[{"data":1,"prerenderedAt":323},["ShallowReactive",2],{"doc-permission-and-security":3},{"id":4,"title":5,"body":6,"description":312,"extension":313,"meta":314,"navigation":315,"order":316,"path":317,"publishedAt":318,"seo":319,"stem":320,"tags":321,"__hash__":322},"docs\u002Fzh\u002Fdocs\u002Fpermission-and-security.md","权限与安全",{"type":7,"value":8,"toc":301},"minimark",[9,12,21,26,88,91,95,98,111,117,121,192,199,203,223,227,230,251,258,262,283,286],[10,11,5],"h1",{"id":5},[13,14,15,16,20],"p",{},"多门店、多团队共用一套系统时，权限体系要同时满足两件事：",[17,18,19],"strong",{},"让该看的人看到，让不该看的人看不到","，并且每一次敏感操作都能追溯。",[22,23,25],"h2",{"id":24},"一三层权限模型","一、三层权限模型",[27,28,29,45],"table",{},[30,31,32],"thead",{},[33,34,35,39,42],"tr",{},[36,37,38],"th",{},"层级",[36,40,41],{},"控制内容",[36,43,44],{},"举例",[46,47,48,62,75],"tbody",{},[33,49,50,56,59],{},[51,52,53],"td",{},[17,54,55],{},"组织",[51,57,58],{},"数据可见范围",[51,60,61],{},"店员只看本店，店长看本店，区域总监看全区",[33,63,64,69,72],{},[51,65,66],{},[17,67,68],{},"角色",[51,70,71],{},"功能权限",[51,73,74],{},"销售顾问、仓管、财务、系统管理员各不相同",[33,76,77,82,85],{},[51,78,79],{},[17,80,81],{},"字段\u002F动作",[51,83,84],{},"敏感项控制",[51,86,87],{},"成本价是否可见、是否可以审批超低价、是否可以作废单据",[13,89,90],{},"这三层的组合才是完整的权限。只配角色不配组织范围，会出现「店员看到全公司库存和成本价」的典型事故。",[22,92,94],{"id":93},"二组织与可见范围","二、组织与可见范围",[13,96,97],{},"数据可见性按组织树向上汇总：",[99,100,101,105,108],"ul",{},[102,103,104],"li",{},"上级组织人员可见本级及所有下级组织的数据；",[102,106,107],{},"平级组织之间默认互相不可见，需要跨组织查看走「数据可见性授权」；",[102,109,110],{},"兼任多家门店的人员，单独授予多组织可见范围。",[13,112,113,116],{},[17,114,115],{},"门店之间要共享库存，正确做法是走调拨单","，而不是放开组织权限。放开权限会导致数据边界长期模糊，后期想收回极其困难。",[22,118,120],{"id":119},"三角色配置建议","三、角色配置建议",[27,122,123,135],{},[30,124,125],{},[33,126,127,129,132],{},[36,128,68],{},[36,130,131],{},"权限范围",[36,133,134],{},"注意点",[46,136,137,148,159,170,181],{},[33,138,139,142,145],{},[51,140,141],{},"销售顾问",[51,143,144],{},"本人\u002F本组的订单与客户",[51,146,147],{},"默认不可见成本价",[33,149,150,153,156],{},[51,151,152],{},"销售经理",[51,154,155],{},"本店全部订单、价格审批",[51,157,158],{},"可见本店毛利，不可修改他人已锁定订单",[33,160,161,164,167],{},[51,162,163],{},"仓管",[51,165,166],{},"出入库、调拨、盘点",[51,168,169],{},"不可新增\u002F作废销售订单",[33,171,172,175,178],{},[51,173,174],{},"财务",[51,176,177],{},"收付款、发票、往来",[51,179,180],{},"与业务单据只读关系，不可改车辆状态",[33,182,183,186,189],{},[51,184,185],{},"系统管理员",[51,187,188],{},"组织、角色、账号",[51,190,191],{},"建议双人共管，避免单人操作",[13,193,194,195,198],{},"配置原则：",[17,196,197],{},"按岗位最小够用给权限","，宁可先小后大。权限一旦放开再回收，一定会遇到「某人某个流程突然不能用了」的投诉。",[22,200,202],{"id":201},"四敏感数据安全","四、敏感数据安全",[99,204,205,211,217],{},[102,206,207,210],{},[17,208,209],{},"成本价与毛利","：按角色控制可见性。销售一线默认不可见，经理及以上可见。",[102,212,213,216],{},[17,214,215],{},"客户联系方式","：导出、批量发送等操作需单独授权并记录操作日志。",[102,218,219,222],{},[17,220,221],{},"国产加密算法","：涉及国产化合规的企业，字段加密请确认算法满足自身要求（SM2 \u002F SM3 \u002F SM4 系列），并在上线前做一次安全评估。",[22,224,226],{"id":225},"五审计与日常检查","五、审计与日常检查",[13,228,229],{},"建议每月做一次权限抽查，重点看三类问题：",[231,232,233,239,245],"ol",{},[102,234,235,238],{},[17,236,237],{},"离职人员账号未停用","：定期检查离职名单与系统账号比对；",[102,240,241,244],{},[17,242,243],{},"权限膨胀","：长期未使用的高权限账号，降权或回收；",[102,246,247,250],{},[17,248,249],{},"异常操作","：价格修改、单据作废、状态变更的操作日志，按人、按周导出核查。",[13,252,253,254,257],{},"所有越权访问必须在服务端校验并显式报错——",[17,255,256],{},"「查不到」不等于「没权限」","，静默成功会让问题长期隐藏。",[22,259,261],{"id":260},"六新建账号的标准流程","六、新建账号的标准流程",[231,263,264,267,274,277,280],{},[102,265,266],{},"员工入职 → 由店长提交账号申请；",[102,268,269,270,273],{},"系统管理员创建账号并分配",[17,271,272],{},"组织 + 角色","；",[102,275,276],{},"员工首次登录强制修改密码；",[102,278,279],{},"涉及敏感岗位时开启二次验证（如财务、管理员）；",[102,281,282],{},"试用期结束或岗位变动时复核权限是否需要调整。",[22,284,285],{"id":285},"下一步",[99,287,288,295],{},[102,289,290],{},[291,292,294],"a",{"href":293},"\u002Fdocs\u002Fquick-start","快速开始",[102,296,297],{},[291,298,300],{"href":299},"\u002Fdocs\u002Fvehicle-and-model","车辆与车型",{"title":302,"searchDepth":303,"depth":303,"links":304},"",2,[305,306,307,308,309,310,311],{"id":24,"depth":303,"text":25},{"id":93,"depth":303,"text":94},{"id":119,"depth":303,"text":120},{"id":201,"depth":303,"text":202},{"id":225,"depth":303,"text":226},{"id":260,"depth":303,"text":261},{"id":285,"depth":303,"text":285},"组织架构、角色权限、跨组织数据可见性配置与国产加密算法说明，以及日常权限审计的做法。","md",{},true,6,"\u002Fzh\u002Fdocs\u002Fpermission-and-security","2026-09-20",{"title":5,"description":312},"zh\u002Fdocs\u002Fpermission-and-security",null,"IDFLgwJHp9lcYqFosheerAP6hmWmB5kHhAQUV8ZPtUI",1792764732693]