diff --git a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/definition/BpmProcessDefinitionController.java b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/definition/BpmProcessDefinitionController.java
index bef74733e..4e38294c3 100644
--- a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/definition/BpmProcessDefinitionController.java
+++ b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/definition/BpmProcessDefinitionController.java
@@ -32,11 +32,9 @@ public class BpmProcessDefinitionController {
     @Resource
     private BpmProcessDefinitionService bpmDefinitionService;
 
-    // TODO 芋艿：权限相关
-
     @GetMapping ("/page")
     @ApiOperation(value = "获得流程定义分页")
-    @PreAuthorize("@ss.hasPermission('bpm:model:query')") // 暂时使用 model 的权限标识
+    @PreAuthorize("@ss.hasPermission('bpm:process-definition:query')")
     public CommonResult<PageResult<BpmProcessDefinitionPageItemRespVO>> getProcessDefinitionPage(
             BpmProcessDefinitionPageReqVO pageReqVO) {
         return success(bpmDefinitionService.getProcessDefinitionPage(pageReqVO));
@@ -44,6 +42,7 @@ public class BpmProcessDefinitionController {
 
     @GetMapping ("/list")
     @ApiOperation(value = "获得流程定义列表")
+    @PreAuthorize("@ss.hasPermission('bpm:process-definition:query')")
     public CommonResult<List<BpmProcessDefinitionRespVO>> getProcessDefinitionList(
             BpmProcessDefinitionListReqVO listReqVO) {
         return success(bpmDefinitionService.getProcessDefinitionList(listReqVO));
@@ -52,7 +51,7 @@ public class BpmProcessDefinitionController {
     @GetMapping ("/get-bpmn-xml")
     @ApiOperation(value = "获得流程定义的 BPMN XML")
     @ApiImplicitParam(name = "id", value = "编号", required = true, example = "1024", dataTypeClass = String.class)
-    @PreAuthorize("@ss.hasPermission('bpm:model:query')") // 暂时使用 model 的权限标识
+    @PreAuthorize("@ss.hasPermission('bpm:process-definition:query')")
     public CommonResult<String> getProcessDefinitionBpmnXML(@RequestParam("id") String id) {
         String bpmnXML = bpmDefinitionService.getProcessDefinitionBpmnXML(id);
         return success(bpmnXML);
diff --git a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/definition/BpmTaskAssignRuleController.java b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/definition/BpmTaskAssignRuleController.java
index e00dad1ab..b1f3186fd 100644
--- a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/definition/BpmTaskAssignRuleController.java
+++ b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/definition/BpmTaskAssignRuleController.java
@@ -6,6 +6,10 @@ import cn.iocoder.yudao.adminserver.modules.bpm.controller.definition.vo.rule.Bp
 import cn.iocoder.yudao.adminserver.modules.bpm.service.definition.BpmTaskAssignRuleService;
 import cn.iocoder.yudao.framework.common.pojo.CommonResult;
 import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiImplicitParam;
+import io.swagger.annotations.ApiImplicitParams;
+import io.swagger.annotations.ApiOperation;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 
@@ -25,6 +29,12 @@ public class BpmTaskAssignRuleController {
     private BpmTaskAssignRuleService taskAssignRuleService;
 
     @GetMapping("/list")
+    @ApiOperation(value = "获得任务分配规则列表")
+    @ApiImplicitParams({
+            @ApiImplicitParam(name = "modelId", value = "模型编号", example = "1024", dataTypeClass = String.class),
+            @ApiImplicitParam(name = "processDefinitionId", value = "刘晨定义的编号", example = "2048", dataTypeClass = String.class)
+    })
+    @PreAuthorize("@ss.hasPermission('bpm:task-assign-rule:query')")
     public CommonResult<List<BpmTaskAssignRuleRespVO>> getTaskAssignRuleList(
             @RequestParam(value = "modelId", required = false) String modelId,
             @RequestParam(value = "processDefinitionId", required = false) String processDefinitionId) {
@@ -32,11 +42,15 @@ public class BpmTaskAssignRuleController {
     }
 
     @PostMapping("/create")
+    @ApiOperation(value = "创建任务分配规则")
+    @PreAuthorize("@ss.hasPermission('bpm:task-assign-rule:create')")
     public CommonResult<Long> createTaskAssignRule(@Valid @RequestBody BpmTaskAssignRuleCreateReqVO reqVO) {
         return success(taskAssignRuleService.createTaskAssignRule(reqVO));
     }
 
     @PutMapping("/update")
+    @ApiOperation(value = "更新任务分配规则")
+    @PreAuthorize("@ss.hasPermission('bpm:task-assign-rule:update')")
     public CommonResult<Boolean> updateTaskAssignRule(@Valid @RequestBody BpmTaskAssignRuleUpdateReqVO reqVO) {
         taskAssignRuleService.updateTaskAssignRule(reqVO);
         return success(true);
diff --git a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/oa/BpmOALeaveController.java b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/oa/BpmOALeaveController.java
index ed7b2f719..4f8a394c8 100644
--- a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/oa/BpmOALeaveController.java
+++ b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/oa/BpmOALeaveController.java
@@ -11,6 +11,7 @@ import cn.iocoder.yudao.framework.common.pojo.PageResult;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiImplicitParam;
 import io.swagger.annotations.ApiOperation;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 
@@ -35,15 +36,15 @@ public class BpmOALeaveController {
     @Resource
     private BpmOALeaveService leaveService;
 
-    // TODO @芋艿：权限
-
     @PostMapping("/create")
+    @PreAuthorize("@ss.hasPermission('bpm:oa-leave:create')")
     @ApiOperation("创建请求申请")
     public CommonResult<Long> createLeave(@Valid @RequestBody BpmOALeaveCreateReqVO createReqVO) {
         return success(leaveService.createLeave(getLoginUserId(), createReqVO));
     }
 
     @GetMapping("/get")
+    @PreAuthorize("@ss.hasPermission('bpm:oa-leave:query')")
     @ApiOperation("获得请假申请")
     @ApiImplicitParam(name = "id", value = "编号", required = true, example = "1024", dataTypeClass = Long.class)
     public CommonResult<BpmOALeaveRespVO> getLeave(@RequestParam("id") Long id) {
@@ -52,6 +53,7 @@ public class BpmOALeaveController {
     }
 
     @GetMapping("/page")
+    @PreAuthorize("@ss.hasPermission('bpm:oa-leave:query')")
     @ApiOperation("获得请假申请分页")
     public CommonResult<PageResult<BpmOALeaveRespVO>> getLeavePage(@Valid BpmOALeavePageReqVO pageVO) {
         PageResult<BpmOALeaveDO> pageResult = leaveService.getLeavePage(getLoginUserId(), pageVO);
diff --git a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmActivityController.java b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmActivityController.java
index b348603c3..b5b7f59d9 100644
--- a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmActivityController.java
+++ b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmActivityController.java
@@ -8,6 +8,7 @@ import cn.iocoder.yudao.framework.common.util.servlet.ServletUtils;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiImplicitParam;
 import io.swagger.annotations.ApiOperation;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -30,12 +31,11 @@ public class BpmActivityController {
     @Resource
     private BpmActivityService activityService;
 
-    // TODO 芋艿：权限
-
     @GetMapping("/list")
     @ApiOperation(value = "生成指定流程实例的高亮流程图",
             notes = "只高亮进行中的任务。不过要注意，该接口暂时没用，通过前端的 ProcessViewer.vue 界面的 highlightDiagram 方法生成")
     @ApiImplicitParam(name = "id", value = "流程实例的编号", required = true, dataTypeClass = String.class)
+    @PreAuthorize("@ss.hasPermission('bpm:task:query')")
     public CommonResult<List<BpmActivityRespVO>> getActivityList(
             @RequestParam("processInstanceId") String processInstanceId) {
         return success(activityService.getActivityListByProcessInstanceId(processInstanceId));
@@ -45,6 +45,7 @@ public class BpmActivityController {
     @ApiOperation(value = "生成指定流程实例的高亮流程图",
             notes = "只高亮进行中的任务。不过要注意，该接口暂时没用，通过前端的 ProcessViewer.vue 界面的 highlightDiagram 方法生成")
     @ApiImplicitParam(name = "id", value = "流程实例的编号", required = true, dataTypeClass = String.class)
+    @PreAuthorize("@ss.hasPermission('bpm:task:query')")
     public void generateHighlightDiagram(@RequestParam("processInstanceId") String processInstanceId,
                                          HttpServletResponse response) throws IOException {
         byte[] bytes = activityService.generateHighlightDiagram(processInstanceId);
diff --git a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmProcessInstanceController.java b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmProcessInstanceController.java
index a389c0dc9..4240e39af 100644
--- a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmProcessInstanceController.java
+++ b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmProcessInstanceController.java
@@ -7,6 +7,7 @@ import cn.iocoder.yudao.framework.common.pojo.PageResult;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiImplicitParam;
 import io.swagger.annotations.ApiOperation;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 
@@ -24,17 +25,17 @@ public class BpmProcessInstanceController {
 
     @Resource
     private BpmProcessInstanceService processInstanceService;
-
-    // TODO 芋艿：权限
-
+    
     @PostMapping("/create")
     @ApiOperation("新建流程实例")
+    @PreAuthorize("@ss.hasPermission('bpm:process-instance:query')")
     public CommonResult<String> createProcessInstance(@Valid @RequestBody BpmProcessInstanceCreateReqVO createReqVO) {
         return success(processInstanceService.createProcessInstance(getLoginUserId(), createReqVO));
     }
 
     @DeleteMapping("/cancel")
     @ApiOperation(value = "取消流程实例", notes = "撤回发起的流程")
+    @PreAuthorize("@ss.hasPermission('bpm:process-instance:cancel')")
     public CommonResult<Boolean> cancelProcessInstance(@Valid @RequestBody BpmProcessInstanceCancelReqVO cancelReqVO) {
         processInstanceService.cancelProcessInstance(getLoginUserId(), cancelReqVO);
         return success(true);
@@ -42,6 +43,7 @@ public class BpmProcessInstanceController {
 
     @GetMapping("/my-page")
     @ApiOperation(value = "获得我的实例分页列表", notes = "在【我的流程】菜单中，进行调用")
+    @PreAuthorize("@ss.hasPermission('bpm:process-instance:query')")
     public CommonResult<PageResult<BpmProcessInstancePageItemRespVO>> getMyProcessInstancePage(
             @Valid BpmProcessInstanceMyPageReqVO pageReqVO) {
         return success(processInstanceService.getMyProcessInstancePage(getLoginUserId(), pageReqVO));
@@ -50,6 +52,7 @@ public class BpmProcessInstanceController {
     @GetMapping("/get")
     @ApiOperation(value = "获得指定流程实例", notes = "在【流程详细】界面中，进行调用")
     @ApiImplicitParam(name = "id", value = "流程实例的编号", required = true, dataTypeClass = String.class)
+    @PreAuthorize("@ss.hasPermission('bpm:process-instance:query')")
     public CommonResult<BpmProcessInstanceRespVO> getProcessInstance(@RequestParam("id") String id) {
         return success(processInstanceService.getProcessInstanceVO(id));
     }
diff --git a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmTaskController.java b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmTaskController.java
index 5a0b6af4b..3ad59a7aa 100644
--- a/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmTaskController.java
+++ b/yudao-admin-server/src/main/java/cn/iocoder/yudao/adminserver/modules/bpm/controller/task/BpmTaskController.java
@@ -8,6 +8,7 @@ import cn.iocoder.yudao.framework.common.util.servlet.ServletUtils;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiImplicitParam;
 import io.swagger.annotations.ApiOperation;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 
@@ -29,22 +30,23 @@ public class BpmTaskController {
     @Resource
     private BpmTaskService taskService;
 
-    // TODO 芋艿：权限、validation；
-
     @GetMapping("todo-page")
     @ApiOperation("获取 Todo 待办任务分页")
+    @PreAuthorize("@ss.hasPermission('bpm:task:query')")
     public CommonResult<PageResult<BpmTaskTodoPageItemRespVO>> getTodoTaskPage(@Valid BpmTaskTodoPageReqVO pageVO) {
         return success(taskService.getTodoTaskPage(getLoginUserId(), pageVO));
     }
 
     @GetMapping("done-page")
     @ApiOperation("获取 Done 已办任务分页")
+    @PreAuthorize("@ss.hasPermission('bpm:task:query')")
     public CommonResult<PageResult<BpmTaskDonePageItemRespVO>> getTodoTaskPage(@Valid BpmTaskDonePageReqVO pageVO) {
         return success(taskService.getDoneTaskPage(getLoginUserId(), pageVO));
     }
 
     @PutMapping("/approve")
     @ApiOperation("通过任务")
+    @PreAuthorize("@ss.hasPermission('bpm:task:update')")
     public CommonResult<Boolean> approveTask(@Valid @RequestBody BpmTaskApproveReqVO reqVO) {
         taskService.approveTask(getLoginUserId(), reqVO);
         return success(true);
@@ -52,6 +54,7 @@ public class BpmTaskController {
 
     @PutMapping("/reject")
     @ApiOperation("不通过任务")
+    @PreAuthorize("@ss.hasPermission('bpm:task:update')")
     public CommonResult<Boolean> rejectTask(@Valid @RequestBody BpmTaskRejectReqVO reqVO) {
         taskService.rejectTask(getLoginUserId(), reqVO);
         return success(true);
@@ -59,6 +62,7 @@ public class BpmTaskController {
 
     @PutMapping("/update-assignee")
     @ApiOperation(value = "更新任务的负责人", notes = "用于【流程详情】的【转派】按钮")
+    @PreAuthorize("@ss.hasPermission('bpm:task:update')")
     public CommonResult<Boolean> updateTaskAssignee(@Valid @RequestBody BpmTaskUpdateAssigneeReqVO reqVO) {
         taskService.updateTaskAssignee(getLoginUserId(), reqVO);
         return success(true);
@@ -67,6 +71,7 @@ public class BpmTaskController {
     @GetMapping("/list-by-process-instance-id")
     @ApiOperation(value = "获得指定流程实例的任务列表", notes = "包括完成的、未完成的")
     @ApiImplicitParam(name = "processInstanceId", value = "流程实例的编号", required = true, dataTypeClass = String.class)
+    @PreAuthorize("@ss.hasPermission('bpm:task:query')")
     public CommonResult<List<BpmTaskRespVO>> getTaskListByProcessInstanceId(
             @RequestParam("processInstanceId") String processInstanceId) {
         return success(taskService.getTaskListByProcessInstanceId(processInstanceId));
diff --git a/yudao-admin-ui/src/router/index.js b/yudao-admin-ui/src/router/index.js
index 17a82ed97..0da45e8f6 100644
--- a/yudao-admin-ui/src/router/index.js
+++ b/yudao-admin-ui/src/router/index.js
@@ -60,149 +60,112 @@ export const constantRoutes = [
     path: '',
     component: Layout,
     redirect: 'index',
-    children: [
-      {
+    children: [{
         path: 'index',
         component: (resolve) => require(['@/views/index'], resolve),
         name: '首页',
-        meta: { title: '首页', icon: 'dashboard', noCache: true, affix: true }
+        meta: {title: '首页', icon: 'dashboard', noCache: true, affix: true}
       }
     ]
-  },
-  {
+  }, {
     path: '/user',
     component: Layout,
     hidden: true,
     redirect: 'noredirect',
-    children: [
-      {
+    children: [{
         path: 'profile',
         component: (resolve) => require(['@/views/system/user/profile/index'], resolve),
         name: 'Profile',
-        meta: { title: '个人中心', icon: 'user' }
+        meta: {title: '个人中心', icon: 'user'}
       }
     ]
-  },
-  {
+  }, {
     path: '/dict',
     component: Layout,
     hidden: true,
-    children: [
-      {
+    children: [{
         path: 'type/data/:dictId(\\d+)',
         component: (resolve) => require(['@/views/system/dict/data'], resolve),
         name: 'Data',
-        meta: { title: '字典数据', icon: '' }
+        meta: {title: '字典数据', icon: ''}
       }
     ]
-  },
-  {
+  }, {
     path: '/job',
     component: Layout,
     hidden: true,
-    children: [
-      {
+    children: [{
         path: 'log',
         component: (resolve) => require(['@/views/infra/job/log'], resolve),
         name: 'JobLog',
-        meta: { title: '调度日志' }
+        meta: {title: '调度日志'}
       }
     ]
-  },
-  {
+  }, {
     path: '/codegen',
     component: Layout,
     hidden: true,
-    children: [
-      {
+    children: [{
         path: 'edit/:tableId(\\d+)',
         component: (resolve) => require(['@/views/tool/codegen/editTable'], resolve),
         name: 'GenEdit',
-        meta: { title: '修改生成配置' }
-      }
-    ]
-  },
-  {
-    path: '/bpm',
-    component: Layout,
-    hidden: true,
-    redirect: 'noredirect',
-    children: [
-      {
-        path: 'oa/leave/create',
-        component: (resolve) => require(['@/views/bpm/oa/leave/create'], resolve),
-        name: '发起 OA 请假',
-        meta: { title: '发起 OA 请假', icon: 'form' }
-      }, {
-        path: 'oa/leave/detail',
-        component: (resolve) => require(['@/views/bpm/oa/leave/detail'], resolve),
-        name: '查看 OA 请假',
-        meta: { title: '查看 OA 请假', icon: 'view' }
-      }
-    ]
-  },
-  {
-    path: '/bpm',
-    component: Layout,
-    hidden: true,
-    children: [
-      {
-        path: 'manager/form/edit',
-        component: (resolve) => require(['@/views/bpm/form/formEditor'], resolve),
-        name: '流程表单-编辑',
-        meta: { title: '流程表单-编辑' }
-      }
-    ]
-  },
-  {
-    path: '/bpm',
-    component: Layout,
-    hidden: true,
-    children: [
-      {
-        path: 'manager/model/design',
-        component: (resolve) => require(['@/views/bpm/model/modelEditor'], resolve),
-        name: '设计流程',
-        meta: { title: '设计流程' }
-      }
-    ]
-  },
-  {
-    path: '/bpm',
-    component: Layout,
-    hidden: true,
-    children: [
-      {
-        path: 'manager/definition',
-        component: (resolve) => require(['@/views/bpm/definition/index'], resolve),
-        name: '流程定义',
-        meta: { title: '流程定义' }
+        meta: {title: '修改生成配置'}
       }
     ]
   }, {
     path: '/bpm',
     component: Layout,
     hidden: true,
-    children: [
-      {
+    redirect: 'noredirect',
+    children: [{
+        path: 'oa/leave/create',
+        component: (resolve) => require(['@/views/bpm/oa/leave/create'], resolve),
+        name: '发起 OA 请假',
+        meta: {title: '发起 OA 请假', icon: 'form'}
+      }, {
+        path: 'oa/leave/detail',
+        component: (resolve) => require(['@/views/bpm/oa/leave/detail'], resolve),
+        name: '查看 OA 请假',
+        meta: {title: '查看 OA 请假', icon: 'view'}
+      }
+    ]
+  }, {
+    path: '/bpm',
+    component: Layout,
+    hidden: true,
+    children: [{
+        path: 'manager/form/edit',
+        component: (resolve) => require(['@/views/bpm/form/formEditor'], resolve),
+        name: '流程表单-编辑',
+        meta: {title: '流程表单-编辑'}
+      }, {
+        path: 'manager/definition',
+        component: (resolve) => require(['@/views/bpm/definition/index'], resolve),
+        name: '流程定义',
+        meta: {title: '流程定义'}
+      }, {
+        path: 'manager/model/design',
+        component: (resolve) => require(['@/views/bpm/model/modelEditor'], resolve),
+        name: '设计流程',
+        meta: {title: '设计流程'}
+      }, {
         path: 'process-instance/create',
         component: (resolve) => require(['@/views/bpm/processInstance/create'], resolve),
         name: '发起流程',
-        meta: { title: '发起流程' }
-      },
-      {
+        meta: {title: '发起流程'}
+      }, {
         path: 'process-instance/detail',
         component: (resolve) => require(['@/views/bpm/processInstance/detail'], resolve),
         name: '流程详情',
-        meta: { title: '流程详情' }
+        meta: {title: '流程详情'}
       }
     ]
-  },
+  }
 ]
 
 export default new Router({
   base: process.env.VUE_APP_APP_NAME ? process.env.VUE_APP_APP_NAME : "/",
   mode: 'history', // 去掉url中的#
-  scrollBehavior: () => ({ y: 0 }),
+  scrollBehavior: () => ({y: 0}),
   routes: constantRoutes
 })
diff --git a/yudao-admin-ui/src/views/bpm/definition/index.vue b/yudao-admin-ui/src/views/bpm/definition/index.vue
index ec89f82b4..88afd64df 100644
--- a/yudao-admin-ui/src/views/bpm/definition/index.vue
+++ b/yudao-admin-ui/src/views/bpm/definition/index.vue
@@ -46,9 +46,8 @@
       <el-table-column label="定义描述" align="center" prop="description" width="300" show-overflow-tooltip />
       <el-table-column label="操作" align="center" width="150" fixed="right">
         <template slot-scope="scope">
-          <!-- TODO 权限 -->
           <el-button size="mini" type="text" icon="el-icon-s-custom" @click="handleAssignRule(scope.row)"
-                     v-hasPermi="['bpm:model:update']">分配规则</el-button>
+                     v-hasPermi="['bpm:task-assign-rule:update']">分配规则</el-button>
         </template>
       </el-table-column>
     </el-table>
diff --git a/yudao-admin-ui/src/views/bpm/model/index.vue b/yudao-admin-ui/src/views/bpm/model/index.vue
index d290395c7..1c70d7826 100644
--- a/yudao-admin-ui/src/views/bpm/model/index.vue
+++ b/yudao-admin-ui/src/views/bpm/model/index.vue
@@ -91,13 +91,12 @@
                      v-hasPermi="['bpm:model:update']">修改流程</el-button>
           <el-button size="mini" type="text" icon="el-icon-setting" @click="handleDesign(scope.row)"
                      v-hasPermi="['bpm:model:update']">设计流程</el-button>
-          <!-- TODO 权限 -->
           <el-button size="mini" type="text" icon="el-icon-s-custom" @click="handleAssignRule(scope.row)"
-                     v-hasPermi="['bpm:model:update']">分配规则</el-button>
+                     v-hasPermi="['bpm:task-assign-rule:query']">分配规则</el-button>
           <el-button size="mini" type="text" icon="el-icon-thumb" @click="handleDeploy(scope.row)"
                      v-hasPermi="['bpm:model:deploy']">发布流程</el-button>
           <el-button size="mini" type="text" icon="el-icon-ice-cream-round" @click="handleDefinitionList(scope.row)"
-                     v-hasPermi="['bpm:model:query']">流程定义</el-button>
+                     v-hasPermi="['bpm:process-definition:query']">流程定义</el-button>
           <el-button size="mini" type="text" icon="el-icon-delete" @click="handleDelete(scope.row)"
                      v-hasPermi="['bpm:model:delete']">删除</el-button>
         </template>
diff --git a/yudao-admin-ui/src/views/bpm/oa/leave/index.vue b/yudao-admin-ui/src/views/bpm/oa/leave/index.vue
index b8be6cd62..eeff6d1d1 100644
--- a/yudao-admin-ui/src/views/bpm/oa/leave/index.vue
+++ b/yudao-admin-ui/src/views/bpm/oa/leave/index.vue
@@ -30,7 +30,7 @@
     <!-- 操作工具栏 -->
     <el-row :gutter="10" class="mb8">
       <el-col :span="1.5">
-        <el-button type="primary" icon="el-icon-plus" size="mini" @click="handleAdd">发起请假</el-button>
+        <el-button type="primary" icon="el-icon-plus" size="mini" v-hasPermi="['bpm:oa-leave:create']" @click="handleAdd">发起请假</el-button>
       </el-col>
       <right-toolbar :showSearch.sync="showSearch" @queryTable="getList"></right-toolbar>
     </el-row>
@@ -59,8 +59,9 @@
       <el-table-column label="操作" align="center" class-name="small-padding fixed-width" width="200">
         <template slot-scope="scope">
           <el-button size="mini" type="text" icon="el-icon-delete" @click="handleCancel(scope.row)"
-                     v-if="scope.row.result === 1">取消请假</el-button>
-          <el-button size="mini" type="text" icon="el-icon-view" @click="handleDetail(scope.row)">详情</el-button>
+                     v-hasPermi="['bpm:oa-leave:create']" v-if="scope.row.result === 1">取消请假</el-button>
+          <el-button size="mini" type="text" icon="el-icon-view" @click="handleDetail(scope.row)"
+                     v-hasPermi="['bpm:oa-leave:query']">详情</el-button>
           <el-button size="mini" type="text" icon="el-icon-edit" @click="handleProcessDetail(scope.row)">审批进度</el-button>
         </template>
       </el-table-column>
diff --git a/yudao-admin-ui/src/views/bpm/processInstance/index.vue b/yudao-admin-ui/src/views/bpm/processInstance/index.vue
index 98c7dc94e..94d315ddc 100644
--- a/yudao-admin-ui/src/views/bpm/processInstance/index.vue
+++ b/yudao-admin-ui/src/views/bpm/processInstance/index.vue
@@ -40,7 +40,8 @@
     <!-- 操作工具栏 -->
     <el-row :gutter="10" class="mb8">
       <el-col :span="1.5">
-        <el-button type="primary" plain icon="el-icon-plus" size="mini" @click="handleAdd">发起流程</el-button>
+        <el-button type="primary" plain icon="el-icon-plus" size="mini" @click="handleAdd"
+                   v-hasPermi="['bpm:process-instance:query']">发起流程</el-button>
       </el-col>
       <right-toolbar :showSearch.sync="showSearch" @queryTable="getList"></right-toolbar>
     </el-row>
@@ -103,10 +104,10 @@
       </el-table-column>
       <el-table-column label="操作" align="center" class-name="small-padding fixed-width">
         <template slot-scope="scope">
-          <!-- TODO 芋艿：权限 -->
           <el-button type="text" size="small" icon="el-icon-delete" v-if="scope.row.result === 1"
-                     @click="handleCancel(scope.row)">取消</el-button>
-          <el-button size="mini" type="text" icon="el-icon-edit" @click="handleDetail(scope.row)">详情</el-button>
+                     v-hasPermi="['bpm:process-instance:cancel']" @click="handleCancel(scope.row)">取消</el-button>
+          <el-button size="mini" type="text" icon="el-icon-edit" @click="handleDetail(scope.row)"
+                     v-hasPermi="['bpm:process-instance:query']">详情</el-button>
         </template>
       </el-table-column>
     </el-table>
diff --git a/yudao-admin-ui/src/views/bpm/task/done.vue b/yudao-admin-ui/src/views/bpm/task/done.vue
index 25ccca82f..8c7e7e89c 100644
--- a/yudao-admin-ui/src/views/bpm/task/done.vue
+++ b/yudao-admin-ui/src/views/bpm/task/done.vue
@@ -56,11 +56,10 @@
           <span>{{ getDateStar(scope.row.durationInMillis) }}</span>
         </template>
       </el-table-column>
-      <!-- TODO 耗时 -->
       <el-table-column label="操作" align="center" fixed="right" class-name="small-padding fixed-width">
         <template slot-scope="scope">
-          <!-- TODO 权限、颜色 -->
-          <el-button size="mini" type="text" icon="el-icon-edit" @click="handleAudit(scope.row)">详情</el-button>
+          <el-button size="mini" type="text" icon="el-icon-edit" @click="handleAudit(scope.row)"
+                     v-hasPermi="['bpm:task:query']">详情</el-button>
         </template>
       </el-table-column>
     </el-table>
diff --git a/yudao-admin-ui/src/views/bpm/task/todo.vue b/yudao-admin-ui/src/views/bpm/task/todo.vue
index 60340f1e6..360bc23b5 100644
--- a/yudao-admin-ui/src/views/bpm/task/todo.vue
+++ b/yudao-admin-ui/src/views/bpm/task/todo.vue
@@ -38,10 +38,12 @@
       </el-table-column>
       <el-table-column label="操作" align="center" class-name="small-padding fixed-width">
         <template slot-scope="scope">
-          <!-- TODO 权限、颜色 -->
-          <el-button size="mini" type="text" icon="el-icon-edit" @click="handleAudit(scope.row)">审批</el-button>
-          <el-button size="mini" type="text" icon="el-icon-edit" v-if="scope.row.suspensionState === 2">激活</el-button>
-          <el-button size="mini" type="text" icon="el-icon-edit" v-if="scope.row.suspensionState === 1">挂起</el-button>
+          <el-button size="mini" type="text" icon="el-icon-edit" @click="handleAudit(scope.row)"
+                     v-hasPermi="['bpm:task:update']">审批</el-button>
+          <el-button size="mini" type="text" icon="el-icon-edit" v-if="scope.row.suspensionState === 2"
+                     v-hasPermi="['bpm:task:update']">激活</el-button>
+          <el-button size="mini" type="text" icon="el-icon-edit" v-if="scope.row.suspensionState === 1"
+                     v-hasPermi="['bpm:task:update']">挂起</el-button>
         </template>
       </el-table-column>
     </el-table>
diff --git a/yudao-admin-ui/src/views/bpm/taskAssignRule/taskAssignRuleDialog.vue b/yudao-admin-ui/src/views/bpm/taskAssignRule/taskAssignRuleDialog.vue
index 093508599..1c10de1ba 100644
--- a/yudao-admin-ui/src/views/bpm/taskAssignRule/taskAssignRuleDialog.vue
+++ b/yudao-admin-ui/src/views/bpm/taskAssignRule/taskAssignRuleDialog.vue
@@ -19,9 +19,8 @@
         </el-table-column>
         <el-table-column v-if="modelId" label="操作" align="center" width="80" fixed="right">
           <template slot-scope="scope">
-            <!-- TODO 权限 -->
             <el-button size="mini" type="text" icon="el-icon-edit" @click="handleUpdateTaskAssignRule(scope.row)"
-                       v-hasPermi="['bpm:model:update']">修改</el-button>
+                       v-hasPermi="['bpm:task-assign-rule:update']">修改</el-button>
           </template>
         </el-table-column>
       </el-table>
diff --git a/yudao-admin-ui/src/views/system/menu/index.vue b/yudao-admin-ui/src/views/system/menu/index.vue
index e46c2664f..c9bf6d306 100644
--- a/yudao-admin-ui/src/views/system/menu/index.vue
+++ b/yudao-admin-ui/src/views/system/menu/index.vue
@@ -25,7 +25,7 @@
 
     <el-table v-loading="loading" :data="menuList" row-key="id"
               :tree-props="{children: 'children', hasChildren: 'hasChildren'}">
-      <el-table-column prop="name" label="菜单名称" :show-overflow-tooltip="true" width="200"></el-table-column>
+      <el-table-column prop="name" label="菜单名称" :show-overflow-tooltip="true" width="250"></el-table-column>
       <el-table-column prop="icon" label="图标" align="center" width="100">
         <template slot-scope="scope">
           <svg-icon :icon-class="scope.row.icon" />