diff --git a/ui/src/layout/sidebar/WorkspaceSidebar.vue b/ui/src/layout/sidebar/WorkspaceSidebar.vue
index 668e404e1da..5dd0cfa2769 100644
--- a/ui/src/layout/sidebar/WorkspaceSidebar.vue
+++ b/ui/src/layout/sidebar/WorkspaceSidebar.vue
@@ -19,19 +19,20 @@ function navigateToWorkspaceMenu(workspaceMenuItem: LayoutMenuItem) {
 
 <template>
   <div class="space-y-1 p-1">
-    <div
-      v-for="workspaceMenuItem in workspaceMenuItems"
-      :key="workspaceMenuItem.name"
-      class="flex-col-center w-full cursor-pointer rounded-md py-2 text-xs font-semibold text-N600 hover:bg-N900/10"
-      :class="isWorkspaceMenuActive(workspaceMenuItem) && 'bg-white text-N900'"
-      @click="navigateToWorkspaceMenu(workspaceMenuItem)"
-    >
-      <MkIcon
-        v-if="workspaceMenuItem.icon"
-        :name="isWorkspaceMenuActive(workspaceMenuItem) ? (workspaceMenuItem.activeIcon ?? workspaceMenuItem.icon) : workspaceMenuItem.icon"
-        :gradient="isWorkspaceMenuActive(workspaceMenuItem)"
-      />
-      <span class="mt-[2px]">{{ workspaceMenuItem.label }}</span>
-    </div>
+    <template v-for="workspaceMenuItem in workspaceMenuItems" :key="workspaceMenuItem.name">
+      <div
+        v-if="workspaceMenuItem.permission ? workspaceMenuItem.permission(route) : true"
+        class="flex-col-center w-full cursor-pointer rounded-md py-2 text-xs font-semibold text-N600 hover:bg-N900/10"
+        :class="isWorkspaceMenuActive(workspaceMenuItem) && 'bg-white text-N900'"
+        @click="navigateToWorkspaceMenu(workspaceMenuItem)"
+      >
+        <MkIcon
+          v-if="workspaceMenuItem.icon"
+          :name="isWorkspaceMenuActive(workspaceMenuItem) ? (workspaceMenuItem.activeIcon ?? workspaceMenuItem.icon) : workspaceMenuItem.icon"
+          :gradient="isWorkspaceMenuActive(workspaceMenuItem)"
+        />
+        <span class="mt-[2px]">{{ workspaceMenuItem.label }}</span>
+      </div>
+    </template>
   </div>
 </template>
diff --git a/ui/src/permission/modules/application/workspace.ts b/ui/src/permission/modules/application/workspace.ts
index 96329209172..2bec5c47376 100644
--- a/ui/src/permission/modules/application/workspace.ts
+++ b/ui/src/permission/modules/application/workspace.ts
@@ -5,6 +5,10 @@ import { PermissionConstants as P } from '../../core'
 
 const workspace = {
   // —— 工作空间级（无资源 id）——
+/**
+ * 工作空间「智能体」只读权限
+ */
+  isShare: () => can(P.APPLICATION_READ),
 /**
  * 工作空间「智能体」创建权限
  */
diff --git a/ui/src/router/admin/workspace/modules/application.ts b/ui/src/router/admin/workspace/modules/application.ts
index 37d7b81cf42..f509a07ce07 100644
--- a/ui/src/router/admin/workspace/modules/application.ts
+++ b/ui/src/router/admin/workspace/modules/application.ts
@@ -7,7 +7,12 @@ export const applicationRoutes: RouteRecordRaw[] = [
     path: 'application',
     name: 'workspace-application',
     redirect: { name: 'workspace-application-list' },
-    meta: { title: '智能体', activeMenu: 'workspace-application', icon: 'icon_robot_outlined', activeIcon: 'icon_robot_filled', order: 20 },
+    meta: { title: '智能体',
+      activeMenu: 'workspace-application',
+      icon: 'icon_robot_outlined', activeIcon: 'icon_robot_filled', order: 20,
+      permission: () => perm.application.workspace.isShare(),
+      next: 'workspace-knowledge',
+    },
     children: [
       {
         path: '',
@@ -31,7 +36,7 @@ export const applicationRoutes: RouteRecordRaw[] = [
               activeIcon: 'icon_screen_filled',
               order: 10,
               canAccess: (params) => perm.application.workspace.overviewRead(String(params.applicationId)),
-              permission: ({ params }) => perm.application.workspace.overviewRead(String(params.knowledgeId)),
+              permission: ({ params }) => perm.application.workspace.overviewRead(String(params.applicationId)),
               next: 'workspace-application-simple-setting',
             },
           },
@@ -46,7 +51,7 @@ export const applicationRoutes: RouteRecordRaw[] = [
               order: 20,
               detailMenuVisible: (params) => params.type === APPLICATION_TYPE.SIMPLE,
               canAccess: (params) => params.type === APPLICATION_TYPE.SIMPLE && perm.application.workspace.edit(String(params.applicationId)),
-              permission: ({ params }) => perm.application.workspace.edit(String(params.knowledgeId)),
+              permission: ({ params }) => perm.application.workspace.edit(String(params.applicationId)),
               next: 'workspace-application-access',
             },
           },
@@ -75,7 +80,7 @@ export const applicationRoutes: RouteRecordRaw[] = [
             meta: { title: '发布渠道',
               icon: 'icon_application_outlined',
               activeIcon: 'icon_application_filled', order: 30,
-              permission: ({ params }) => perm.application.workspace.accessRead(String(params.knowledgeId)),
+              permission: ({ params }) => perm.application.workspace.accessRead(String(params.applicationId)),
               next: 'workspace-application-chat-user',
           },
         },
@@ -86,7 +91,7 @@ export const applicationRoutes: RouteRecordRaw[] = [
             meta: { title: '对话用户',
               icon: 'icon_contacts_outlined',
               activeIcon: 'icon_contacts_filled', order: 40,
-              permission: ({ params }) => perm.application.workspace.chatUserRead(String(params.knowledgeId)),
+              permission: ({ params }) => perm.application.workspace.chatUserRead(String(params.applicationId)),
               next: 'workspace-application-operation-log',
             },
           },
@@ -97,7 +102,7 @@ export const applicationRoutes: RouteRecordRaw[] = [
             meta: { title: '对话日志',
               icon: 'icon_logs_outlined',
               activeIcon: 'icon_logs_filled', order: 50,
-              permission: ({ params }) => perm.application.workspace.chatLogRead(String(params.knowledgeId)),
+              permission: ({ params }) => perm.application.workspace.chatLogRead(String(params.applicationId)),
               next: 'workspace-application-overview',
             },
           },
diff --git a/ui/src/router/admin/workspace/modules/knowledge.ts b/ui/src/router/admin/workspace/modules/knowledge.ts
index fa3dd99234c..34aed845935 100644
--- a/ui/src/router/admin/workspace/modules/knowledge.ts
+++ b/ui/src/router/admin/workspace/modules/knowledge.ts
@@ -7,7 +7,13 @@ export const knowledgeRoutes: RouteRecordRaw[] = [
     path: 'knowledge',
     name: 'workspace-knowledge',
     redirect: { name: 'workspace-knowledge-list' },
-    meta: { title: '知识库', activeMenu: 'workspace-knowledge', icon: 'icon_book_outlined', activeIcon: 'icon_book_filled', order: 30 },
+    meta: { title: '知识库',
+      activeMenu: 'workspace-knowledge',
+      icon: 'icon_book_outlined',
+      activeIcon: 'icon_book_filled', order: 30,
+      permission: () => perm.knowledge.workspace.isShare(),
+      next: 'workspace-tools',
+    },
     children: [
       {
         path: '',
diff --git a/ui/src/router/admin/workspace/modules/model.ts b/ui/src/router/admin/workspace/modules/model.ts
index bfdb10c6cea..7f6f5e3c54b 100644
--- a/ui/src/router/admin/workspace/modules/model.ts
+++ b/ui/src/router/admin/workspace/modules/model.ts
@@ -1,10 +1,16 @@
 import type { RouteRecordRaw } from 'vue-router'
+import { perm } from '@/permission'
 
 export const modelRoutes: RouteRecordRaw[] = [
   {
     path: 'model',
     name: 'workspace-model',
     component: () => import('@/views/model/index.vue'),
-    meta: { title: '模型', icon: 'icon_dataset_outlined', activeIcon: 'icon_dataset_filled', order: 50 },
+    meta: { title: '模型',
+      icon: 'icon_dataset_outlined',
+      activeIcon: 'icon_dataset_filled', order: 50,
+      permission: () => perm.model.workspace.isShare(),
+      next: 'workspace-trigger',
+    },
   },
 ]
diff --git a/ui/src/router/admin/workspace/modules/tool.ts b/ui/src/router/admin/workspace/modules/tool.ts
index 7ff5723f4f8..fa1a4836ffb 100644
--- a/ui/src/router/admin/workspace/modules/tool.ts
+++ b/ui/src/router/admin/workspace/modules/tool.ts
@@ -1,10 +1,16 @@
 import type { RouteRecordRaw } from 'vue-router'
+import { perm } from '@/permission'
 
 export const toolRoutes: RouteRecordRaw[] = [
   {
     path: 'tools',
     name: 'workspace-tools',
     component: () => import('@/views/tool/index.vue'),
-    meta: { title: '工具', icon: 'icon_busy_outlined', activeIcon: 'icon_busy__filled', order: 40 },
+    meta: { title: '工具',
+      icon: 'icon_busy_outlined',
+      activeIcon: 'icon_busy__filled', order: 40,
+      permission: () => perm.tool.workspace.isShare(),
+      next: 'workspace-model',
+    },
   },
 ]
diff --git a/ui/src/router/admin/workspace/modules/trigger.ts b/ui/src/router/admin/workspace/modules/trigger.ts
index 82b5c575874..5a8d4b4d038 100644
--- a/ui/src/router/admin/workspace/modules/trigger.ts
+++ b/ui/src/router/admin/workspace/modules/trigger.ts
@@ -1,10 +1,16 @@
 import type { RouteRecordRaw } from 'vue-router'
+import { perm } from '@/permission'
 
 export const triggerRoutes: RouteRecordRaw[] = [
   {
     path: 'trigger',
     name: 'workspace-trigger',
     component: () => import('@/views/trigger/index.vue'),
-    meta: { title: '触发器', icon: 'icon-laser', activeIcon: 'icon_laser_filled', order: 60 },
+    meta: { title: '触发器',
+      icon: 'icon-laser',
+      activeIcon: 'icon_laser_filled', order: 60,
+      permission: () => perm.trigger.read(),
+      next: 'workspace-application',
+    },
   },
 ]