diff --git a/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java b/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java
index ae5fcda..d128a4a 100644
--- a/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java
+++ b/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java
@@ -214,6 +214,18 @@ public class AdminPermissionCheck implements ApplicationRunner {
                                                     }
                                                 },
                                             });
+                                    // 系统配置
+                                    put(
+                                            "系统配置",
+                                            new AdminPermission[] {
+                                                new AdminPermission() {
+                                                    {
+                                                        setSort(0);
+                                                        setName("系统配置");
+                                                        setSlug(BPermissionConstant.SYSTEM_CONFIG);
+                                                    }
+                                                },
+                                            });
                                 }
                             });
                     put(
diff --git a/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java b/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java
index f49bc6d..9201f8a 100644
--- a/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java
+++ b/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java
@@ -50,6 +50,10 @@ public class BPermissionConstant {
 
     public static final String RESOURCE_DESTROY = "resource-destroy";
 
+    public static final String SYSTEM_CONFIG = "system-config";
+
+    // ##### 友情分割线 ##################################################
+
     public static final String DATA_USER_NAME = "data-user-name";
     public static final String DATA_USER_EMAIL = "data-user-email";
     public static final String DATA_USER_ID_CARD = "data-user-id-card";
diff --git a/src/main/java/xyz/playedu/api/controller/backend/AppConfigController.java b/src/main/java/xyz/playedu/api/controller/backend/AppConfigController.java
index e363042..bac6ca6 100644
--- a/src/main/java/xyz/playedu/api/controller/backend/AppConfigController.java
+++ b/src/main/java/xyz/playedu/api/controller/backend/AppConfigController.java
@@ -18,7 +18,9 @@ package xyz.playedu.api.controller.backend;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
 
+import xyz.playedu.api.constant.BPermissionConstant;
 import xyz.playedu.api.domain.AppConfig;
+import xyz.playedu.api.middleware.BackendPermissionMiddleware;
 import xyz.playedu.api.request.backend.AppConfigRequest;
 import xyz.playedu.api.service.AppConfigService;
 import xyz.playedu.api.types.JsonResponse;
@@ -36,12 +38,14 @@ public class AppConfigController {
 
     @Autowired private AppConfigService configService;
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.SYSTEM_CONFIG)
     @GetMapping("")
     public JsonResponse index() {
         List<AppConfig> configs = configService.allShow();
         return JsonResponse.data(configs);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.SYSTEM_CONFIG)
     @PutMapping("")
     public JsonResponse save(@RequestBody AppConfigRequest req) {
         configService.saveFromMap(req.getData());