diff --git a/WonderQ-Admin-UI-Vue/src/router/index.ts b/WonderQ-Admin-UI-Vue/src/router/index.ts
index 42687f0..65c9b44 100644
--- a/WonderQ-Admin-UI-Vue/src/router/index.ts
+++ b/WonderQ-Admin-UI-Vue/src/router/index.ts
@@ -31,11 +31,11 @@ const router = createRouter({
       name: "admin",
       component: AdminLayout,
       children: [
-        { path: "dashboard", name: "dashboard", component: DashboardPage },
-        { path: "home", name: "home", component: HomePage },
-        { path: "play", name: "play", component: WanfaPage },
-        { path: "concierge", name: "concierge", component: ConciergePage },
-        { path: "leads", name: "leads", component: LeadsPage },
+        { path: "dashboard", name: "dashboard", component: DashboardPage, meta: { permission: "admin:dashboard" } },
+        { path: "home", name: "home", component: HomePage, meta: { permission: "admin:site-config" } },
+        { path: "play", name: "play", component: WanfaPage, meta: { permission: "admin:wanfa:read" } },
+        { path: "concierge", name: "concierge", component: ConciergePage, meta: { permission: "admin:concierge:read" } },
+        { path: "leads", name: "leads", component: LeadsPage, meta: { permission: "admin:leads:read" } },
         { path: "system/:resource", name: "system-resource", component: SystemResourcePage },
         { path: "", redirect: "/dashboard" },
       ],
@@ -72,7 +72,17 @@ router.beforeEach(async (to) => {
   await auth.bootstrap();
   if (!auth.isAuthenticated) return { name: "login", query: { redirect: to.fullPath } };
   registerDynamicRoutes();
-  const permission = to.meta.permission;
+  const systemPermissions: Record<string, string> = {
+    users: "system:user:read",
+    roles: "system:role:read",
+    menus: "system:menu:read",
+    depts: "system:dept:read",
+  };
+  const permission = typeof to.meta.permission === "string"
+    ? to.meta.permission
+    : to.name === "system-resource"
+      ? systemPermissions[String(to.params.resource)]
+      : undefined;
   if (typeof permission === "string" && !auth.hasPermission(permission)) return { name: "not-found" };
   return true;
 });