diff --git a/ui/src/api/API_README.md b/ui/src/api/API_README.md
index 35a936d98a3..95259558ae6 100644
--- a/ui/src/api/API_README.md
+++ b/ui/src/api/API_README.md
@@ -184,3 +184,17 @@ API 枚举与类型统一在 `src/api` 范围内管理，相关规则由本文
 `ResourceAuthorizationTargetType` 包含资源类型和三个 `_FOLDER` 类型，文件夹类型用于后端
 鉴权。包含子资源时传 `include_children: true` 及经过管理权限筛选的 `folder_ids`，
 普通资源或仅当前文件夹不传子文件夹 ID。loading、刷新及成功提示由抽屉负责。
+
+用户组视角使用同文件的 `getResourceUserGroupAuthorization` 和
+`putResourceUserGroupAuthorization`，请求路径为
+`resource_user_group_permission/resource/<target>/resource/<resource>`。分页返回
+`ResponsePage<ResourceUserGroupPermission>`（`id`、`name`、`count`、`permission`），
+名称查询参数为 `name`，提交 `ResourceUserGroupPermissionPayload[]`，对象 ID 字段为
+`user_group_id`；文件夹生效范围参数与用户授权一致。
+
+System 资源管理的用户授权维护在 `admin/system/resource-management/resource-authorization.ts`，
+使用 `/system/workspace/<workspaceId>/resource_management/resource/<target>/resource/<resource>`。
+查询与保存签名、分页类型、响应类型及提交类型与 Workspace 用户授权保持一致；工作空间 ID
+由接口内部读取，loading 由组件管理。`ResourceAuthorizationDrawer` 内部通过
+`isSystemResource()` 选择完整的用户授权 API 对象，作为该抽屉的范围选择例外；用户组仍使用
+现有 Workspace 接口，不推测 System 用户组路径。
diff --git a/ui/src/api/admin/system/resource-management/resource-authorization.ts b/ui/src/api/admin/system/resource-management/resource-authorization.ts
new file mode 100644
index 00000000000..acf003ed64b
--- /dev/null
+++ b/ui/src/api/admin/system/resource-management/resource-authorization.ts
@@ -0,0 +1,24 @@
+import { get, put } from '../../core/request'
+import type { ParamsPage, ResponsePage } from '../../core/types'
+import type { Dict, ResourceAuthorizationTargetType, ResourceUserPermission, ResourceUserPermissionPayload } from '@/api/types'
+import { getWorkspaceId } from '@/utils/resource-context'
+
+const getPrefix = () => `/system/workspace/${getWorkspaceId()}/resource_management`
+
+/** 获取 System 资源管理中指定资源或文件夹的用户权限分页列表。 */
+const getResourceAuthorization = (targetId: string, resource: ResourceAuthorizationTargetType, page: ParamsPage, query?: Dict<unknown>) => {
+  return get<ResponsePage<ResourceUserPermission>>(
+    `${getPrefix()}/resource/${targetId}/resource/${resource}/${page.currentPage}/${page.pageSize}`,
+    query,
+  )
+}
+
+/** 更新 System 资源管理中的用户权限及文件夹生效范围。 */
+const putResourceAuthorization = (targetId: string, resource: ResourceAuthorizationTargetType, permissions: ResourceUserPermissionPayload[]) => {
+  return put<ResourceUserPermissionPayload[], ResourceUserPermissionPayload[]>(
+    `${getPrefix()}/resource/${targetId}/resource/${resource}`,
+    permissions,
+  )
+}
+
+export default { getResourceAuthorization, putResourceAuthorization }
diff --git a/ui/src/api/admin/workspace/resource-authorization.ts b/ui/src/api/admin/workspace/resource-authorization.ts
index 68974b724e6..8d76f8ffb80 100644
--- a/ui/src/api/admin/workspace/resource-authorization.ts
+++ b/ui/src/api/admin/workspace/resource-authorization.ts
@@ -1,6 +1,13 @@
 import { get, put } from '../core/request'
 import type { ParamsPage, ResponsePage } from '../core/types'
-import type { Dict, ResourceAuthorizationTargetType, ResourceUserPermission, ResourceUserPermissionPayload } from '@/api/types'
+import type {
+  Dict,
+  ResourceUserGroupPermission,
+  ResourceUserGroupPermissionPayload,
+  ResourceAuthorizationTargetType,
+  ResourceUserPermission,
+  ResourceUserPermissionPayload,
+} from '@/api/types'
 import { getWorkspaceId } from '@/utils/resource-context'
 
 const getPrefix = () => {
@@ -23,4 +30,24 @@ const putResourceAuthorization = (targetId: string, resource: ResourceAuthorizat
   )
 }
 
-export default { getResourceAuthorization, putResourceAuthorization }
+/** 获取指定资源或文件夹的用户组权限分页列表。 */
+const getResourceUserGroupAuthorization = (targetId: string, resource: ResourceAuthorizationTargetType, page: ParamsPage, query?: Dict<unknown>) => {
+  return get<ResponsePage<ResourceUserGroupPermission>>(
+    `${getPrefix()}/resource_user_group_permission/resource/${targetId}/resource/${resource}/${page.currentPage}/${page.pageSize}`,
+    query,
+  )
+}
+
+/** 更新资源的用户组权限，可应用到有管理权限的子文件夹及资源。 */
+const putResourceUserGroupAuthorization = (
+  targetId: string,
+  resource: ResourceAuthorizationTargetType,
+  permissions: ResourceUserGroupPermissionPayload[],
+) => {
+  return put<ResourceUserGroupPermissionPayload[], ResourceUserGroupPermissionPayload[]>(
+    `${getPrefix()}/resource_user_group_permission/resource/${targetId}/resource/${resource}`,
+    permissions,
+  )
+}
+
+export default { getResourceAuthorization, putResourceAuthorization, getResourceUserGroupAuthorization, putResourceUserGroupAuthorization }
diff --git a/ui/src/api/types/resource-authorization.ts b/ui/src/api/types/resource-authorization.ts
index a2abcabbf15..407e8594d14 100644
--- a/ui/src/api/types/resource-authorization.ts
+++ b/ui/src/api/types/resource-authorization.ts
@@ -25,6 +25,21 @@ export interface ResourceUserPermissionPayload {
   folder_ids?: string[]
 }
 
+/** 指定资源下的用户组及其权限。 */
+export interface ResourceUserGroupPermission {
+  id: string
+  name: string
+  count: number
+  permission: ResourcePermission
+}
+
+export interface ResourceUserGroupPermissionPayload {
+  user_group_id: string
+  permission: ResourcePermission
+  include_children?: boolean
+  folder_ids?: string[]
+}
+
 export interface ResourcePermissionItem {
   auth_target_type: ResourceAuthorizationType
   children?: ResourcePermissionItem[]
diff --git a/ui/src/components/COMPONENT_README.md b/ui/src/components/COMPONENT_README.md
index 98ac0a12588..3aed62e16b3 100644
--- a/ui/src/components/COMPONENT_README.md
+++ b/ui/src/components/COMPONENT_README.md
@@ -51,8 +51,13 @@ src/components/
 │   │   └── ModelParamsDialog.vue # 模型参数动态表单弹窗
 │   ├── workspace-dropdown/
 │   │   └── index.vue             # 工作空间选择下拉框
-│   ├── resource-authorization-drawer/ # 资源用户授权抽屉与权限配置弹窗
+│   ├── resource-authorization-drawer/ # 资源用户组、用户授权抽屉与权限配置弹窗
 │   │   ├── index.vue
+│   │   ├── UserAuthorization.vue      # 按用户查询与授权
+│   │   ├── types.ts                 # 内部公共 Props 与权限选项类型
+│   │   ├── user-group/
+│   │   │   ├── UserGroupAuthorization.vue # 按用户组查询与授权
+│   │   │   └── UserGroupMembersDrawer.vue # 用户组成员查询抽屉
 │   │   └── PermissionConfigDialog.vue
 │   └── workspace-relation-tags/
 │       └── index.vue             # 标签及关联工作空间展示
@@ -1321,15 +1326,34 @@ import WorkspaceRelationTags from '@/components/business/workspace-relation-tags
 
 ### ResourceAuthorizationDrawer
 
-手动导入 `business/resource-authorization-drawer/index.vue`。调用方传入完整 `api`
-（`typeof ResourceAuthorizationApi`）和 `type`（`ResourceAuthorizationTargetType`），不由抽屉
-根据路由路径选择接口。当前后端的资源用户授权统一使用
-`api/admin/workspace/resource-authorization.ts`。通过 `open(id, folder?)` 打开；
-接口请求与文件夹鉴权均直接通过 `getWorkspaceId()` 读取路由中的工作空间，无需额外传入或保存。
+手动导入 `business/resource-authorization-drawer/index.vue`，调用方传入
+`type`（`ResourceAuthorizationTargetType`），通过 `open(id, folder?)` 打开，不再传入 API。
+抽屉内部使用 `isSystemResource()` 判断：用户授权在 System 资源管理中选择
+`api/admin/system/resource-management/resource-authorization.ts`，其他范围选择 Workspace 授权接口。
+用户组授权继续使用 Workspace 的 `resource_user_group_permission` 接口，尚无独立 System 接口。
+两个标签子组件只调用入口传入的完整 API 对象，不自行判断资源范围。
+接口请求与文件夹鉴权均通过 `getWorkspaceId()` 读取路由中的工作空间。
 `isFolder`、`isRootFolder` 标记文件夹及根目录，传入文件夹类型也可识别文件夹。
 
-支持姓名、用户名、权限及商业版本角色搜索，跨页选择和单人、批量授权；搜索后清空选择。
+入口 `index.vue` 只管理抽屉、标签切换和公共资源权限上下文；`UserGroupAuthorization.vue`
+与 `UserAuthorization.vue` 分别管理各自的查询、分页、选择、单项及批量保存，复用
+`PermissionConfigDialog`。仅挂载当前标签组件，切换后重新查询并重置临时状态；子组件通过
+`v-model:submitting` 同步保存状态，通过 `refresh` 通知入口转发刷新。
+默认打开“按用户组”，展示用户组名称、成员数和操作权限，支持名称搜索；成员数链接打开共享
+`UserGroupMembersDrawer`。原用户授权放在“按用户”，保留姓名、用户名、权限及商业版本角色搜索。
+两个标签均支持跨页选择、单项和批量授权；切换标签重置搜索、分页及选择，保存期间禁止切换。
+查询仅应用最新响应，避免快速切换标签后串用用户与用户组数据；搜索后清空选择。
 根目录隐藏“不授权”，返回的“不授权”按“查看”展示。包含子资源时必须传入完整文件夹子树，
 抽屉根据当前路由工作空间筛选有管理权限的文件夹 ID；没有可管理文件夹时禁用该范围。
 `PermissionConfigDialog` 只收集权限和范围，保存成功才关闭并刷新，失败保留配置。
-保存成功触发 `refresh`，关闭后统一重置临时数据。
+保存成功触发 `refresh`，关闭动画结束后重置临时数据并触发 `closed`，供资源 Action 卸载按需挂载的抽屉。
+
+### UserGroupMembersDrawer
+
+手动导入 `business/resource-authorization-drawer/user-group/UserGroupMembersDrawer.vue`，通过 `open(userGroup)` 传入
+`SystemUserGroup`，按其 `workspace_id` 查询成员。支持用户名、姓名搜索和分页，角色使用
+`MkTagGroup` 展示；供系统资源授权页面和资源授权抽屉共同复用。
+
+资源授权抽屉内部公共展示 Props 放在同目录 `types.ts`，权限选项类型从
+`RESOURCE_PERMISSION_OPTIONS` 派生；用户和用户组 API Props 分别保留完整 API 对象类型，
+用户组组件只接收具备用户组方法的 Workspace API。
diff --git a/ui/src/components/business/folder-tree/index.vue b/ui/src/components/business/folder-tree/index.vue
index 24d96fef532..99c9c4a2fa5 100644
--- a/ui/src/components/business/folder-tree/index.vue
+++ b/ui/src/components/business/folder-tree/index.vue
@@ -2,7 +2,6 @@
 import { computed, defineAsyncComponent, onMounted, ref, useTemplateRef } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import FolderApi from '@/api/admin/workspace/folder'
-import ResourceAuthorizationApi from '@/api/admin/workspace/resource-authorization'
 import type { FolderSource, FolderItem } from '@/api/types'
 import { FOLDER_SORT, type FolderSort } from './types'
 import { FOLDER_ENTRIES, FOLDER_ENTRY_ID } from '@/constants'
@@ -433,6 +432,6 @@ defineExpose({ refresh: loadFolders, openCreate: handleOpenCreateFolder })
 
     <FolderFormDialog ref="folderFormDialogRef" :title="formTitle" :source="props.source" @refresh="handleFolderRefresh" />
     <MoveToDialog v-if="canEdit" ref="moveToDialogRef" :loading="moveSubmitting" :source="props.source" @submit="handleMoveFolder" />
-    <ResourceAuthorizationDrawer v-if="canEdit" ref="resourceAuthorizationDrawerRef" :api="ResourceAuthorizationApi" :type="source" is-folder />
+    <ResourceAuthorizationDrawer v-if="canEdit" ref="resourceAuthorizationDrawerRef" :type="source" is-folder />
   </div>
 </template>
diff --git a/ui/src/components/business/resource-authorization-drawer/PermissionConfigDialog.vue b/ui/src/components/business/resource-authorization-drawer/PermissionConfigDialog.vue
index 8f110ce987f..7167014975a 100644
--- a/ui/src/components/business/resource-authorization-drawer/PermissionConfigDialog.vue
+++ b/ui/src/components/business/resource-authorization-drawer/PermissionConfigDialog.vue
@@ -1,9 +1,11 @@
 <script setup lang="ts">
 import { ref } from 'vue'
-import type { OptionItem, ResourcePermission } from '@/api/types'
+import type { ResourcePermission } from '@/api/types'
+
+import type { ResourcePermissionOption } from './types'
 
 const props = defineProps<{
-  options: (OptionItem<ResourcePermission> & { description: string })[]
+  options: ResourcePermissionOption[]
   isFolder: boolean
   canIncludeChildren: boolean
   loading: boolean
diff --git a/ui/src/components/business/resource-authorization-drawer/UserAuthorization.vue b/ui/src/components/business/resource-authorization-drawer/UserAuthorization.vue
new file mode 100644
index 00000000000..b36c5062156
--- /dev/null
+++ b/ui/src/components/business/resource-authorization-drawer/UserAuthorization.vue
@@ -0,0 +1,167 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, useTemplateRef } from 'vue'
+import type ResourceAuthorizationApi from '@/api/admin/workspace/resource-authorization'
+import type SystemResourceAuthorizationApi from '@/api/admin/system/resource-management/resource-authorization'
+import { RESOURCE_PERMISSION } from '@/api/enums'
+import type { Dict, ResourcePermission, ResourceUserPermission } from '@/api/types'
+import { MsgSuccess } from '@/utils/message'
+import MkTable from '@/components/global/mk-table/index.vue'
+import PermissionConfigDialog from './PermissionConfigDialog.vue'
+import { useStore } from '@/stores'
+
+import type { ResourceAuthorizationContentProps, ResourcePermissionOption } from './types'
+
+interface Props extends ResourceAuthorizationContentProps {
+  api: typeof ResourceAuthorizationApi | typeof SystemResourceAuthorizationApi
+  permissionOptions: ResourcePermissionOption[]
+}
+
+const props = defineProps<Props>()
+const emit = defineEmits<{ refresh: [] }>()
+const submitting = defineModel<boolean>('submitting', { required: true })
+
+/* 查询与跨页选择 */
+const { auth } = useStore()
+const searchFields = computed(() => [
+  { label: '姓名', value: 'nick_name' },
+  { label: '用户名', value: 'username' },
+  { label: '权限', value: 'permission', multiple: true, options: props.permissionOptions },
+  ...(auth.isEE || auth.isPE ? [{ label: '角色', value: 'role' }] : []),
+])
+const loading = ref(false)
+const permissionUsers = ref<ResourceUserPermission[]>([])
+const selectedUsers = ref<ResourceUserPermission[]>([])
+const paginationConfig = ref({ currentPage: 1, pageSize: 20, total: 0 })
+const searchQuery = ref<Dict<unknown>>()
+const tableRef = useTemplateRef('tableRef')
+
+function loadPermissions() {
+  if (!props.targetId) return Promise.resolve()
+  loading.value = true
+  return props.api
+    .getResourceAuthorization(props.targetId, props.type, paginationConfig.value, searchQuery.value)
+    .then(({ records, total }) => {
+      permissionUsers.value = records.map((subject) => ({
+        ...subject,
+        permission: props.isRootFolder && subject.permission === RESOURCE_PERMISSION.NOT_AUTH ? RESOURCE_PERMISSION.VIEW : subject.permission,
+      }))
+      paginationConfig.value.total = total
+    })
+    .finally(() => {
+      loading.value = false
+    })
+}
+
+function clearSelection() {
+  selectedUsers.value = []
+  tableRef.value?.clearSelection()
+}
+
+function handleSearch(query?: Dict<unknown>) {
+  searchQuery.value = query
+  paginationConfig.value.currentPage = 1
+  clearSelection()
+  loadPermissions()
+}
+
+function handleSelectionChange(selection: unknown[]) {
+  selectedUsers.value = selection as ResourceUserPermission[]
+}
+
+/* 单项与批量保存：确认前不修改行数据，失败时保留待提交配置。 */
+const configDialogRef = useTemplateRef<InstanceType<typeof PermissionConfigDialog>>('configDialogRef')
+const pendingUserIds = ref<string[]>([])
+
+function handleOpenBatchConfig() {
+  if (!selectedUsers.value.length || submitting.value) return
+  pendingUserIds.value = selectedUsers.value.map(({ id }) => id)
+  configDialogRef.value?.open()
+}
+
+function handlePermissionChange(value: string | number | boolean | undefined, subject: ResourceUserPermission) {
+  const permission = props.editablePermissionOptions.find((option) => option.value === value)?.value
+  if (!permission || permission === subject.permission || submitting.value) return
+  pendingUserIds.value = [subject.id]
+  if (props.isFolder) {
+    configDialogRef.value?.open(permission)
+  } else {
+    submitPermissions(permission, false)
+  }
+}
+
+function submitPermissions(permission: ResourcePermission, includeChildren: boolean) {
+  if (submitting.value || !pendingUserIds.value.length || (includeChildren && !props.managedFolderIds.length)) return
+  const permissionScope = {
+    permission,
+    include_children: includeChildren,
+    ...(includeChildren ? { folder_ids: [...props.managedFolderIds] } : {}),
+  }
+  submitting.value = true
+  return props.api
+    .putResourceAuthorization(
+      props.targetId,
+      props.type,
+      pendingUserIds.value.map((id) => ({ user_id: id, ...permissionScope })),
+    )
+    .then(() => {
+      MsgSuccess('提交成功')
+      configDialogRef.value?.close()
+      pendingUserIds.value = []
+      clearSelection()
+      emit('refresh')
+      return loadPermissions()
+    })
+    .finally(() => {
+      submitting.value = false
+    })
+}
+
+/* 挂载当前标签时查询权限。 */
+onMounted(() => loadPermissions())
+</script>
+
+<template>
+  <div>
+    <div class="flex-between mb-4 gap-4">
+      <el-button type="primary" :disabled="!selectedUsers.length || loading || submitting" @click="handleOpenBatchConfig">配置权限</el-button>
+      <MkComplexSearch :fields="searchFields" @change="handleSearch" />
+    </div>
+    <MkTable
+      ref="tableRef"
+      v-loading="loading || submitting"
+      v-model:pagination-config="paginationConfig"
+      :data="permissionUsers"
+      :max-table-height="260"
+      @current-change="loadPermissions"
+      @size-change="loadPermissions"
+      @selection-change="handleSelectionChange"
+    >
+      <el-table-column type="selection" width="40" reserve-selection />
+      <el-table-column prop="nick_name" label="姓名" min-width="120" show-overflow-tooltip />
+      <el-table-column prop="username" label="用户名" min-width="120" show-overflow-tooltip />
+      <el-table-column v-if="auth.isEE || auth.isPE" label="角色" width="160">
+        <template #default="{ row }">
+          <MkTagGroup v-if="row.role_name?.length" :tags="row.role_name" />
+          <span v-else>-</span>
+        </template>
+      </el-table-column>
+      <el-table-column label="权限" min-width="340">
+        <template #default="{ row }">
+          <el-radio-group :model-value="row.permission" :disabled="submitting" @change="handlePermissionChange($event, row)">
+            <el-radio v-for="option in editablePermissionOptions" :key="option.value" :value="option.value" class="mr-4!">{{
+              option.label
+            }}</el-radio>
+          </el-radio-group>
+        </template>
+      </el-table-column>
+    </MkTable>
+    <PermissionConfigDialog
+      ref="configDialogRef"
+      :options="editablePermissionOptions"
+      :is-folder="isFolder"
+      :can-include-children="managedFolderIds.length > 0"
+      :loading="submitting"
+      @submit="submitPermissions"
+    />
+  </div>
+</template>
diff --git a/ui/src/components/business/resource-authorization-drawer/index.vue b/ui/src/components/business/resource-authorization-drawer/index.vue
index f580e809106..cb1df015a9a 100644
--- a/ui/src/components/business/resource-authorization-drawer/index.vue
+++ b/ui/src/components/business/resource-authorization-drawer/index.vue
@@ -1,100 +1,63 @@
 <script setup lang="ts">
-import { computed, ref, useTemplateRef } from 'vue'
+import { computed, ref } from 'vue'
 import { cloneDeep } from 'lodash'
-import type ResourceAuthorizationApi from '@/api/admin/workspace/resource-authorization'
+import ResourceAuthorizationApi from '@/api/admin/workspace/resource-authorization'
+import SystemResourceAuthorizationApi from '@/api/admin/system/resource-management/resource-authorization'
 import { RESOURCE_AUTHORIZATION_TARGET_TYPE as TARGET, RESOURCE_PERMISSION } from '@/api/enums'
-import type {
-  Dict,
-  FolderItem,
-  ResourceAuthorizationTargetType,
-  ResourcePermission,
-  ResourceUserPermission,
-  ResourceUserPermissionPayload,
-} from '@/api/types'
+import type { FolderItem, ResourceAuthorizationTargetType } from '@/api/types'
 import { RESOURCE_PERMISSION_OPTIONS } from '@/constants/resource-authorization'
 import { buildBaseResourcePermission, hasPermission, PermissionConstants as P, Role, RoleConstants } from '@/permission/core'
 import { useStore } from '@/stores'
-import { getWorkspaceId } from '@/utils/resource-context'
-import { MsgSuccess } from '@/utils/message'
-import MkTable from '@/components/global/mk-table/index.vue'
-import PermissionConfigDialog from './PermissionConfigDialog.vue'
+import { getWorkspaceId, isSystemResource } from '@/utils/resource-context'
+import UserAuthorization from './UserAuthorization.vue'
+import UserGroupAuthorization from './user-group/UserGroupAuthorization.vue'
 
 defineOptions({ name: 'ResourceAuthorizationDrawer' })
 const props = defineProps<{
-  api: typeof ResourceAuthorizationApi
   type: ResourceAuthorizationTargetType
   isFolder?: boolean
   isRootFolder?: boolean
 }>()
-const emit = defineEmits<{ refresh: [] }>()
+const emit = defineEmits<{ refresh: []; closed: [] }>()
 const { auth } = useStore()
 
+/* 抽屉和当前授权对象 */
+const drawerVisible = ref(false)
+const targetType = ref<'user-group' | 'user'>('user-group')
+const targetId = ref('')
+const folderData = ref<FolderItem>()
+const submitting = ref(false)
+
+/* System 资源管理使用专属用户授权接口，用户组沿用现有接口。 */
+const userAuthorizationApi = computed(() => (isSystemResource() ? SystemResourceAuthorizationApi : ResourceAuthorizationApi))
+
 /* 资源类型与权限选项 */
 const folderPermissionMap = {
   [TARGET.APPLICATION]: { target: TARGET.APPLICATION_FOLDER, edit: P.APPLICATION_FOLDER_EDIT, auth: P.APPLICATION_RESOURCE_AUTHORIZATION },
   [TARGET.KNOWLEDGE]: { target: TARGET.KNOWLEDGE_FOLDER, edit: P.KNOWLEDGE_FOLDER_EDIT, auth: P.KNOWLEDGE_RESOURCE_AUTHORIZATION },
   [TARGET.TOOL]: { target: TARGET.TOOL_FOLDER, edit: P.TOOL_FOLDER_EDIT, auth: P.TOOL_RESOURCE_AUTHORIZATION },
 }
-const resourceType = computed(() => props.type.replace('_FOLDER', '') as keyof typeof folderPermissionMap | typeof TARGET.MODEL)
-const folderPermissions = computed(() => (resourceType.value === TARGET.MODEL ? undefined : folderPermissionMap[resourceType.value]))
+const folderPermissions = computed(() => {
+  switch (props.type) {
+    case TARGET.APPLICATION:
+    case TARGET.APPLICATION_FOLDER:
+      return folderPermissionMap[TARGET.APPLICATION]
+    case TARGET.KNOWLEDGE:
+    case TARGET.KNOWLEDGE_FOLDER:
+      return folderPermissionMap[TARGET.KNOWLEDGE]
+    case TARGET.TOOL:
+    case TARGET.TOOL_FOLDER:
+      return folderPermissionMap[TARGET.TOOL]
+    default:
+      return undefined
+  }
+})
 const isFolder = computed(() => Boolean(folderPermissions.value && (props.isFolder || props.isRootFolder || props.type.endsWith('_FOLDER'))))
-const authorizationType = computed(() => (isFolder.value ? folderPermissions.value!.target : props.type))
+const authorizationType = computed(() => (isFolder.value ? (folderPermissions.value?.target ?? props.type) : props.type))
 const permissionOptions = computed(() => RESOURCE_PERMISSION_OPTIONS.filter(({ value }) => !auth.isCE || value !== RESOURCE_PERMISSION.ROLE))
 const editablePermissionOptions = computed(() =>
   permissionOptions.value.filter(({ value }) => !props.isRootFolder || value !== RESOURCE_PERMISSION.NOT_AUTH),
 )
-const searchFields = computed(() => [
-  { label: '姓名', value: 'nick_name' },
-  { label: '用户名', value: 'username' },
-  { label: '权限', value: 'permission', multiple: true, options: permissionOptions.value },
-  ...(auth.isEE || auth.isPE ? [{ label: '角色', value: 'role' }] : []),
-])
-
-/* 查询与跨页选择 */
-const drawerVisible = ref(false)
-const targetId = ref('')
-const folderData = ref<FolderItem>()
-const loading = ref(false)
-const submitting = ref(false)
-const permissionUsers = ref<ResourceUserPermission[]>([])
-const selectedUsers = ref<ResourceUserPermission[]>([])
-const paginationConfig = ref({ currentPage: 1, pageSize: 20, total: 0 })
-const searchQuery = ref<Dict<unknown>>()
-const tableRef = useTemplateRef('tableRef')
-
-function loadPermissions() {
-  if (!targetId.value) return Promise.resolve()
-  loading.value = true
-  return props.api
-    .getResourceAuthorization(targetId.value, authorizationType.value, paginationConfig.value, searchQuery.value)
-    .then(({ records, total }) => {
-      permissionUsers.value = records.map((user) => ({
-        ...user,
-        permission: props.isRootFolder && user.permission === RESOURCE_PERMISSION.NOT_AUTH ? RESOURCE_PERMISSION.VIEW : user.permission,
-      }))
-      paginationConfig.value.total = total
-    })
-    .finally(() => {
-      loading.value = false
-    })
-}
-
-function clearSelection() {
-  selectedUsers.value = []
-  tableRef.value?.clearSelection()
-}
-
-function handleSearch(query?: Dict<unknown>) {
-  searchQuery.value = query
-  paginationConfig.value.currentPage = 1
-  clearSelection()
-  loadPermissions()
-}
-
-function handleSelectionChange(selection: unknown[]) {
-  selectedUsers.value = selection as ResourceUserPermission[]
-}
-
 /* 子资源范围：直接使用路由中的工作空间鉴权。 */
 const managedFolderIds = computed(() => {
   const permissions = folderPermissions.value
@@ -104,122 +67,71 @@ const managedFolderIds = computed(() => {
     undefined,
     { workspaceId: getWorkspaceId() },
   )
+  const folderEditPermission = permissions.edit
   function collectFolders(folder: FolderItem): string[] {
-    const canManage = canManageAll || hasPermission(buildBaseResourcePermission(permissions!.edit, folder.id, getWorkspaceId()))
+    const canManage = canManageAll || hasPermission(buildBaseResourcePermission(folderEditPermission, folder.id, getWorkspaceId()))
     return [...(canManage ? [folder.id] : []), ...(folder.children ?? []).flatMap(collectFolders)]
   }
   return collectFolders(folderData.value)
 })
 
-/* 单项与批量保存：确认前不修改行数据，失败时保留待提交配置。 */
-const configDialogRef = useTemplateRef<InstanceType<typeof PermissionConfigDialog>>('configDialogRef')
-const pendingUserIds = ref<string[]>([])
-
-function handleOpenBatchConfig() {
-  if (!selectedUsers.value.length || submitting.value) return
-  pendingUserIds.value = selectedUsers.value.map(({ id }) => id)
-  configDialogRef.value?.open()
-}
-
-function handlePermissionChange(value: string | number | boolean | undefined, user: ResourceUserPermission) {
-  const permission = editablePermissionOptions.value.find((option) => option.value === value)?.value
-  if (!permission || permission === user.permission || submitting.value) return
-  pendingUserIds.value = [user.id]
-  if (isFolder.value) {
-    configDialogRef.value?.open(permission)
-  } else {
-    submitPermissions(permission, false)
-  }
-}
-
-function submitPermissions(permission: ResourcePermission, includeChildren: boolean) {
-  if (submitting.value || !pendingUserIds.value.length || (includeChildren && !managedFolderIds.value.length)) return
-  const permissions: ResourceUserPermissionPayload[] = pendingUserIds.value.map((userId) => ({
-    user_id: userId,
-    permission,
-    include_children: includeChildren,
-    ...(includeChildren ? { folder_ids: [...managedFolderIds.value] } : {}),
-  }))
-  submitting.value = true
-  return props.api
-    .putResourceAuthorization(targetId.value, authorizationType.value, permissions)
-    .then(() => {
-      MsgSuccess('提交成功')
-      configDialogRef.value?.close()
-      pendingUserIds.value = []
-      clearSelection()
-      emit('refresh')
-      return loadPermissions()
-    })
-    .finally(() => {
-      submitting.value = false
-    })
-}
-
+/* 抽屉生命周期 */
 function open(id: string, folder?: FolderItem) {
   targetId.value = id
   folderData.value = folder ? cloneDeep(folder) : undefined
   drawerVisible.value = true
-  loadPermissions()
 }
 
 function resetData() {
+  targetType.value = 'user-group'
   targetId.value = ''
   folderData.value = undefined
-  permissionUsers.value = []
-  searchQuery.value = undefined
-  paginationConfig.value = { currentPage: 1, pageSize: 20, total: 0 }
-  pendingUserIds.value = []
-  loading.value = false
   submitting.value = false
-  clearSelection()
+}
+
+function handleClosed() {
+  resetData()
+  emit('closed')
 }
 
 defineExpose({ open })
 </script>
 
 <template>
-  <MkDrawer v-model="drawerVisible" title="资源授权" :size="920" :show-close="!submitting" @closed="resetData">
-    <div class="flex-between mb-4 gap-4">
-      <el-button type="primary" :disabled="!selectedUsers.length || loading || submitting" @click="handleOpenBatchConfig">配置权限</el-button>
-      <MkComplexSearch :fields="searchFields" @change="handleSearch" />
+  <MkDrawer v-model="drawerVisible" title="资源授权" :size="920" :show-close="!submitting" @closed="handleClosed">
+    <el-tabs v-model="targetType" :before-leave="() => !submitting">
+      <el-tab-pane label="按用户组" name="user-group" />
+      <el-tab-pane label="按用户" name="user" />
+    </el-tabs>
+    <div class="mt-4">
+      <UserGroupAuthorization
+        v-if="targetType === 'user-group' && targetId"
+        :key="targetId"
+        v-model:submitting="submitting"
+        :api="ResourceAuthorizationApi"
+        :target-id="targetId"
+        :type="authorizationType"
+        :is-folder="isFolder"
+        :is-root-folder="isRootFolder"
+        :managed-folder-ids="managedFolderIds"
+        :editable-permission-options="editablePermissionOptions"
+        @refresh="emit('refresh')"
+      />
+
+      <UserAuthorization
+        v-if="targetType === 'user' && targetId"
+        :key="targetId"
+        v-model:submitting="submitting"
+        :api="userAuthorizationApi"
+        :target-id="targetId"
+        :type="authorizationType"
+        :is-folder="isFolder"
+        :is-root-folder="isRootFolder"
+        :managed-folder-ids="managedFolderIds"
+        :permission-options="permissionOptions"
+        :editable-permission-options="editablePermissionOptions"
+        @refresh="emit('refresh')"
+      />
     </div>
-    <MkTable
-      ref="tableRef"
-      v-loading="loading || submitting"
-      v-model:pagination-config="paginationConfig"
-      :data="permissionUsers"
-      :max-table-height="200"
-      @current-change="loadPermissions"
-      @size-change="loadPermissions"
-      @selection-change="handleSelectionChange"
-    >
-      <el-table-column type="selection" width="40" reserve-selection />
-      <el-table-column prop="nick_name" label="姓名" min-width="120" show-overflow-tooltip />
-      <el-table-column prop="username" label="用户名" min-width="120" show-overflow-tooltip />
-      <el-table-column v-if="auth.isEE || auth.isPE" label="角色" width="160">
-        <template #default="{ row }">
-          <MkTagGroup v-if="row.role_name?.length" :tags="row.role_name" />
-          <span v-else>-</span>
-        </template>
-      </el-table-column>
-      <el-table-column label="权限" min-width="340">
-        <template #default="{ row }">
-          <el-radio-group :model-value="row.permission" :disabled="submitting" @change="handlePermissionChange($event, row)">
-            <el-radio v-for="option in editablePermissionOptions" :key="option.value" :value="option.value" class="mr-4!">{{
-              option.label
-            }}</el-radio>
-          </el-radio-group>
-        </template>
-      </el-table-column>
-    </MkTable>
-    <PermissionConfigDialog
-      ref="configDialogRef"
-      :options="editablePermissionOptions"
-      :is-folder="isFolder"
-      :can-include-children="managedFolderIds.length > 0"
-      :loading="submitting"
-      @submit="submitPermissions"
-    />
   </MkDrawer>
 </template>
diff --git a/ui/src/components/business/resource-authorization-drawer/types.ts b/ui/src/components/business/resource-authorization-drawer/types.ts
new file mode 100644
index 00000000000..50875abaf88
--- /dev/null
+++ b/ui/src/components/business/resource-authorization-drawer/types.ts
@@ -0,0 +1,14 @@
+/** 资源授权抽屉及其内部组件共用的展示类型。 */
+import type { ResourceAuthorizationTargetType } from '@/api/types'
+import type { RESOURCE_PERMISSION_OPTIONS } from '@/constants/resource-authorization'
+
+export type ResourcePermissionOption = (typeof RESOURCE_PERMISSION_OPTIONS)[number]
+
+export interface ResourceAuthorizationContentProps {
+  targetId: string
+  type: ResourceAuthorizationTargetType
+  isFolder: boolean
+  isRootFolder?: boolean
+  managedFolderIds: string[]
+  editablePermissionOptions: ResourcePermissionOption[]
+}
diff --git a/ui/src/components/business/resource-authorization-drawer/user-group/UserGroupAuthorization.vue b/ui/src/components/business/resource-authorization-drawer/user-group/UserGroupAuthorization.vue
new file mode 100644
index 00000000000..bf04cfb2d5c
--- /dev/null
+++ b/ui/src/components/business/resource-authorization-drawer/user-group/UserGroupAuthorization.vue
@@ -0,0 +1,168 @@
+<script setup lang="ts">
+import { onMounted, ref, useTemplateRef } from 'vue'
+import type ResourceAuthorizationApi from '@/api/admin/workspace/resource-authorization'
+import { RESOURCE_PERMISSION } from '@/api/enums'
+import type { Dict, ResourcePermission, ResourceUserGroupPermission } from '@/api/types'
+import { MsgSuccess } from '@/utils/message'
+import MkTable from '@/components/global/mk-table/index.vue'
+import PermissionConfigDialog from '../PermissionConfigDialog.vue'
+import { getWorkspaceId } from '@/utils/resource-context'
+import UserGroupMembersDrawer from './UserGroupMembersDrawer.vue'
+
+import type { ResourceAuthorizationContentProps } from '../types'
+
+interface Props extends ResourceAuthorizationContentProps {
+  api: typeof ResourceAuthorizationApi
+}
+
+const props = defineProps<Props>()
+const emit = defineEmits<{ refresh: [] }>()
+const submitting = defineModel<boolean>('submitting', { required: true })
+
+/* 查询与跨页选择 */
+const searchFields = [{ label: '名称', value: 'name' }]
+const loading = ref(false)
+const permissionGroups = ref<ResourceUserGroupPermission[]>([])
+const selectedGroups = ref<ResourceUserGroupPermission[]>([])
+const paginationConfig = ref({ currentPage: 1, pageSize: 10, total: 0 })
+const searchQuery = ref<Dict<unknown>>()
+const tableRef = useTemplateRef('tableRef')
+
+function loadPermissions() {
+  if (!props.targetId) return Promise.resolve()
+  loading.value = true
+  return props.api
+    .getResourceUserGroupAuthorization(props.targetId, props.type, paginationConfig.value, searchQuery.value)
+    .then(({ records, total }) => {
+      permissionGroups.value = records.map((subject) => ({
+        ...subject,
+        permission: props.isRootFolder && subject.permission === RESOURCE_PERMISSION.NOT_AUTH ? RESOURCE_PERMISSION.VIEW : subject.permission,
+      }))
+      paginationConfig.value.total = total
+    })
+    .finally(() => {
+      loading.value = false
+    })
+}
+
+function clearSelection() {
+  selectedGroups.value = []
+  tableRef.value?.clearSelection()
+}
+
+function handleSearch(query?: Dict<unknown>) {
+  searchQuery.value = query
+  paginationConfig.value.currentPage = 1
+  clearSelection()
+  loadPermissions()
+}
+
+/* 查看用户组成员 */
+const membersDrawerRef = useTemplateRef<InstanceType<typeof UserGroupMembersDrawer>>('membersDrawerRef')
+
+function handleOpenMembersDrawer(group: ResourceUserGroupPermission) {
+  const workspaceId = getWorkspaceId()
+  if (!workspaceId) return
+  membersDrawerRef.value?.open({ ...group, workspace_id: workspaceId })
+}
+
+function handleSelectionChange(selection: unknown[]) {
+  selectedGroups.value = selection as ResourceUserGroupPermission[]
+}
+
+/* 单项与批量保存：确认前不修改行数据，失败时保留待提交配置。 */
+const configDialogRef = useTemplateRef<InstanceType<typeof PermissionConfigDialog>>('configDialogRef')
+const pendingGroupIds = ref<string[]>([])
+
+function handleOpenBatchConfig() {
+  if (!selectedGroups.value.length || submitting.value) return
+  pendingGroupIds.value = selectedGroups.value.map(({ id }) => id)
+  configDialogRef.value?.open()
+}
+
+function handlePermissionChange(value: string | number | boolean | undefined, subject: ResourceUserGroupPermission) {
+  const permission = props.editablePermissionOptions.find((option) => option.value === value)?.value
+  if (!permission || permission === subject.permission || submitting.value) return
+  pendingGroupIds.value = [subject.id]
+  if (props.isFolder) {
+    configDialogRef.value?.open(permission)
+  } else {
+    submitPermissions(permission, false)
+  }
+}
+
+function submitPermissions(permission: ResourcePermission, includeChildren: boolean) {
+  if (submitting.value || !pendingGroupIds.value.length || (includeChildren && !props.managedFolderIds.length)) return
+  const permissionScope = {
+    permission,
+    include_children: includeChildren,
+    ...(includeChildren ? { folder_ids: [...props.managedFolderIds] } : {}),
+  }
+  submitting.value = true
+  return props.api
+    .putResourceUserGroupAuthorization(
+      props.targetId,
+      props.type,
+      pendingGroupIds.value.map((id) => ({ user_group_id: id, ...permissionScope })),
+    )
+    .then(() => {
+      MsgSuccess('提交成功')
+      configDialogRef.value?.close()
+      pendingGroupIds.value = []
+      clearSelection()
+      emit('refresh')
+      return loadPermissions()
+    })
+    .finally(() => {
+      submitting.value = false
+    })
+}
+
+/* 仅挂载当前标签，卸载后忽略未完成的查询响应。 */
+onMounted(() => loadPermissions())
+</script>
+
+<template>
+  <div>
+    <div class="flex-between mb-4 gap-4">
+      <el-button type="primary" :disabled="!selectedGroups.length || loading || submitting" @click="handleOpenBatchConfig">配置权限</el-button>
+      <MkComplexSearch :fields="searchFields" @change="handleSearch" />
+    </div>
+    <MkTable
+      ref="tableRef"
+      v-loading="loading || submitting"
+      v-model:pagination-config="paginationConfig"
+      :data="permissionGroups"
+      :max-table-height="260"
+      @current-change="loadPermissions"
+      @size-change="loadPermissions"
+      @selection-change="handleSelectionChange"
+    >
+      <el-table-column type="selection" width="40" reserve-selection />
+      <el-table-column prop="name" label="用户组" min-width="160" show-overflow-tooltip />
+      <el-table-column label="成员数" min-width="100">
+        <template #default="{ row }">
+          <el-link type="primary" @click="handleOpenMembersDrawer(row)">{{ row.count }}</el-link>
+        </template>
+      </el-table-column>
+      <el-table-column label="操作权限" min-width="340">
+        <template #default="{ row }">
+          <el-radio-group :model-value="row.permission" :disabled="submitting" @change="handlePermissionChange($event, row)">
+            <el-radio v-for="option in editablePermissionOptions" :key="option.value" :value="option.value" class="mr-4!">{{
+              option.label
+            }}</el-radio>
+          </el-radio-group>
+        </template>
+      </el-table-column>
+    </MkTable>
+    <UserGroupMembersDrawer ref="membersDrawerRef" />
+    <PermissionConfigDialog
+      ref="configDialogRef"
+      :options="editablePermissionOptions"
+      :is-folder="isFolder"
+      :can-include-children="managedFolderIds.length > 0"
+      :loading="submitting"
+      @submit="submitPermissions"
+    />
+  </div>
+</template>
diff --git a/ui/src/views/system/identity/resource-authorization/components/user-group/UserGroupMembersDrawer.vue b/ui/src/components/business/resource-authorization-drawer/user-group/UserGroupMembersDrawer.vue
similarity index 97%
rename from ui/src/views/system/identity/resource-authorization/components/user-group/UserGroupMembersDrawer.vue
rename to ui/src/components/business/resource-authorization-drawer/user-group/UserGroupMembersDrawer.vue
index 3318e1b74ee..9443b1558c2 100644
--- a/ui/src/views/system/identity/resource-authorization/components/user-group/UserGroupMembersDrawer.vue
+++ b/ui/src/components/business/resource-authorization-drawer/user-group/UserGroupMembersDrawer.vue
@@ -3,6 +3,8 @@ import { ref } from 'vue'
 import UserGroupsApi from '@/api/admin/system/user-groups'
 import type { Dict, OptionItem, SystemUserGroup, SystemUserGroupMember } from '@/api/types'
 
+defineOptions({ name: 'UserGroupMembersDrawer' })
+
 /* 成员查询与分页 */
 const drawerVisible = ref(false)
 const currentGroup = ref<SystemUserGroup>()
@@ -38,6 +40,7 @@ function handleMemberSearch(query?: Dict<unknown>) {
 }
 
 function open(userGroup: SystemUserGroup) {
+  resetData()
   currentGroup.value = { ...userGroup }
   drawerVisible.value = true
   loadUserGroupMembers()
diff --git a/ui/src/router/ROUTE_README.md b/ui/src/router/ROUTE_README.md
index 99eae739df7..f184f5ad214 100644
--- a/ui/src/router/ROUTE_README.md
+++ b/ui/src/router/ROUTE_README.md
@@ -180,7 +180,9 @@ Vue Router 的 meta 合并自动继承。
 判断。非资源页面不配置 `resourceScope`。
 
 `resourceScope` 负责表达当前路由语义，页面据此决定展示和选用哪个业务 API；卡片、Action、
-Drawer、Dialog 不根据 path、路由名称或 Scope 自行维护 API 映射。
+Drawer、Dialog 通常不根据 path、路由名称或 Scope 自行维护 API 映射。
+资源授权抽屉 `ResourceAuthorizationDrawer` 例外：由抽屉入口通过 `isSystemResource()`
+选择 System 资源管理或 Workspace 用户授权接口，再传给标签子组件。
 
 ## 业务路由层级
 
diff --git a/ui/src/views/VIEW_README.md b/ui/src/views/VIEW_README.md
index 3920a9e5ece..4b73a538aa7 100644
--- a/ui/src/views/VIEW_README.md
+++ b/ui/src/views/VIEW_README.md
@@ -263,8 +263,8 @@ src/views/system/identity/users/
 `CleanStrategyButton.vue` 管理打开动作和弹窗 Ref，`CleanStrategyDialog.vue` 负责策略查询与保存，
 `OperateLogListView.vue` 只组合入口组件。
 
-资源授权页面的 `UserGroupAuthorizationList` 通过人数链接打开同目录的
-`UserGroupMembersDrawer.vue`，按用户组所属工作空间查询成员，提供用户名、姓名搜索和分页，
+资源授权页面的 `UserGroupAuthorizationList` 通过人数链接打开共享业务组件
+`components/business/resource-authorization-drawer/user-group/UserGroupMembersDrawer.vue`，按用户组所属工作空间查询成员，提供用户名、姓名搜索和分页，
 并使用 `MkTagGroup` 折叠展示角色；点击人数不切换当前授权对象。
 
 ## 文件命名
@@ -385,3 +385,11 @@ Dialog。新增或重命名文件时，应同步更新所有导入和页面功
 `ModelCreateButton` 默认渲染主按钮，也支持通过默认作用域插槽的 `open()` 定制触发按钮，
 `SelectModel` 的下拉页脚使用该插槽复用同一创建流程。创建成功后保留基础资料刷新，再触发
 `refresh` 通知调用方重新加载模型列表。
+
+## 资源授权 Action
+
+四类资源卡片的 `action-dropdown/` 分别提供 `AuthorizeModelAction`、`AuthorizeToolAction`、
+`AuthorizeKnowledgeAction` 和 `AuthorizeApplicationAction`，由列表页面组合，显式传入 `label`
+和当前资源，保存成功后通过 `refresh` 刷新列表。Action 使用对应资源的 Workspace 或 System
+`auth` 权限判断，共享资源不展示入口。点击后按需挂载公共 `ResourceAuthorizationDrawer`，
+传入资源类型并调用 `open(id)`；在 `closed` 后卸载，不再复制授权表格或请求逻辑。
diff --git a/ui/src/views/application/ApplicationView.vue b/ui/src/views/application/ApplicationView.vue
index 068527ee577..c6e3505ac3a 100644
--- a/ui/src/views/application/ApplicationView.vue
+++ b/ui/src/views/application/ApplicationView.vue
@@ -10,7 +10,13 @@ import FolderTree from '@/components/business/folder-tree/index.vue'
 import MoveToDialog from '@/components/business/folder-tree/MoveToDialog.vue'
 import { MsgConfirm, MsgSuccess } from '@/utils/message'
 import ApplicationCard from './application-card/ApplicationCard.vue'
-import { DeleteApplicationAction, ExportApplicationAction, MoveApplicationAction, SettingApplicationAction } from './application-card/action-dropdown'
+import {
+  AuthorizeApplicationAction,
+  DeleteApplicationAction,
+  ExportApplicationAction,
+  MoveApplicationAction,
+  SettingApplicationAction,
+} from './application-card/action-dropdown'
 import CreateApplicationDropdown from './create-application/CreateApplicationDropdown.vue'
 
 const route = useRoute()
@@ -229,6 +235,8 @@ function handleBatchDelete() {
                     :api="ApplicationApi"
                     :application="application"
                   />
+                  <!-- 资源授权 -->
+                  <AuthorizeApplicationAction label="资源授权" :application="application" @refresh="refreshApplications" />
                   <DeleteApplicationAction
                     v-model:loading="applicationOperationLoading"
                     label="删除"
diff --git a/ui/src/views/application/application-card/action-dropdown/AuthorizeApplicationAction.vue b/ui/src/views/application/application-card/action-dropdown/AuthorizeApplicationAction.vue
new file mode 100644
index 00000000000..93d867266b0
--- /dev/null
+++ b/ui/src/views/application/application-card/action-dropdown/AuthorizeApplicationAction.vue
@@ -0,0 +1,37 @@
+<script setup lang="ts">
+import { nextTick, ref, useTemplateRef } from 'vue'
+import type { ApplicationDetail } from '@/api/types'
+import { RESOURCE_TYPE } from '@/api/enums'
+import ResourceAuthorizationDrawer from '@/components/business/resource-authorization-drawer/index.vue'
+
+defineOptions({ name: 'AuthorizeApplicationAction' })
+const props = defineProps<{ application: ApplicationDetail; label: string }>()
+const emit = defineEmits<{ refresh: [] }>()
+
+const drawerMounted = ref(false)
+const authorizationDrawerRef = useTemplateRef<InstanceType<typeof ResourceAuthorizationDrawer>>('authorizationDrawerRef')
+
+function handleOpenAuthorization() {
+  drawerMounted.value = true
+  return nextTick(() => authorizationDrawerRef.value?.open(props.application.id))
+}
+
+function handleDrawerClosed() {
+  drawerMounted.value = false
+}
+</script>
+
+<template>
+  <!-- 资源授权 -->
+  <MkDropdownItem @click="handleOpenAuthorization">
+    <template #icon><MkIcon name="icon_passkeys_outlined" /></template>
+    <span>{{ label }}</span>
+  </MkDropdownItem>
+  <ResourceAuthorizationDrawer
+    v-if="drawerMounted"
+    ref="authorizationDrawerRef"
+    :type="RESOURCE_TYPE.APPLICATION"
+    @closed="handleDrawerClosed"
+    @refresh="emit('refresh')"
+  />
+</template>
diff --git a/ui/src/views/application/application-card/action-dropdown/index.ts b/ui/src/views/application/application-card/action-dropdown/index.ts
index b3161ec6e91..80269d2ceba 100644
--- a/ui/src/views/application/application-card/action-dropdown/index.ts
+++ b/ui/src/views/application/application-card/action-dropdown/index.ts
@@ -2,3 +2,4 @@ export { default as DeleteApplicationAction } from './DeleteApplicationAction.vu
 export { default as ExportApplicationAction } from './ExportApplicationAction.vue'
 export { default as MoveApplicationAction } from './MoveApplicationAction.vue'
 export { default as SettingApplicationAction } from './SettingApplicationAction.vue'
+export { default as AuthorizeApplicationAction } from './AuthorizeApplicationAction.vue'
diff --git a/ui/src/views/knowledge/KnowledgeView.vue b/ui/src/views/knowledge/KnowledgeView.vue
index 254fc2f12b3..6c80c1e1c7d 100644
--- a/ui/src/views/knowledge/KnowledgeView.vue
+++ b/ui/src/views/knowledge/KnowledgeView.vue
@@ -9,7 +9,7 @@ import { RESOURCE_TYPE } from '@/api/enums'
 import { FOLDER_ENTRIES, FOLDER_ENTRY_ID } from '@/constants'
 import FolderTree from '@/components/business/folder-tree/index.vue'
 import KnowledgeCard from './knowledge-card/KnowledgeCard.vue'
-import { DeleteKnowledgeAction, MoveKnowledgeAction } from './knowledge-card/action-dropdown'
+import { AuthorizeKnowledgeAction, DeleteKnowledgeAction, MoveKnowledgeAction } from './knowledge-card/action-dropdown'
 import MoveToDialog from '@/components/business/folder-tree/MoveToDialog.vue'
 import { MsgConfirm, MsgSuccess } from '@/utils/message'
 
@@ -217,6 +217,8 @@ function handleBatchDelete() {
                     @delete="handleDeleteKnowledge"
                     @move="handleMoveKnowledge"
                   />
+                  <!-- 资源授权 -->
+                  <AuthorizeKnowledgeAction label="资源授权" :knowledge="knowledge" @refresh="refreshKnowledge" />
                   <DeleteKnowledgeAction
                     v-model:loading="knowledgeOperationLoading"
                     label="删除"
diff --git a/ui/src/views/knowledge/knowledge-card/action-dropdown/AuthorizeKnowledgeAction.vue b/ui/src/views/knowledge/knowledge-card/action-dropdown/AuthorizeKnowledgeAction.vue
new file mode 100644
index 00000000000..827e8436370
--- /dev/null
+++ b/ui/src/views/knowledge/knowledge-card/action-dropdown/AuthorizeKnowledgeAction.vue
@@ -0,0 +1,37 @@
+<script setup lang="ts">
+import { nextTick, ref, useTemplateRef } from 'vue'
+import type { KnowledgeItem } from '@/api/types'
+import { RESOURCE_TYPE } from '@/api/enums'
+import ResourceAuthorizationDrawer from '@/components/business/resource-authorization-drawer/index.vue'
+
+defineOptions({ name: 'AuthorizeKnowledgeAction' })
+const props = defineProps<{ knowledge: KnowledgeItem; label: string }>()
+const emit = defineEmits<{ refresh: [] }>()
+
+const drawerMounted = ref(false)
+const authorizationDrawerRef = useTemplateRef<InstanceType<typeof ResourceAuthorizationDrawer>>('authorizationDrawerRef')
+
+function handleOpenAuthorization() {
+  drawerMounted.value = true
+  return nextTick(() => authorizationDrawerRef.value?.open(props.knowledge.id))
+}
+
+function handleDrawerClosed() {
+  drawerMounted.value = false
+}
+</script>
+
+<template>
+  <!-- 资源授权 -->
+  <MkDropdownItem @click="handleOpenAuthorization">
+    <template #icon><MkIcon name="icon_passkeys_outlined" /></template>
+    <span>{{ label }}</span>
+  </MkDropdownItem>
+  <ResourceAuthorizationDrawer
+    v-if="drawerMounted"
+    ref="authorizationDrawerRef"
+    :type="RESOURCE_TYPE.KNOWLEDGE"
+    @closed="handleDrawerClosed"
+    @refresh="emit('refresh')"
+  />
+</template>
diff --git a/ui/src/views/knowledge/knowledge-card/action-dropdown/index.ts b/ui/src/views/knowledge/knowledge-card/action-dropdown/index.ts
index 40905fc7dac..4dc1486ef50 100644
--- a/ui/src/views/knowledge/knowledge-card/action-dropdown/index.ts
+++ b/ui/src/views/knowledge/knowledge-card/action-dropdown/index.ts
@@ -1,3 +1,4 @@
 /** 知识库卡片菜单操作。 */
 export { default as MoveKnowledgeAction } from './MoveKnowledgeAction.vue'
 export { default as DeleteKnowledgeAction } from './DeleteKnowledgeAction.vue'
+export { default as AuthorizeKnowledgeAction } from './AuthorizeKnowledgeAction.vue'
diff --git a/ui/src/views/model/ModelView.vue b/ui/src/views/model/ModelView.vue
index 821ae9a0ba4..01fb400ccba 100644
--- a/ui/src/views/model/ModelView.vue
+++ b/ui/src/views/model/ModelView.vue
@@ -10,7 +10,7 @@ import ProviderApi from '@/api/admin/model-provider.ts'
 import ModelCard from './model-card/ModelCard.vue'
 import ModelCreateButton from './create-model/ModelCreateButton.vue'
 import ModelProvider from './components/ModelProvider.vue'
-import { DeleteModelAction, EditModelAction, ParamSettingAction } from './model-card/action-dropdown'
+import { AuthorizeModelAction, DeleteModelAction, EditModelAction, ParamSettingAction } from './model-card/action-dropdown'
 
 const DEFAULT_MODEL_PROVIDER: ModelProviderItem = { icon: '', name: '全部模型', provider: 'all' }
 
@@ -107,11 +107,14 @@ onMounted(() => {
               :disabled="isShared"
             >
               <template #action-dropdown>
+                <!-- 编辑 -->
                 <EditModelAction label="编辑" :api="ModelApi" :model="model" :provider="getModelProvider(model)" @refresh="loadModels" />
+                <!-- 模型参数设置 -->
                 <ParamSettingAction v-if="model.model_type !== 'RERANKER'" label="模型参数设置" :api="ModelApi" :model="model" />
-                <!-- // TODO: 资源授权-统一处理-->
+                <!-- 资源授权 -->
+                <AuthorizeModelAction label="资源授权" :model="model" @refresh="loadModels" />
                 <!-- // TODO: 查看关联资源-->
-
+                <!-- 删除 -->
                 <DeleteModelAction label="删除" :api="ModelApi" :model="model" @refresh="loadModels" />
               </template>
             </ModelCard>
diff --git a/ui/src/views/model/model-card/action-dropdown/AuthorizeModelAction.vue b/ui/src/views/model/model-card/action-dropdown/AuthorizeModelAction.vue
new file mode 100644
index 00000000000..1fb132ff7c2
--- /dev/null
+++ b/ui/src/views/model/model-card/action-dropdown/AuthorizeModelAction.vue
@@ -0,0 +1,37 @@
+<script setup lang="ts">
+import { nextTick, ref, useTemplateRef } from 'vue'
+import type { ModelItem } from '@/api/types'
+import { RESOURCE_TYPE } from '@/api/enums'
+import ResourceAuthorizationDrawer from '@/components/business/resource-authorization-drawer/index.vue'
+
+defineOptions({ name: 'AuthorizeModelAction' })
+const props = defineProps<{ model: ModelItem; label: string }>()
+const emit = defineEmits<{ refresh: [] }>()
+
+const drawerMounted = ref(false)
+const authorizationDrawerRef = useTemplateRef<InstanceType<typeof ResourceAuthorizationDrawer>>('authorizationDrawerRef')
+
+function handleOpenAuthorization() {
+  drawerMounted.value = true
+  return nextTick(() => authorizationDrawerRef.value?.open(props.model.id))
+}
+
+function handleDrawerClosed() {
+  drawerMounted.value = false
+}
+</script>
+
+<template>
+  <!-- 资源授权 -->
+  <MkDropdownItem @click="handleOpenAuthorization">
+    <template #icon><MkIcon name="icon_passkeys_outlined" /></template>
+    <span>{{ label }}</span>
+  </MkDropdownItem>
+  <ResourceAuthorizationDrawer
+    v-if="drawerMounted"
+    ref="authorizationDrawerRef"
+    :type="RESOURCE_TYPE.MODEL"
+    @closed="handleDrawerClosed"
+    @refresh="emit('refresh')"
+  />
+</template>
diff --git a/ui/src/views/model/model-card/action-dropdown/index.ts b/ui/src/views/model/model-card/action-dropdown/index.ts
index ec171cbbdf0..d0ec5bf723e 100644
--- a/ui/src/views/model/model-card/action-dropdown/index.ts
+++ b/ui/src/views/model/model-card/action-dropdown/index.ts
@@ -1,3 +1,4 @@
 export { default as DeleteModelAction } from './DeleteModelAction.vue'
 export { default as EditModelAction } from './edit-model-action/EditModelAction.vue'
 export { default as ParamSettingAction } from './param-setting-action/ParamSettingAction.vue'
+export { default as AuthorizeModelAction } from './AuthorizeModelAction.vue'
diff --git a/ui/src/views/system/identity/resource-authorization/components/user-group/UserGroupAuthorizationList.vue b/ui/src/views/system/identity/resource-authorization/components/user-group/UserGroupAuthorizationList.vue
index a40138ebf8c..c0ffa2a39c7 100644
--- a/ui/src/views/system/identity/resource-authorization/components/user-group/UserGroupAuthorizationList.vue
+++ b/ui/src/views/system/identity/resource-authorization/components/user-group/UserGroupAuthorizationList.vue
@@ -2,7 +2,7 @@
 import { useTemplateRef } from 'vue'
 import type { SystemUserGroup } from '@/api/types'
 import MkSearchList from '@/components/mk-search-list/index.vue'
-import UserGroupMembersDrawer from './UserGroupMembersDrawer.vue'
+import UserGroupMembersDrawer from '@/components/business/resource-authorization-drawer/user-group/UserGroupMembersDrawer.vue'
 
 defineOptions({ name: 'UserGroupAuthorizationList' })
 
diff --git a/ui/src/views/system/identity/roles/components/RoleMemberList.vue b/ui/src/views/system/identity/roles/components/RoleMemberList.vue
index 8f054e18e0e..ccd9331079e 100644
--- a/ui/src/views/system/identity/roles/components/RoleMemberList.vue
+++ b/ui/src/views/system/identity/roles/components/RoleMemberList.vue
@@ -109,6 +109,7 @@ watch(
       :max-table-height="290"
       rowKey="user_relation_id"
       @selection-change="handleBatchSelectionChange"
+      rowKey="user_relation_id"
     >
       <el-table-column type="selection" width="40" />
       <el-table-column prop="nick_name" label="姓名" min-width="180" show-overflow-tooltip />
diff --git a/ui/src/views/tool/ToolView.vue b/ui/src/views/tool/ToolView.vue
index b082ed0e8df..d39c573f2e2 100644
--- a/ui/src/views/tool/ToolView.vue
+++ b/ui/src/views/tool/ToolView.vue
@@ -13,6 +13,7 @@ import MoveToDialog from '@/components/business/folder-tree/MoveToDialog.vue'
 import { MsgConfirm, MsgSuccess } from '@/utils/message'
 import ToolCard from './tool-card/ToolCard.vue'
 import {
+  AuthorizeToolAction,
   CopyToolAction,
   DeleteToolAction,
   EditToolAction,
@@ -250,7 +251,6 @@ onMounted(() => {
                     :tool="tool"
                   />
 
-                  <!-- // TODO: 资源授权-统一处理-->
                   <!-- // TODO: 触发器 (item.tool_type === 'CUSTOM' || item.tool_type === 'WORKFLOW')-->
                   <!-- // TODO: 查看关联资源-->
                   <!-- // TODO: 查看执行记录    (item.tool_type === 'CUSTOM' || item.tool_type === 'WORKFLOW')-->
@@ -265,6 +265,8 @@ onMounted(() => {
                     @delete="handleDeleteTool"
                   />
                   <ExportToolAction v-if="!tool.template_id" v-model:loading="toolOperationLoading" label="导出" :api="ToolApi" :tool="tool" />
+                  <!-- 资源授权 -->
+                  <AuthorizeToolAction label="资源授权" :tool="tool" @refresh="refreshTool" />
                   <DeleteToolAction v-model:loading="toolOperationLoading" label="删除" :api="ToolApi" :tool="tool" @delete="handleDeleteTool" />
                 </template>
               </ToolCard>
diff --git a/ui/src/views/tool/tool-card/action-dropdown/AuthorizeToolAction.vue b/ui/src/views/tool/tool-card/action-dropdown/AuthorizeToolAction.vue
new file mode 100644
index 00000000000..b3b5481a3b3
--- /dev/null
+++ b/ui/src/views/tool/tool-card/action-dropdown/AuthorizeToolAction.vue
@@ -0,0 +1,37 @@
+<script setup lang="ts">
+import { nextTick, ref, useTemplateRef } from 'vue'
+import type { ToolItem } from '@/api/types'
+import { RESOURCE_TYPE } from '@/api/enums'
+import ResourceAuthorizationDrawer from '@/components/business/resource-authorization-drawer/index.vue'
+
+defineOptions({ name: 'AuthorizeToolAction' })
+const props = defineProps<{ tool: ToolItem; label: string }>()
+const emit = defineEmits<{ refresh: [] }>()
+
+const drawerMounted = ref(false)
+const authorizationDrawerRef = useTemplateRef<InstanceType<typeof ResourceAuthorizationDrawer>>('authorizationDrawerRef')
+
+function handleOpenAuthorization() {
+  drawerMounted.value = true
+  return nextTick(() => authorizationDrawerRef.value?.open(props.tool.id))
+}
+
+function handleDrawerClosed() {
+  drawerMounted.value = false
+}
+</script>
+
+<template>
+  <!-- 资源授权 -->
+  <MkDropdownItem @click="handleOpenAuthorization">
+    <template #icon><MkIcon name="icon_passkeys_outlined" /></template>
+    <span>{{ label }}</span>
+  </MkDropdownItem>
+  <ResourceAuthorizationDrawer
+    v-if="drawerMounted"
+    ref="authorizationDrawerRef"
+    :type="RESOURCE_TYPE.TOOL"
+    @closed="handleDrawerClosed"
+    @refresh="emit('refresh')"
+  />
+</template>
diff --git a/ui/src/views/tool/tool-card/action-dropdown/index.ts b/ui/src/views/tool/tool-card/action-dropdown/index.ts
index f83fa0036b4..c978ee824e9 100644
--- a/ui/src/views/tool/tool-card/action-dropdown/index.ts
+++ b/ui/src/views/tool/tool-card/action-dropdown/index.ts
@@ -6,3 +6,4 @@ export { default as InitParamAction } from './InitParamAction.vue'
 export { default as McpConfigAction } from './mcp-config-action/McpConfigAction.vue'
 export { default as MoveToolAction } from './MoveToolAction.vue'
 export { default as ToolWorkflowAction } from './ToolWorkflowAction.vue'
+export { default as AuthorizeToolAction } from './AuthorizeToolAction.vue'