权限矩阵

每个权限点、哪些内置角色持有它、它守着哪个菜单或 API。

权限点是夜莺权限模型的第一层。第二层是业务组成员关系，两层是 AND 关系：

能改这条告警规则  =  角色里有「改告警规则」这个权限点
                   且
                   我所在的某个团队，对这条规则所属的业务组有读写权

模型本身见认证与权限模型，这页只是查表用的清单。

三个内置角色

角色	覆盖范围
Admin	跳过权限校验，所有权限点都视为持有，也不受业务组成员关系限制
Standard	日常使用者。持有绝大多数权限点
Guest	只读旁观者。只有查询类的十几个权限点

自定义角色在 人员组织 → 角色管理 里建，勾选需要的权限点即可。

一个用户可以同时持有多个角色，权限取并集。

清单

带「只用于菜单可见性」的权限点不守任何接口——它只决定侧栏里那一项显不显示， 后端不会因为缺它而拒绝请求。真正的门禁是那些列了接口的。

共 96 个权限点。Admin 角色不在这张表里——它在代码里直接跳过权限校验， 所有权限点都视为持有，并且不受业务组成员关系限制。

权限点只是第一层。能不能操作某条具体数据，还要看你所在的团队对那条数据所属的 业务组有没有读写权——两层是 AND 关系。

权限点	Standard	Guest	守着的接口
/ai-config/llm-configs			GET /ai-llm-configs GET /ai-llm-config/:id POST /ai-llm-configs PUT /ai-llm-config/:id DELETE /ai-llm-config/:id POST /ai-llm-config/test
/ai-config/skills			GET /ai-skills GET /ai-skill/:id POST /ai-skills PUT /ai-skill/:id DELETE /ai-skill/:id POST /ai-skills/import PUT /ai-skill/:id/import POST /ai-skills/git/install PUT /ai-skill/:id/git/install POST /ai-skill/:id/git/update GET /ai-skill-file/:fileId DELETE /ai-skill-file/:fileId
/alert-cur-events	✅		（只用于菜单可见性）
/alert-cur-events/del	✅		DELETE /alert-cur-events
/alert-his-events	✅		（只用于菜单可见性）
/alert-mutes	✅		GET /busi-groups/alert-mutes GET /busi-group/:id/alert-mutes GET /busi-group/:id/alert-mute/:amid
/alert-mutes/add	✅		POST /busi-group/:id/alert-mutes/preview POST /busi-group/:id/alert-mutes POST /alert-mute-tryrun
/alert-mutes/del	✅		DELETE /busi-group/:id/alert-mutes
/alert-mutes/put			PUT /busi-group/:id/alert-mute/:amid PUT /busi-group/:id/alert-mutes/fields
/alert-rules	✅		GET /busi-groups/alert-rules GET /busi-group/:id/alert-rules GET /alert-rule/:arid GET /alert-rule/:arid/pure GET /alert-rule/:arid/eval-records
/alert-rules-built-in	✅		（只用于菜单可见性）
/alert-rules/add	✅		POST /busi-group/:id/alert-rules POST /busi-group/:id/alert-rules/import POST /busi-group/:id/alert-rules/clone POST /busi-groups/alert-rules/clones POST /busi-group/alert-rules/notify-tryrun POST /busi-group/alert-rules/enable-tryrun POST /busi-group/:id/alert-rule/test-fire
/alert-rules/del	✅		DELETE /busi-group/:id/alert-rules
/alert-rules/put	✅		PUT /busi-group/:id/alert-rules/fields PUT /busi-group/:id/alert-rule/:arid PUT /busi-group/alert-rule/validate
/alert-subscribes	✅		GET /busi-groups/alert-subscribes GET /busi-group/:id/alert-subscribes GET /alert-subscribe/:sid
/alert-subscribes/add	✅		POST /busi-group/:id/alert-subscribes POST /alert-subscribe/alert-subscribes-tryrun
/alert-subscribes/del	✅		DELETE /busi-group/:id/alert-subscribes
/alert-subscribes/put	✅		PUT /busi-group/:id/alert-subscribes
/builtin-metrics/add			POST /builtin-metrics
/builtin-metrics/del			DELETE /builtin-metrics
/builtin-metrics/put			PUT /builtin-metrics
/busi-groups	✅		（只用于菜单可见性）
/busi-groups/add	✅		POST /busi-groups
/busi-groups/del	✅		DELETE /busi-group/:id
/busi-groups/put	✅		PUT /busi-group/:id POST /busi-group/:id/members DELETE /busi-group/:id/members
/components/add			POST /builtin-components POST /builtin-payloads
/components/del			DELETE /builtin-components DELETE /builtin-payloads
/components/put			PUT /builtin-components PUT /builtin-payloads
/dashboards	✅		GET /busi-groups/public-boards GET /busi-groups/boards GET /busi-group/:id/boards
/dashboards-built-in	✅		（只用于菜单可见性）
/dashboards/add	✅		POST /busi-group/:id/boards POST /busi-group/:id/board/:bid/clone POST /busi-groups/boards/clones
/dashboards/del	✅		DELETE /boards DELETE /dashboard-annotation/:id
/dashboards/put	✅		PUT /board/:bid PUT /board/:bid/configs PUT /board/:bid/public POST /dashboard-annotations PUT /dashboard-annotation/:id
/embedded-dashboards			GET /embedded-dashboards
/embedded-dashboards/put			PUT /embedded-dashboards
/embedded-product/add			POST /embedded-product
/embedded-product/delete			DELETE /embedded-product/:id
/embedded-product/put			PUT /embedded-products/weights PUT /embedded-product/:id/hide PUT /embedded-product/:id
/event-pipelines			GET /event-pipelines GET /event-pipeline/:id POST /event-pipeline-tryrun POST /event-processor-tryrun POST /event-pipeline/:id/trigger POST /event-pipeline/:id/stream GET /event-pipeline-executions GET /event-pipeline/:id/executions GET /event-pipeline/:id/execution/:exec_id GET /event-pipeline-execution/:exec_id GET /event-pipeline/:id/execution-stats
/event-pipelines/add			POST /event-pipeline
/event-pipelines/del			DELETE /event-pipelines
/event-pipelines/put			PUT /event-pipeline PUT /event-pipelines/disabled
/help/contact	✅	✅	（只用于菜单可见性）
/help/migrate	✅		（只用于菜单可见性）
/help/notification-settings			GET /notify-script GET /notify-channel GET /notify-config
/help/servers	✅		（只用于菜单可见性）
/help/version	✅	✅	（只用于菜单可见性）
/job-tasks	✅		GET /busi-groups/tasks GET /busi-group/:id/tasks
/job-tasks/add	✅		POST /busi-group/:id/tasks
/job-tasks/put	✅		（只用于菜单可见性）
/job-tpls	✅		GET /busi-groups/task-tpls GET /busi-group/:id/task-tpls GET /busi-group/:id/task-tpl/:tid
/job-tpls/add	✅		POST /busi-group/:id/task-tpls
/job-tpls/del	✅		DELETE /busi-group/:id/task-tpl/:tid
/job-tpls/put	✅		POST /busi-group/:id/task-tpls/tags DELETE /busi-group/:id/task-tpls/tags PUT /busi-group/:id/task-tpl/:tid
/log/explorer	✅	✅	（只用于菜单可见性）
/log/index-patterns/add			POST /es-index-pattern
/log/index-patterns/del			DELETE /es-index-pattern
/log/index-patterns/put			PUT /es-index-pattern PUT /es-index-patterns/weights
/metric/explorer	✅	✅	（只用于菜单可见性）
/notification-channels			GET /notify-channel-config/:id GET /notify-channel-configs POST /feishu-visible-chats/:id POST /dingtalk-group-list/:id
/notification-channels/add			POST /notify-channel-configs POST /notify-channel-config/test
/notification-channels/del			DELETE /notify-channel-configs
/notification-channels/put			PUT /notify-channel-config/:id
/notification-rules			GET /notify-rule/:id GET /notify-rules POST /notify-rule/test GET /notify-rule/custom-params
/notification-rules/add			POST /notify-rules POST /notify-rule/event-pipelines-tryrun
/notification-rules/del			DELETE /notify-rules
/notification-rules/put			PUT /notify-rule/:id
/notification-templates			GET /message-template/:id
/notification-templates/add			POST /message-templates
/notification-templates/del			DELETE /message-templates
/notification-templates/put			PUT /message-template/:id
/object/explorer	✅	✅	（只用于菜单可见性）
/recording-rules	✅		GET /busi-groups/recording-rules GET /busi-group/:id/recording-rules GET /recording-rule/:rrid PUT /recording-rule/:rrid
/recording-rules/add	✅		POST /busi-group/:id/recording-rules
/recording-rules/del	✅		DELETE /busi-group/:id/recording-rules
/recording-rules/put	✅		PUT /busi-group/:id/recording-rules/fields
/roles			GET /role/:id/ops
/roles/add			POST /roles
/roles/del			DELETE /role/:id
/roles/put			PUT /roles PUT /role/:id/ops
/system/alerting-engines			GET /servers
/system/variable-settings			GET /user-variable-configs POST /user-variable-config PUT /user-variable-config/:id DELETE /user-variable-config/:id
/targets	✅		（只用于菜单可见性）
/targets/add	✅		（只用于菜单可见性）
/targets/del	✅		DELETE /targets
/targets/put	✅		POST /targets/tags DELETE /targets/tags PUT /targets/note PUT /targets/bgids
/trace/dependencies	✅		（只用于菜单可见性）
/trace/explorer	✅	✅	（只用于菜单可见性）
/user-groups	✅		（只用于菜单可见性）
/user-groups/add	✅		POST /user-groups
/user-groups/del	✅		DELETE /user-group/:id
/user-groups/put	✅		PUT /user-group/:id POST /user-group/:id/members DELETE /user-group/:id/members
/users	✅		GET /users
/users/add			POST /users
/users/del			DELETE /user/:id
/users/put			PUT /user/:id/profile PUT /user/:id/password