diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application.Contracts/LINGYUN/Abp/AIManagement/Permissions/AIManagementPermissionDefinitionProvider.cs b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application.Contracts/LINGYUN/Abp/AIManagement/Permissions/AIManagementPermissionDefinitionProvider.cs
new file mode 100644
index 000000000..ce5c6f665
--- /dev/null
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application.Contracts/LINGYUN/Abp/AIManagement/Permissions/AIManagementPermissionDefinitionProvider.cs
@@ -0,0 +1,56 @@
+using LINGYUN.Abp.AIManagement.Localization;
+using Volo.Abp.Authorization.Permissions;
+using Volo.Abp.Localization;
+using Volo.Abp.MultiTenancy;
+
+namespace LINGYUN.Abp.AIManagement.Permissions;
+
+public class AIManagementPermissionDefinitionProvider : PermissionDefinitionProvider
+{
+    public override void Define(IPermissionDefinitionContext context)
+    {
+        var group = context.AddGroup(AIManagementPermissionNames.GroupName, L("Permission:AIManagement"));
+
+        var groupDefinition = group.AddPermission(
+            AIManagementPermissionNames.WorkspaceDefinition.Default,
+            L("Permission:WorkspaceDefinition"),
+            MultiTenancySides.Host);
+        groupDefinition.AddChild(
+            AIManagementPermissionNames.WorkspaceDefinition.Create,
+            L("Permission:Create"),
+            MultiTenancySides.Host);
+        groupDefinition.AddChild(
+            AIManagementPermissionNames.WorkspaceDefinition.Update,
+            L("Permission:Edit"),
+            MultiTenancySides.Host);
+        groupDefinition.AddChild(
+            AIManagementPermissionNames.WorkspaceDefinition.Delete,
+            L("Permission:Delete"),
+            MultiTenancySides.Host);
+
+        var conversation = group.AddPermission(
+            AIManagementPermissionNames.Conversation.Default,
+            L("Permission:Conversation"));
+        conversation.AddChild(
+            AIManagementPermissionNames.Conversation.Create,
+            L("Permission:Create"));
+        conversation.AddChild(
+            AIManagementPermissionNames.Conversation.Update,
+            L("Permission:Update"));
+        conversation.AddChild(
+            AIManagementPermissionNames.Conversation.Delete,
+            L("Permission:Delete"));
+
+        var chat = group.AddPermission(
+            AIManagementPermissionNames.Chat.Default,
+            L("Permission:Chats"));
+        chat.AddChild(
+            AIManagementPermissionNames.Chat.SendMessage,
+            L("Permission:SendMessage"));
+    }
+
+    private static LocalizableString L(string name)
+    {
+        return LocalizableString.Create<AIManagementResource>(name);
+    }
+}
diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application.Contracts/LINGYUN/Abp/AIManagement/Permissions/AIManagementPermissionNames.cs b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application.Contracts/LINGYUN/Abp/AIManagement/Permissions/AIManagementPermissionNames.cs
new file mode 100644
index 000000000..949d5539d
--- /dev/null
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application.Contracts/LINGYUN/Abp/AIManagement/Permissions/AIManagementPermissionNames.cs
@@ -0,0 +1,38 @@
+using Volo.Abp.Reflection;
+
+namespace LINGYUN.Abp.AIManagement.Permissions;
+
+public static class AIManagementPermissionNames
+{
+    public const string GroupName = "AIManagement";
+
+    public static class WorkspaceDefinition
+    {
+        public const string Default = GroupName + ".WorkspaceDefinitions";
+
+        public const string Create = Default + ".Create";
+        public const string Update = Default + ".Update";
+        public const string Delete = Default + ".Delete";
+    }
+
+    public static class Conversation
+    {
+        public const string Default = GroupName + ".Conversations";
+
+        public const string Create = Default + ".Create";
+        public const string Update = Default + ".Update";
+        public const string Delete = Default + ".Delete";
+    }
+
+    public static class Chat
+    {
+        public const string Default = GroupName + ".Chats";
+
+        public const string SendMessage = Default + ".SendMessage";
+    }
+
+    public static string[] GetAll()
+    {
+        return ReflectionHelper.GetPublicConstantsRecursively(typeof(AIManagementPermissionNames));
+    }
+}
diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Chats/ChatAppService.cs b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Chats/ChatAppService.cs
index b7863f15a..af96ece71 100644
--- a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Chats/ChatAppService.cs
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Chats/ChatAppService.cs
@@ -1,6 +1,8 @@
 using LINGYUN.Abp.AI.Agent;
 using LINGYUN.Abp.AI.Models;
 using LINGYUN.Abp.AIManagement.Chats.Dtos;
+using LINGYUN.Abp.AIManagement.Permissions;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.Extensions.AI;
 using System.Collections.Generic;
 using System.Threading.Tasks;
@@ -8,6 +10,8 @@ using Volo.Abp.Application.Dtos;
 using Volo.Abp.Specifications;
 
 namespace LINGYUN.Abp.AIManagement.Chats;
+
+[Authorize(AIManagementPermissionNames.Chat.Default)]
 public class ChatAppService : AIManagementApplicationServiceBase, IChatAppService
 {
     private readonly IAgentService _agentService;
@@ -20,6 +24,7 @@ public class ChatAppService : AIManagementApplicationServiceBase, IChatAppServic
         _repository = repository;
     }
 
+    [Authorize(AIManagementPermissionNames.Chat.SendMessage)]
     public virtual IAsyncEnumerable<string> SendMessageAsync(SendTextChatMessageDto input)
     {
         var chatMessage = new TextChatMessage(
diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Chats/ConversationAppService.cs b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Chats/ConversationAppService.cs
index 2ecabaa41..81bd7ea55 100644
--- a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Chats/ConversationAppService.cs
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Chats/ConversationAppService.cs
@@ -1,5 +1,6 @@
 using LINGYUN.Abp.AIManagement.Chats.Dtos;
 using LINGYUN.Abp.AIManagement.Localization;
+using LINGYUN.Abp.AIManagement.Permissions;
 using Microsoft.Extensions.Options;
 using System;
 using System.Linq;
@@ -28,6 +29,12 @@ public class ConversationAppService :
 
         LocalizationResource = typeof(AIManagementResource);
         ObjectMapperContext = typeof(AbpAIManagementApplicationModule);
+
+        CreatePolicyName = AIManagementPermissionNames.Conversation.Create;
+        UpdatePolicyName = AIManagementPermissionNames.Conversation.Update;
+        DeletePolicyName = AIManagementPermissionNames.Conversation.Delete;
+        GetListPolicyName = AIManagementPermissionNames.Conversation.Default;
+        GetPolicyName = AIManagementPermissionNames.Conversation.Default;
     }
 
     protected async override Task<IQueryable<ConversationRecord>> CreateFilteredQueryAsync(ConversationGetListInput input)
diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Workspaces/WorkspaceDefinitionAppService.cs b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Workspaces/WorkspaceDefinitionAppService.cs
index 38f7a016a..661fc697c 100644
--- a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Workspaces/WorkspaceDefinitionAppService.cs
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Application/LINGYUN/Abp/AIManagement/Workspaces/WorkspaceDefinitionAppService.cs
@@ -1,5 +1,6 @@
 using LINGYUN.Abp.AI;
 using LINGYUN.Abp.AIManagement.Localization;
+using LINGYUN.Abp.AIManagement.Permissions;
 using LINGYUN.Abp.AIManagement.Workspaces.Dtos;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
@@ -38,6 +39,12 @@ public class WorkspaceDefinitionAppService :
 
         LocalizationResource = typeof(AIManagementResource);
         ObjectMapperContext = typeof(AbpAIManagementApplicationModule);
+
+        CreatePolicyName = AIManagementPermissionNames.WorkspaceDefinition.Create;
+        UpdatePolicyName = AIManagementPermissionNames.WorkspaceDefinition.Update;
+        DeletePolicyName = AIManagementPermissionNames.WorkspaceDefinition.Delete;
+        GetListPolicyName = AIManagementPermissionNames.WorkspaceDefinition.Default;
+        GetPolicyName = AIManagementPermissionNames.WorkspaceDefinition.Default;
     }
 
     public virtual Task<ListResultDto<ChatClientProviderDto>> GetAvailableProvidersAsync()
diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Domain.Shared/LINGYUN/Abp/AIManagement/Localization/Resources/en.json b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Domain.Shared/LINGYUN/Abp/AIManagement/Localization/Resources/en.json
index b55671f5b..b3dfbe714 100644
--- a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Domain.Shared/LINGYUN/Abp/AIManagement/Localization/Resources/en.json
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Domain.Shared/LINGYUN/Abp/AIManagement/Localization/Resources/en.json
@@ -1,6 +1,11 @@
 {
   "culture": "en",
   "texts": {
+    "Permission:AIManagement": "Artificia Intelligence",
+    "Permission:WorkspaceDefinition": "Workspaces",
+    "Permission:Conversation": "Conversations",
+    "Permission:Chat": "Chats",
+    "Permission:SendMessage": "Send Message",
     "AIManagement:111001": "Workspace {Workspace} already exists!",
     "AIManagement:111002": "System workspace {Workspace} is not allowed to be deleted!",
     "DisplayName:MaxLatestHistoryMessagesToKeep": "Carry the recent conversation records",
diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Domain.Shared/LINGYUN/Abp/AIManagement/Localization/Resources/zh-Hans.json b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Domain.Shared/LINGYUN/Abp/AIManagement/Localization/Resources/zh-Hans.json
index 021c57d77..dfdbc8f8a 100644
--- a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Domain.Shared/LINGYUN/Abp/AIManagement/Localization/Resources/zh-Hans.json
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.Domain.Shared/LINGYUN/Abp/AIManagement/Localization/Resources/zh-Hans.json
@@ -1,6 +1,11 @@
 {
   "culture": "zh-Hans",
   "texts": {
+    "Permission:AIManagement": "人工智能",
+    "Permission:WorkspaceDefinition": "工作区管理",
+    "Permission:Conversation": "对话管理",
+    "Permission:Chat": "聊天管理",
+    "Permission:SendMessage": "发送消息",
     "AIManagement:111001": "工作区 {Workspace} 已存在!",
     "AIManagement:111002": "系统工作区 {Workspace} 不允许删除!",
     "DisplayName:MaxLatestHistoryMessagesToKeep": "携带最近对话记录",
diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Chats/ChatController.cs b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Chats/ChatController.cs
index 2ed4e67bb..a562fdeb1 100644
--- a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Chats/ChatController.cs
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Chats/ChatController.cs
@@ -1,4 +1,6 @@
 using LINGYUN.Abp.AIManagement.Chats.Dtos;
+using LINGYUN.Abp.AIManagement.Permissions;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using System.Collections.Generic;
 using System.Threading.Tasks;
@@ -12,6 +14,7 @@ namespace LINGYUN.Abp.AIManagement.Chats;
 [RemoteService(Name = AIManagementRemoteServiceConsts.RemoteServiceName)]
 [Area(AIManagementRemoteServiceConsts.ModuleName)]
 [Route($"api/{AIManagementRemoteServiceConsts.ModuleName}/chats")]
+[Authorize(AIManagementPermissionNames.Chat.Default)]
 public class ChatController : AbpControllerBase, IChatAppService
 {
     private readonly IChatAppService _service;
@@ -22,6 +25,7 @@ public class ChatController : AbpControllerBase, IChatAppService
 
     [HttpPost]
     [ServiceFilter<SseAsyncEnumerableResultFilter>]
+    [Authorize(AIManagementPermissionNames.Chat.SendMessage)]
     public async virtual IAsyncEnumerable<string> SendMessageAsync(SendTextChatMessageDto input)
     {
         await foreach (var content in _service.SendMessageAsync(input))
diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Chats/ConversationController.cs b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Chats/ConversationController.cs
index e90aced0b..4822f5847 100644
--- a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Chats/ConversationController.cs
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Chats/ConversationController.cs
@@ -1,4 +1,6 @@
 using LINGYUN.Abp.AIManagement.Chats.Dtos;
+using LINGYUN.Abp.AIManagement.Permissions;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using System;
 using System.Threading.Tasks;
@@ -12,6 +14,7 @@ namespace LINGYUN.Abp.AIManagement.Chats;
 [RemoteService(Name = AIManagementRemoteServiceConsts.RemoteServiceName)]
 [Area(AIManagementRemoteServiceConsts.ModuleName)]
 [Route($"api/{AIManagementRemoteServiceConsts.ModuleName}/chats/conversations")]
+[Authorize(AIManagementPermissionNames.Conversation.Default)]
 public class ConversationController : AbpControllerBase, IConversationAppService
 {
     private readonly IConversationAppService _service;
@@ -21,12 +24,14 @@ public class ConversationController : AbpControllerBase, IConversationAppService
     }
 
     [HttpPost]
+    [Authorize(AIManagementPermissionNames.Conversation.Create)]
     public virtual Task<ConversationDto> CreateAsync(ConversationCreateDto input)
     {
         return _service.CreateAsync(input);
     }
 
     [HttpDelete("{id}")]
+    [Authorize(AIManagementPermissionNames.Conversation.Delete)]
     public virtual Task DeleteAsync(Guid id)
     {
         return _service.DeleteAsync(id);
@@ -45,6 +50,7 @@ public class ConversationController : AbpControllerBase, IConversationAppService
     }
 
     [HttpPut("{id}")]
+    [Authorize(AIManagementPermissionNames.Conversation.Update)]
     public virtual Task<ConversationDto> UpdateAsync(Guid id, ConversationUpdateDto input)
     {
         return _service.UpdateAsync(id, input);
diff --git a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Workspaces/WorkspaceDefinitionController.cs b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Workspaces/WorkspaceDefinitionController.cs
index 0e7446fa7..0a61a7bc2 100644
--- a/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Workspaces/WorkspaceDefinitionController.cs
+++ b/aspnet-core/modules/ai/LINGYUN.Abp.AIManagement.HttpApi/LINGYUN/Abp/AIManagement/Workspaces/WorkspaceDefinitionController.cs
@@ -1,4 +1,6 @@
-using LINGYUN.Abp.AIManagement.Workspaces.Dtos;
+using LINGYUN.Abp.AIManagement.Permissions;
+using LINGYUN.Abp.AIManagement.Workspaces.Dtos;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using System;
 using System.Threading.Tasks;
@@ -12,6 +14,7 @@ namespace LINGYUN.Abp.AIManagement.Workspaces;
 [RemoteService(Name = AIManagementRemoteServiceConsts.RemoteServiceName)]
 [Area(AIManagementRemoteServiceConsts.ModuleName)]
 [Route($"api/{AIManagementRemoteServiceConsts.ModuleName}/workspaces")]
+[Authorize(AIManagementPermissionNames.WorkspaceDefinition.Default)]
 public class WorkspaceDefinitionController : AbpControllerBase, IWorkspaceDefinitionAppService
 {
     private readonly IWorkspaceDefinitionAppService _service;
@@ -27,12 +30,14 @@ public class WorkspaceDefinitionController : AbpControllerBase, IWorkspaceDefini
     }
 
     [HttpPost]
+    [Authorize(AIManagementPermissionNames.WorkspaceDefinition.Create)]
     public virtual Task<WorkspaceDefinitionRecordDto> CreateAsync(WorkspaceDefinitionRecordCreateDto input)
     {
         return _service.CreateAsync(input);
     }
 
     [HttpDelete("{id}")]
+    [Authorize(AIManagementPermissionNames.WorkspaceDefinition.Delete)]
     public virtual Task DeleteAsync(Guid id)
     {
         return _service.DeleteAsync(id);
@@ -51,6 +56,7 @@ public class WorkspaceDefinitionController : AbpControllerBase, IWorkspaceDefini
     }
 
     [HttpPut("{id}")]
+    [Authorize(AIManagementPermissionNames.WorkspaceDefinition.Update)]
     public virtual Task<WorkspaceDefinitionRecordDto> UpdateAsync(Guid id, WorkspaceDefinitionRecordUpdateDto input)
     {
         return _service.UpdateAsync(id, input);