diff --git a/apps/common/auth/handle/impl/user_token.py b/apps/common/auth/handle/impl/user_token.py
index f81ce8c379f..3666d9add86 100644
--- a/apps/common/auth/handle/impl/user_token.py
+++ b/apps/common/auth/handle/impl/user_token.py
@@ -121,6 +121,7 @@ def get_permissions(
             "----------------------处理工作空间权限--------------------------------------------------"
             for _ in workspace_user_role_mapping_list:
                 _role_permission_mapping_list = role_permission_mapping_dict.get(str(_.role_id)) or []
+                role = role_model_dict.get(str(_.role_id))
                 permissions = [
                     PERMISSION_STR_MAP.get(_role_permission_mapping.permission_id)
                     for _role_permission_mapping in _role_permission_mapping_list
@@ -135,6 +136,9 @@ def get_permissions(
                     k = f"{group}:w:{_.workspace_id}"
                     bits = reduce(lambda x, y: x | y, [p.value.bit() for p in ps], 0)
                     permission_map[k] = permission_map.get(k, 0) | bits
+                    if role and role.type == str(RoleConstants.WORKSPACE_MANAGE.value) and not role.internal:
+                        workspace_manage_k = f"{group}_{RoleConstants.WORKSPACE_MANAGE.value}:w:{_.workspace_id}"
+                        permission_map[workspace_manage_k] = permission_map.get(workspace_manage_k, 0) | bits
             "----------------------处理系统权限--------------------------------------------------"
             system_permissions = [
                 PERMISSION_STR_MAP.get(_role_permission_mapping.permission_id)
diff --git a/apps/common/auth/struct/permission.py b/apps/common/auth/struct/permission.py
index a083cdfc90c..e1a5d7bae91 100644
--- a/apps/common/auth/struct/permission.py
+++ b/apps/common/auth/struct/permission.py
@@ -37,10 +37,11 @@ def bit(self):
     def get_resource_permission_key(self, resource_id):
         workspace = f":w:{self.workspace_id}" if self.workspace_id else ""
         resource = f":r:{self.resource_id}" if self.resource_id else ""
+        flag = f"_{self.flag}" if self.flag else ""
         group = str(self.group)
         if self.group in (Group.SYSTEM_RES_KNOWLEDGE, Group.KNOWLEDGE) and self.sub_group != self.group:
             group = f"{group}_{self.sub_group}"
-        return f"{group}{workspace}{resource}"
+        return f"{group}{flag}{workspace}{resource}"
 
     def __str__(self):
         sub = f"_{self.sub_group}" if self.sub_group != self.group else ""
diff --git a/apps/homepage/serializers/homepage.py b/apps/homepage/serializers/homepage.py
index 539577d3575..db50e2aea69 100644
--- a/apps/homepage/serializers/homepage.py
+++ b/apps/homepage/serializers/homepage.py
@@ -53,7 +53,7 @@
 def hasPermission(auth, permission):
     if "USER" in auth.roles:
         return True
-    key = permission.get_resource_permission_key(permission.resource_id) if permission.resource_id else str(permission)
+    key = permission.get_resource_permission_key(permission.resource_id)
     return (auth.permissions.get(key, 0) & permission.bit()) > 0
 
 
diff --git a/ui/src/permission/core/common.ts b/ui/src/permission/core/common.ts
index 99902abcef1..d0bba1df96e 100644
--- a/ui/src/permission/core/common.ts
+++ b/ui/src/permission/core/common.ts
@@ -260,8 +260,9 @@ export class Permission {
   getResourcePermissionKey(): string {
     const workspace = this.workspaceId ? `:w:${this.workspaceId}` : ''
     const resource = this.resourceId ? `:r:${this.resourceId}` : ''
+    const flag = this.flag ? `_${this.flag}` : ''
     const group = (this.group === Group.SYSTEM_RES_KNOWLEDGE || this.group === Group.KNOWLEDGE) && this.subGroup !== this.group ? `${this.group}_${this.subGroup}` : this.group
-    return `${group}${workspace}${resource}`
+    return `${group}${flag}${workspace}${resource}`
   }
 
   /** 判定时使用的最终 key，对应后端 `AggregatePermission._match_permission`。 */
diff --git a/ui/src/permission/core/index.ts b/ui/src/permission/core/index.ts
index abf1eda36fc..b4c28dfd685 100644
--- a/ui/src/permission/core/index.ts
+++ b/ui/src/permission/core/index.ts
@@ -74,10 +74,7 @@ export const buildBaseResourcePermission = (permission: Permission, resourceId:
     ? buildBasePermission(permission, workspaceId)
     : AggregatePermission.builder()
         .addPermission(permission.newResourcePermission(workspaceId, resourceId))
-        .addPermission(AggregatePermission.builder().addRole(new Role(RoleConstants.EXTENDS_WORKSPACE_MANAGE.name, workspaceId))
-        .addPermission(new Permission(permission.group,permission.subGroup,permission.operate,permission.bitIndex,workspaceId))
-        .compare(Compare.AND)
-        .build())
+        .addPermission(new Permission(permission.group,permission.subGroup,permission.operate,permission.bitIndex,workspaceId).getWorkspaceManageFlagPermission())
         .addRole(new Role(RoleConstants.WORKSPACE_MANAGE.name, workspaceId))
         .compare(Compare.OR)
         .build()