diff --git a/mateclaw-server/src/main/java/vip/mate/channel/controller/ChannelController.java b/mateclaw-server/src/main/java/vip/mate/channel/controller/ChannelController.java
index 22e13bd7..68c95a31 100644
--- a/mateclaw-server/src/main/java/vip/mate/channel/controller/ChannelController.java
+++ b/mateclaw-server/src/main/java/vip/mate/channel/controller/ChannelController.java
@@ -43,7 +43,7 @@ public class ChannelController {
     private final ChannelVerifierRegistry verifierRegistry;
     private final ObjectMapper objectMapper;
 
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("admin")
     @Operation(summary = "获取渠道列表")
     @GetMapping
     public R<List<ChannelEntity>> list(
@@ -52,7 +52,7 @@ public class ChannelController {
         return R.ok(channelService.listChannelsByWorkspace(wsId));
     }
 
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("admin")
     @Operation(summary = "按类型获取渠道列表")
     @GetMapping("/type/{channelType}")
     public R<List<ChannelEntity>> listByType(@PathVariable String channelType,
@@ -61,7 +61,7 @@ public class ChannelController {
         return R.ok(channelService.listChannelsByTypeAndWorkspace(channelType, wsId));
     }
 
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("admin")
     @Operation(summary = "获取渠道详情")
     @GetMapping("/{id}")
     public R<ChannelEntity> get(@PathVariable Long id,
@@ -140,7 +140,7 @@ public class ChannelController {
         return R.ok(channelManager.getStatus());
     }
 
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("admin")
     @Operation(summary = "获取指定渠道的实时健康状态（真连接状态，前端绿点应该绑这个）")
     @GetMapping("/{id}/health")
     public R<Map<String, Object>> health(@PathVariable Long id,
diff --git a/mateclaw-server/src/main/java/vip/mate/cron/controller/CronJobController.java b/mateclaw-server/src/main/java/vip/mate/cron/controller/CronJobController.java
index fd161d5c..b34064cd 100644
--- a/mateclaw-server/src/main/java/vip/mate/cron/controller/CronJobController.java
+++ b/mateclaw-server/src/main/java/vip/mate/cron/controller/CronJobController.java
@@ -38,7 +38,7 @@ public class CronJobController {
 
     @Operation(summary = "获取定时任务列表")
     @GetMapping
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<List<CronJobDTO>> list(
             @RequestHeader(value = "X-Workspace-Id", required = false) Long workspaceId) {
         return R.ok(cronJobService.list(resolve(workspaceId)));
@@ -46,7 +46,7 @@ public class CronJobController {
 
     @Operation(summary = "获取定时任务详情")
     @GetMapping("/{id}")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<CronJobDTO> get(@PathVariable Long id,
             @RequestHeader(value = "X-Workspace-Id", required = false) Long workspaceId) {
         return R.ok(cronJobService.getById(id, resolve(workspaceId)));
@@ -70,7 +70,7 @@ public class CronJobController {
 
     @Operation(summary = "删除定时任务")
     @DeleteMapping("/{id}")
-    @RequireWorkspaceRole("admin")
+    @RequireWorkspaceRole("member")
     public R<Void> delete(@PathVariable Long id,
             @RequestHeader(value = "X-Workspace-Id", required = false) Long workspaceId) {
         cronJobService.delete(id, resolve(workspaceId));
@@ -103,7 +103,7 @@ public class CronJobController {
      */
     @Operation(summary = "查询会话下正在执行的定时任务运行")
     @GetMapping("/active-runs")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<List<ActiveCronRunVO>> activeRuns(
             @RequestParam("conversationId") String conversationId) {
         return R.ok(cronJobRunService.listActiveByConversation(conversationId));
diff --git a/mateclaw-server/src/main/java/vip/mate/dashboard/controller/DashboardController.java b/mateclaw-server/src/main/java/vip/mate/dashboard/controller/DashboardController.java
index 23e49e5c..67e24556 100644
--- a/mateclaw-server/src/main/java/vip/mate/dashboard/controller/DashboardController.java
+++ b/mateclaw-server/src/main/java/vip/mate/dashboard/controller/DashboardController.java
@@ -36,7 +36,7 @@ public class DashboardController {
 
     @Operation(summary = "获取概览统计")
     @GetMapping("/overview")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<Map<String, Object>> overview(
             @RequestHeader(value = "X-Workspace-Id", required = false) Long workspaceId) {
         return R.ok(dashboardService.getOverview(workspaceId));
@@ -44,7 +44,7 @@ public class DashboardController {
 
     @Operation(summary = "获取日用量趋势")
     @GetMapping("/trend")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<List<Map<String, Object>>> trend(
             @RequestHeader(value = "X-Workspace-Id", required = false) Long workspaceId,
             @RequestParam(defaultValue = "30") int days) {
@@ -53,7 +53,7 @@ public class DashboardController {
 
     @Operation(summary = "获取 CronJob 执行历史")
     @GetMapping("/cron-runs/{cronJobId}")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<List<CronJobRunEntity>> cronJobRuns(
             @PathVariable Long cronJobId,
             @RequestHeader(value = "X-Workspace-Id", required = false) Long workspaceId,
@@ -74,7 +74,7 @@ public class DashboardController {
 
     @Operation(summary = "获取最近执行记录（当前 workspace 关联的 CronJob）")
     @GetMapping("/cron-runs")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<List<CronJobRunEntity>> recentRuns(
             @RequestHeader(value = "X-Workspace-Id", required = false) Long workspaceId,
             @RequestParam(defaultValue = "20") int limit) {
diff --git a/mateclaw-server/src/main/java/vip/mate/memory/controller/DreamController.java b/mateclaw-server/src/main/java/vip/mate/memory/controller/DreamController.java
index ca247fdd..344d7bd0 100644
--- a/mateclaw-server/src/main/java/vip/mate/memory/controller/DreamController.java
+++ b/mateclaw-server/src/main/java/vip/mate/memory/controller/DreamController.java
@@ -41,7 +41,7 @@ public class DreamController {
 
     @Operation(summary = "List dream reports (paginated, newest first)")
     @GetMapping("/reports")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<Map<String, Object>> listReports(
             @PathVariable Long agentId,
             @RequestParam(defaultValue = "1") int page,
@@ -63,7 +63,7 @@ public class DreamController {
 
     @Operation(summary = "Get a single dream report by ID")
     @GetMapping("/reports/{reportId}")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<DreamReportEntity> getReport(
             @PathVariable Long agentId,
             @PathVariable Long reportId) {
@@ -82,7 +82,7 @@ public class DreamController {
 
     @Operation(summary = "Subscribe to dream events (SSE)")
     @GetMapping(value = "/events", produces = MediaType.TEXT_EVENT_STREAM_VALUE)
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public SseEmitter subscribeDreamEvents(@PathVariable Long agentId) {
         return eventBroadcaster.register(agentId);
     }
@@ -91,7 +91,7 @@ public class DreamController {
 
     @Operation(summary = "Get morning card for current user + agent")
     @GetMapping("/morning-card")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<Map<String, Object>> getMorningCard(@PathVariable Long agentId, Authentication auth) {
         Long userId = resolveUserId(auth);
         if (userId == null) return R.fail("Not authenticated");
@@ -101,7 +101,7 @@ public class DreamController {
 
     @Operation(summary = "Mark morning card as seen")
     @PostMapping("/morning-card/seen")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<Void> markMorningCardSeen(@PathVariable Long agentId,
                                         @RequestBody Map<String, Object> body,
                                         Authentication auth) {
diff --git a/mateclaw-server/src/main/java/vip/mate/memory/controller/MemoryController.java b/mateclaw-server/src/main/java/vip/mate/memory/controller/MemoryController.java
index 4abbfcfe..6f63553c 100644
--- a/mateclaw-server/src/main/java/vip/mate/memory/controller/MemoryController.java
+++ b/mateclaw-server/src/main/java/vip/mate/memory/controller/MemoryController.java
@@ -92,7 +92,7 @@ public class MemoryController {
 
     @Operation(summary = "查询 Dreaming 状态（配置、统计、上次运行时间）")
     @GetMapping("/{agentId}/dreaming/status")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<Map<String, Object>> getDreamingStatus(@PathVariable Long agentId) {
         Map<String, Object> status = recallService.getDreamingStatus(agentId);
         status.put("lastRunTime", dreamingScheduler.getLastRunTime());
@@ -101,14 +101,14 @@ public class MemoryController {
 
     @Operation(summary = "查询召回候选列表（含评分详情）")
     @GetMapping("/{agentId}/dreaming/candidates")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<List<Map<String, Object>>> getDreamingCandidates(@PathVariable Long agentId) {
         return R.ok(recallService.listCandidatesWithDetails(agentId));
     }
 
     @Operation(summary = "查询 DREAMS.md 整合日记")
     @GetMapping("/{agentId}/dreaming/dreams")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<Map<String, Object>> getDreams(@PathVariable Long agentId) {
         WorkspaceFileEntity file = workspaceFileService.getFile(agentId, "DREAMS.md");
         Map<String, Object> result = new LinkedHashMap<>();
diff --git a/mateclaw-server/src/main/java/vip/mate/memory/fact/controller/FactController.java b/mateclaw-server/src/main/java/vip/mate/memory/fact/controller/FactController.java
index 373b9240..81d5f6bb 100644
--- a/mateclaw-server/src/main/java/vip/mate/memory/fact/controller/FactController.java
+++ b/mateclaw-server/src/main/java/vip/mate/memory/fact/controller/FactController.java
@@ -44,7 +44,7 @@ public class FactController {
 
     @Operation(summary = "List facts for an agent")
     @GetMapping
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<List<FactEntity>> listFacts(@PathVariable Long agentId,
                                           @RequestParam(required = false) String keyword) {
         LambdaQueryWrapper<FactEntity> query = new LambdaQueryWrapper<FactEntity>()
@@ -165,7 +165,7 @@ public class FactController {
 
     @Operation(summary = "List unresolved contradictions")
     @GetMapping("/contradictions")
-    @RequireWorkspaceRole("viewer")
+    @RequireWorkspaceRole("member")
     public R<List<FactContradictionEntity>> listContradictions(@PathVariable Long agentId) {
         return R.ok(contradictionMapper.selectList(
                 new LambdaQueryWrapper<FactContradictionEntity>()
diff --git a/mateclaw-server/src/main/java/vip/mate/workspace/conversation/controller/TokenUsageController.java b/mateclaw-server/src/main/java/vip/mate/workspace/conversation/controller/TokenUsageController.java
index 6c270c34..0c9f5790 100644
--- a/mateclaw-server/src/main/java/vip/mate/workspace/conversation/controller/TokenUsageController.java
+++ b/mateclaw-server/src/main/java/vip/mate/workspace/conversation/controller/TokenUsageController.java
@@ -8,6 +8,7 @@ import org.springframework.web.bind.annotation.*;
 import vip.mate.common.result.R;
 import vip.mate.workspace.conversation.TokenUsageService;
 import vip.mate.workspace.conversation.vo.TokenUsageSummaryVO;
+import vip.mate.workspace.core.annotation.RequireWorkspaceRole;
 
 import java.time.LocalDate;
 
@@ -26,6 +27,7 @@ public class TokenUsageController {
 
     @Operation(summary = "获取 Token 使用统计")
     @GetMapping
+    @RequireWorkspaceRole("member")
     public R<TokenUsageSummaryVO> getSummary(
             @RequestParam(required = false) @DateTimeFormat(pattern = "yyyy-MM-dd") LocalDate startDate,
             @RequestParam(required = false) @DateTimeFormat(pattern = "yyyy-MM-dd") LocalDate endDate,