diff --git a/apps/common/auth/constants/group_constants.py b/apps/common/auth/constants/group_constants.py
index 12e514c50f6..cf859fdf436 100644
--- a/apps/common/auth/constants/group_constants.py
+++ b/apps/common/auth/constants/group_constants.py
@@ -1,11 +1,12 @@
 # coding=utf-8
 """
-    @project: MaxKB
-    @Author：虎虎虎
-    @file： group_constants.py
-    @date：2026/8/3 17:31
-    @desc: 权限分组常量，用于菜单和权限分类
+@project: MaxKB
+@Author：虎虎虎
+@file： group_constants.py
+@date：2026/8/3 17:31
+@desc: 权限分组常量，用于菜单和权限分类
 """
+
 from enum import Enum
 
 from django.utils.translation import gettext_lazy as _
@@ -61,7 +62,7 @@ class Group(Enum):
     # 对话相关
     CHAT_USER_GROUP = ("CHAT_USER_GROUP", _("Chat User Group"))
     CHAT_USER_AUTH = ("CHAT_USER_AUTH", _("Chat User Auth"))
-    PORTAL = ("PORTAL", _('portal'))
+    PORTAL = ("PORTAL", _("portal"))
     # 其他
     OTHER = ("OTHER", _("Other"))
     HOMEPAGE = ("HOMEPAGE", _("Home page"))
@@ -69,6 +70,13 @@ class Group(Enum):
 
     # 资源授权分组
     RESOURCE_PERMISSION = ("RESOURCE_PERMISSION", _("Resource Permission"))
+    APPLICATION_RESOURCE_PERMISSION = (
+        "APPLICATION_RESOURCE_PERMISSION",
+        _("Application"),
+    )
+    KNOWLEDGE_RESOURCE_PERMISSION = ("KNOWLEDGE_RESOURCE_PERMISSION", _("Knowledge"))
+    TOOL_RESOURCE_PERMISSION = ("TOOL_RESOURCE_PERMISSION", _("Tool"))
+    MODEL_RESOURCE_PERMISSION = ("MODEL_RESOURCE_PERMISSION", _("Model"))
 
     # 工作空间分组
     WORKSPACE_ROLE = ("WORKSPACE_ROLE", _("Role Management"))
diff --git a/apps/common/auth/constants/operate_constants.py b/apps/common/auth/constants/operate_constants.py
index 1cb265c20ef..6f3c63c5b65 100644
--- a/apps/common/auth/constants/operate_constants.py
+++ b/apps/common/auth/constants/operate_constants.py
@@ -1,19 +1,21 @@
 # coding=utf-8
 """
-    @project: MaxKB
-    @Author：虎虎虎
-    @file： operate_constants.py
-    @date：2026/8/3 17:32
-    @desc: 操作权限常量
+@project: MaxKB
+@Author：虎虎虎
+@file： operate_constants.py
+@date：2026/8/3 17:32
+@desc: 操作权限常量
 """
+
 from enum import Enum
 from django.utils.translation import gettext_lazy as _
 
 
 class Operate(Enum):
     """
-     一个权限组的操作权限
+    一个权限组的操作权限
     """
+
     SELF = ("", "")
     READ = ("READ", _("Read"))
     EDIT = ("READ+EDIT", _("Edit"))
@@ -68,6 +70,13 @@ class Operate(Enum):
     SET_ROLE = ("READ+SET_ROLE", _("Set Role"))
     QUOTA_SETTING = ("READ+QUOTA_SETTING", _("Quota Setting"))
 
+    ABOUT = ("READ", _("About"))
+    LICENSE = ("READ+UPDATE", _("Update License"))
+    SWITCH_LANGUAGE = ("READ+EDIT", _("Switch Language"))
+    CHANGE_PASSWORD = ("READ+CREATE", _("Change Password"))
+    SYSTEM_API_KEY = ("READ+DELETE", _("System API Key"))
+    PORTAL = ("READ+PORTAL", _("Portal"))
+
     def __init__(self, value, label):
         self._value_ = value
         self.label = label
diff --git a/apps/common/auth/constants/permission_constants.py b/apps/common/auth/constants/permission_constants.py
index fef0435565a..0df6c3a7bb0 100644
--- a/apps/common/auth/constants/permission_constants.py
+++ b/apps/common/auth/constants/permission_constants.py
@@ -1047,9 +1047,12 @@ class PermissionConstants(Enum):
     )
 
     # ==================== 资源授权 ====================
-    APPLICATION_WORKSPACE_USER_RESOURCE_PERMISSION_READ = (
+    APPLICATION_RESOURCE_PERMISSION_READ = (
         Permission(
-            group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.READ, bit_index=0
+            group=Group.RESOURCE_PERMISSION,
+            sub_group=Group.APPLICATION_RESOURCE_PERMISSION,
+            operate=Operate.READ,
+            bit_index=0,
         ),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE],
@@ -1058,9 +1061,12 @@ class PermissionConstants(Enum):
         ),
     )
 
-    APPLICATION_WORKSPACE_USER_RESOURCE_PERMISSION_EDIT = (
+    APPLICATION_RESOURCE_PERMISSION_EDIT = (
         Permission(
-            group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.EDIT, bit_index=1
+            group=Group.RESOURCE_PERMISSION,
+            sub_group=Group.APPLICATION_RESOURCE_PERMISSION,
+            operate=Operate.EDIT,
+            bit_index=1,
         ),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE],
@@ -1069,9 +1075,12 @@ class PermissionConstants(Enum):
         ),
     )
 
-    KNOWLEDGE_WORKSPACE_USER_RESOURCE_PERMISSION_READ = (
+    KNOWLEDGE_RESOURCE_PERMISSION_READ = (
         Permission(
-            group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.READ, bit_index=0
+            group=Group.RESOURCE_PERMISSION,
+            sub_group=Group.KNOWLEDGE_RESOURCE_PERMISSION,
+            operate=Operate.READ,
+            bit_index=0,
         ),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE],
@@ -1080,9 +1089,12 @@ class PermissionConstants(Enum):
         ),
     )
 
-    KNOWLEDGE_WORKSPACE_USER_RESOURCE_PERMISSION_EDIT = (
+    KNOWLEDGE_RESOURCE_PERMISSION_EDIT = (
         Permission(
-            group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.EDIT, bit_index=1
+            group=Group.RESOURCE_PERMISSION,
+            sub_group=Group.KNOWLEDGE_RESOURCE_PERMISSION,
+            operate=Operate.EDIT,
+            bit_index=1,
         ),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE],
@@ -1091,9 +1103,9 @@ class PermissionConstants(Enum):
         ),
     )
 
-    TOOL_WORKSPACE_USER_RESOURCE_PERMISSION_READ = (
+    TOOL_RESOURCE_PERMISSION_READ = (
         Permission(
-            group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.READ, bit_index=0
+            group=Group.RESOURCE_PERMISSION, sub_group=Group.TOOL_RESOURCE_PERMISSION, operate=Operate.READ, bit_index=0
         ),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE],
@@ -1102,9 +1114,12 @@ class PermissionConstants(Enum):
         ),
     )
 
-    TOOL_WORKSPACE_USER_RESOURCE_PERMISSION_EDIT = (
+    TOOL_RESOURCE_PERMISSION_EDIT = (
         Permission(
-            group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.EDIT, bit_index=1
+            group=Group.RESOURCE_PERMISSION,
+            sub_group=Group.TOOL_RESOURCE_PERMISSION,
+            operate=Operate.EDIT,
+            bit_index=1,
         ),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE],
@@ -1113,9 +1128,12 @@ class PermissionConstants(Enum):
         ),
     )
 
-    MODEL_WORKSPACE_USER_RESOURCE_PERMISSION_READ = (
+    MODEL_RESOURCE_PERMISSION_READ = (
         Permission(
-            group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.READ, bit_index=0
+            group=Group.RESOURCE_PERMISSION,
+            sub_group=Group.MODEL_RESOURCE_PERMISSION,
+            operate=Operate.READ,
+            bit_index=0,
         ),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE],
@@ -1124,9 +1142,12 @@ class PermissionConstants(Enum):
         ),
     )
 
-    MODEL_WORKSPACE_USER_RESOURCE_PERMISSION_EDIT = (
+    MODEL_RESOURCE_PERMISSION_EDIT = (
         Permission(
-            group=Group.RESOURCE_PERMISSION, sub_group=Group.RESOURCE_PERMISSION, operate=Operate.EDIT, bit_index=1
+            group=Group.RESOURCE_PERMISSION,
+            sub_group=Group.MODEL_RESOURCE_PERMISSION,
+            operate=Operate.EDIT,
+            bit_index=1,
         ),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE],
@@ -1625,7 +1646,7 @@ class PermissionConstants(Enum):
 
     # ==================== 其他 ====================
     ABOUT_READ = (
-        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.READ, bit_index=0),
+        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.ABOUT, bit_index=0),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.USER, RoleConstants.WORKSPACE_MANAGE],
             category=Category.SYSTEM_SETTING,
@@ -1633,8 +1654,8 @@ class PermissionConstants(Enum):
         ),
     )
 
-    ABOUT_UPDATE = (
-        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.UPDATE, bit_index=1),
+    LICENSE_UPDATE = (
+        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.LICENSE, bit_index=1),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.WORKSPACE_MANAGE],
             category=Category.SYSTEM_SETTING,
@@ -1643,7 +1664,7 @@ class PermissionConstants(Enum):
     )
 
     SWITCH_LANGUAGE = (
-        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.EDIT, bit_index=2),
+        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.SWITCH_LANGUAGE, bit_index=2),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.USER, RoleConstants.WORKSPACE_MANAGE],
             category=Category.SYSTEM_SETTING,
@@ -1652,7 +1673,7 @@ class PermissionConstants(Enum):
     )
 
     CHANGE_PASSWORD = (
-        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.CREATE, bit_index=3),
+        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.CHANGE_PASSWORD, bit_index=3),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.USER, RoleConstants.WORKSPACE_MANAGE],
             category=Category.SYSTEM_SETTING,
@@ -1661,7 +1682,16 @@ class PermissionConstants(Enum):
     )
 
     SYSTEM_API_KEY_EDIT = (
-        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.DELETE, bit_index=4),
+        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.SYSTEM_API_KEY, bit_index=4),
+        PermissionMeta(
+            role_list=[RoleConstants.ADMIN, RoleConstants.USER, RoleConstants.WORKSPACE_MANAGE],
+            category=Category.SYSTEM_SETTING,
+            scope=[PermissionScopeConstants.SYSTEM],
+        ),
+    )
+
+    PORTAL = (
+        Permission(group=Group.OTHER, sub_group=Group.OTHER, operate=Operate.PORTAL, bit_index=5),
         PermissionMeta(
             role_list=[RoleConstants.ADMIN, RoleConstants.USER, RoleConstants.WORKSPACE_MANAGE],
             category=Category.SYSTEM_SETTING,