diff --git a/clinical-web/.env.example b/clinical-web/.env.example
index 65734d5..8ebc4b1 100644
--- a/clinical-web/.env.example
+++ b/clinical-web/.env.example
@@ -1,3 +1,4 @@
 VITE_APP_NAME=medical-sign-clinical
 VITE_API_BASE_URL=/api
-VITE_USE_MOCK=true
+# 联调默认走真实后端；仅在演示原型时改为 true。
+VITE_USE_MOCK=false
diff --git a/clinical-web/README.md b/clinical-web/README.md
index f57fe84..d3c11a6 100644
--- a/clinical-web/README.md
+++ b/clinical-web/README.md
@@ -178,6 +178,6 @@ API 请求和响应类型按业务域放在 `api/workbench/types.ts`、`api/mana
 
 开发环境默认使用 `/api` 作为同源接口前缀，Vite 会将 `/api` 转发到 `https://ipad.shenynet.com`，因此浏览器不会直接跨域请求后端。代理配置位于 `vite.config.ts`，不改写 `/api/v1/...` 路径。修改代理或环境变量后需要重启 Vite 开发服务。
 
-生产环境不会使用 Vite 的开发代理，需要在 Nginx 或其他网关中配置同样的 `/api` 反向代理。除登录外，当前业务 API 模块默认返回 Mock 数据，设置 `VITE_USE_MOCK=false` 后切换已实现的真实接口。使用本地开发代理时，`VITE_API_BASE_URL` 应填写 `/api`；如果改为直连后端，则需要后端配置允许当前前端源的 CORS。
+生产环境不会使用 Vite 的开发代理，需要在 Nginx 或其他网关中配置同样的 `/api` 反向代理。文档权限和用户权限相关管理接口默认调用真实后端，仅在显式设置 `VITE_USE_MOCK=true` 时使用 Mock 数据。使用本地开发代理时，`VITE_API_BASE_URL` 应填写 `/api`；如果改为直连后端，则需要后端配置允许当前前端源的 CORS。
 
-当前尚未接入的签署能力包括手写板设备桥接、线上签署页面/签名回调和打印服务。签署投递、一次性 Token 消费和真实 PNG 上传 API 已完成封装，但页面不能用 Canvas 演示数据冒充真实签名；需要接入设备适配器或患者 H5 回调后再启用。短信初次发送接口需要完整手机号，而患者查询只返回脱敏手机号，因此真实模式会要求当前操作人员确认完整投递地址；生产环境也可以改为由后端根据患者 ID 解析投递地址。默认 Mock 模式仍可用于演示完整交互，联调时设置 `VITE_USE_MOCK=false`。
+当前尚未接入的签署能力包括手写板设备桥接、线上签署页面/签名回调和打印服务。签署投递、一次性 Token 消费和真实 PNG 上传 API 已完成封装，但页面不能用 Canvas 演示数据冒充真实签名；需要接入设备适配器或患者 H5 回调后再启用。短信初次发送接口需要完整手机号，而患者查询只返回脱敏手机号，因此真实模式会要求当前操作人员确认完整投递地址；生产环境也可以改为由后端根据患者 ID 解析投递地址。需要演示完整交互时再设置 `VITE_USE_MOCK=true`。
diff --git a/clinical-web/docs/document-permissions-api.md b/clinical-web/docs/document-permissions-api.md
index 0e436e0..1516b4c 100644
--- a/clinical-web/docs/document-permissions-api.md
+++ b/clinical-web/docs/document-permissions-api.md
@@ -80,6 +80,8 @@
 
 ## 当前核验结论
 
+文档权限页面仅在显式设置 `VITE_USE_MOCK=true` 时使用演示数据；未设置该变量或设置为其他值时，页面调用真实权限接口。修改环境变量后需要重启 Vite。
+
 本轮新增接口已覆盖当前文档权限页面的后端缺口，暂无阻断前端接入的缺失接口。跨模板矩阵查询最多支持 100 个模板，批量保存最多支持 200 项；页面当前采用“模板选择 + 当前模板矩阵”的交互，没有臆造跨模板对比表。
 
 联调验收至少包括：
diff --git a/clinical-web/src/api/management/document-permissions.ts b/clinical-web/src/api/management/document-permissions.ts
index cc55b73..b3861e1 100644
--- a/clinical-web/src/api/management/document-permissions.ts
+++ b/clinical-web/src/api/management/document-permissions.ts
@@ -6,9 +6,16 @@ import type {
   BackendCollection,
   BackendPage,
   CreateTemplatePermissionRequest,
+  DepartmentPermissionPolicyRecord,
   PermissionListResponse,
+  PermissionPolicyLevel,
+  PermissionPoliciesRecord,
+  PermissionPoliciesResponseDto,
+  PermissionPolicyDepartmentDto,
+  PermissionPolicyRoleDto,
   PermissionQuery,
   PermissionRecord,
+  RolePermissionPolicyRecord,
   TemplatePermissionBatchRequest,
   TemplatePermissionBatchResponse,
   TemplatePermissionBatchResponseDto,
@@ -19,9 +26,12 @@ import type {
   TemplatePermissionMatrixResponse,
   TemplatePermissionRecord,
   TemplatePermissionResponseDto,
+  UpdateDepartmentPermissionPolicyRequest,
+  UpdateRolePermissionPolicyRequest,
 } from './types'
 
-const useMockData = import.meta.env.VITE_USE_MOCK !== 'false'
+// 仅显式开启 VITE_USE_MOCK=true 时使用演示数据，避免联调环境因未注入变量而误入 Mock 分支。
+const useMockData = import.meta.env.VITE_USE_MOCK === 'true'
 
 export const isPermissionMockEnabled = useMockData
 
@@ -44,6 +54,473 @@ const mockRecords: PermissionRecord[] = [
   },
 ]
 
+const mockPermissionPolicies: PermissionPoliciesRecord = {
+  campusId: 'mock-main',
+  roles: [
+    {
+      roleId: 'system-admin',
+      code: 'SYSTEM_ADMIN',
+      name: '系统管理员',
+      description: '系统配置、用户与权限管理、审计日志',
+      userCount: 2,
+      campusId: 'mock-main',
+      view: true,
+      use: true,
+      maintain: true,
+      permissionLevel: 'MAINTAIN',
+    },
+    {
+      roleId: 'medical-management',
+      code: 'MEDICAL_MANAGEMENT',
+      name: '医务管理',
+      description: '全院文档库维护、报表分析、任务监督',
+      userCount: 4,
+      campusId: 'mock-main',
+      view: true,
+      use: true,
+      maintain: true,
+      permissionLevel: 'MAINTAIN',
+    },
+    {
+      roleId: 'department-signer',
+      code: 'DEPARTMENT_SIGNER',
+      name: '科室签署员',
+      description: '本科室文档发起签署、手写板 / 短信操作',
+      userCount: 23,
+      campusId: 'mock-main',
+      view: true,
+      use: true,
+      maintain: false,
+      permissionLevel: 'USE',
+    },
+    {
+      roleId: 'audit-viewer',
+      code: 'AUDIT_VIEWER',
+      name: '查询审计员',
+      description: '只读查询报表与审计留痕，不可发起',
+      userCount: 3,
+      campusId: 'mock-main',
+      view: true,
+      use: false,
+      maintain: false,
+      permissionLevel: 'VIEW',
+    },
+  ],
+  departments: [
+    {
+      departmentId: 'mock-department-radiology',
+      code: 'RADIOLOGY',
+      name: '放射科',
+      campusId: 'mock-main',
+      own: true,
+      common: true,
+      other: false,
+      ownPermission: 'USE',
+      commonPermission: 'USE',
+      otherPermission: 'NONE',
+    },
+    {
+      departmentId: 'mock-department-cardiology',
+      code: 'CARDIOLOGY',
+      name: '心内科',
+      campusId: 'mock-main',
+      own: true,
+      common: true,
+      other: false,
+      ownPermission: 'USE',
+      commonPermission: 'USE',
+      otherPermission: 'NONE',
+    },
+    {
+      departmentId: 'mock-department-orthopedics',
+      code: 'ORTHOPEDICS',
+      name: '骨科',
+      campusId: 'mock-main',
+      own: true,
+      common: true,
+      other: false,
+      ownPermission: 'USE',
+      commonPermission: 'USE',
+      otherPermission: 'NONE',
+    },
+    {
+      departmentId: 'mock-department-health',
+      code: 'HEALTH_MANAGEMENT',
+      name: '健康管理中心',
+      campusId: 'mock-main',
+      own: true,
+      common: true,
+      other: false,
+      ownPermission: 'USE',
+      commonPermission: 'USE',
+      otherPermission: 'NONE',
+    },
+  ],
+  templateCount: 2,
+}
+
+type PermissionPolicyObject = Record<string, unknown>
+
+function asObject(value: unknown): PermissionPolicyObject {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as PermissionPolicyObject)
+    : {}
+}
+
+function asArray(value: unknown): unknown[] {
+  return Array.isArray(value) ? value : []
+}
+
+function readString(source: PermissionPolicyObject, keys: string[], fallback = '') {
+  for (const key of keys) {
+    const value = source[key]
+    if (typeof value === 'string' && value.trim()) {
+      return value.trim()
+    }
+  }
+
+  return fallback
+}
+
+function readNumber(source: PermissionPolicyObject, keys: string[]) {
+  for (const key of keys) {
+    const value = source[key]
+    if (typeof value === 'number' && Number.isFinite(value)) {
+      return value
+    }
+    if (typeof value === 'string' && value.trim() && Number.isFinite(Number(value))) {
+      return Number(value)
+    }
+  }
+
+  return undefined
+}
+
+function readBoolean(source: PermissionPolicyObject, keys: string[]) {
+  for (const key of keys) {
+    const value = source[key]
+
+    if (typeof value === 'boolean') {
+      return value
+    }
+
+    if (typeof value === 'number') {
+      return value !== 0
+    }
+
+    if (typeof value === 'string') {
+      const normalized = value.trim().toLowerCase()
+      if (['true', '1', 'yes', 'allow', 'allowed', 'enabled', 'on'].includes(normalized)) {
+        return true
+      }
+      if (['false', '0', 'no', 'deny', 'denied', 'disabled', 'off'].includes(normalized)) {
+        return false
+      }
+    }
+
+    if (value !== null && typeof value === 'object') {
+      const nested = asObject(value)
+      const nestedValue = nested.enabled ?? nested.allowed ?? nested.value
+      if (typeof nestedValue === 'boolean') {
+        return nestedValue
+      }
+    }
+  }
+
+  return false
+}
+
+function readVersion(source: PermissionPolicyObject) {
+  return readNumber(source, ['version', 'policyVersion', 'revision'])
+}
+
+const policyLevelRank: Record<PermissionPolicyLevel, number> = {
+  NONE: 0,
+  VIEW: 1,
+  USE: 2,
+  MAINTAIN: 3,
+}
+
+function normalizePolicyLevel(value: unknown): PermissionPolicyLevel | undefined {
+  if (typeof value !== 'string') {
+    return undefined
+  }
+
+  const level = value.trim().toUpperCase() as PermissionPolicyLevel
+  return level in policyLevelRank ? level : undefined
+}
+
+function policyLevelFromFlags(source: PermissionPolicyObject, keys: string[]) {
+  let level: PermissionPolicyLevel = 'NONE'
+
+  keys.forEach((key, index) => {
+    if (readBoolean(source, [key])) {
+      const nextLevel = (['VIEW', 'USE', 'MAINTAIN'] as const)[index]
+      if (policyLevelRank[nextLevel] > policyLevelRank[level]) {
+        level = nextLevel
+      }
+    }
+  })
+
+  return level
+}
+
+function readPolicyLevel(
+  source: PermissionPolicyObject,
+  levelKeys: string[],
+  flagKeys: string[],
+): PermissionPolicyLevel {
+  for (const key of levelKeys) {
+    const level = normalizePolicyLevel(source[key])
+    if (level) {
+      return level
+    }
+  }
+
+  return policyLevelFromFlags(source, flagKeys)
+}
+
+function flagsForPolicyLevel(level: PermissionPolicyLevel) {
+  const rank = policyLevelRank[level]
+  return {
+    view: rank >= policyLevelRank.VIEW,
+    use: rank >= policyLevelRank.USE,
+    maintain: rank >= policyLevelRank.MAINTAIN,
+  }
+}
+
+function departmentFlagsForPolicyLevel(level: PermissionPolicyLevel) {
+  return level !== 'NONE'
+}
+
+function mapRolePolicy(
+  dto: PermissionPolicyRoleDto | PermissionPolicyObject,
+  fallbackRoleId = '',
+  fallbackCampusId = '',
+): RolePermissionPolicyRecord | null {
+  const source = asObject(dto)
+  const roleId = readString(source, ['roleId', 'roleID', 'id'], fallbackRoleId)
+
+  if (!roleId) {
+    return null
+  }
+
+  const permissionLevel = readPolicyLevel(
+    source,
+    ['permissionLevel', 'maxPermissionLevel', 'level'],
+    ['view', 'use', 'maintain'],
+  )
+
+  return {
+    roleId,
+    campusId: readString(source, ['campusId', 'campusID'], fallbackCampusId),
+    code: readString(source, ['code', 'roleCode'], roleId),
+    name: readString(source, ['name', 'roleName'], roleId),
+    description: readString(source, ['description'], '—'),
+    userCount: readNumber(source, ['userCount', 'users', 'memberCount']) ?? null,
+    ...flagsForPolicyLevel(permissionLevel),
+    permissionLevel,
+    version: readVersion(source),
+  }
+}
+
+function mapDepartmentPolicy(
+  dto: PermissionPolicyDepartmentDto | PermissionPolicyObject,
+  fallbackCampusId = '',
+): DepartmentPermissionPolicyRecord | null {
+  const source = asObject(dto)
+  const departmentId = readString(source, ['departmentId', 'departmentID', 'id'])
+
+  if (!departmentId) {
+    return null
+  }
+
+  const ownPermission = readPolicyLevel(
+    source,
+    ['ownPermission', 'ownLevel'],
+    ['own', 'ownDocuments', 'ownDocument', 'ownEnabled'],
+  )
+  const commonPermission = readPolicyLevel(
+    source,
+    ['commonPermission', 'commonLevel'],
+    ['common', 'commonDocuments', 'commonDocument', 'commonEnabled'],
+  )
+  const otherPermission = readPolicyLevel(
+    source,
+    ['otherPermission', 'otherLevel'],
+    ['other', 'otherDocuments', 'otherDocument', 'otherEnabled'],
+  )
+
+  return {
+    departmentId,
+    code: readString(source, ['code', 'departmentCode'], departmentId),
+    name: readString(source, ['name', 'departmentName'], departmentId),
+    campusId: readString(source, ['campusId', 'campusID'], fallbackCampusId),
+    own: departmentFlagsForPolicyLevel(ownPermission),
+    common: departmentFlagsForPolicyLevel(commonPermission),
+    other: departmentFlagsForPolicyLevel(otherPermission),
+    ownPermission,
+    commonPermission,
+    otherPermission,
+    version: readVersion(source),
+  }
+}
+
+function normalizePermissionPolicies(
+  data: PermissionPoliciesResponseDto | PermissionPolicyObject,
+  requestedCampusId = '',
+): PermissionPoliciesRecord {
+  const source = asObject(data)
+  const campusId = readString(source, ['campusId', 'campusID'], requestedCampusId)
+  const roleDtos = asArray(source.roles ?? source.rolePolicies ?? source.rolePermissionPolicies)
+  const departmentDtos = asArray(
+    source.departments ?? source.departmentPolicies ?? source.departmentPermissionPolicies,
+  )
+  const roles = roleDtos
+    .map((role) => mapRolePolicy(role as PermissionPolicyObject, '', campusId))
+    .filter((role): role is RolePermissionPolicyRecord => Boolean(role))
+  const departments = departmentDtos
+    .map((department) => mapDepartmentPolicy(department as PermissionPolicyObject, campusId))
+    .filter((department): department is DepartmentPermissionPolicyRecord => Boolean(department))
+
+  return {
+    campusId,
+    roles,
+    departments,
+    templateCount: readNumber(source, ['templateCount', 'templatesCount', 'count']) ?? 0,
+  }
+}
+
+function mapUpdatedRolePolicy(
+  data: PermissionPolicyRoleDto | PermissionPolicyObject,
+  roleId: string,
+  previous: RolePermissionPolicyRecord,
+) {
+  return (
+    mapRolePolicy(data, roleId, previous.campusId) ?? {
+      ...previous,
+      roleId,
+    }
+  )
+}
+
+function mapUpdatedDepartmentPolicy(
+  data: PermissionPolicyDepartmentDto | PermissionPolicyObject,
+  departmentId: string,
+  previous: DepartmentPermissionPolicyRecord,
+) {
+  return (
+    mapDepartmentPolicy(data, previous.campusId) ?? {
+      ...previous,
+      departmentId,
+    }
+  )
+}
+
+export async function getPermissionPolicies(campusId?: string): Promise<PermissionPoliciesRecord> {
+  if (useMockData) {
+    return {
+      ...mockPermissionPolicies,
+      campusId: campusId ?? mockPermissionPolicies.campusId,
+      roles: mockPermissionPolicies.roles.map((role) => ({ ...role })),
+      departments: mockPermissionPolicies.departments.map((department) => ({ ...department })),
+    }
+  }
+
+  const response = await request.get<ApiResponse<PermissionPoliciesResponseDto>>(
+    '/v1/templates/permission-policies',
+    { params: campusId ? { campusId } : undefined },
+  )
+  return normalizePermissionPolicies(unwrapApiResponse(response), campusId)
+}
+
+export async function updateRolePermissionPolicy(
+  roleId: string,
+  payload: UpdateRolePermissionPolicyRequest,
+  previous?: RolePermissionPolicyRecord,
+): Promise<RolePermissionPolicyRecord> {
+  if (useMockData) {
+    const role = mockPermissionPolicies.roles.find((item) => item.roleId === roleId)
+    if (!role) {
+      throw new Error('角色默认策略不存在')
+    }
+    Object.assign(role, flagsForPolicyLevel(payload.permissionLevel), {
+      permissionLevel: payload.permissionLevel,
+      campusId: payload.campusId,
+      version: (role.version ?? 0) + 1,
+    })
+    return { ...role }
+  }
+
+  const response = await request.put<ApiResponse<PermissionPolicyRoleDto>>(
+    `/v1/templates/permission-policies/roles/${encodeURIComponent(roleId)}`,
+    payload,
+  )
+  return mapUpdatedRolePolicy(
+    unwrapApiResponse(response),
+    roleId,
+    previous ?? {
+      roleId,
+      campusId: payload.campusId,
+      code: roleId,
+      name: roleId,
+      description: '—',
+      userCount: null,
+      ...flagsForPolicyLevel(payload.permissionLevel),
+      permissionLevel: payload.permissionLevel,
+      version: payload.expectedVersion,
+    },
+  )
+}
+
+export async function updateDepartmentPermissionPolicy(
+  departmentId: string,
+  payload: UpdateDepartmentPermissionPolicyRequest,
+  previous?: DepartmentPermissionPolicyRecord,
+): Promise<DepartmentPermissionPolicyRecord> {
+  if (useMockData) {
+    const department = mockPermissionPolicies.departments.find(
+      (item) => item.departmentId === departmentId,
+    )
+    if (!department) {
+      throw new Error('科室默认策略不存在')
+    }
+    Object.assign(department, {
+      own: departmentFlagsForPolicyLevel(payload.ownPermission),
+      common: departmentFlagsForPolicyLevel(payload.commonPermission),
+      other: departmentFlagsForPolicyLevel(payload.otherPermission),
+      ownPermission: payload.ownPermission,
+      commonPermission: payload.commonPermission,
+      otherPermission: payload.otherPermission,
+      campusId: payload.campusId,
+      version: (department.version ?? 0) + 1,
+    })
+    return { ...department }
+  }
+
+  const response = await request.put<ApiResponse<PermissionPolicyDepartmentDto>>(
+    `/v1/templates/permission-policies/departments/${encodeURIComponent(departmentId)}`,
+    payload,
+  )
+  return mapUpdatedDepartmentPolicy(
+    unwrapApiResponse(response),
+    departmentId,
+    previous ?? {
+      departmentId,
+      code: departmentId,
+      name: departmentId,
+      campusId: payload.campusId,
+      own: departmentFlagsForPolicyLevel(payload.ownPermission),
+      common: departmentFlagsForPolicyLevel(payload.commonPermission),
+      other: departmentFlagsForPolicyLevel(payload.otherPermission),
+      ownPermission: payload.ownPermission,
+      commonPermission: payload.commonPermission,
+      otherPermission: payload.otherPermission,
+      version: payload.expectedVersion,
+    },
+  )
+}
+
 export function getDocumentPermissions(query: PermissionQuery): Promise<PermissionListResponse> {
   if (!useMockData) {
     return Promise.reject(
diff --git a/clinical-web/src/api/management/documents.ts b/clinical-web/src/api/management/documents.ts
index 784f7cf..5cedc04 100644
--- a/clinical-web/src/api/management/documents.ts
+++ b/clinical-web/src/api/management/documents.ts
@@ -17,7 +17,8 @@ import type {
   TemplateVersionResponseDto,
 } from './types'
 
-const useMockData = import.meta.env.VITE_USE_MOCK !== 'false'
+// 仅显式开启 VITE_USE_MOCK=true 时使用演示数据，避免联调环境因未注入变量而误入 Mock 分支。
+const useMockData = import.meta.env.VITE_USE_MOCK === 'true'
 
 export const isDocumentMockEnabled = useMockData
 
diff --git a/clinical-web/src/api/management/organization.ts b/clinical-web/src/api/management/organization.ts
index 6a1b13b..3160ee0 100644
--- a/clinical-web/src/api/management/organization.ts
+++ b/clinical-web/src/api/management/organization.ts
@@ -13,7 +13,8 @@ import type {
   UpdateDepartmentRequest,
 } from './types'
 
-const useMockData = import.meta.env.VITE_USE_MOCK !== 'false'
+// 仅显式开启 VITE_USE_MOCK=true 时使用演示数据，避免联调环境因未注入变量而误入 Mock 分支。
+const useMockData = import.meta.env.VITE_USE_MOCK === 'true'
 
 function getRecords(data: BackendCollection<OrganizationResponseDto>) {
   return Array.isArray(data) ? data : (data.records ?? data.items ?? data.content ?? [])
diff --git a/clinical-web/src/api/management/permissions.ts b/clinical-web/src/api/management/permissions.ts
index 10358f6..0e82336 100644
--- a/clinical-web/src/api/management/permissions.ts
+++ b/clinical-web/src/api/management/permissions.ts
@@ -14,7 +14,8 @@ import type {
   UpdateApiPermissionRequest,
 } from './types'
 
-const useMockData = import.meta.env.VITE_USE_MOCK !== 'false'
+// 仅显式开启 VITE_USE_MOCK=true 时使用演示权限目录。
+const useMockData = import.meta.env.VITE_USE_MOCK === 'true'
 
 export const isApiPermissionMockEnabled = useMockData
 
diff --git a/clinical-web/src/api/management/roles.ts b/clinical-web/src/api/management/roles.ts
index 8544163..a25e9e7 100644
--- a/clinical-web/src/api/management/roles.ts
+++ b/clinical-web/src/api/management/roles.ts
@@ -14,7 +14,8 @@ import type {
   UpdateRoleRequest,
 } from './types'
 
-const useMockData = import.meta.env.VITE_USE_MOCK !== 'false'
+// 仅显式开启 VITE_USE_MOCK=true 时使用演示数据，避免联调环境因未注入变量而误入 Mock 分支。
+const useMockData = import.meta.env.VITE_USE_MOCK === 'true'
 
 const fallbackColors = ['#6b5bd2', '#0e6e8c', '#0f9d6c', '#d9821f', '#c65d5d']
 
diff --git a/clinical-web/src/api/management/types.ts b/clinical-web/src/api/management/types.ts
index f785ed1..00c7448 100644
--- a/clinical-web/src/api/management/types.ts
+++ b/clinical-web/src/api/management/types.ts
@@ -538,6 +538,118 @@ export interface RolePermissionsUpdateRequest {
   expectedVersion?: number
 }
 
+export type PermissionPolicyLevel = 'NONE' | 'VIEW' | 'USE' | 'MAINTAIN'
+
+/** 默认文档权限策略的后端 DTO。字段保留常见别名，由 API 边界统一为页面模型。 */
+export interface PermissionPolicyRoleDto {
+  roleId?: string | null
+  id?: string | null
+  campusId?: string | null
+  code?: string | null
+  roleCode?: string | null
+  name?: string | null
+  roleName?: string | null
+  description?: string | null
+  userCount?: number | null
+  view?: unknown
+  canView?: unknown
+  viewEnabled?: unknown
+  use?: unknown
+  canUse?: unknown
+  useEnabled?: unknown
+  maintain?: unknown
+  canMaintain?: unknown
+  maintainEnabled?: unknown
+  permissionLevel?: PermissionPolicyLevel | string | null
+  maxPermissionLevel?: PermissionPolicyLevel | string | null
+  version?: number | null
+}
+
+export interface PermissionPolicyDepartmentDto {
+  departmentId?: string | null
+  id?: string | null
+  code?: string | null
+  departmentCode?: string | null
+  name?: string | null
+  departmentName?: string | null
+  campusId?: string | null
+  ownPermission?: PermissionPolicyLevel | string | null
+  commonPermission?: PermissionPolicyLevel | string | null
+  otherPermission?: PermissionPolicyLevel | string | null
+  own?: unknown
+  ownDocuments?: unknown
+  ownDocument?: unknown
+  ownEnabled?: unknown
+  common?: unknown
+  commonDocuments?: unknown
+  commonDocument?: unknown
+  commonEnabled?: unknown
+  other?: unknown
+  otherDocuments?: unknown
+  otherDocument?: unknown
+  otherEnabled?: unknown
+  version?: number | null
+}
+
+export interface PermissionPoliciesResponseDto {
+  campusId?: string | null
+  roles?: PermissionPolicyRoleDto[] | null
+  rolePolicies?: PermissionPolicyRoleDto[] | null
+  departments?: PermissionPolicyDepartmentDto[] | null
+  departmentPolicies?: PermissionPolicyDepartmentDto[] | null
+  templateCount?: number | null
+  templatesCount?: number | null
+}
+
+export interface RolePermissionPolicyRecord {
+  roleId: string
+  campusId: string
+  code: string
+  name: string
+  description: string
+  userCount: number | null
+  view: boolean
+  use: boolean
+  maintain: boolean
+  permissionLevel: PermissionPolicyLevel
+  version?: number
+}
+
+export interface DepartmentPermissionPolicyRecord {
+  departmentId: string
+  version?: number
+  code: string
+  name: string
+  campusId: string
+  own: boolean
+  common: boolean
+  other: boolean
+  ownPermission: PermissionPolicyLevel
+  commonPermission: PermissionPolicyLevel
+  otherPermission: PermissionPolicyLevel
+}
+
+export interface PermissionPoliciesRecord {
+  campusId: string
+  roles: RolePermissionPolicyRecord[]
+  departments: DepartmentPermissionPolicyRecord[]
+  templateCount: number
+}
+
+export interface UpdateRolePermissionPolicyRequest {
+  campusId: string
+  permissionLevel: PermissionPolicyLevel
+  expectedVersion?: number
+}
+
+export interface UpdateDepartmentPermissionPolicyRequest {
+  campusId: string
+  ownPermission: PermissionPolicyLevel
+  commonPermission: PermissionPolicyLevel
+  otherPermission: PermissionPolicyLevel
+  expectedVersion?: number
+}
+
 export interface PasswordResetRequest {
   newPassword: string
   forceChangeOnNextLogin?: boolean
diff --git a/clinical-web/src/api/management/users.ts b/clinical-web/src/api/management/users.ts
index 630073f..ac2198e 100644
--- a/clinical-web/src/api/management/users.ts
+++ b/clinical-web/src/api/management/users.ts
@@ -22,7 +22,8 @@ import type {
   UserRolesUpdateRequest,
 } from './types'
 
-const useMockData = import.meta.env.VITE_USE_MOCK !== 'false'
+// 仅显式开启 VITE_USE_MOCK=true 时使用演示数据，避免联调环境因未注入变量而误入 Mock 分支。
+const useMockData = import.meta.env.VITE_USE_MOCK === 'true'
 
 export const isUserMockEnabled = useMockData
 
diff --git a/clinical-web/src/components/layout/Menu.vue b/clinical-web/src/components/layout/Menu.vue
index d772bf8..8e73091 100644
--- a/clinical-web/src/components/layout/Menu.vue
+++ b/clinical-web/src/components/layout/Menu.vue
@@ -32,7 +32,11 @@ const menuGroups: MenuGroup[] = [
       { path: '/management/documents', label: '文档库管理' },
       { path: '/management/reports', label: '报表分析' },
       { path: '/management/users', label: '用户与权限', permission: 'system:user:query' },
-      { path: '/management/document-permissions', label: '文档权限' },
+      {
+        path: '/management/document-permissions',
+        label: '文档权限',
+        permission: 'sign:template:permission:query',
+      },
       { path: '/management/settings', label: '系统设置' },
     ],
   },
diff --git a/clinical-web/src/router/index.ts b/clinical-web/src/router/index.ts
index a1539ad..889bfff 100644
--- a/clinical-web/src/router/index.ts
+++ b/clinical-web/src/router/index.ts
@@ -76,7 +76,11 @@ const router = createRouter({
               path: 'document-permissions',
               name: 'management-document-permissions',
               component: DocumentPermissionsView,
-              meta: { title: '文档权限', group: '管理' },
+              meta: {
+                title: '文档权限',
+                group: '管理',
+                permission: 'sign:template:permission:query',
+              },
             },
             {
               path: 'settings',
diff --git a/clinical-web/src/stores/app.ts b/clinical-web/src/stores/app.ts
index 5c8a939..2622867 100644
--- a/clinical-web/src/stores/app.ts
+++ b/clinical-web/src/stores/app.ts
@@ -5,7 +5,9 @@ import { getCampuses } from '@/api/management/organization'
 import type { CampusRecord } from '@/api/management/types'
 import type { WorkbenchCampus } from '@/api/workbench/types'
 
-const useMockData = import.meta.env.VITE_USE_MOCK !== 'false'
+// 仅显式开启 VITE_USE_MOCK=true 时使用演示院区，避免真实接口联调时把 mock UUID
+// 作为 campusId 发给后端。
+const useMockData = import.meta.env.VITE_USE_MOCK === 'true'
 
 const mockCampusRecords: CampusRecord[] = [
   { id: 'mock-campus-main', code: 'MAIN', name: '本部院区', status: 'ENABLED', sortNo: 1 },
diff --git a/clinical-web/src/views/management/document-permissions/components/DepartmentPermissionDrawer.vue b/clinical-web/src/views/management/document-permissions/components/DepartmentPermissionDrawer.vue
new file mode 100644
index 0000000..4b6a502
--- /dev/null
+++ b/clinical-web/src/views/management/document-permissions/components/DepartmentPermissionDrawer.vue
@@ -0,0 +1,475 @@
+<script setup lang="ts">
+import { computed, reactive, watch } from 'vue'
+
+import type { DocumentRecord, TemplatePermissionRecord } from '@/api/management/types'
+
+import TemplatePermissionPanel from './TemplatePermissionPanel.vue'
+import type {
+  DepartmentPermissionRow,
+  PermissionSubjectOption,
+  TemplatePermissionForm,
+} from '../types'
+
+const props = defineProps<{
+  visible: boolean
+  department: DepartmentPermissionRow | null
+  templates: DocumentRecord[]
+  selectedTemplateId: string
+  permissions: TemplatePermissionRecord[]
+  subjects: PermissionSubjectOption[]
+  policySaving: boolean
+  templateLoading: boolean
+  templateCatalogLoading: boolean
+  templateSaving: boolean
+  templateError: boolean
+  templateErrorMessage?: string
+  templateCatalogError?: string
+  previewUserId: string
+  canEditPolicy: boolean
+  canEditTemplate: boolean
+}>()
+
+const emit = defineEmits<{
+  close: []
+  savePolicy: [payload: { own: boolean; common: boolean; other: boolean; expectedVersion?: number }]
+  'update:selectedTemplateId': [value: string]
+  'update:previewUserId': [value: string]
+  add: [form: TemplatePermissionForm]
+  delete: [permissionId: string]
+  retry: []
+}>()
+
+const form = reactive({
+  own: false,
+  common: false,
+  other: false,
+})
+
+const departmentTitle = computed(() => props.department?.department ?? '科室权限')
+
+function syncForm() {
+  form.own = props.department?.own ?? false
+  form.common = props.department?.common ?? false
+  form.other = props.department?.other ?? false
+}
+
+function savePolicy() {
+  if (!props.department || props.policySaving || !props.canEditPolicy) {
+    return
+  }
+
+  emit('savePolicy', {
+    ...form,
+    expectedVersion: props.department.version,
+  })
+}
+
+watch(
+  () => [props.visible, props.department] as const,
+  ([visible]) => {
+    if (visible) {
+      syncForm()
+    }
+  },
+  { immediate: true },
+)
+</script>
+
+<template>
+  <Teleport to="body">
+    <div v-if="props.visible" class="drawer-mask" @click.self="emit('close')">
+      <aside
+        class="permission-drawer"
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="drawer-title"
+      >
+        <header class="drawer-header">
+          <div>
+            <strong id="drawer-title">调整{{ departmentTitle }}文档权限</strong>
+            <p>默认策略适用于当前院区；模板例外仅覆盖指定模板。</p>
+          </div>
+          <button type="button" class="close-button" aria-label="关闭" @click="emit('close')">
+            ×
+          </button>
+        </header>
+
+        <div class="drawer-body">
+          <section class="drawer-section">
+            <div class="section-heading">
+              <div>
+                <h2>默认策略</h2>
+                <p>未配置模板例外时，科室按以下范围访问文档。</p>
+              </div>
+              <span v-if="department?.campus" class="section-meta">{{ department.campus }}</span>
+            </div>
+
+            <div v-if="department" class="policy-options">
+              <button
+                type="button"
+                class="policy-option"
+                :class="{ active: form.own }"
+                :disabled="!props.canEditPolicy || props.policySaving"
+                :aria-pressed="form.own"
+                @click="form.own = !form.own"
+              >
+                <span class="policy-switch" aria-hidden="true"><i /></span>
+                <span>
+                  <strong>本科室文档</strong>
+                  <small>本部门维护的文档模板</small>
+                </span>
+              </button>
+              <button
+                type="button"
+                class="policy-option"
+                :class="{ active: form.common }"
+                :disabled="!props.canEditPolicy || props.policySaving"
+                :aria-pressed="form.common"
+                @click="form.common = !form.common"
+              >
+                <span class="policy-switch" aria-hidden="true"><i /></span>
+                <span>
+                  <strong>全院通用文档</strong>
+                  <small>标记为全院通用的文档模板</small>
+                </span>
+              </button>
+              <button
+                type="button"
+                class="policy-option"
+                :class="{ active: form.other }"
+                :disabled="!props.canEditPolicy || props.policySaving"
+                :aria-pressed="form.other"
+                @click="form.other = !form.other"
+              >
+                <span class="policy-switch" aria-hidden="true"><i /></span>
+                <span>
+                  <strong>其他科室文档</strong>
+                  <small>其他科室维护的非通用文档</small>
+                </span>
+              </button>
+            </div>
+            <div v-else class="empty-state">暂无科室信息</div>
+            <p v-if="!props.canEditPolicy" class="readonly-tip">当前账号仅可查看默认策略。</p>
+          </section>
+
+          <section class="drawer-section template-section">
+            <div class="section-heading">
+              <div>
+                <h2>模板例外</h2>
+                <p>对单个模板新增或撤销直接权限；继承权限只读。</p>
+              </div>
+              <span class="section-meta">
+                {{ props.templates.length ? `${props.templates.length} 个模板` : '暂无模板' }}
+              </span>
+            </div>
+            <TemplatePermissionPanel
+              :templates="props.templates"
+              :selected-template-id="props.selectedTemplateId"
+              :permissions="props.permissions"
+              :subjects="props.subjects"
+              :loading="props.templateLoading"
+              :saving="props.templateSaving"
+              :error="props.templateError"
+              :error-message="props.templateErrorMessage"
+              :catalog-error="props.templateCatalogError"
+              :catalog-loading="props.templateCatalogLoading"
+              :preview-user-id="props.previewUserId"
+              :can-edit="props.canEditTemplate"
+              @update:selected-template-id="emit('update:selectedTemplateId', $event)"
+              @update:preview-user-id="emit('update:previewUserId', $event)"
+              @add="emit('add', $event)"
+              @delete="emit('delete', $event)"
+              @retry="emit('retry')"
+            />
+          </section>
+        </div>
+
+        <footer class="drawer-footer">
+          <span class="footer-note">
+            {{
+              props.canEditPolicy
+                ? '调整后即时生效并记录审计日志。'
+                : '默认策略由有权限的管理员调整。'
+            }}
+          </span>
+          <button type="button" class="button button--ghost" @click="emit('close')">关闭</button>
+          <button
+            v-if="props.canEditPolicy"
+            type="button"
+            class="button"
+            :disabled="!department || props.policySaving"
+            @click="savePolicy"
+          >
+            {{ props.policySaving ? '保存中…' : '保存默认策略' }}
+          </button>
+        </footer>
+      </aside>
+    </div>
+  </Teleport>
+</template>
+
+<style scoped>
+.drawer-mask {
+  position: fixed;
+  z-index: 50;
+  inset: 0;
+  display: flex;
+  justify-content: flex-end;
+  background: rgb(9 40 52 / 45%);
+}
+
+.permission-drawer {
+  display: flex;
+  width: min(720px, 96vw);
+  height: 100%;
+  flex-direction: column;
+  background: var(--card);
+  box-shadow: var(--sh-modal);
+  animation: slide-in 0.18s ease-out;
+}
+
+.drawer-header,
+.drawer-footer {
+  display: flex;
+  gap: 12px;
+  align-items: center;
+  padding: 18px 22px;
+}
+
+.drawer-header {
+  flex-shrink: 0;
+  border-bottom: 1px solid var(--line);
+}
+
+.drawer-header strong {
+  color: var(--ink);
+  font-size: 15px;
+}
+
+.drawer-header p,
+.section-heading p {
+  margin: 4px 0 0;
+  color: var(--mut);
+  font-size: 11.5px;
+}
+
+.close-button {
+  padding: 0 2px;
+  margin-left: auto;
+  color: var(--mut);
+  font-size: 24px;
+  line-height: 1;
+  background: transparent;
+}
+
+.close-button:hover {
+  color: var(--ink);
+}
+
+.drawer-body {
+  display: grid;
+  gap: 16px;
+  padding: 18px 22px;
+  overflow-y: auto;
+}
+
+.drawer-section {
+  padding: 16px;
+  border: 1px solid var(--line);
+  border-radius: 9px;
+}
+
+.section-heading {
+  display: flex;
+  gap: 12px;
+  align-items: flex-start;
+  justify-content: space-between;
+  margin-bottom: 14px;
+}
+
+.section-heading h2 {
+  margin: 0;
+  color: var(--ink);
+  font-size: 14px;
+}
+
+.section-meta {
+  flex-shrink: 0;
+  color: var(--mut);
+  font-size: 11.5px;
+}
+
+.policy-options {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 10px;
+}
+
+.policy-option {
+  display: flex;
+  gap: 9px;
+  align-items: flex-start;
+  min-height: 72px;
+  padding: 11px;
+  color: var(--ink);
+  text-align: left;
+  background: #f8fbfc;
+  border: 1px solid var(--line);
+  border-radius: 7px;
+}
+
+.policy-option:not(:disabled) {
+  cursor: pointer;
+}
+
+.policy-option.active {
+  background: var(--brand-l);
+  border-color: var(--brand);
+}
+
+.policy-option:disabled {
+  cursor: not-allowed;
+  opacity: 0.68;
+}
+
+.policy-switch {
+  position: relative;
+  display: block;
+  width: 36px;
+  height: 20px;
+  flex-shrink: 0;
+  margin-top: 1px;
+  background: #cbd8de;
+  border-radius: 20px;
+}
+
+.policy-switch i {
+  position: absolute;
+  top: 2px;
+  left: 2px;
+  width: 16px;
+  height: 16px;
+  background: #fff;
+  border-radius: 50%;
+  transition: left 0.2s ease;
+}
+
+.policy-option.active .policy-switch {
+  background: var(--ok);
+}
+
+.policy-option.active .policy-switch i {
+  left: 18px;
+}
+
+.policy-option strong,
+.policy-option small {
+  display: block;
+}
+
+.policy-option strong {
+  font-size: 12px;
+}
+
+.policy-option small {
+  margin-top: 4px;
+  color: var(--mut);
+  font-size: 10.5px;
+  line-height: 1.45;
+}
+
+.readonly-tip {
+  padding: 9px 10px;
+  margin: 10px 0 0;
+  color: var(--mut);
+  font-size: 11.5px;
+  background: #f8fbfc;
+  border-radius: 6px;
+}
+
+.empty-state {
+  padding: 24px 12px;
+  color: var(--mut);
+  font-size: 12px;
+  text-align: center;
+  background: #f8fbfc;
+  border-radius: 6px;
+}
+
+.template-section :deep(.permission-panel) {
+  gap: 12px;
+}
+
+.template-section :deep(.panel-toolbar) {
+  padding-bottom: 12px;
+}
+
+.drawer-footer {
+  flex-shrink: 0;
+  background: #f8fbfc;
+  border-top: 1px solid var(--line);
+}
+
+.footer-note {
+  flex: 1;
+  min-width: 0;
+  overflow: hidden;
+  color: var(--mut);
+  font-size: 11px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.button {
+  padding: 8px 16px;
+  color: #fff;
+  font-size: 12.5px;
+  font-weight: 700;
+  background: var(--brand);
+  border-radius: 7px;
+}
+
+.button--ghost {
+  color: var(--brand);
+  background: #fff;
+  border: 1px solid var(--brand);
+}
+
+.button:disabled {
+  cursor: not-allowed;
+  opacity: 0.55;
+}
+
+@keyframes slide-in {
+  from {
+    transform: translateX(18px);
+    opacity: 0;
+  }
+
+  to {
+    transform: translateX(0);
+    opacity: 1;
+  }
+}
+
+@media (max-width: 640px) {
+  .permission-drawer {
+    width: 100%;
+  }
+
+  .drawer-header,
+  .drawer-footer,
+  .drawer-body {
+    padding-right: 16px;
+    padding-left: 16px;
+  }
+
+  .policy-options {
+    grid-template-columns: 1fr;
+  }
+
+  .footer-note {
+    display: none;
+  }
+}
+</style>
diff --git a/clinical-web/src/views/management/document-permissions/components/DepartmentPermissionTable.vue b/clinical-web/src/views/management/document-permissions/components/DepartmentPermissionTable.vue
index f13cd0e..0339512 100644
--- a/clinical-web/src/views/management/document-permissions/components/DepartmentPermissionTable.vue
+++ b/clinical-web/src/views/management/document-permissions/components/DepartmentPermissionTable.vue
@@ -1,109 +1,71 @@
 <script setup lang="ts">
-import type {
-  PermissionCellState,
-  PermissionColumn,
-  PermissionKey,
-  DepartmentPermissionRow,
-} from '../types'
+import type { DepartmentPermissionRow } from '../types'
 
 const props = defineProps<{
   rows: DepartmentPermissionRow[]
-  columns: PermissionColumn[]
-  saving?: boolean
+  canEdit?: boolean
 }>()
 
 const emit = defineEmits<{
-  toggle: [departmentId: string, permission: PermissionKey]
+  adjust: [row: DepartmentPermissionRow]
 }>()
 
-function getState(row: DepartmentPermissionRow, permission: PermissionKey): PermissionCellState {
-  return (
-    row.permissionStates?.[permission] ?? (row.permissions[permission] ? 'direct-allow' : 'none')
-  )
-}
-
-function stateLabel(state: PermissionCellState) {
-  const labels: Record<PermissionCellState, string> = {
-    none: '未授权',
-    'direct-allow': '直接允许',
-    'direct-deny': '直接拒绝',
-    'inherited-allow': '继承允许',
-    'inherited-deny': '继承拒绝',
-  }
-  return labels[state]
-}
-
-function isDisabled(row: DepartmentPermissionRow, permission: PermissionKey) {
-  return props.saving || getState(row, permission) === 'inherited-deny'
+function policyLabel(enabled: boolean) {
+  return enabled ? '可用' : '不可见'
 }
 </script>
 
 <template>
-  <div v-if="!rows.length" class="empty-state">暂无科室数据</div>
-  <template v-else>
-    <div class="table-scroll">
-      <table class="permission-table" aria-label="按科室授权矩阵">
-        <thead>
-          <tr>
-            <th>科室</th>
-            <th
-              v-for="column in columns"
-              :key="column.key"
-              class="permission-heading"
-              :title="column.description"
+  <div v-if="!props.rows.length" class="empty-state">暂无科室默认策略</div>
+  <div v-else class="table-scroll">
+    <table class="permission-table" aria-label="按科室授权">
+      <thead>
+        <tr>
+          <th>科室</th>
+          <th>本科室文档</th>
+          <th>全院通用文档</th>
+          <th>其他科室文档</th>
+          <th>操作</th>
+        </tr>
+      </thead>
+      <tbody>
+        <tr v-for="row in props.rows" :key="row.id">
+          <td>
+            <div class="department-name">
+              <strong>{{ row.department }}</strong>
+              <small v-if="row.campus">{{ row.campus }}</small>
+            </div>
+          </td>
+          <td>
+            <span class="policy-tag" :class="row.own ? 'is-enabled' : 'is-disabled'">
+              {{ policyLabel(row.own) }}
+            </span>
+          </td>
+          <td>
+            <span class="policy-tag" :class="row.common ? 'is-enabled' : 'is-disabled'">
+              {{ policyLabel(row.common) }}
+            </span>
+          </td>
+          <td>
+            <span class="policy-tag" :class="row.other ? 'is-enabled' : 'is-disabled'">
+              {{ policyLabel(row.other) }}
+            </span>
+          </td>
+          <td class="operation-cell">
+            <button
+              v-if="props.canEdit"
+              type="button"
+              class="adjust-button"
+              @click="emit('adjust', row)"
             >
-              {{ column.label }}
-            </th>
-          </tr>
-        </thead>
-        <tbody>
-          <tr v-for="row in rows" :key="row.id">
-            <td>
-              <div class="department-name">
-                <strong>{{ row.department }}</strong>
-                <small v-if="row.campus">{{ row.campus }}</small>
-              </div>
-            </td>
-            <td v-for="column in columns" :key="column.key" class="permission-cell">
-              <button
-                type="button"
-                class="permission-toggle"
-                :class="{
-                  active: row.permissions[column.key],
-                  inherited: getState(row, column.key).startsWith('inherited'),
-                  denied: getState(row, column.key).endsWith('deny'),
-                }"
-                :disabled="isDisabled(row, column.key)"
-                :aria-pressed="row.permissions[column.key]"
-                :aria-label="
-                  row.department +
-                  '：' +
-                  column.label +
-                  '，' +
-                  stateLabel(getState(row, column.key))
-                "
-                :title="
-                  column.label +
-                  '：' +
-                  column.description +
-                  '（' +
-                  stateLabel(getState(row, column.key)) +
-                  '）'
-                "
-                @click="emit('toggle', row.id, column.key)"
-              >
-                <span class="switch-track" aria-hidden="true" />
-              </button>
-              <span class="state-label">{{ stateLabel(getState(row, column.key)) }}</span>
-            </td>
-          </tr>
-        </tbody>
-      </table>
-    </div>
-    <p class="legend">
-      继承允许可通过开关新增直接拒绝；继承拒绝由上级规则控制，当前接口不支持直接覆盖。
-    </p>
-  </template>
+              调整
+            </button>
+            <span v-else class="readonly-label">无调整权限</span>
+          </td>
+        </tr>
+      </tbody>
+    </table>
+  </div>
 </template>
 
 <style scoped>
@@ -114,15 +76,15 @@ function isDisabled(row: DepartmentPermissionRow, permission: PermissionKey) {
 
 .permission-table {
   width: 100%;
-  min-width: 680px;
-  font-size: 12.5px;
+  min-width: 760px;
+  font-size: 13px;
   border-collapse: collapse;
 }
 
 .permission-table th {
   padding: 9px 12px;
   color: var(--mut);
-  font-size: 12px;
+  font-size: 12.5px;
   font-weight: 700;
   text-align: left;
   white-space: nowrap;
@@ -130,10 +92,6 @@ function isDisabled(row: DepartmentPermissionRow, permission: PermissionKey) {
   border-bottom: 1px solid var(--line);
 }
 
-.permission-table th.permission-heading {
-  text-align: center;
-}
-
 .permission-table td {
   padding: 9px 12px;
   vertical-align: middle;
@@ -156,86 +114,46 @@ function isDisabled(row: DepartmentPermissionRow, permission: PermissionKey) {
   font-size: 11px;
 }
 
-.permission-cell {
-  width: 23%;
-  text-align: center;
-}
-
-.permission-toggle {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 44px;
-  height: 28px;
-  padding: 0;
-  vertical-align: middle;
-  background: transparent;
-  border-radius: 16px;
-}
-
-.permission-toggle:focus-visible {
-  outline: 2px solid var(--brand);
-  outline-offset: 2px;
-}
-
-.switch-track {
-  position: relative;
-  display: block;
-  width: 36px;
-  height: 20px;
-  background: #cbd8de;
-  border-radius: 20px;
-  transition: background-color 0.2s ease;
-}
-
-.switch-track::after {
-  position: absolute;
-  top: 2px;
-  left: 2px;
-  width: 16px;
-  height: 16px;
-  content: '';
-  background: #fff;
-  border-radius: 50%;
-  transition: left 0.2s ease;
-}
-
-.permission-toggle.active .switch-track {
-  background: var(--ok);
-}
-
-.permission-toggle.inherited.active .switch-track {
-  background: #4eaa8a;
-  box-shadow: inset 0 0 0 2px rgb(255 255 255 / 45%);
-}
-
-.permission-toggle.denied .switch-track {
-  background: #cbd8de;
-}
-
-.permission-toggle.active .switch-track::after {
-  left: 18px;
-}
-
-.permission-toggle:disabled {
-  cursor: not-allowed;
-  opacity: 0.58;
-}
-
-.state-label {
+.policy-tag {
   display: inline-block;
-  min-width: 52px;
-  margin-left: 3px;
-  color: var(--mut);
-  font-size: 10.5px;
-  text-align: left;
+  min-width: 48px;
+  padding: 2px 9px;
+  font-size: 11.5px;
+  font-weight: 700;
+  text-align: center;
+  border-radius: 20px;
 }
 
-.legend {
-  margin: 10px 0 0;
+.policy-tag.is-enabled {
+  color: var(--ok);
+  background: var(--ok-l);
+}
+
+.policy-tag.is-disabled {
+  color: #8a9aa3;
+  background: #eceef0;
+}
+
+.operation-cell {
+  white-space: nowrap;
+}
+
+.adjust-button {
+  padding: 4px 10px;
+  color: var(--brand);
+  font-size: 12px;
+  background: #fff;
+  border: 1px solid var(--brand);
+  border-radius: 5px;
+}
+
+.adjust-button:hover {
+  background: var(--brand-l);
+}
+
+.readonly-label {
   color: var(--mut);
-  font-size: 11px;
-  line-height: 1.6;
+  font-size: 11.5px;
 }
 
 .empty-state {
diff --git a/clinical-web/src/views/management/document-permissions/components/RolePermissionMatrix.vue b/clinical-web/src/views/management/document-permissions/components/RolePermissionMatrix.vue
index 49b2a57..4b37d67 100644
--- a/clinical-web/src/views/management/document-permissions/components/RolePermissionMatrix.vue
+++ b/clinical-web/src/views/management/document-permissions/components/RolePermissionMatrix.vue
@@ -10,6 +10,7 @@ const props = defineProps<{
   rows: RolePermissionRow[]
   columns: PermissionColumn[]
   saving?: boolean
+  canEdit?: boolean
 }>()
 
 const emit = defineEmits<{
@@ -34,7 +35,7 @@ function stateLabel(state: PermissionCellState) {
 }
 
 function isDisabled(row: RolePermissionRow, permission: PermissionKey) {
-  return props.saving || getState(row, permission) === 'inherited-deny'
+  return props.saving || props.canEdit === false || getState(row, permission) === 'inherited-deny'
 }
 </script>
 
diff --git a/clinical-web/src/views/management/document-permissions/components/TemplatePermissionPanel.vue b/clinical-web/src/views/management/document-permissions/components/TemplatePermissionPanel.vue
index a215528..4c6011c 100644
--- a/clinical-web/src/views/management/document-permissions/components/TemplatePermissionPanel.vue
+++ b/clinical-web/src/views/management/document-permissions/components/TemplatePermissionPanel.vue
@@ -13,7 +13,11 @@ const props = defineProps<{
   loading: boolean
   saving: boolean
   error: boolean
+  errorMessage?: string
+  catalogError?: string
+  catalogLoading?: boolean
   previewUserId: string
+  canEdit?: boolean
 }>()
 
 const emit = defineEmits<{
@@ -107,7 +111,7 @@ watch(
 <template>
   <section class="permission-panel">
     <div class="panel-toolbar">
-      <label class="template-select">
+      <label v-if="templates.length" class="template-select">
         <span>选择模板</span>
         <select :value="selectedTemplateId" @change="handleTemplateChange">
           <option value="" disabled>请选择模板</option>
@@ -116,6 +120,7 @@ watch(
           </option>
         </select>
       </label>
+      <span v-else class="template-empty-label">当前院区暂无可配置模板</span>
       <span v-if="selectedTemplate" class="template-meta">
         {{ selectedTemplate.code || selectedTemplate.id }} · {{ selectedTemplate.category }}
       </span>
@@ -130,10 +135,19 @@ watch(
       </label>
     </div>
 
-    <div v-if="!selectedTemplateId" class="empty-state">暂无模板，请先选择一个模板。</div>
+    <div v-if="catalogError" class="error-state">
+      <span>{{ catalogError }}</span>
+      <button type="button" class="retry-button" @click="emit('retry')">重新加载</button>
+    </div>
+    <div v-else-if="catalogLoading" class="loading-state">正在加载模板目录…</div>
+    <div v-else-if="!templates.length" class="empty-state">
+      暂无模板例外
+      <small>当前院区还没有可配置的文档模板。</small>
+    </div>
+    <div v-else-if="!selectedTemplateId" class="empty-state">请选择一个模板查看例外权限。</div>
     <div v-else-if="loading" class="loading-state">正在加载模板权限…</div>
     <div v-else-if="error" class="error-state">
-      <span>模板权限加载失败</span>
+      <span>{{ errorMessage || '模板权限加载失败，请稍后重试' }}</span>
       <button type="button" class="retry-button" @click="emit('retry')">重新加载</button>
     </div>
     <template v-else>
@@ -179,8 +193,14 @@ watch(
                   <button
                     type="button"
                     class="delete-button"
-                    :disabled="permission.inherited || saving"
-                    :title="permission.inherited ? '继承权限不可直接删除' : '删除权限'"
+                    :disabled="permission.inherited || saving || props.canEdit === false"
+                    :title="
+                      permission.inherited
+                        ? '继承权限不可直接删除'
+                        : props.canEdit === false
+                          ? '当前账号无直接权限修改权限'
+                          : '删除权限'
+                    "
                     @click="deletePermission(permission.id)"
                   >
                     删除
@@ -193,7 +213,7 @@ watch(
         <p v-else class="empty-state compact">当前模板暂无直接权限配置。</p>
       </div>
 
-      <form class="add-form" @submit.prevent="submit">
+      <form v-if="props.canEdit !== false" class="add-form" @submit.prevent="submit">
         <div class="list-heading">
           <span>新增权限</span>
           <span>服务端会再次校验授权范围</span>
@@ -237,6 +257,7 @@ watch(
           </button>
         </div>
       </form>
+      <p v-else class="readonly-tip">当前账号仅可查看模板例外，新增和删除操作已禁用。</p>
     </template>
   </section>
 </template>
@@ -299,6 +320,12 @@ select:disabled {
   font-size: 11.5px;
 }
 
+.template-empty-label {
+  padding-bottom: 8px;
+  color: var(--mut);
+  font-size: 12px;
+}
+
 .list-heading {
   display: flex;
   gap: 12px;
@@ -406,6 +433,13 @@ td {
   text-align: center;
 }
 
+.empty-state small {
+  display: block;
+  margin-top: 5px;
+  color: var(--mut);
+  font-size: 11px;
+}
+
 .error-state {
   display: flex;
   gap: 10px;
@@ -435,6 +469,15 @@ td {
   background: #f8fbfc;
 }
 
+.readonly-tip {
+  padding: 10px 12px;
+  margin: 0;
+  color: var(--mut);
+  font-size: 11.5px;
+  background: #f8fbfc;
+  border-radius: 6px;
+}
+
 @media (max-width: 960px) {
   .form-grid {
     grid-template-columns: repeat(2, minmax(0, 1fr));
diff --git a/clinical-web/src/views/management/document-permissions/index.vue b/clinical-web/src/views/management/document-permissions/index.vue
index ec331c4..693343c 100644
--- a/clinical-web/src/views/management/document-permissions/index.vue
+++ b/clinical-web/src/views/management/document-permissions/index.vue
@@ -1,66 +1,353 @@
 <script setup lang="ts">
-import { computed, onMounted, ref } from 'vue'
+import { computed, onMounted, ref, watch } from 'vue'
 import { ElMessage } from 'element-plus'
 
-import { getAllDepartments } from '@/api/management/organization'
-import { getTemplatePermissionConfig } from '@/api/management/documents'
 import {
-  batchSaveTemplatePermissions,
-  getTemplatePermissions,
+  getPermissionPolicies,
   getTemplatePermissionMatrix,
+  getTemplatePermissions,
   isPermissionMockEnabled,
+  batchSaveTemplatePermissions,
+  updateDepartmentPermissionPolicy,
+  updateRolePermissionPolicy,
 } from '@/api/management/document-permissions'
+import { getTemplatePermissionConfig } from '@/api/management/documents'
 import { getUsers } from '@/api/management/users'
-import { getRoleSummaries, getRoles } from '@/api/management/roles'
 import type {
+  DepartmentPermissionPolicyRecord,
   DepartmentRecord,
   DocumentRecord,
+  PermissionPoliciesRecord,
+  PermissionPolicyLevel,
+  RolePermissionPolicyRecord,
   RoleRecord,
   TemplatePermissionBatchItemRequest,
   TemplatePermissionRecord,
   UserRecord,
 } from '@/api/management/types'
+import { useAppStore } from '@/stores/app'
+import { useLoginStore } from '@/stores/login'
 
+import DepartmentPermissionDrawer from './components/DepartmentPermissionDrawer.vue'
 import DepartmentPermissionTable from './components/DepartmentPermissionTable.vue'
 import RolePermissionMatrix from './components/RolePermissionMatrix.vue'
-import TemplatePermissionPanel from './components/TemplatePermissionPanel.vue'
-import { departmentPermissionRows, permissionColumns, rolePermissionRows } from './mock'
+import { permissionColumns } from './mock'
 import type {
   DepartmentPermissionRow,
-  PermissionCellState,
   PermissionKey,
   PermissionSubjectOption,
   RolePermissionRow,
   TemplatePermissionForm,
 } from './types'
 
-type PermissionSubjectType = 'ROLE' | 'DEPARTMENT' | 'USER'
+const policyReadPermissions = [
+  'sign:template:permission:query',
+  'system:template:permission:query',
+  'system:template:permission:update',
+  'system:template:permission:manage',
+  'system:document:permission:query',
+  'system:document:permission:update',
+  'system:document:permission:manage',
+  'system:document-permission:query',
+  'system:document-permission:update',
+  'system:document-permission:manage',
+] as const
 
-interface PermissionResolution {
-  enabled: boolean
-  state: PermissionCellState
-}
-
-const permissionKeys: PermissionKey[] = ['VIEW', 'USE', 'MAINTAIN']
+const policyWritePermissions = [
+  'sign:template:permission:maintain',
+  'system:template:permission:update',
+  'system:template:permission:manage',
+  'system:document:permission:update',
+  'system:document:permission:manage',
+  'system:document-permission:update',
+  'system:document-permission:manage',
+] as const
 
+const appStore = useAppStore()
+const loginStore = useLoginStore()
 const loading = ref(true)
+const policyError = ref('')
+const policies = ref<PermissionPoliciesRecord | null>(null)
 const roleRecords = ref<RoleRecord[]>([])
 const departmentRecords = ref<DepartmentRecord[]>([])
 const userRecords = ref<UserRecord[]>([])
 const roleRows = ref<RolePermissionRow[]>([])
 const departmentRows = ref<DepartmentPermissionRow[]>([])
+const templateCount = ref(0)
+const defaultSavingId = ref('')
+
+const departmentDrawerVisible = ref(false)
+const selectedDepartment = ref<DepartmentPermissionRow | null>(null)
 const templates = ref<DocumentRecord[]>([])
+const templatesLoaded = ref(false)
+const templateCatalogLoading = ref(false)
+const templateCatalogError = ref('')
 const selectedTemplateId = ref('')
 const templatePermissions = ref<TemplatePermissionRecord[]>([])
-const permissionLoading = ref(false)
-const permissionSaving = ref(false)
-const permissionError = ref(false)
+const templatePermissionLoading = ref(false)
+const templatePermissionSaving = ref(false)
+const templatePermissionError = ref(false)
+const templatePermissionErrorMessage = ref('')
 const permissionPreviewUserId = ref('')
-let permissionRequestId = 0
+const subjectsLoaded = ref(false)
+let templatePermissionRequestId = 0
+let templateCatalogRequest: Promise<void> | null = null
+let subjectRequest: Promise<void> | null = null
 
-const selectedTemplate = computed(() =>
-  templates.value.find((template) => template.id === selectedTemplateId.value),
+const canViewPolicy = computed(
+  () => isPermissionMockEnabled || hasAnyPermission(policyReadPermissions),
 )
+const canEditPolicy = computed(
+  () => isPermissionMockEnabled || hasAnyPermission(policyWritePermissions),
+)
+const canViewTemplateExceptions = computed(() => canViewPolicy.value)
+const canEditTemplateExceptions = computed(() => canEditPolicy.value)
+
+function hasAnyPermission(codes: readonly string[]) {
+  return codes.some((code) => loginStore.hasPermission(code))
+}
+
+function formatError(error: unknown, fallback: string) {
+  return error instanceof Error && error.message ? `${fallback}：${error.message}` : fallback
+}
+
+function mapRoleRecord(policy: RolePermissionPolicyRecord, index: number): RoleRecord {
+  return {
+    id: policy.roleId,
+    code: policy.code,
+    name: policy.name,
+    description: policy.description,
+    color: ['#6b5bd2', '#0e6e8c', '#0f9d6c', '#d9821f', '#c65d5d'][index % 5],
+    userCount: policy.userCount ?? undefined,
+    status: 'ENABLED',
+    version: policy.version,
+  }
+}
+
+function mapRoleRow(policy: RolePermissionPolicyRecord, index: number): RolePermissionRow {
+  return {
+    id: policy.roleId,
+    name: policy.name,
+    color: ['#6b5bd2', '#0e6e8c', '#0f9d6c', '#d9821f', '#c65d5d'][index % 5],
+    description: policy.description,
+    userCount: policy.userCount ?? 0,
+    permissions: {
+      VIEW: policy.view,
+      USE: policy.use,
+      MAINTAIN: policy.maintain,
+    },
+    permissionStates: {
+      VIEW: policy.view ? 'direct-allow' : 'none',
+      USE: policy.use ? 'direct-allow' : 'none',
+      MAINTAIN: policy.maintain ? 'direct-allow' : 'none',
+    },
+    version: policy.version,
+  }
+}
+
+function mapDepartmentRow(policy: DepartmentPermissionPolicyRecord): DepartmentPermissionRow {
+  const campusName = appStore.campusRecords.find((campus) => campus.id === policy.campusId)?.name
+
+  return {
+    id: policy.departmentId,
+    code: policy.code,
+    department: policy.name,
+    campus:
+      campusName || (policy.campusId === policies.value?.campusId ? appStore.selectedCampus : ''),
+    campusId: policy.campusId,
+    own: policy.own,
+    common: policy.common,
+    other: policy.other,
+    version: policy.version,
+  }
+}
+
+function syncPolicyRows(policy: PermissionPoliciesRecord) {
+  policies.value = policy
+  templateCount.value = policy.templateCount
+  roleRecords.value = policy.roles.map(mapRoleRecord)
+  departmentRecords.value = policy.departments.map((department) => ({
+    id: department.departmentId,
+    campusId: department.campusId || policy.campusId,
+    code: department.code,
+    name: department.name,
+    status: 'ENABLED',
+    sortNo: 0,
+  }))
+  roleRows.value = policy.roles.map(mapRoleRow)
+  departmentRows.value = policy.departments.map(mapDepartmentRow)
+}
+
+async function loadPolicies() {
+  loading.value = true
+  policyError.value = ''
+
+  try {
+    if (!isPermissionMockEnabled) {
+      await loginStore.ensureCurrentUser()
+      if (!canViewPolicy.value) {
+        policyError.value = '当前账号没有文档权限配置的查看权限'
+        return
+      }
+      await appStore.loadCampuses()
+    }
+
+    const policy = await getPermissionPolicies(appStore.selectedCampusId || undefined)
+    syncPolicyRows(policy)
+  } catch (error: unknown) {
+    roleRecords.value = []
+    departmentRecords.value = []
+    roleRows.value = []
+    departmentRows.value = []
+    policyError.value = formatError(error, '默认权限策略加载失败，请稍后重试')
+  } finally {
+    loading.value = false
+  }
+}
+
+async function getAllTemplatesForPermission(campusId?: string) {
+  const firstPage = await getTemplatePermissionConfig({
+    page: 1,
+    pageSize: 200,
+    status: 'all',
+    campusId,
+  })
+  const pageSize = Math.max(firstPage.pageSize, 1)
+  const pageCount = Math.ceil(firstPage.total / pageSize)
+
+  if (pageCount <= 1) {
+    return firstPage.records
+  }
+
+  const remainingPages = await Promise.all(
+    Array.from({ length: pageCount - 1 }, (_, index) =>
+      getTemplatePermissionConfig({
+        page: index + 2,
+        pageSize,
+        status: 'all',
+        campusId,
+      }),
+    ),
+  )
+
+  return [firstPage, ...remainingPages].flatMap((page) => page.records)
+}
+
+async function loadTemplateCatalog() {
+  if (templateCatalogRequest) {
+    return templateCatalogRequest
+  }
+
+  templateCatalogLoading.value = true
+  templateCatalogError.value = ''
+  const campusId = appStore.selectedCampusId || policies.value?.campusId || undefined
+  const request = getAllTemplatesForPermission(campusId)
+    .then((records) => {
+      templates.value = records
+      templatesLoaded.value = true
+      if (!records.some((template) => template.id === selectedTemplateId.value)) {
+        selectedTemplateId.value = records[0]?.id ?? ''
+        templatePermissions.value = []
+      }
+    })
+    .catch((error: unknown) => {
+      templates.value = []
+      selectedTemplateId.value = ''
+      templatesLoaded.value = false
+      templateCatalogError.value = formatError(error, '模板例外目录加载失败，请稍后重试')
+    })
+    .finally(() => {
+      templateCatalogLoading.value = false
+      templateCatalogRequest = null
+    })
+
+  templateCatalogRequest = request
+  return request
+}
+
+async function getAllTemplatePermissionMatrix(templateId: string) {
+  const firstPage = await getTemplatePermissionMatrix({
+    page: 1,
+    pageSize: 200,
+    templateId,
+  })
+  const pageSize = Math.max(firstPage.pageSize, 1)
+  const pageCount = Math.ceil(firstPage.total / pageSize)
+
+  if (pageCount <= 1) {
+    return firstPage.records
+  }
+
+  const remainingPages = await Promise.all(
+    Array.from({ length: pageCount - 1 }, (_, index) =>
+      getTemplatePermissionMatrix({
+        page: index + 2,
+        pageSize,
+        templateId,
+      }),
+    ),
+  )
+
+  return [firstPage, ...remainingPages].flatMap((page) => page.records)
+}
+
+async function getAllUsersForPermission() {
+  const campusId = appStore.selectedCampusId || policies.value?.campusId || undefined
+  const firstPage = await getUsers({
+    page: 1,
+    pageSize: 200,
+    status: 'all',
+    ...(isPermissionMockEnabled || !campusId ? {} : { campusId }),
+  })
+  const pageSize = Math.max(firstPage.pageSize, 1)
+  const pageCount = Math.ceil(firstPage.total / pageSize)
+
+  if (pageCount <= 1) {
+    return firstPage.records
+  }
+
+  const remainingPages = await Promise.all(
+    Array.from({ length: pageCount - 1 }, (_, index) =>
+      getUsers({
+        page: index + 2,
+        pageSize,
+        status: 'all',
+        ...(isPermissionMockEnabled || !campusId ? {} : { campusId }),
+      }),
+    ),
+  )
+
+  return [firstPage, ...remainingPages].flatMap((page) => page.records)
+}
+
+async function loadTemplateSubjects() {
+  if (subjectsLoaded.value) {
+    return
+  }
+
+  if (subjectRequest) {
+    return subjectRequest
+  }
+
+  const request = getAllUsersForPermission()
+    .then((records) => {
+      userRecords.value = records
+      subjectsLoaded.value = true
+      if (!records.some((user) => user.id === permissionPreviewUserId.value)) {
+        permissionPreviewUserId.value = ''
+      }
+    })
+    .catch(() => {
+      userRecords.value = []
+      ElMessage.warning('用户授权对象加载失败，当前只能配置角色和科室例外')
+    })
+    .finally(() => {
+      subjectRequest = null
+    })
+
+  subjectRequest = request
+  return request
+}
 
 const templateSubjects = computed<PermissionSubjectOption[]>(() => [
   ...roleRecords.value.map((role) => ({
@@ -80,118 +367,6 @@ const templateSubjects = computed<PermissionSubjectOption[]>(() => [
   })),
 ])
 
-function resolvePermission(
-  subjectType: PermissionSubjectType,
-  subjectId: string,
-  permission: PermissionKey,
-): PermissionResolution {
-  const records = templatePermissions.value.filter(
-    (record) =>
-      record.subjectType === subjectType &&
-      record.subjectId === subjectId &&
-      record.permissionLevel === permission,
-  )
-  const hasDirectDeny = records.some((record) => !record.inherited && record.effect === 'DENY')
-  const hasDirectAllow = records.some((record) => !record.inherited && record.effect === 'ALLOW')
-  const hasInheritedDeny = records.some((record) => record.inherited && record.effect === 'DENY')
-  const hasInheritedAllow = records.some((record) => record.inherited && record.effect === 'ALLOW')
-
-  if (hasInheritedDeny) {
-    return { enabled: false, state: 'inherited-deny' }
-  }
-
-  if (hasDirectDeny) {
-    return { enabled: false, state: 'direct-deny' }
-  }
-
-  if (hasDirectAllow) {
-    return { enabled: true, state: 'direct-allow' }
-  }
-
-  if (hasInheritedAllow) {
-    return { enabled: true, state: 'inherited-allow' }
-  }
-
-  return { enabled: false, state: 'none' }
-}
-
-function buildPermissionMaps(subjectType: PermissionSubjectType, subjectId: string) {
-  const permissions = {} as Record<PermissionKey, boolean>
-  const permissionStates = {} as Record<PermissionKey, PermissionCellState>
-
-  for (const permission of permissionKeys) {
-    const resolution = resolvePermission(subjectType, subjectId, permission)
-    permissions[permission] = resolution.enabled
-    permissionStates[permission] = resolution.state
-  }
-
-  return { permissions, permissionStates }
-}
-
-function syncPermissionRows() {
-  roleRows.value = roleRecords.value.map((role, index) => ({
-    id: role.id,
-    name: role.name,
-    color: role.color ?? ['#6b5bd2', '#0e6e8c', '#0f9d6c', '#d9821f'][index % 4],
-    description: role.description,
-    userCount:
-      role.userCount ?? userRecords.value.filter((user) => user.roleIds?.includes(role.id)).length,
-    ...buildPermissionMaps('ROLE', role.id),
-  }))
-
-  departmentRows.value = departmentRecords.value.map((department) => ({
-    id: department.id,
-    department: department.name,
-    ...buildPermissionMaps('DEPARTMENT', department.id),
-  }))
-}
-
-async function getAllTemplatesForPermission() {
-  const firstPage = await getTemplatePermissionConfig({ page: 1, pageSize: 200, status: 'all' })
-  const pageCount = Math.ceil(firstPage.total / firstPage.pageSize)
-
-  if (pageCount <= 1) {
-    return firstPage.records
-  }
-
-  const remainingPages = await Promise.all(
-    Array.from({ length: pageCount - 1 }, (_, index) =>
-      getTemplatePermissionConfig({
-        page: index + 2,
-        pageSize: firstPage.pageSize,
-        status: 'all',
-      }),
-    ),
-  )
-
-  return [firstPage, ...remainingPages].flatMap((page) => page.records)
-}
-
-async function getAllTemplatePermissionMatrix(templateId: string) {
-  const firstPage = await getTemplatePermissionMatrix({
-    page: 1,
-    pageSize: 200,
-    templateId,
-  })
-  const pageCount = Math.ceil(firstPage.total / firstPage.pageSize)
-
-  if (pageCount <= 1) {
-    return firstPage.records
-  }
-
-  const remainingPages = await Promise.all(
-    Array.from({ length: pageCount - 1 }, (_, index) =>
-      getTemplatePermissionMatrix({
-        page: index + 2,
-        pageSize: firstPage.pageSize,
-        templateId,
-      }),
-    ),
-  )
-
-  return [firstPage, ...remainingPages].flatMap((page) => page.records)
-}
-
 function mergeTemplatePermissions(
   matrixRecords: TemplatePermissionRecord[],
   effectiveRecords: TemplatePermissionRecord[],
@@ -219,123 +394,21 @@ function mergeTemplatePermissions(
   )
 }
 
-async function getRolesForPermission(): Promise<{
-  records: RoleRecord[]
-  usedFallback: boolean
-}> {
-  try {
-    return { records: await getRoleSummaries(), usedFallback: false }
-  } catch (summaryError) {
-    try {
-      return {
-        records: await getRoles({ page: 1, pageSize: 200 }),
-        usedFallback: true,
-      }
-    } catch {
-      throw summaryError
-    }
-  }
-}
-
-async function getAllUsersForPermission() {
-  const firstPage = await getUsers({ page: 1, pageSize: 200, status: 'all' })
-  const pageCount = Math.ceil(firstPage.total / firstPage.pageSize)
-
-  if (pageCount <= 1) {
-    return firstPage.records
-  }
-
-  const remainingPages = await Promise.all(
-    Array.from({ length: pageCount - 1 }, (_, index) =>
-      getUsers({ page: index + 2, pageSize: 200, status: 'all' }),
-    ),
-  )
-
-  return [firstPage, ...remainingPages].flatMap((page) => page.records)
-}
-
-async function loadPermissions() {
-  loading.value = true
-
-  try {
-    if (isPermissionMockEnabled) {
-      roleRows.value = rolePermissionRows.map((role) => ({
-        ...role,
-        permissions: { ...role.permissions },
-      }))
-      departmentRows.value = departmentPermissionRows.map((row) => ({
-        ...row,
-        permissions: { ...row.permissions },
-      }))
-      return
-    }
-
-    const [templatesResult, rolesResult, departmentsResult, usersResult] = await Promise.allSettled(
-      [
-        getAllTemplatesForPermission(),
-        getRolesForPermission(),
-        getAllDepartments(),
-        getAllUsersForPermission(),
-      ],
-    )
-
-    if (templatesResult.status === 'rejected') {
-      throw templatesResult.reason
-    }
-
-    templates.value = templatesResult.value
-    roleRecords.value = rolesResult.status === 'fulfilled' ? rolesResult.value.records : []
-    departmentRecords.value =
-      departmentsResult.status === 'fulfilled' ? departmentsResult.value : []
-    userRecords.value = usersResult.status === 'fulfilled' ? usersResult.value : []
-    syncPermissionRows()
-
-    if (
-      rolesResult.status === 'rejected' ||
-      departmentsResult.status === 'rejected' ||
-      usersResult.status === 'rejected'
-    ) {
-      ElMessage.warning('角色、科室或用户列表加载不完整，部分授权对象暂不可配置')
-    } else if (rolesResult.value.usedFallback) {
-      ElMessage.warning('角色人数统计接口暂不可用，已回退到角色列表，人数仅按当前用户列表估算')
-    }
-
-    if (!userRecords.value.some((user) => user.id === permissionPreviewUserId.value)) {
-      permissionPreviewUserId.value = ''
-    }
-
-    if (!templates.value.some((template) => template.id === selectedTemplateId.value)) {
-      selectedTemplateId.value = templates.value[0]?.id ?? ''
-    }
-    await loadTemplatePermissions()
-  } catch {
-    roleRecords.value = []
-    departmentRecords.value = []
-    userRecords.value = []
-    roleRows.value = []
-    departmentRows.value = []
-    templates.value = []
-    templatePermissions.value = []
-    permissionError.value = false
-    ElMessage.error('权限配置加载失败，请稍后重试')
-  } finally {
-    loading.value = false
-  }
-}
-
 async function loadTemplatePermissions() {
   const templateId = selectedTemplateId.value
-  const requestId = ++permissionRequestId
+  const requestId = ++templatePermissionRequestId
 
-  if (!templateId || isPermissionMockEnabled) {
+  if (!templateId || !templatesLoaded.value || !canViewTemplateExceptions.value) {
     templatePermissions.value = []
-    permissionError.value = false
-    permissionLoading.value = false
+    templatePermissionError.value = false
+    templatePermissionErrorMessage.value = ''
+    templatePermissionLoading.value = false
     return
   }
 
-  permissionLoading.value = true
-  permissionError.value = false
+  templatePermissionLoading.value = true
+  templatePermissionError.value = false
+  templatePermissionErrorMessage.value = ''
 
   try {
     const [matrixResult, effectiveResult] = await Promise.allSettled([
@@ -347,7 +420,7 @@ async function loadTemplatePermissions() {
       throw matrixResult.reason
     }
 
-    if (requestId !== permissionRequestId || templateId !== selectedTemplateId.value) {
+    if (requestId !== templatePermissionRequestId || templateId !== selectedTemplateId.value) {
       return
     }
 
@@ -355,171 +428,211 @@ async function loadTemplatePermissions() {
       matrixResult.value,
       effectiveResult.status === 'fulfilled' ? effectiveResult.value : [],
     )
-    syncPermissionRows()
 
     if (effectiveResult.status === 'rejected') {
-      ElMessage.warning('用户继承权限预览加载失败，当前仅展示矩阵权限数据')
+      ElMessage.warning('继承权限预览加载失败，当前仅展示模板矩阵数据')
     }
-  } catch {
-    if (requestId !== permissionRequestId) {
+  } catch (error: unknown) {
+    if (requestId !== templatePermissionRequestId) {
       return
     }
 
     templatePermissions.value = []
-    permissionError.value = true
-    syncPermissionRows()
-    ElMessage.error('模板权限加载失败，请稍后重试')
+    templatePermissionError.value = true
+    templatePermissionErrorMessage.value = formatError(error, '模板权限加载失败，请稍后重试')
   } finally {
-    if (requestId === permissionRequestId) {
-      permissionLoading.value = false
+    if (requestId === templatePermissionRequestId) {
+      templatePermissionLoading.value = false
     }
   }
 }
 
-function toggleRolePermission(roleId: string, permission: PermissionKey) {
-  if (isPermissionMockEnabled) {
-    const role = roleRows.value.find((item) => item.id === roleId)
-    if (role) {
-      role.permissions[permission] = !role.permissions[permission]
-      ElMessage.info('演示数据已调整，真实环境将通过权限接口保存')
-    }
+async function prepareDepartmentDrawer() {
+  await Promise.all([loadTemplateCatalog(), loadTemplateSubjects()])
+  await loadTemplatePermissions()
+}
+
+function openDepartmentDrawer(row: DepartmentPermissionRow) {
+  if (!canEditPolicy.value && !canViewPolicy.value) {
     return
   }
 
-  void setSubjectPermission('ROLE', roleId, permission)
+  selectedDepartment.value = row
+  departmentDrawerVisible.value = true
+  void prepareDepartmentDrawer()
 }
 
-function toggleDepartmentPermission(departmentId: string, permission: PermissionKey) {
-  if (isPermissionMockEnabled) {
-    const row = departmentRows.value.find((item) => item.id === departmentId)
-    if (row) {
-      row.permissions[permission] = !row.permissions[permission]
-      ElMessage.info('演示数据已调整，真实环境将通过权限接口保存')
-    }
+const policyLevelRank: Record<PermissionPolicyLevel, number> = {
+  NONE: 0,
+  VIEW: 1,
+  USE: 2,
+  MAINTAIN: 3,
+}
+
+function policyLevelForPermissions(
+  permissions: Record<PermissionKey, boolean>,
+): PermissionPolicyLevel {
+  if (permissions.MAINTAIN) return 'MAINTAIN'
+  if (permissions.USE) return 'USE'
+  if (permissions.VIEW) return 'VIEW'
+  return 'NONE'
+}
+
+function toggleRolePolicy(roleId: string, permission: PermissionKey) {
+  if (!canEditPolicy.value || defaultSavingId.value) {
     return
   }
 
-  void setSubjectPermission('DEPARTMENT', departmentId, permission)
+  const row = roleRows.value.find((item) => item.id === roleId)
+  const source = policies.value?.roles.find((item) => item.roleId === roleId)
+
+  if (!row || !source) {
+    return
+  }
+
+  const nextPermissions = { ...row.permissions }
+  const permissionIndex: Record<PermissionKey, number> = { VIEW: 0, USE: 1, MAINTAIN: 2 }
+  const nextIndex = permissionIndex[permission]
+  const currentLevel = policyLevelForPermissions(nextPermissions)
+  const currentIndex = policyLevelRank[currentLevel] - 1
+  const nextLevel: PermissionPolicyLevel = row.permissions[permission]
+    ? nextIndex <= currentIndex
+      ? (['NONE', 'VIEW', 'USE'] as const)[nextIndex]
+      : currentLevel
+    : permission
+
+  Object.assign(nextPermissions, {
+    VIEW: policyLevelRank[nextLevel] >= policyLevelRank.VIEW,
+    USE: policyLevelRank[nextLevel] >= policyLevelRank.USE,
+    MAINTAIN: policyLevelRank[nextLevel] >= policyLevelRank.MAINTAIN,
+  })
+  const payload = {
+    campusId: source.campusId || policies.value?.campusId || appStore.selectedCampusId,
+    permissionLevel: nextLevel,
+    expectedVersion: source.version,
+  }
+
+  defaultSavingId.value = roleId
+  void updateRolePermissionPolicy(roleId, payload, source)
+    .then((updated) => {
+      const nextRoles = (policies.value?.roles ?? []).map((item) =>
+        item.roleId === roleId ? updated : item,
+      )
+      syncPolicyRows({
+        ...(policies.value as PermissionPoliciesRecord),
+        roles: nextRoles,
+      })
+      ElMessage.success('角色默认策略已保存')
+    })
+    .catch((error: unknown) => {
+      ElMessage.error(formatError(error, '角色默认策略保存失败，请稍后重试'))
+    })
+    .finally(() => {
+      defaultSavingId.value = ''
+    })
 }
 
-async function applyTemplatePermission(
-  templateId: string,
-  subjectType: PermissionSubjectType,
-  subjectId: string,
-  permission: PermissionKey,
-  enabled: boolean,
-) {
-  const operations: TemplatePermissionBatchItemRequest[] = []
-  const matchingRecords = templatePermissions.value.filter(
-    (record) =>
-      record.subjectType === subjectType &&
-      record.subjectId === subjectId &&
-      record.permissionLevel === permission,
-  )
-  const directAllows = matchingRecords.filter(
-    (record) => !record.inherited && record.effect === 'ALLOW',
-  )
-  const directDenies = matchingRecords.filter(
-    (record) => !record.inherited && record.effect === 'DENY',
-  )
-  const inheritedAllows = matchingRecords.some(
-    (record) => record.inherited && record.effect === 'ALLOW',
-  )
+function mapRowToDepartmentPolicy(row: DepartmentPermissionRow): DepartmentPermissionPolicyRecord {
+  return {
+    departmentId: row.id,
+    code: row.code ?? row.id,
+    name: row.department,
+    campusId: row.campusId ?? policies.value?.campusId ?? '',
+    own: row.own,
+    common: row.common,
+    other: row.other,
+    ownPermission: row.own ? 'USE' : 'NONE',
+    commonPermission: row.common ? 'USE' : 'NONE',
+    otherPermission: row.other ? 'USE' : 'NONE',
+    version: row.version,
+  }
+}
 
-  if (enabled) {
-    for (const binding of directDenies) {
-      if (!binding.id) {
-        throw new Error('该直接拒绝权限缺少绑定 ID，无法撤销')
+function saveDepartmentPolicy(payload: {
+  own: boolean
+  common: boolean
+  other: boolean
+  expectedVersion?: number
+}) {
+  const row = selectedDepartment.value
+
+  if (!row || !canEditPolicy.value || defaultSavingId.value) {
+    return
+  }
+
+  defaultSavingId.value = row.id
+  void updateDepartmentPermissionPolicy(
+    row.id,
+    {
+      campusId: row.campusId ?? policies.value?.campusId ?? appStore.selectedCampusId,
+      ownPermission: payload.own ? 'USE' : 'NONE',
+      commonPermission: payload.common ? 'USE' : 'NONE',
+      otherPermission: payload.other ? 'USE' : 'NONE',
+      expectedVersion: payload.expectedVersion,
+    },
+    mapRowToDepartmentPolicy(row),
+  )
+    .then((updated) => {
+      const nextDepartments = (policies.value?.departments ?? []).map((item) =>
+        item.departmentId === row.id ? updated : item,
+      )
+      const nextPolicy = {
+        ...(policies.value as PermissionPoliciesRecord),
+        departments: nextDepartments,
       }
-      operations.push({
-        templateId,
-        action: 'REVOKE',
-        permissionId: binding.id,
-      })
-    }
-
-    if (!directAllows.length && !inheritedAllows) {
-      operations.push({
-        templateId,
-        action: 'ADD',
-        subjectType,
-        subjectId,
-        permissionLevel: permission,
-        effect: 'ALLOW',
-      })
-    }
-  } else {
-    for (const binding of directAllows) {
-      if (!binding.id) {
-        throw new Error('该直接允许权限缺少绑定 ID，无法撤销')
-      }
-      operations.push({
-        templateId,
-        action: 'REVOKE',
-        permissionId: binding.id,
-      })
-    }
-
-    if (!directDenies.length && inheritedAllows) {
-      operations.push({
-        templateId,
-        action: 'ADD',
-        subjectType,
-        subjectId,
-        permissionLevel: permission,
-        effect: 'DENY',
-      })
-    }
-  }
-
-  if (operations.length) {
-    await batchSaveTemplatePermissions({ operations })
-  }
+      syncPolicyRows(nextPolicy)
+      selectedDepartment.value = departmentRows.value.find((item) => item.id === row.id) ?? null
+      ElMessage.success('科室默认策略已保存')
+    })
+    .catch((error: unknown) => {
+      ElMessage.error(formatError(error, '科室默认策略保存失败，请稍后重试'))
+    })
+    .finally(() => {
+      defaultSavingId.value = ''
+    })
 }
 
-async function setSubjectPermission(
-  subjectType: PermissionSubjectType,
-  subjectId: string,
-  permission: PermissionKey,
-) {
-  if (!selectedTemplateId.value || permissionSaving.value || permissionError.value) {
+function handleTemplateChange(templateId: string) {
+  if (!templates.value.some((template) => template.id === templateId)) {
     return
   }
 
-  const current = resolvePermission(subjectType, subjectId, permission)
+  selectedTemplateId.value = templateId
+  templatePermissions.value = []
+  void loadTemplatePermissions()
+}
 
-  if (current.state === 'inherited-deny') {
-    ElMessage.warning('该权限由上级规则拒绝，当前接口不支持直接覆盖')
+function handlePreviewUserChange(userId: string) {
+  permissionPreviewUserId.value = userId
+  void loadTemplatePermissions()
+}
+
+function retryTemplatePermissions() {
+  if (templateCatalogError.value) {
+    templatesLoaded.value = false
+    void loadTemplateCatalog().then(loadTemplatePermissions)
     return
   }
 
-  const nextEnabled = !current.enabled
-  permissionSaving.value = true
-
-  try {
-    await applyTemplatePermission(
-      selectedTemplateId.value,
-      subjectType,
-      subjectId,
-      permission,
-      nextEnabled,
-    )
-    await loadTemplatePermissions()
-    ElMessage.success(nextEnabled ? '权限已开启' : '权限已关闭')
-  } catch (error) {
-    ElMessage.error(error instanceof Error ? error.message : '权限调整失败，请稍后重试')
-  } finally {
-    permissionSaving.value = false
-  }
+  void loadTemplatePermissions()
 }
 
 async function addTemplatePermission(form: TemplatePermissionForm) {
-  if (!selectedTemplateId.value || permissionSaving.value || permissionError.value) {
+  if (
+    !selectedTemplateId.value ||
+    templatePermissionSaving.value ||
+    templatePermissionError.value ||
+    !canEditTemplateExceptions.value
+  ) {
     return
   }
 
-  permissionSaving.value = true
+  if (isPermissionMockEnabled) {
+    ElMessage.info('演示模式不保存模板例外；真实环境会提交权限批量接口')
+    return
+  }
 
+  templatePermissionSaving.value = true
   try {
     await batchSaveTemplatePermissions({
       operations: [
@@ -531,60 +644,75 @@ async function addTemplatePermission(form: TemplatePermissionForm) {
       ],
     })
     await loadTemplatePermissions()
-    ElMessage.success('模板权限已添加')
-  } catch (error) {
-    ElMessage.error(error instanceof Error ? error.message : '模板权限添加失败，请稍后重试')
+    ElMessage.success('模板直接权限已添加')
+  } catch (error: unknown) {
+    ElMessage.error(formatError(error, '模板直接权限添加失败，请稍后重试'))
   } finally {
-    permissionSaving.value = false
+    templatePermissionSaving.value = false
   }
 }
 
 async function removeTemplatePermission(permissionId: string) {
-  if (!selectedTemplateId.value || permissionSaving.value || permissionError.value) {
+  if (
+    !selectedTemplateId.value ||
+    templatePermissionSaving.value ||
+    templatePermissionError.value ||
+    !canEditTemplateExceptions.value
+  ) {
     return
   }
 
-  permissionSaving.value = true
+  const permission = templatePermissions.value.find((item) => item.id === permissionId)
+  if (!permission || permission.inherited) {
+    ElMessage.warning('继承权限不可直接删除')
+    return
+  }
 
+  if (isPermissionMockEnabled) {
+    ElMessage.info('演示模式不保存模板例外；真实环境会提交权限批量接口')
+    return
+  }
+
+  const operation: TemplatePermissionBatchItemRequest = {
+    templateId: selectedTemplateId.value,
+    action: 'REVOKE',
+    permissionId,
+  }
+  templatePermissionSaving.value = true
   try {
-    await batchSaveTemplatePermissions({
-      operations: [
-        {
-          templateId: selectedTemplateId.value,
-          action: 'REVOKE',
-          permissionId,
-        },
-      ],
-    })
+    await batchSaveTemplatePermissions({ operations: [operation] })
     await loadTemplatePermissions()
-    ElMessage.success('模板权限已删除')
-  } catch (error) {
-    ElMessage.error(error instanceof Error ? error.message : '模板权限删除失败，请稍后重试')
+    ElMessage.success('模板直接权限已删除')
+  } catch (error: unknown) {
+    ElMessage.error(formatError(error, '模板直接权限删除失败，请稍后重试'))
   } finally {
-    permissionSaving.value = false
+    templatePermissionSaving.value = false
   }
 }
 
-function handleTemplateChange(event: Event) {
-  selectedTemplateId.value = (event.target as HTMLSelectElement).value
-  void loadTemplatePermissions()
+function closeDepartmentDrawer() {
+  departmentDrawerVisible.value = false
 }
 
-function handlePanelTemplateChange(templateId: string) {
-  selectedTemplateId.value = templateId
-  void loadTemplatePermissions()
-}
+watch(
+  () => appStore.selectedCampusId,
+  (campusId, previousCampusId) => {
+    if (campusId && previousCampusId && campusId !== previousCampusId) {
+      departmentDrawerVisible.value = false
+      templatesLoaded.value = false
+      templates.value = []
+      selectedTemplateId.value = ''
+      templatePermissions.value = []
+      subjectsLoaded.value = false
+      userRecords.value = []
+      void loadPolicies()
+    }
+  },
+)
 
-function handlePermissionPreviewUserChange(userId: string) {
-  permissionPreviewUserId.value = userId
-  void loadTemplatePermissions()
-}
-
-function retryTemplatePermissions() {
-  void loadTemplatePermissions()
-}
-
-onMounted(loadPermissions)
+onMounted(() => {
+  void loadPolicies()
+})
 </script>
 
 <template>
@@ -592,119 +720,85 @@ onMounted(loadPermissions)
     <section class="page-card intro-card">
       <div class="card-heading">
         <h2>文档库权限矩阵</h2>
-        <span>可见 / 可用 / 可维护 分级授权，下级继承上级</span>
+        <span>可见 / 可用 / 可维护分级授权，下级继承上级</span>
       </div>
       <p>
         可见=可浏览模板；可用=可发起签署；可维护=可编辑/停用模板。科室签署员默认继承本科室「可用」权限。调整即时生效并记录审计日志。
       </p>
     </section>
 
-    <template v-if="loading">
-      <section class="page-card loading-card" aria-label="正在加载权限配置">
-        <span class="loading-title" />
-        <span class="loading-row" />
-        <span class="loading-row" />
-        <span class="loading-row short" />
-      </section>
-    </template>
+    <section v-if="loading" class="page-card loading-card" aria-label="正在加载权限配置">
+      <span class="loading-title" />
+      <span class="loading-row" />
+      <span class="loading-row" />
+      <span class="loading-row short" />
+    </section>
+
+    <section v-else-if="policyError" class="page-card state-card error-state">
+      <span>{{ policyError }}</span>
+      <button type="button" class="retry-button" @click="loadPolicies">重新加载</button>
+    </section>
 
     <template v-else>
       <section class="page-card">
         <div class="card-heading section-heading">
-          <div class="heading-copy">
+          <div>
             <h2>按角色授权</h2>
-            <p>选择文档模板后，调整各个角色的可见、可用和可维护权限。</p>
+            <p>配置当前院区的默认角色策略；模板例外在科室“调整”抽屉中维护。</p>
           </div>
-          <label v-if="!isPermissionMockEnabled" class="template-select">
-            <span>当前文档模板</span>
-            <select :value="selectedTemplateId" @change="handleTemplateChange">
-              <option value="" disabled>请选择模板</option>
-              <option v-for="template in templates" :key="template.id" :value="template.id">
-                {{ template.name }} · {{ template.version }}
-              </option>
-            </select>
-          </label>
-        </div>
-
-        <div v-if="!isPermissionMockEnabled && !selectedTemplateId" class="empty-state">
-          暂无可配置的文档模板
-        </div>
-        <div v-else-if="!isPermissionMockEnabled && permissionLoading" class="loading-state">
-          正在加载模板权限…
-        </div>
-        <div v-else-if="!isPermissionMockEnabled && permissionError" class="error-state">
-          <span>模板权限加载失败</span>
-          <button type="button" class="retry-button" @click="retryTemplatePermissions">
-            重新加载
-          </button>
+          <span class="policy-summary">默认策略 · {{ templateCount }} 个模板例外入口</span>
         </div>
         <RolePermissionMatrix
-          v-else
           :rows="roleRows"
           :columns="permissionColumns"
-          :saving="permissionSaving"
-          @toggle="toggleRolePermission"
+          :saving="Boolean(defaultSavingId)"
+          :can-edit="canEditPolicy"
+          @toggle="toggleRolePolicy"
         />
+        <p v-if="!canEditPolicy" class="legend">当前账号仅可查看角色默认策略。</p>
       </section>
 
       <section class="page-card department-card">
         <div class="card-heading section-heading">
-          <div class="heading-copy">
+          <div>
             <h2>按科室授权</h2>
-            <p>
-              {{ selectedTemplate ? selectedTemplate.name : '当前文档模板' }}：调整各个科室的权限。
-            </p>
+            <p>科室级别的文档可用范围；调整后即时生效。</p>
           </div>
-          <span v-if="selectedTemplate" class="template-meta">
-            {{ selectedTemplate.code || selectedTemplate.id }} · {{ selectedTemplate.category }}
-          </span>
-        </div>
-
-        <div v-if="!isPermissionMockEnabled && !selectedTemplateId" class="empty-state">
-          暂无可配置的文档模板
-        </div>
-        <div v-else-if="!isPermissionMockEnabled && permissionLoading" class="loading-state">
-          正在加载模板权限…
-        </div>
-        <div v-else-if="!isPermissionMockEnabled && permissionError" class="error-state">
-          <span>模板权限加载失败</span>
-          <button type="button" class="retry-button" @click="retryTemplatePermissions">
-            重新加载
-          </button>
+          <span class="policy-summary">当前院区：{{ appStore.selectedCampus || '—' }}</span>
         </div>
         <DepartmentPermissionTable
-          v-else
           :rows="departmentRows"
-          :columns="permissionColumns"
-          :saving="permissionSaving"
-          @toggle="toggleDepartmentPermission"
-        />
-      </section>
-
-      <section v-if="!isPermissionMockEnabled" class="page-card direct-permission-card">
-        <div class="card-heading section-heading">
-          <div class="heading-copy">
-            <h2>模板权限明细与直接授权</h2>
-            <p>可对角色、科室或单个用户新增和删除模板权限；继承权限不能直接删除。</p>
-          </div>
-        </div>
-        <TemplatePermissionPanel
-          :templates="templates"
-          :selected-template-id="selectedTemplateId"
-          :permissions="templatePermissions"
-          :subjects="templateSubjects"
-          :loading="permissionLoading"
-          :saving="permissionSaving"
-          :error="permissionError"
-          :preview-user-id="permissionPreviewUserId"
-          @update:selected-template-id="handlePanelTemplateChange"
-          @update:preview-user-id="handlePermissionPreviewUserChange"
-          @add="addTemplatePermission"
-          @delete="removeTemplatePermission"
-          @retry="retryTemplatePermissions"
+          :can-edit="canEditPolicy"
+          @adjust="openDepartmentDrawer"
         />
       </section>
     </template>
+
+    <DepartmentPermissionDrawer
+      :visible="departmentDrawerVisible"
+      :department="selectedDepartment"
+      :templates="templates"
+      :selected-template-id="selectedTemplateId"
+      :permissions="templatePermissions"
+      :subjects="templateSubjects"
+      :policy-saving="Boolean(defaultSavingId)"
+      :template-catalog-loading="templateCatalogLoading"
+      :template-loading="templatePermissionLoading"
+      :template-saving="templatePermissionSaving"
+      :template-error="templatePermissionError"
+      :template-error-message="templatePermissionErrorMessage"
+      :template-catalog-error="templateCatalogError"
+      :preview-user-id="permissionPreviewUserId"
+      :can-edit-policy="canEditPolicy"
+      :can-edit-template="canEditTemplateExceptions"
+      @close="closeDepartmentDrawer"
+      @save-policy="saveDepartmentPolicy"
+      @update:selected-template-id="handleTemplateChange"
+      @update:preview-user-id="handlePreviewUserChange"
+      @add="addTemplatePermission"
+      @delete="removeTemplatePermission"
+      @retry="retryTemplatePermissions"
+    />
   </section>
 </template>
 
@@ -735,14 +829,10 @@ onMounted(loadPermissions)
 }
 
 .section-heading {
-  align-items: flex-end;
+  align-items: flex-start;
   justify-content: space-between;
 }
 
-.heading-copy {
-  min-width: 0;
-}
-
 .card-heading h2 {
   margin: 0;
   color: var(--ink);
@@ -750,7 +840,7 @@ onMounted(loadPermissions)
   line-height: 1.4;
 }
 
-.heading-copy p {
+.card-heading p {
   margin: 5px 0 0;
   color: var(--mut);
   font-size: 11.5px;
@@ -769,33 +859,9 @@ onMounted(loadPermissions)
   line-height: 1.8;
 }
 
-.template-select {
-  display: flex;
-  flex-direction: column;
+.policy-summary {
   flex-shrink: 0;
-  gap: 6px;
-  min-width: min(360px, 100%);
-  color: var(--mut);
-  font-size: 12px;
-}
-
-select {
-  min-width: 0;
-  padding: 7px 10px;
-  color: var(--ink);
-  font: inherit;
-  background: #fff;
-  border: 1px solid var(--line);
-  border-radius: 6px;
-}
-
-select:focus {
-  outline: none;
-  border-color: var(--brand);
-}
-
-.template-meta {
-  padding-bottom: 8px;
+  padding-top: 4px;
   font-size: 11.5px !important;
 }
 
@@ -832,22 +898,14 @@ select:focus {
   width: 70%;
 }
 
-.loading-state,
-.empty-state,
-.error-state {
-  padding: 28px 16px;
-  color: var(--mut);
-  font-size: 12.5px;
-  text-align: center;
-  background: #f8fbfc;
-  border-radius: 6px;
-}
-
-.error-state {
+.state-card {
   display: flex;
   gap: 10px;
   align-items: center;
   justify-content: center;
+}
+
+.error-state {
   color: var(--err);
 }
 
@@ -864,6 +922,13 @@ select:focus {
   background: var(--brand-l);
 }
 
+.legend {
+  margin: 10px 0 0;
+  color: var(--mut);
+  font-size: 11px;
+  line-height: 1.6;
+}
+
 @keyframes skeleton-shimmer {
   0% {
     background-position: 100% 0;
@@ -876,16 +941,11 @@ select:focus {
 
 @media (max-width: 760px) {
   .section-heading {
-    align-items: flex-start;
     flex-direction: column;
   }
 
-  .template-select {
-    width: 100%;
-  }
-
-  .template-meta {
-    padding-bottom: 0;
+  .policy-summary {
+    padding-top: 0;
   }
 }
 
@@ -894,9 +954,5 @@ select:focus {
     align-items: flex-start;
     flex-direction: column;
   }
-
-  .card-heading > span {
-    margin-left: 0;
-  }
 }
 </style>
diff --git a/clinical-web/src/views/management/document-permissions/mock.ts b/clinical-web/src/views/management/document-permissions/mock.ts
index d6db1a1..b2362ed 100644
--- a/clinical-web/src/views/management/document-permissions/mock.ts
+++ b/clinical-web/src/views/management/document-permissions/mock.ts
@@ -73,26 +73,36 @@ export const departmentPermissionRows: DepartmentPermissionRow[] = [
   {
     id: 'radiology',
     department: '放射科',
-    permissions: { VIEW: true, USE: true, MAINTAIN: false },
+    own: true,
+    common: true,
+    other: false,
   },
   {
     id: 'cardiology',
     department: '心内科',
-    permissions: { VIEW: true, USE: true, MAINTAIN: false },
+    own: true,
+    common: true,
+    other: false,
   },
   {
     id: 'orthopedics',
     department: '骨科',
-    permissions: { VIEW: true, USE: true, MAINTAIN: false },
+    own: true,
+    common: true,
+    other: false,
   },
   {
     id: 'health-management',
     department: '健康管理中心',
-    permissions: { VIEW: true, USE: true, MAINTAIN: false },
+    own: true,
+    common: true,
+    other: false,
   },
   {
     id: 'general',
     department: '全院通用',
-    permissions: { VIEW: true, USE: true, MAINTAIN: false },
+    own: false,
+    common: true,
+    other: false,
   },
 ]
diff --git a/clinical-web/src/views/management/document-permissions/types.ts b/clinical-web/src/views/management/document-permissions/types.ts
index e9d4423..b135c9c 100644
--- a/clinical-web/src/views/management/document-permissions/types.ts
+++ b/clinical-web/src/views/management/document-permissions/types.ts
@@ -17,14 +17,19 @@ export interface RolePermissionRow {
   userCount: number
   permissions: Record<PermissionKey, boolean>
   permissionStates?: Record<PermissionKey, PermissionCellState>
+  version?: number
 }
 
 export interface DepartmentPermissionRow {
   id: string
+  code?: string
   department: string
   campus?: string
-  permissions: Record<PermissionKey, boolean>
-  permissionStates?: Record<PermissionKey, PermissionCellState>
+  campusId?: string
+  own: boolean
+  common: boolean
+  other: boolean
+  version?: number
 }
 
 export interface PermissionSubjectOption {
diff --git a/clinical-web/src/views/management/users/components/RoleApiPermissionPanel.vue b/clinical-web/src/views/management/users/components/RoleApiPermissionPanel.vue
index f4f0863..8c7a9dd 100644
--- a/clinical-web/src/views/management/users/components/RoleApiPermissionPanel.vue
+++ b/clinical-web/src/views/management/users/components/RoleApiPermissionPanel.vue
@@ -11,12 +11,15 @@ const props = defineProps<{
   loading: boolean
   saving: boolean
   error: string
+  canEdit?: boolean
+  drawer?: boolean
 }>()
 
 const emit = defineEmits<{
   selectRole: [roleId: string]
   togglePermission: [permissionId: string]
   save: []
+  close: []
 }>()
 
 const groupedPermissions = computed(() => {
@@ -37,14 +40,26 @@ function isSelected(permissionId: string) {
 </script>
 
 <template>
-  <section class="page-card api-permission-card">
+  <section
+    :class="['api-permission-card', { 'drawer-panel': props.drawer, 'page-card': !props.drawer }]"
+  >
     <div class="card-heading">
       <div>
         <h2>角色 API 权限</h2>
-        <p>这里维护角色与后端 API 权限目录的关联，不等同于文档模板权限。</p>
+        <p>维护角色与后端 API 权限目录的关联，不等同于文档模板权限。</p>
       </div>
       <span class="heading-spacer" />
       <button
+        v-if="props.drawer"
+        type="button"
+        class="close-button"
+        aria-label="关闭角色 API 权限"
+        @click="emit('close')"
+      >
+        ×
+      </button>
+      <button
+        v-if="props.canEdit !== false"
         type="button"
         class="table-button"
         :disabled="saving || loading || !selectedRoleId"
@@ -52,6 +67,7 @@ function isSelected(permissionId: string) {
       >
         {{ saving ? '保存中…' : '保存角色权限' }}
       </button>
+      <span v-else class="readonly-note">当前账号仅可查看</span>
     </div>
 
     <div v-if="loading" class="loading-state">正在加载 API 权限目录…</div>
@@ -80,7 +96,7 @@ function isSelected(permissionId: string) {
             <input
               type="checkbox"
               :checked="isSelected(permission.id)"
-              :disabled="saving"
+              :disabled="saving || props.canEdit === false"
               @change="emit('togglePermission', permission.id)"
             />
             <span>
@@ -102,6 +118,15 @@ function isSelected(permissionId: string) {
   margin-top: 14px;
 }
 
+.drawer-panel {
+  display: flex;
+  min-height: 100%;
+  flex-direction: column;
+  margin-top: 0;
+  overflow: hidden;
+  background: var(--card);
+}
+
 .card-heading {
   display: flex;
   gap: 12px;
@@ -110,6 +135,11 @@ function isSelected(permissionId: string) {
   border-bottom: 1px solid var(--line);
 }
 
+.drawer-panel .card-heading {
+  flex-shrink: 0;
+  padding: 18px 20px;
+}
+
 .card-heading h2 {
   margin: 0;
   color: var(--ink);
@@ -126,6 +156,23 @@ function isSelected(permissionId: string) {
   flex: 1;
 }
 
+.close-button {
+  padding: 0 2px;
+  color: var(--mut);
+  font-size: 24px;
+  line-height: 1;
+  background: transparent;
+}
+
+.close-button:hover {
+  color: var(--ink);
+}
+
+.readonly-note {
+  color: var(--mut);
+  font-size: 11.5px;
+}
+
 .table-button {
   padding: 5px 10px;
   color: var(--brand);
@@ -160,6 +207,11 @@ function isSelected(permissionId: string) {
   padding: 16px;
 }
 
+.drawer-panel .api-permission-layout {
+  flex: 1;
+  overflow: auto;
+}
+
 .role-selector {
   display: grid;
   align-content: start;
diff --git a/clinical-web/src/views/management/users/components/RoleSummaryCards.vue b/clinical-web/src/views/management/users/components/RoleSummaryCards.vue
index fa58cdc..a85f154 100644
--- a/clinical-web/src/views/management/users/components/RoleSummaryCards.vue
+++ b/clinical-web/src/views/management/users/components/RoleSummaryCards.vue
@@ -3,12 +3,27 @@ import type { RoleSummary } from '../types'
 
 defineProps<{
   rows: RoleSummary[]
+  interactive?: boolean
+  selectedRoleId?: string
+}>()
+
+const emit = defineEmits<{
+  select: [role: RoleSummary]
 }>()
 </script>
 
 <template>
-  <div class="role-cards">
-    <article v-for="role in rows" :key="role.id" class="role-card">
+  <div v-if="rows.length" class="role-cards">
+    <button
+      v-for="role in rows"
+      :key="role.id"
+      type="button"
+      class="role-card"
+      :class="{ 'is-selected': selectedRoleId === role.id }"
+      :disabled="!interactive"
+      :aria-label="`${role.name}，${interactive ? '配置角色 API 权限' : '无角色权限配置权限'}`"
+      @click="emit('select', role)"
+    >
       <h3>
         <span class="role-color" :style="{ backgroundColor: role.color }" aria-hidden="true" />
         {{ role.name }}
@@ -17,8 +32,10 @@ defineProps<{
       <span class="role-count">
         {{ role.userCount === null ? '暂无人数统计' : `${role.userCount} 人` }}
       </span>
-    </article>
+      <span v-if="interactive" class="role-action">配置角色权限 →</span>
+    </button>
   </div>
+  <div v-else class="role-empty">暂无角色概览</div>
 </template>
 
 <style scoped>
@@ -30,10 +47,32 @@ defineProps<{
 }
 
 .role-card {
+  width: 100%;
+  color: inherit;
+  text-align: left;
   padding: 13px 14px;
   background: #fff;
   border: 1px solid var(--line);
   border-radius: 10px;
+  transition:
+    border-color 0.15s ease,
+    box-shadow 0.15s ease,
+    transform 0.15s ease;
+}
+
+.role-card:not(:disabled) {
+  cursor: pointer;
+}
+
+.role-card:not(:disabled):hover,
+.role-card.is-selected {
+  border-color: var(--brand);
+  box-shadow: var(--sh-hover);
+  transform: translateY(-1px);
+}
+
+.role-card:disabled {
+  cursor: default;
 }
 
 .role-card h3 {
@@ -69,6 +108,25 @@ defineProps<{
   border-radius: 20px;
 }
 
+.role-action {
+  display: block;
+  margin-top: 9px;
+  color: var(--brand);
+  font-size: 11px;
+  font-weight: 700;
+}
+
+.role-empty {
+  padding: 26px 12px;
+  margin-bottom: 16px;
+  color: var(--mut);
+  font-size: 12px;
+  text-align: center;
+  background: #f8fbfc;
+  border: 1px solid var(--line);
+  border-radius: 10px;
+}
+
 @media (max-width: 1200px) {
   .role-cards {
     grid-template-columns: repeat(2, minmax(0, 1fr));
diff --git a/clinical-web/src/views/management/users/components/UserTable.vue b/clinical-web/src/views/management/users/components/UserTable.vue
index a36996b..df688d4 100644
--- a/clinical-web/src/views/management/users/components/UserTable.vue
+++ b/clinical-web/src/views/management/users/components/UserTable.vue
@@ -1,10 +1,13 @@
 <script setup lang="ts">
 import type { UserStatus, UserTableRow } from '../types'
 
-defineProps<{
+const props = defineProps<{
   rows: UserTableRow[]
   roleColors: Record<string, string>
   disablingId?: string | null
+  canEdit?: boolean
+  canResetPassword?: boolean
+  canDeactivate?: boolean
 }>()
 
 const emit = defineEmits<{
@@ -72,12 +75,24 @@ const statusLabels: Record<UserStatus, string> = {
             </span>
           </td>
           <td class="actions-cell">
-            <button type="button" class="table-button" @click="emit('edit', row)">编辑</button>
-            <button type="button" class="table-button" @click="emit('resetPassword', row)">
+            <button
+              v-if="props.canEdit"
+              type="button"
+              class="table-button"
+              @click="emit('edit', row)"
+            >
+              编辑
+            </button>
+            <button
+              v-if="props.canResetPassword"
+              type="button"
+              class="table-button"
+              @click="emit('resetPassword', row)"
+            >
               重置密码
             </button>
             <button
-              v-if="row.status === 'enabled'"
+              v-if="props.canDeactivate && row.status === 'enabled'"
               type="button"
               class="table-button table-button--danger"
               :disabled="disablingId === row.id"
diff --git a/clinical-web/src/views/management/users/index.vue b/clinical-web/src/views/management/users/index.vue
index dde0a1c..606b6ff 100644
--- a/clinical-web/src/views/management/users/index.vue
+++ b/clinical-web/src/views/management/users/index.vue
@@ -34,6 +34,7 @@ import type {
   UserRecord as ApiUserRecord,
 } from '@/api/management/types'
 import { useAppStore } from '@/stores/app'
+import { useLoginStore } from '@/stores/login'
 
 import RoleSummaryCards from './components/RoleSummaryCards.vue'
 import UserTable from './components/UserTable.vue'
@@ -45,6 +46,7 @@ import { roleColors, roleSummaries, users } from './mock'
 import type { RoleSummary, UserEditorForm, UserTableRow } from './types'
 
 const appStore = useAppStore()
+const loginStore = useLoginStore()
 const loading = ref(true)
 const keyword = ref('')
 const roleRows = ref<RoleSummary[]>([])
@@ -74,8 +76,33 @@ const rolePermissionVersion = ref<number | undefined>()
 const apiPermissionLoading = ref(false)
 const apiPermissionSaving = ref(false)
 const apiPermissionError = ref('')
+const rolePermissionDrawerVisible = ref(false)
 let userRequestId = 0
 
+const canEditUsers = computed(
+  () => isUserMockEnabled || loginStore.hasPermission('system:user:update'),
+)
+const canCreateUsers = computed(
+  () => isUserMockEnabled || loginStore.hasPermission('system:user:create'),
+)
+const canDeactivateUsers = computed(
+  () => isUserMockEnabled || loginStore.hasPermission('system:user:disable'),
+)
+const canResetPasswords = computed(
+  () => isUserMockEnabled || loginStore.hasPermission('system:user:password:reset'),
+)
+const canImportUsers = computed(
+  () => isUserMockEnabled || loginStore.hasPermission('system:user:import'),
+)
+const canViewRoleApiPermissions = computed(
+  () =>
+    !isUserMockEnabled &&
+    loginStore.hasPermission(['system:permission:query', 'system:role:permission:query']),
+)
+const canEditRoleApiPermissions = computed(
+  () => !isUserMockEnabled && loginStore.hasPermission('system:role:permission:update'),
+)
+
 const mockCampuses: CampusRecord[] = [
   { id: 'mock-main', code: 'MAIN', name: '本部院区', status: 'ENABLED', sortNo: 1 },
   { id: 'mock-east', code: 'EAST', name: '东院区', status: 'ENABLED', sortNo: 2 },
@@ -229,7 +256,7 @@ async function loadSelectedRolePermissions() {
 }
 
 async function loadApiPermissionCatalog() {
-  if (isUserMockEnabled || apiPermissionLoading.value) {
+  if (isUserMockEnabled || !canViewRoleApiPermissions.value || apiPermissionLoading.value) {
     return
   }
 
@@ -255,6 +282,10 @@ async function loadApiPermissionCatalog() {
 }
 
 async function selectRoleForApiPermissions(roleId: string) {
+  if (!canViewRoleApiPermissions.value) {
+    return
+  }
+
   selectedRoleId.value = roleId
   apiPermissionLoading.value = true
   apiPermissionError.value = ''
@@ -282,7 +313,7 @@ function toggleApiPermission(permissionId: string) {
 }
 
 async function saveRoleApiPermissions() {
-  if (!selectedRoleId.value || apiPermissionSaving.value) {
+  if (!canEditRoleApiPermissions.value || !selectedRoleId.value || apiPermissionSaving.value) {
     return
   }
 
@@ -363,11 +394,19 @@ function mapRoleSummary(role: RoleRecord): RoleSummary {
 }
 
 function showAddUserMessage() {
+  if (!canCreateUsers.value) {
+    return
+  }
+
   editorInitial.value = null
   editorVisible.value = true
 }
 
 function showImportMessage() {
+  if (!canImportUsers.value) {
+    return
+  }
+
   if (isUserMockEnabled) {
     ElMessage.info('批量导入需要切换到真实接口模式（VITE_USE_MOCK=false）')
     return
@@ -379,6 +418,10 @@ function showImportMessage() {
 }
 
 async function editUser(row: UserTableRow) {
+  if (!canEditUsers.value) {
+    return
+  }
+
   try {
     const user = isUserMockEnabled
       ? userRows.value.find((item) => item.id === row.id)
@@ -419,6 +462,10 @@ async function editUser(row: UserTableRow) {
 }
 
 function resetPassword(user: UserTableRow) {
+  if (!canResetPasswords.value) {
+    return
+  }
+
   if (isUserMockEnabled) {
     ElMessage.info('密码重置需要切换到真实接口模式（VITE_USE_MOCK=false）')
     return
@@ -515,7 +562,11 @@ function changeUserPage(nextPage: number) {
 }
 
 async function deactivateUser(row: UserTableRow) {
-  if (row.status !== 'enabled' || !window.confirm(`确定停用用户“${row.name}”吗？`)) {
+  if (
+    !canDeactivateUsers.value ||
+    row.status !== 'enabled' ||
+    !window.confirm(`确定停用用户“${row.name}”吗？`)
+  ) {
     return
   }
 
@@ -663,6 +714,15 @@ watch(
 )
 
 onMounted(loadUsers)
+
+function openRolePermissionDrawer(role: RoleSummary) {
+  if (!canViewRoleApiPermissions.value) {
+    return
+  }
+
+  rolePermissionDrawerVisible.value = true
+  void selectRoleForApiPermissions(role.id)
+}
 </script>
 
 <template>
@@ -672,7 +732,12 @@ onMounted(loadUsers)
     </div>
 
     <template v-else>
-      <RoleSummaryCards :rows="roleRows" />
+      <RoleSummaryCards
+        :rows="roleRows"
+        :interactive="canViewRoleApiPermissions"
+        :selected-role-id="selectedRoleId"
+        @select="openRolePermissionDrawer"
+      />
 
       <section class="page-card">
         <div class="card-heading">
@@ -687,13 +752,30 @@ onMounted(loadUsers)
             @keydown.enter.prevent="searchUsers"
           />
           <button type="button" class="table-button" @click="searchUsers">查询</button>
-          <button type="button" class="table-button" @click="showAddUserMessage">＋新增用户</button>
-          <button type="button" class="table-button" @click="showImportMessage">批量导入</button>
+          <button
+            v-if="canCreateUsers"
+            type="button"
+            class="table-button"
+            @click="showAddUserMessage"
+          >
+            ＋新增用户
+          </button>
+          <button
+            v-if="canImportUsers"
+            type="button"
+            class="table-button"
+            @click="showImportMessage"
+          >
+            批量导入
+          </button>
         </div>
         <UserTable
           :rows="visibleUsers"
           :role-colors="roleColorMap"
           :disabling-id="disablingUserId"
+          :can-edit="canEditUsers"
+          :can-reset-password="canResetPasswords"
+          :can-deactivate="canDeactivateUsers"
           @edit="editUser"
           @reset-password="resetPassword"
           @deactivate="deactivateUser"
@@ -720,19 +802,31 @@ onMounted(loadUsers)
         </div>
       </section>
 
-      <RoleApiPermissionPanel
-        v-if="!isUserMockEnabled"
-        :roles="roleOptions"
-        :permissions="apiPermissions"
-        :selected-role-id="selectedRoleId"
-        :selected-permission-ids="selectedRolePermissionIds"
-        :loading="apiPermissionLoading"
-        :saving="apiPermissionSaving"
-        :error="apiPermissionError"
-        @select-role="selectRoleForApiPermissions"
-        @toggle-permission="toggleApiPermission"
-        @save="saveRoleApiPermissions"
-      />
+      <Teleport to="body">
+        <div
+          v-if="rolePermissionDrawerVisible && canViewRoleApiPermissions"
+          class="role-permission-mask"
+          @click.self="rolePermissionDrawerVisible = false"
+        >
+          <aside class="role-permission-drawer" role="dialog" aria-modal="true">
+            <RoleApiPermissionPanel
+              :roles="roleOptions"
+              :permissions="apiPermissions"
+              :selected-role-id="selectedRoleId"
+              :selected-permission-ids="selectedRolePermissionIds"
+              :loading="apiPermissionLoading"
+              :saving="apiPermissionSaving"
+              :error="apiPermissionError"
+              :can-edit="canEditRoleApiPermissions"
+              drawer
+              @select-role="selectRoleForApiPermissions"
+              @toggle-permission="toggleApiPermission"
+              @save="saveRoleApiPermissions"
+              @close="rolePermissionDrawerVisible = false"
+            />
+          </aside>
+        </div>
+      </Teleport>
     </template>
 
     <UserEditorDialog
@@ -841,6 +935,24 @@ onMounted(loadUsers)
   opacity: 0.55;
 }
 
+.role-permission-mask {
+  position: fixed;
+  z-index: 50;
+  inset: 0;
+  display: flex;
+  justify-content: flex-end;
+  background: rgb(9 40 52 / 45%);
+}
+
+.role-permission-drawer {
+  width: min(760px, 96vw);
+  height: 100%;
+  overflow: hidden;
+  background: var(--card);
+  box-shadow: var(--sh-modal);
+  animation: slide-in 0.18s ease-out;
+}
+
 .loading-card {
   display: grid;
   grid-template-columns: repeat(4, minmax(0, 1fr));
@@ -867,6 +979,18 @@ onMounted(loadUsers)
   }
 }
 
+@keyframes slide-in {
+  from {
+    transform: translateX(12px);
+    opacity: 0;
+  }
+
+  to {
+    transform: translateX(0);
+    opacity: 1;
+  }
+}
+
 @media (max-width: 900px) {
   .card-heading {
     align-items: flex-start;