diff --git a/jituan/services/club_rbac.py b/jituan/services/club_rbac.py
index e901939..2026e25 100644
--- a/jituan/services/club_rbac.py
+++ b/jituan/services/club_rbac.py
@@ -192,20 +192,21 @@ def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None, scop
 def resolve_effective_permission_codes(user, club_id, scope, allowed_club_ids=None):
     """
     菜单与各业务接口统一权限码：当前俱乐部 gvsdsdk 角色。
-    单俱乐部任职且 gvsdsdk 为空时，兜底合并旧 user_role 表（兼容未迁移账号）。
+    gvsdsdk 完全无绑定时才兜底旧 user_role 表（旧表不区分俱乐部，避免多俱乐部串权）。
     """
     from backend.utils import _legacy_backend_role_permissions
+    from gvsdsdk.models import UserRole as SdkUserRole
 
     codes = resolve_permission_codes_for_club(
         user, club_id, allowed_club_ids, scope=scope,
     )
     if codes:
         return codes
-    allowed = {c for c in (allowed_club_ids or []) if c}
-    if len(allowed) <= 1:
-        legacy_codes, _ = _legacy_backend_role_permissions(getattr(user, 'Phone', ''))
-        if legacy_codes:
-            return list(legacy_codes)
+    if SdkUserRole.objects.filter(UserUUID=user.UserUUID).exists():
+        return []
+    legacy_codes, _ = _legacy_backend_role_permissions(getattr(user, 'Phone', ''))
+    if legacy_codes:
+        return list(legacy_codes)
     return []
 
 
diff --git a/jituan/services/kefu_menu.py b/jituan/services/kefu_menu.py
index 65dabe8..ca7e28a 100644
--- a/jituan/services/kefu_menu.py
+++ b/jituan/services/kefu_menu.py
@@ -136,21 +136,44 @@ def build_menu_access_payload(request, username=None):
         if any(child.page_id in visible_ids for child in children):
             visible_ids.append(page.page_id)
 
+    from jituan.constants import DATA_SCOPE_SINGLE
+    from jituan.models import AdminAssignment
+
     club_ctx = build_admin_club_context(request.user)
     club_id = getattr(request, 'club_id', None) or resolve_club_id_from_request(request)
     scope = getattr(request, 'club_scope', None) or resolve_club_scope(request)
     allowed = list(get_allowed_club_ids(request.user))
+    perm_codes = _permission_codes_list(permissions)
+    role_names = user_bound_role_names(request.user, club_id, scope, allowed)
+
+    perm_hint = ''
+    if scope == DATA_SCOPE_SINGLE and not perm_codes:
+        has_assignment = AdminAssignment.query.filter(
+            yonghuid=request.user.UserUID, status=1, club_id=club_id,
+        ).exists()
+        if has_assignment and not role_names:
+            perm_hint = (
+                f'当前俱乐部（{club_id}）已有任职但未绑定功能角色，'
+                '请在「后台用户」中为该俱乐部分配角色后重新登录。'
+            )
+        elif not has_assignment:
+            perm_hint = (
+                f'当前俱乐部（{club_id}）无功能角色；'
+                '请确认已在该俱乐部绑定 gvsdsdk 角色（与数据范围任职是两套配置）。'
+            )
+
     path_by_id = {p.page_id: p.path for p in pages if p.path}
     visible_paths = [path_by_id[pid] for pid in visible_ids if pid in path_by_id]
     return {
         'visible_page_ids': sorted(set(visible_ids)),
         'visible_paths': visible_paths,
-        'permission_codes': _permission_codes_list(permissions),
-        'role_names': user_bound_role_names(request.user, club_id, scope, allowed),
+        'permission_codes': perm_codes,
+        'role_names': role_names,
         'yonghuid': getattr(request.user, 'UserUID', '') or '',
         'club_id': club_id,
         'club_scope': scope,
         'effective_club_id': club_id,
+        'perm_hint': perm_hint,
         'can_switch_club': bool(club_ctx.get('can_switch_club')),
         'is_group_admin': bool(club_ctx.get('is_group_admin')),
         'menu_ready': True,