUserPermissionAPI, ResourceUserPermissionPageAPI, ResourceUserPermissionEditAPI, \
@@ -125,7 +129,7 @@ class WorkspaceResourceUserPermissionView(APIView):
                        [lambda r, kwargs: Permission(group=Group(kwargs.get('resource').replace('_FOLDER','')),
                                                      operate=Operate.SELF,
                                                      resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource').replace('_FOLDER','')}/{kwargs.get('target')}")],
-                       CompareConstants.AND),
+                       compare=CompareConstants.AND),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id: str, target: str, resource: str):
         return result.success(ResourceUserPermissionSerializer(
@@ -161,7 +165,7 @@ def get(self, request: Request, workspace_id: str, target: str, resource: str):
                        [lambda r, kwargs: Permission(group=Group(kwargs.get('resource').replace('_FOLDER','')),
                                                      operate=Operate.SELF,
                                                      resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource').replace('_FOLDER','')}/{kwargs.get('target')}")],
-                       CompareConstants.AND),
+                       compare=CompareConstants.AND),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def put(self, request: Request, workspace_id: str, target: str, resource: str):
         return result.success(ResourceUserPermissionSerializer(
@@ -191,7 +195,7 @@ class Page(APIView):
                            [lambda r, kwargs: Permission(group=Group(kwargs.get('resource').replace('_FOLDER','')),
                                      operate=Operate.SELF,
                                      resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('resource').replace('_FOLDER','')}/{kwargs.get('target')}")],
-                           CompareConstants.AND),
+                           compare=CompareConstants.AND),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, target: str, resource: str, current_page: int,
                 page_size: int):
diff --git a/apps/tools/views/tool.py b/apps/tools/views/tool.py
index cbbb0cb87b5..d5a67ef1a6a 100644
--- a/apps/tools/views/tool.py
+++ b/apps/tools/views/tool.py
@@ -1,7 +1,10 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import check_batch_permissions, has_permissions
-from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from django.db.models import QuerySet
 from django.utils.translation import gettext_lazy as _
@@ -153,7 +156,7 @@ class Operate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -182,7 +185,7 @@ def put(self, request: Request, workspace_id: str, tool_id: str):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(menu="Tool", operate="Get tool")
@@ -205,7 +208,7 @@ def get(self, request: Request, workspace_id: str, tool_id: str):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -246,7 +249,7 @@ def put(self, request: Request, workspace_id: str):
                     ViewPermission(
                         [RoleConstants.USER.get_workspace_role()],
                         [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                        CompareConstants.AND,
+                        compare=CompareConstants.AND,
                     ),
                     RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
                 ),
@@ -295,7 +298,7 @@ def put(self, request: Request, workspace_id: str):
                     ViewPermission(
                         [RoleConstants.USER.get_workspace_role()],
                         [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                        CompareConstants.AND,
+                        compare=CompareConstants.AND,
                     ),
                     RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
                 ),
@@ -437,7 +440,7 @@ class Export(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -491,7 +494,7 @@ class EditIcon(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def put(self, request: Request, tool_id: str, workspace_id: str):
@@ -703,7 +706,7 @@ class PageToolRecord(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, tool_id: str, workspace_id: str, current_page: int, page_size: int):
@@ -738,7 +741,7 @@ class ToolRecord(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, tool_id: str, workspace_id: str, record_id: str):
@@ -795,7 +798,7 @@ class DownloadSkillFile(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, tool_id: str):
diff --git a/apps/tools/views/tool_workflow.py b/apps/tools/views/tool_workflow.py
index 7bad1926c92..d0e38441b4b 100644
--- a/apps/tools/views/tool_workflow.py
+++ b/apps/tools/views/tool_workflow.py
@@ -3,7 +3,10 @@
 from application.api.application_api import SpeechToTextAPI
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import CompareConstants, PermissionConstants, RoleConstants, ViewPermission
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from common.result import DefaultResultSerializer, result
 from django.utils.translation import gettext_lazy as _
@@ -40,7 +43,7 @@ class Publish(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
         )
@@ -80,7 +83,7 @@ class Operate(APIView):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         @log(
@@ -111,7 +114,7 @@ def put(self, request: Request, workspace_id: str, tool_id: str):
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
                 [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                CompareConstants.AND,
+                compare=CompareConstants.AND,
             ),
         )
         def get(self, request: Request, workspace_id: str, tool_id: str):
@@ -141,7 +144,7 @@ class ToolWorkflowDebugView(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.TOOL.get_workspace_tool_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
     )
     def post(self, request: Request, workspace_id: str, tool_id: str):
@@ -169,7 +172,7 @@ class McpServers(APIView):
         ViewPermission(
             [RoleConstants.USER.get_workspace_role()],
             [PermissionConstants.TOOL.get_workspace_tool_permission()],
-            CompareConstants.AND,
+            compare=CompareConstants.AND,
         ),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
     )
diff --git a/apps/tools/views/tool_workflow_version.py b/apps/tools/views/tool_workflow_version.py
index d3f8a319d7e..7c6547bb9f5 100644
--- a/apps/tools/views/tool_workflow_version.py
+++ b/apps/tools/views/tool_workflow_version.py
@@ -15,7 +15,10 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
 from common.log.log import log
 from knowledge.api.knowledge_version import KnowledgeVersionListAPI, KnowledgeVersionPageAPI, \
     KnowledgeVersionOperateAPI
@@ -49,7 +52,7 @@ class ToolWorkflowVersionView(APIView):
                      PermissionConstants.TOOL_READ.get_workspace_permission_workspace_manage_role(),
                      ViewPermission([RoleConstants.USER.get_workspace_role()],
                                     [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                                    CompareConstants.AND),
+                                    compare=CompareConstants.AND),
                      RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     def get(self, request: Request, workspace_id, tool_id: str):
         return result.success(
@@ -73,7 +76,7 @@ class Page(APIView):
                          PermissionConstants.TOOL_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, tool_id: str, current_page: int, page_size: int):
             return result.success(
@@ -98,7 +101,7 @@ class Operate(APIView):
                          PermissionConstants.TOOL_READ.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         def get(self, request: Request, workspace_id: str, tool_id: str, tool_version_id: str):
             return result.success(
@@ -120,7 +123,7 @@ def get(self, request: Request, workspace_id: str, tool_id: str, tool_version_id
                          PermissionConstants.TOOL_EDIT.get_workspace_permission_workspace_manage_role(),
                          ViewPermission([RoleConstants.USER.get_workspace_role()],
                                         [PermissionConstants.TOOL.get_workspace_tool_permission()],
-                                        CompareConstants.AND),
+                                        compare=CompareConstants.AND),
                          RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(menu='Tool', operate="Modify tool version information",
              get_operation_object=lambda r, k: get_tool_operation_object(k.get('tool_id')),
diff --git a/apps/trigger/views/trigger.py b/apps/trigger/views/trigger.py
index 2cfcd3bab05..b68f3b1755e 100644
--- a/apps/trigger/views/trigger.py
+++ b/apps/trigger/views/trigger.py
@@ -16,8 +16,13 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants, ViewPermission, CompareConstants, \
-    Permission, Group, Operate
+from common.auth.constants.compare_constants import CompareConstants
+from common.auth.constants.group_constants import Group
+from common.auth.constants.operate_constants import Operate
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.aggregate_permission import ViewPermission
+from common.auth.struct.permission import Permission
 from common.log.log import log
 from common.result import DefaultResultSerializer
 from trigger.models import Trigger
@@ -270,7 +275,7 @@ class TaskSourceTriggerView(APIView):
                        [lambda r, kwargs: Permission(group=Group(kwargs.get('source_type')),
                                                      operate=Operate.SELF,
                                                      resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('source_type')}/{kwargs.get('source_id')}")],
-                       CompareConstants.AND),
+                       compare=CompareConstants.AND),
         RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
     @log(
         menu="Trigger", operate="Create trigger in source",
@@ -358,7 +363,7 @@ def get(self, request: Request, workspace_id: str, source_type: str, source_id:
                            [lambda r, kwargs: Permission(group=Group(kwargs.get('source_type')),
                                                          operate=Operate.SELF,
                                                          resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('source_type')}/{kwargs.get('source_id')}")],
-                           CompareConstants.AND),
+                           compare=CompareConstants.AND),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(
             menu="Trigger", operate="Modify the source point trigger",
@@ -390,7 +395,7 @@ def put(self, request: Request, workspace_id: str, source_type: str, source_id:
                            [lambda r, kwargs: Permission(group=Group(kwargs.get('source_type')),
                                                          operate=Operate.SELF,
                                                          resource_path=f"/WORKSPACE/{kwargs.get('workspace_id')}/{kwargs.get('source_type')}/{kwargs.get('source_id')}")],
-                           CompareConstants.AND),
+                           compare=CompareConstants.AND),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role())
         @log(
             menu="Trigger", operate="Delete the source point trigger",
diff --git a/apps/trigger/views/trigger_task.py b/apps/trigger/views/trigger_task.py
index 27758fe8c48..3abcfa432aa 100644
--- a/apps/trigger/views/trigger_task.py
+++ b/apps/trigger/views/trigger_task.py
@@ -17,7 +17,8 @@
 from trigger.api.trigger_task import TriggerTaskRecordExecutionDetailsAPI, TriggerTaskRecordPageAPI, TriggerTaskAPI
 from trigger.serializers.trigger_task import TriggerTaskQuerySerializer, TriggerTaskRecordQuerySerializer, \
     TriggerTaskRecordOperateSerializer
-from common.constants.permission_constants import PermissionConstants, RoleConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
 
 
 class TriggerTaskView(APIView):
diff --git a/apps/users/migrations/0001_initial.py b/apps/users/migrations/0001_initial.py
index 6291d6e5fc6..732b0b13015 100644
--- a/apps/users/migrations/0001_initial.py
+++ b/apps/users/migrations/0001_initial.py
@@ -3,7 +3,7 @@
 import uuid_utils.compat
 from django.db import migrations, models
 
-from common.constants.permission_constants import RoleConstants
+from common.auth.constants.role_constants import RoleConstants
 from common.utils.common import password_encrypt
 from maxkb.const import CONFIG
 
@@ -20,7 +20,6 @@ def insert_default_data(apps, schema_editor):
 
 
 class Migration(migrations.Migration):
-
     initial = True
 
     dependencies = [
@@ -30,8 +29,11 @@ class Migration(migrations.Migration):
         migrations.CreateModel(
             name='User',
             fields=[
-                ('id', models.UUIDField(default=uuid_utils.compat.uuid7, editable=False, primary_key=True, serialize=False, verbose_name='主键id')),
-                ('email', models.EmailField(blank=True, db_index=True, max_length=254, null=True, unique=True, verbose_name='邮箱')),
+                ('id',
+                 models.UUIDField(default=uuid_utils.compat.uuid7, editable=False, primary_key=True, serialize=False,
+                                  verbose_name='主键id')),
+                ('email', models.EmailField(blank=True, db_index=True, max_length=254, null=True, unique=True,
+                                            verbose_name='邮箱')),
                 ('phone', models.CharField(db_index=True, default='', max_length=20, verbose_name='电话')),
                 ('nick_name', models.CharField(db_index=True, max_length=150, unique=True, verbose_name='昵称')),
                 ('username', models.CharField(db_index=True, max_length=150, unique=True, verbose_name='用户名')),
@@ -40,7 +42,8 @@ class Migration(migrations.Migration):
                 ('source', models.CharField(db_index=True, default='LOCAL', max_length=10, verbose_name='来源')),
                 ('is_active', models.BooleanField(db_index=True, default=True)),
                 ('language', models.CharField(default=None, max_length=10, null=True, verbose_name='语言')),
-                ('create_time', models.DateTimeField(auto_now_add=True, db_index=True, null=True, verbose_name='创建时间')),
+                ('create_time',
+                 models.DateTimeField(auto_now_add=True, db_index=True, null=True, verbose_name='创建时间')),
                 ('update_time', models.DateTimeField(auto_now=True, db_index=True, null=True, verbose_name='修改时间')),
             ],
             options={
diff --git a/apps/users/migrations/0003_systemusergroup_systemusergrouprelation.py b/apps/users/migrations/0003_systemusergroup_systemusergrouprelation.py
new file mode 100644
index 00000000000..951c1192f83
--- /dev/null
+++ b/apps/users/migrations/0003_systemusergroup_systemusergrouprelation.py
@@ -0,0 +1,41 @@
+# Generated by Django 5.2.14 on 2026-08-05 07:06
+
+import django.db.models.deletion
+import uuid_utils.compat
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('users', '0002_alter_user_nick_name'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='SystemUserGroup',
+            fields=[
+                ('id', models.CharField(default=uuid_utils.compat.uuid7, editable=False, max_length=128, primary_key=True, serialize=False, verbose_name='主键id')),
+                ('name', models.CharField(db_index=True, max_length=150, unique=True, verbose_name='名称')),
+                ('workspace_id', models.CharField(db_index=True, default='default', max_length=64, verbose_name='工作空间id')),
+                ('create_time', models.DateTimeField(auto_now_add=True, db_index=True, null=True, verbose_name='创建时间')),
+                ('update_time', models.DateTimeField(auto_now=True, db_index=True, null=True, verbose_name='修改时间')),
+            ],
+            options={
+                'db_table': 'system_user_group',
+                'unique_together': {('workspace_id', 'name')},
+            },
+        ),
+        migrations.CreateModel(
+            name='SystemUserGroupRelation',
+            fields=[
+                ('id', models.UUIDField(default=uuid_utils.compat.uuid7, editable=False, primary_key=True, serialize=False, verbose_name='主键id')),
+                ('group', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='users.systemusergroup', verbose_name='用户组')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='users.user', verbose_name='用户')),
+            ],
+            options={
+                'db_table': 'system_user_group_relation',
+                'constraints': [models.UniqueConstraint(fields=('user', 'group'), name='uniq_user_group_relation')],
+            },
+        ),
+    ]
diff --git a/apps/users/serializers/user.py b/apps/users/serializers/user.py
index 0c5efa79bcb..fe722870ecc 100644
--- a/apps/users/serializers/user.py
+++ b/apps/users/serializers/user.py
@@ -16,13 +16,12 @@
 import uuid_utils.compat as uuid
 from common.constants.cache_version import Cache_Version
 from common.constants.exception_code_constants import ExceptionCodeConstants
-from common.constants.permission_constants import (
-    Auth,
-    ResourceAuthType,
-    ResourcePermission,
-    ResourcePermissionRole,
-    RoleConstants,
-)
+
+from common.auth.constants.role_constants import RoleConstants
+from common.auth.struct.auth import Auth
+from common.constants.permission_constants import ResourcePermission
+from common.constants.resource_permission_constants import ResourceAuthType
+
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.db.search import page_search
 from common.exception.app_exception import AppApiException
@@ -194,8 +193,8 @@ def profile(user: User, auth: Auth):
             "nick_name": user.nick_name,
             "email": user.email,
             "source": user.source,
-            "role": auth.role_list,
-            "permissions": auth.permission_list,
+            "role": list(auth.roles),
+            "permissions": auth.permissions,
             "is_edit_password": password_verify(CONFIG.get("DEFAULT_PASSWORD", "MaxKB@123.."), user.password)
             if user.source == "LOCAL"
             else False,
@@ -558,9 +557,9 @@ def edit(self, instance, user_id, with_valid=True):
         @staticmethod
         def _check_admin_modification(user, instance):
             if (
-                user.role == RoleConstants.ADMIN.name
-                and "is_active" in instance
-                and instance.get("is_active") is not None
+                    user.role == RoleConstants.ADMIN.name
+                    and "is_active" in instance
+                    and instance.get("is_active") is not None
             ):
                 raise AppApiException(1004, _("Cannot modify administrator status"))
 
@@ -625,7 +624,7 @@ def get_user_list(self, user_id, workspace_id, nick_name):
         if workspace_user_role_mapping_model:
             # 判断当前用户是否属于该空间，不属于直接返回空
             if not workspace_user_role_mapping_model.objects.filter(
-                workspace_id=workspace_id, user_id=user_id
+                    workspace_id=workspace_id, user_id=user_id
             ).exists():
                 query_set = User.objects.none()
             else:
@@ -701,9 +700,9 @@ def update_user_role(instance, user, user_id=None):
         license_is_valid = DatabaseModelManage.get_model("license_is_valid") or (lambda: False)
         license_is_valid = license_is_valid() if license_is_valid() is not None else False
         if not role_setting or (
-            len(role_setting) == 1
-            and role_setting[0].get("role_id") == ""
-            and len(role_setting[0].get("workspace_ids", [])) == 0
+                len(role_setting) == 1
+                and role_setting[0].get("role_id") == ""
+                and len(role_setting[0].get("workspace_ids", [])) == 0
         ):
             if not license_is_valid:
                 workspace_user_role_mapping_model.objects.create(
@@ -829,9 +828,9 @@ def _get_resource_maps(workspace_ids):
         resource_maps["apps"][ws].append(rid)
 
     for ws, fid in (
-        ApplicationFolder.objects.filter(workspace_id__in=workspace_ids)
-        .exclude(id__in=workspace_ids)
-        .values_list("workspace_id", "id")
+            ApplicationFolder.objects.filter(workspace_id__in=workspace_ids)
+                    .exclude(id__in=workspace_ids)
+                    .values_list("workspace_id", "id")
     ):
         resource_maps["app_folders"][ws].append(fid)
 
@@ -840,9 +839,9 @@ def _get_resource_maps(workspace_ids):
         resource_maps["knowledge"][ws].append(kid)
 
     for ws, kfid in (
-        KnowledgeFolder.objects.filter(workspace_id__in=workspace_ids)
-        .exclude(id__in=workspace_ids)
-        .values_list("workspace_id", "id")
+            KnowledgeFolder.objects.filter(workspace_id__in=workspace_ids)
+                    .exclude(id__in=workspace_ids)
+                    .values_list("workspace_id", "id")
     ):
         resource_maps["knowledge_folders"][ws].append(kfid)
 
@@ -851,9 +850,9 @@ def _get_resource_maps(workspace_ids):
         resource_maps["tools"][ws].append(tid)
 
     for ws, tfid in (
-        ToolFolder.objects.filter(workspace_id__in=workspace_ids)
-        .exclude(id__in=workspace_ids)
-        .values_list("workspace_id", "id")
+            ToolFolder.objects.filter(workspace_id__in=workspace_ids)
+                    .exclude(id__in=workspace_ids)
+                    .values_list("workspace_id", "id")
     ):
         resource_maps["tool_folders"][ws].append(tfid)
 
@@ -977,7 +976,7 @@ def _batch_create_permissions(instances, batch_size=500):
 
     objs = WorkspaceUserResourcePermission.objects
     for i in range(0, len(instances), batch_size):
-        objs.bulk_create(instances[i : i + batch_size])
+        objs.bulk_create(instances[i: i + batch_size])
 
 
 class RePasswordSerializer(serializers.Serializer):
diff --git a/apps/users/serializers/user_group.py b/apps/users/serializers/user_group.py
index d6bded8a6dd..5fbadc6b940 100644
--- a/apps/users/serializers/user_group.py
+++ b/apps/users/serializers/user_group.py
@@ -6,7 +6,7 @@
 from django.utils.translation import gettext_lazy as _
 from rest_framework import serializers
 
-from common.constants.permission_constants import RoleConstants
+from common.auth.constants.role_constants import RoleConstants
 from common.database_model_manage.database_model_manage import DatabaseModelManage
 from common.db.search import page_search
 from common.exception.app_exception import AppApiException
diff --git a/apps/users/views/system_user_group.py b/apps/users/views/system_user_group.py
index 917ff283375..fb7adf45ecf 100644
--- a/apps/users/views/system_user_group.py
+++ b/apps/users/views/system_user_group.py
@@ -8,7 +8,8 @@
 from common import result
 from common.auth import TokenAuth
 from common.auth.authentication import has_permissions
-from common.constants.permission_constants import PermissionConstants, RoleConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
 from common.log.log import log
 from models_provider.api.model import DefaultModelResponse
 from users.api.user_group import (
diff --git a/apps/users/views/user.py b/apps/users/views/user.py
index affce27adb5..5151bb80c66 100644
--- a/apps/users/views/user.py
+++ b/apps/users/views/user.py
@@ -18,7 +18,8 @@
 from common.auth.authenticate import TokenAuth
 from common.auth.authentication import has_permissions
 from common.constants.cache_version import Cache_Version
-from common.constants.permission_constants import PermissionConstants, RoleConstants
+from common.auth.constants.permission_constants import PermissionConstants
+from common.auth.constants.role_constants import RoleConstants
 from common.exception.app_exception import AppApiException
 from common.log.log import log
 from common.result import result
@@ -71,7 +72,7 @@ class UserProfileView(APIView):
 
                    responses=UserProfileAPI.get_response())
     def get(self, request: Request):
-        return result.success(UserProfileSerializer().profile(request.user, request.auth))
+        return result.success(UserProfileSerializer().profile(request.user.profile, request.auth))
 
 
 class TestPermissionsUserView(APIView):
@@ -85,7 +86,7 @@ class TestPermissionsUserView(APIView):
                    responses=UserProfileAPI.get_response())
     @has_permissions(PermissionConstants.USER_EDIT, RoleConstants.ADMIN)
     def get(self, request: Request):
-        return result.success(UserProfileSerializer().profile(request.user, request.auth))
+        return result.success(UserProfileSerializer().profile(request.user.profile, request.auth))
 
 
 class SwitchUserLanguageView(APIView):
@@ -119,7 +120,7 @@ class TestWorkspacePermissionUserView(APIView):
                    parameters=TestWorkspacePermissionUserApi.get_parameters())
     @has_permissions(PermissionConstants.USER_EDIT.get_workspace_permission(), RoleConstants.ADMIN)
     def get(self, request: Request, workspace_id):
-        return result.success(UserProfileSerializer().profile(request.user, request.auth))
+        return result.success(UserProfileSerializer().profile(request.user.profile, request.auth))
 
 
 class UserList(APIView):