diff --git a/backend/utils.py b/backend/utils.py
index 5ab8368..0ccb719 100644
--- a/backend/utils.py
+++ b/backend/utils.py
@@ -5,7 +5,7 @@ from functools import lru_cache
 from django.core.exceptions import ObjectDoesNotExist
 from django.db.models import Q
 from rest_framework.response import Response
-from .models import AbnormalUserLog, UserRole, Permission, PlayerDailyStats, MerchantDailyStats, \
+from .models import AbnormalUserLog, UserRole, RolePermission, Permission, PlayerDailyStats, MerchantDailyStats, \
     ManagerRenewalDailyStats, ManagerDailyStats, LeaderDailyStats, WithdrawalDailyStats
 
 from django.db import transaction
@@ -96,13 +96,45 @@ def verify_kefu_permission(request, username_from_frontend=None):
             'msg': '身份错误，无权操作其他账号，相关操作已记录'
         }, status=403)
 
-    # ---------- 4. 获取用户的所有权限（通过角色） ----------
-    # 步骤1：获取用户的所有角色ID
-    role_ids = UserRole.query.filter(account_id=current_user.phone).values_list('role_id', flat=True)
-    # 步骤2：通过角色ID获取权限编码
-    permissions = list(Permission.query.filter(
-        rolepermission__role_id__in=role_ids
-    ).values_list('perm_code', flat=True).distinct())
+    # ---------- 4. 获取用户的所有权限 ----------
+    # 优先从 RBAC 表获取，若 RBAC 表不存在/无数据则回退到旧 account_permission 表
+    try:
+        user_roles = UserRole.query.filter(account_id=current_user.phone).select_related('role')
+        role_ids = [ur.role_id for ur in user_roles]
+        if role_ids:
+            perm_ids = RolePermission.query.filter(role_id__in=role_ids).values_list('permission_id', flat=True)
+            permissions = list(Permission.query.filter(
+                perm_id__in=perm_ids
+            ).values_list('perm_code', flat=True).distinct())
+        else:
+            permissions = []
+    except Exception:
+        permissions = []
+
+    # RBAC 无数据时，回退到旧 account_permission 表
+    if not permissions:
+        try:
+            from config.models import AccountPermission
+            old_perms = AccountPermission.query.filter(
+                account_id=current_user.phone,
+                is_enabled=True
+            ).values_list('permission_code', flat=True)
+            # 旧权限码映射到新权限编码
+            perm_code_map = {
+                1: '001',   # 超级管理员
+                2: '002ab', # 平台订单管理
+                3: '002ac', # 处罚管理
+                4: '002ad', # 退款管理
+                5: '002ae', # 店铺管理
+                6: '002af', # 商品审核
+                7: '002ag', # 提现审核
+                8: '002ah', # 用户管理
+                9: '002ai', # 数据统计
+                10: '002aj', # 系统配置
+            }
+            permissions = [perm_code_map.get(code, str(code)) for code in old_perms if code in perm_code_map]
+        except Exception:
+            permissions = []
 
     if not permissions:
         logger.warning(f"用户 {current_user.phone} 没有任何权限，请检查角色分配")
diff --git a/create_rbac_tables.sql b/create_rbac_tables.sql
new file mode 100644
index 0000000..aff10cd
--- /dev/null
+++ b/create_rbac_tables.sql
@@ -0,0 +1,82 @@
+-- ============================================================
+-- RBAC 表创建脚本
+-- 仅创建生产数据库中缺失的表，已存在的表会被跳过
+-- 执行方式: mysql -u root -p xaio_cheng_xu < create_rbac_tables.sql
+-- 注意: 索引和外键单独处理，避免重复创建报错
+-- ============================================================
+
+-- ============================================================
+-- Part 1: backend RBAC 表（小写表名，verify_kefu_permission 使用）
+-- ============================================================
+
+CREATE TABLE IF NOT EXISTS `role` (
+    `role_id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY,
+    `role_code` varchar(50) NOT NULL UNIQUE,
+    `role_name` varchar(50) NOT NULL,
+    `description` varchar(200) NOT NULL,
+    `create_time` datetime(6) NOT NULL,
+    `update_time` datetime(6) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS `permission` (
+    `perm_id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY,
+    `perm_code` varchar(100) NOT NULL UNIQUE,
+    `perm_name` varchar(100) NOT NULL,
+    `description` varchar(200) NOT NULL,
+    `create_time` datetime(6) NOT NULL,
+    `update_time` datetime(6) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS `user_role` (
+    `id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY,
+    `account_id` varchar(11) NOT NULL,
+    `create_time` datetime(6) NOT NULL,
+    `update_time` datetime(6) NOT NULL,
+    `role_id` integer NOT NULL,
+    UNIQUE KEY `user_role_account_id_role_id_uniq` (`account_id`, `role_id`)
+);
+
+CREATE TABLE IF NOT EXISTS `role_permission` (
+    `id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY,
+    `create_time` datetime(6) NOT NULL,
+    `permission_id` integer NOT NULL,
+    `role_id` integer NOT NULL,
+    UNIQUE KEY `role_permission_role_id_permission_id_uniq` (`role_id`, `permission_id`)
+);
+
+-- backend 表索引（忽略已存在的错误）
+CREATE INDEX `user_role_account_id_idx` ON `user_role` (`account_id`);
+
+-- backend 外键约束
+ALTER TABLE `user_role` ADD CONSTRAINT `user_role_role_fk` FOREIGN KEY (`role_id`) REFERENCES `role` (`role_id`);
+ALTER TABLE `role_permission` ADD CONSTRAINT `role_permission_permission_fk` FOREIGN KEY (`permission_id`) REFERENCES `permission` (`perm_id`);
+ALTER TABLE `role_permission` ADD CONSTRAINT `role_permission_role_fk` FOREIGN KEY (`role_id`) REFERENCES `role` (`role_id`);
+
+-- ============================================================
+-- Part 2: gvsdsdk RBAC 表（大写表名，UUID 主键）
+-- ============================================================
+
+CREATE TABLE IF NOT EXISTS `AccountActivation` (`AccountActivationCode` BINARY(6) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `CreateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `EphemeralToken` (`ELTUUID` BINARY(16) NOT NULL PRIMARY KEY, `ELTUserUUID` BINARY(16) NOT NULL, `ELTCreateTime` datetime(6) NOT NULL, `ELTEndTime` datetime(6) NOT NULL, `ELTType` smallint NOT NULL, `ELTAllowIP` json NOT NULL, `ELTStatus` smallint NOT NULL);
+CREATE TABLE IF NOT EXISTS `Password` (`UserUUID` BINARY(16) NOT NULL PRIMARY KEY, `Password` varchar(1024) NOT NULL);
+CREATE TABLE IF NOT EXISTS `Permission` (`PermUUID` BINARY(16) NOT NULL PRIMARY KEY, `TenantUUID` BINARY(16) NOT NULL, `PermName` varchar(128) NOT NULL, `PermCode` varchar(128) NOT NULL, `PermCategory` varchar(64) NOT NULL, `PermStatus` smallint NOT NULL, `PermDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `Position` (`PositionUUID` BINARY(16) NOT NULL PRIMARY KEY, `TenantUUID` BINARY(16) NOT NULL, `PositionName` varchar(128) NOT NULL, `PositionCode` varchar(64) NOT NULL, `PositionLevel` smallint NOT NULL, `PositionStatus` smallint NOT NULL, `PositionDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL, `UpdateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `PositionTemplate` (`PositionTemplateUUID` BINARY(16) NOT NULL PRIMARY KEY, `TenantUUID` BINARY(16) NOT NULL, `TemplateName` varchar(128) NOT NULL, `TemplateCode` varchar(64) NOT NULL, `TemplateStatus` smallint NOT NULL, `TemplateDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL, `UpdateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `PositionTemplatePermission` (`PTPermUUID` BINARY(16) NOT NULL PRIMARY KEY, `PositionTemplateUUID` BINARY(16) NOT NULL, `PermUUID` BINARY(16) NOT NULL, `CreateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `Role` (`RoleUUID` BINARY(16) NOT NULL PRIMARY KEY, `TenantUUID` BINARY(16) NOT NULL, `RoleName` varchar(128) NOT NULL, `RoleType` smallint NOT NULL, `RoleStatus` smallint NOT NULL, `AssignScope` smallint NOT NULL, `AssignScopeUUID` BINARY(16) NULL, `RoleDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `RolePermission` (`RolePermUUID` BINARY(16) NOT NULL PRIMARY KEY, `RoleUUID` BINARY(16) NOT NULL, `PermUUID` BINARY(16) NOT NULL, `CreateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `RoleShop` (`RoleShopUUID` BINARY(16) NOT NULL PRIMARY KEY, `RoleUUID` BINARY(16) NOT NULL, `ShopUUID` BINARY(16) NOT NULL, `IsMainShop` smallint NOT NULL, `CreateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `Shop` (`ShopUUID` BINARY(16) NOT NULL PRIMARY KEY, `CompanyUUID` BINARY(16) NOT NULL, `ShopName` varchar(128) NOT NULL, `ShopCode` varchar(64) NOT NULL, `ShopType` smallint NOT NULL, `ShopStatus` smallint NOT NULL, `ShopAddress` varchar(512) NOT NULL, `ShopContact` varchar(128) NOT NULL, `ShopPhone` varchar(32) NOT NULL, `ShopDesc` varchar(512) NOT NULL, `CreateTime` datetime(6) NOT NULL, `UpdateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `User2FA` (`User2FAUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `SecretKey` varchar(64) NOT NULL, `IsEnabled` smallint NOT NULL, `Verified` smallint NOT NULL, `LastUsedAt` datetime(6) NULL, `CreateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `UserABAC` (`UserABACUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `HierarchicalPermissionIdentifiers` varchar(256) NOT NULL);
+CREATE TABLE IF NOT EXISTS `UserAvatar` (`UserUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserAvatar` longblob NOT NULL, `AvatarUploadTime` datetime(6) NOT NULL, `AvatarFileType` varchar(16) NOT NULL);
+CREATE TABLE IF NOT EXISTS `UserDept` (`UserDeptUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `DeptUUID` BINARY(16) NOT NULL, `PositionUUID` BINARY(16) NULL, `IsMainDept` smallint NOT NULL, `CreateTime` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `UserLoginLog` (`LogUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `LoginIP` varchar(39) NOT NULL, `LoginPlatform` varchar(32) NOT NULL, `LoginStatus` smallint NOT NULL, `LoginTime` datetime(6) NOT NULL, `UserAgent` varchar(512) NOT NULL);
+CREATE TABLE IF NOT EXISTS `UserPending2FA` (`PendingUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL UNIQUE, `SecretKey` varchar(64) NOT NULL, `ExpireAt` datetime(6) NOT NULL);
+CREATE TABLE IF NOT EXISTS `UserRole` (`UserRoleUUID` BINARY(16) NOT NULL PRIMARY KEY, `UserUUID` BINARY(16) NOT NULL, `RoleUUID` BINARY(16) NOT NULL, `CompanyUUID` BINARY(16) NOT NULL, `CreateTime` datetime(6) NOT NULL);
+
+-- gvsdsdk 索引
+CREATE INDEX `EphemELTUserUUID_idx` ON `EphemeralToken` (`ELTUserUUID`);
+CREATE INDEX `EphemELTStatus_idx` ON `EphemeralToken` (`ELTStatus`);
+CREATE INDEX `User2FA_UserUUID_idx` ON `User2FA` (`UserUUID`);
+CREATE INDEX `UserLoginLog_UserUUID_idx` ON `UserLoginLog` (`UserUUID`);