diff --git a/apps/common/auth/constants/permission_constants.py b/apps/common/auth/constants/permission_constants.py
index 47604ed542c..1b2f5b0ec95 100644
--- a/apps/common/auth/constants/permission_constants.py
+++ b/apps/common/auth/constants/permission_constants.py
@@ -644,6 +644,16 @@ class PermissionConstants(Enum):
         ),
     )
 
+    KNOWLEDGE_TOKEN = (
+        Permission(group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.TOKEN, bit_index=73),
+        PermissionMeta(
+            role_list=[RoleConstants.WORKSPACE_MANAGE, RoleConstants.USER],
+            category=Category.WORKSPACE,
+            scope=[PermissionScopeConstants.WORKSPACE, PermissionScopeConstants.WORKSPACE_RESOURCE],
+            resource_permission_group_list=[ResourcePermissionConst.KNOWLEDGE_MANAGE],
+        ),
+    )
+
     KNOWLEDGE_BATCH_DELETE = (
         Permission(group=Group.KNOWLEDGE, sub_group=Group.KNOWLEDGE, operate=Operate.BATCH_DELETE, bit_index=8),
         PermissionMeta(
@@ -2521,6 +2531,21 @@ class PermissionConstants(Enum):
         ),
     )
 
+    SHARED_KNOWLEDGE_TOKEN = (
+        Permission(
+            group=Group.SYSTEM_SHARED_KNOWLEDGE,
+            sub_group=Group.SYSTEM_SHARED_KNOWLEDGE,
+            operate=Operate.TOKEN,
+            bit_index=65,
+        ),
+        PermissionMeta(
+            role_list=[RoleConstants.ADMIN],
+            category=Category.SHARED,
+            is_ee=is_ee,
+            scope=[PermissionScopeConstants.SYSTEM],
+        ),
+    )
+
     # 共享知识库工作流
     SHARED_KNOWLEDGE_WORKFLOW_READ = (
         Permission(
@@ -4624,6 +4649,22 @@ class PermissionConstants(Enum):
         ),
     )
 
+    # 资源管理 - 知识库分词索引
+    RESOURCE_KNOWLEDGE_TOKEN = (
+        Permission(
+            group=Group.SYSTEM_RES_KNOWLEDGE,
+            sub_group=Group.SYSTEM_RES_KNOWLEDGE,
+            operate=Operate.TOKEN,
+            bit_index=65,
+        ),
+        PermissionMeta(
+            role_list=[RoleConstants.ADMIN],
+            category=Category.RESOURCE,
+            is_ee=is_ee,
+            scope=[PermissionScopeConstants.SYSTEM],
+        ),
+    )
+
     # ==================== 资源管理 - 工具 ====================
     RESOURCE_TOOL_READ = (
         Permission(group=Group.SYSTEM_RES_TOOL, sub_group=Group.SYSTEM_RES_TOOL, operate=Operate.READ, bit_index=0),
diff --git a/apps/knowledge/tests/test_permissions.py b/apps/knowledge/tests/test_permissions.py
index 2f80a3cc168..ff0eab53151 100644
--- a/apps/knowledge/tests/test_permissions.py
+++ b/apps/knowledge/tests/test_permissions.py
@@ -164,6 +164,18 @@ def test_mcp_config_has_its_own_permission_and_response(self, serializer):
         response = KnowledgeMcpConfigView().get(self.request(P.KNOWLEDGE_MCP_CONFIG), **self.kwargs())
         self.assertEqual(json.loads(response.content)["data"], {"mcp_config": {"test": True}})
 
+    @patch("common.log.log.Log")
+    @patch("knowledge.views.knowledge.KnowledgeSerializer.Operate")
+    def test_tokenize_uses_knowledge_token_permission_instead_of_document_token(self, serializer, log):
+        serializer.return_value.tokenize.return_value = {}
+        KnowledgeView.Tokenize().put(self.request(P.KNOWLEDGE_TOKEN), **self.kwargs())
+        serializer.assert_called_once()
+        for permission in (P.KNOWLEDGE_DOCUMENT_TOKEN, P.KNOWLEDGE_IMAGE_TOKEN, P.KNOWLEDGE_EDIT):
+            serializer.reset_mock()
+            with self.assertRaises(AppUnauthorizedFailed):
+                KnowledgeView.Tokenize().put(self.request(permission), **self.kwargs())
+            serializer.assert_not_called()
+
     @patch("knowledge.views.knowledge.KnowledgeSerializer.Operate")
     def test_detail_redaction_and_settings_section_permissions(self, serializer):
         serializer.return_value.one.side_effect = lambda: {
diff --git a/apps/knowledge/views/knowledge.py b/apps/knowledge/views/knowledge.py
index 85895153cd4..dd05eb689b1 100644
--- a/apps/knowledge/views/knowledge.py
+++ b/apps/knowledge/views/knowledge.py
@@ -565,8 +565,8 @@ class Tokenize(APIView):
             tags=[_("Knowledge Base")],  # type: ignore
         )
         @has_permissions(
-            PermissionConstants.KNOWLEDGE_DOCUMENT_TOKEN.get_workspace_knowledge_permission(),
-            PermissionConstants.KNOWLEDGE_DOCUMENT_TOKEN.get_workspace_permission_workspace_manage_role(),
+            PermissionConstants.KNOWLEDGE_TOKEN.get_workspace_knowledge_permission(),
+            PermissionConstants.KNOWLEDGE_TOKEN.get_workspace_permission_workspace_manage_role(),
             RoleConstants.WORKSPACE_MANAGE.get_workspace_role(),
             ViewPermission(
                 [RoleConstants.USER.get_workspace_role()],
diff --git a/ui/src/permission/core/data.ts b/ui/src/permission/core/data.ts
index 0b43c60988a..c2f570c7855 100644
--- a/ui/src/permission/core/data.ts
+++ b/ui/src/permission/core/data.ts
@@ -94,6 +94,7 @@ export const PermissionConstants = {
   KNOWLEDGE_EXPORT: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.EXPORT, 5),
   KNOWLEDGE_VECTOR: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.VECTOR, 6),
   KNOWLEDGE_GENERATE: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.GENERATE, 7),
+  KNOWLEDGE_TOKEN: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.TOKEN, 73),
   KNOWLEDGE_BATCH_DELETE: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.BATCH_DELETE, 8),
   KNOWLEDGE_BATCH_MOVE: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.BATCH_MOVE, 9),
   KNOWLEDGE_RESOURCE_AUTHORIZATION: p(Group.KNOWLEDGE, Group.KNOWLEDGE, Operate.AUTH, 10),
@@ -295,6 +296,7 @@ export const PermissionConstants = {
   SHARED_KNOWLEDGE_VECTOR: p(Group.SYSTEM_SHARED_KNOWLEDGE, Group.SYSTEM_SHARED_KNOWLEDGE, Operate.VECTOR, 4),
   SHARED_KNOWLEDGE_EXPORT: p(Group.SYSTEM_SHARED_KNOWLEDGE, Group.SYSTEM_SHARED_KNOWLEDGE, Operate.EXPORT, 5),
   SHARED_KNOWLEDGE_GENERATE: p(Group.SYSTEM_SHARED_KNOWLEDGE, Group.SYSTEM_SHARED_KNOWLEDGE, Operate.GENERATE, 6),
+  SHARED_KNOWLEDGE_TOKEN: p(Group.SYSTEM_SHARED_KNOWLEDGE, Group.SYSTEM_SHARED_KNOWLEDGE, Operate.TOKEN, 65),
   SHARED_KNOWLEDGE_DELETE: p(Group.SYSTEM_SHARED_KNOWLEDGE, Group.SYSTEM_SHARED_KNOWLEDGE, Operate.DELETE, 7),
   SHARED_KNOWLEDGE_RELATE_RESOURCE_VIEW: p(Group.SYSTEM_SHARED_KNOWLEDGE, Group.SYSTEM_SHARED_KNOWLEDGE, Operate.RELATE_VIEW, 8),
   SHARED_KNOWLEDGE_TO_WORKSPACE: p(Group.SYSTEM_SHARED_KNOWLEDGE, Group.SYSTEM_SHARED_KNOWLEDGE, Operate.TO_WORKSPACE, 9),
@@ -405,6 +407,7 @@ export const PermissionConstants = {
   RESOURCE_KNOWLEDGE_PUBLISH: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.PUBLISH, 5),
   RESOURCE_KNOWLEDGE_VECTOR: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.VECTOR, 6),
   RESOURCE_KNOWLEDGE_GENERATE: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.GENERATE, 7),
+  RESOURCE_KNOWLEDGE_TOKEN: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.TOKEN, 65),
   RESOURCE_KNOWLEDGE_AUTH: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.AUTH, 8),
   RESOURCE_KNOWLEDGE_RELATE_RESOURCE_VIEW: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_RES_KNOWLEDGE, Operate.RELATE_VIEW, 9),
   RESOURCE_KNOWLEDGE_WORKFLOW_READ: p(Group.SYSTEM_RES_KNOWLEDGE, Group.SYSTEM_WORKFLOW, Operate.READ, 10),
diff --git a/ui/src/permission/modules/knowledge/share.ts b/ui/src/permission/modules/knowledge/share.ts
index 97f1089500c..17779014348 100644
--- a/ui/src/permission/modules/knowledge/share.ts
+++ b/ui/src/permission/modules/knowledge/share.ts
@@ -46,6 +46,10 @@ const share = {
  * 系统「共享知识库」生成问题权限
  */
   generate: () => canSys(P.SHARED_KNOWLEDGE_GENERATE),
+/**
+ * 系统「共享知识库」分词索引权限
+ */
+  token: () => canSys(P.SHARED_KNOWLEDGE_TOKEN),
 /**
  * 系统「共享知识库」导出权限
  */
diff --git a/ui/src/permission/modules/knowledge/system.ts b/ui/src/permission/modules/knowledge/system.ts
index 486354a6876..b26304f7f11 100644
--- a/ui/src/permission/modules/knowledge/system.ts
+++ b/ui/src/permission/modules/knowledge/system.ts
@@ -41,6 +41,10 @@ const system = {
  * 系统「知识库」生成问题权限
  */
   generate: () => canSys(P.RESOURCE_KNOWLEDGE_GENERATE),
+/**
+ * 系统「知识库」分词索引权限
+ */
+  token: () => canSys(P.RESOURCE_KNOWLEDGE_TOKEN),
 /**
  * 系统「知识库」导出权限
  */
diff --git a/ui/src/permission/modules/knowledge/workspace.ts b/ui/src/permission/modules/knowledge/workspace.ts
index 3c9f9df5ee8..bc03be8fec4 100644
--- a/ui/src/permission/modules/knowledge/workspace.ts
+++ b/ui/src/permission/modules/knowledge/workspace.ts
@@ -61,6 +61,10 @@ const workspace = {
  * 工作空间「知识库」生成问题权限
  */
   generate: (id: string) => canWorkspaceKnowledge(P.KNOWLEDGE_GENERATE, id),
+/**
+ * 工作空间「知识库」分词索引权限
+ */
+  token: (id: string) => canWorkspaceKnowledge(P.KNOWLEDGE_TOKEN, id),
 /**
  * 工作空间「知识库」导出权限
  */
diff --git a/ui/src/views/knowledge/index.vue b/ui/src/views/knowledge/index.vue
index 41d8298675f..32402c34b6e 100644
--- a/ui/src/views/knowledge/index.vue
+++ b/ui/src/views/knowledge/index.vue
@@ -286,7 +286,7 @@ function handleBatchDelete() {
                     label="分词索引"
                     :api="KnowledgeApi"
                     :knowledge="knowledge"
-                    v-if="perm.knowledge.workspace.docToken(knowledge.id)"
+                    v-if="perm.knowledge.workspace.token(knowledge.id)"
                   />
                   <!-- MCP 服务配置 -->
                   <McpConfigKnowledgeAction
diff --git a/ui/src/views/system/resource-management/knowledge/index.vue b/ui/src/views/system/resource-management/knowledge/index.vue
index 2e397e0ef5d..aa769932ccb 100644
--- a/ui/src/views/system/resource-management/knowledge/index.vue
+++ b/ui/src/views/system/resource-management/knowledge/index.vue
@@ -218,6 +218,7 @@ onMounted(() => {
                   label="分词索引"
                   :api="SystemResourceKnowledgeApi"
                   :knowledge="row"
+                  v-if="perm.knowledge.system.token()"
                 />
                 <!-- MCP 服务配置 -->
                 <McpConfigKnowledgeAction
diff --git a/ui/src/views/system/shared-resources/knowledge/index.vue b/ui/src/views/system/shared-resources/knowledge/index.vue
index 8e05b97ee6e..a51d46d52fb 100644
--- a/ui/src/views/system/shared-resources/knowledge/index.vue
+++ b/ui/src/views/system/shared-resources/knowledge/index.vue
@@ -136,6 +136,7 @@ function handleSearchChange(query?: Dict<unknown>) {
                     label="分词索引"
                     :api="SystemSharedKnowledgeApi"
                     :knowledge="knowledge"
+                    v-if="perm.knowledge.share.token()"
                   />
                   <!-- MCP 服务配置 -->
                   <McpConfigKnowledgeAction