diff --git a/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java b/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java
index d6d7f71..8e71dc3 100644
--- a/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java
+++ b/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java
@@ -37,6 +37,11 @@ public class AdminPermissionCheck implements ApplicationRunner {
             {"部门", "15", "部门-删除", BPermissionConstant.DEPARTMENT_DESTROY},
 
             {"资源分类", "0", "资源分类管理", BPermissionConstant.RESOURCE_CATEGORY},
+
+            {"学员", "0", "学员-查看", BPermissionConstant.USER_INDEX},
+            {"学员", "5", "学员-添加", BPermissionConstant.USER_STORE},
+            {"学员", "10", "学员-编辑", BPermissionConstant.USER_UPDATE},
+            {"学员", "15", "学员-删除", BPermissionConstant.USER_DESTROY},
     };
 
     @Override
diff --git a/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java b/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java
index a0a3638..a326962 100644
--- a/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java
+++ b/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java
@@ -23,4 +23,9 @@ public class BPermissionConstant {
 
     public final static String RESOURCE_CATEGORY = "resource-category";
 
+    public final static String USER_INDEX = "user-index";
+    public final static String USER_STORE = "user-store";
+    public final static String USER_UPDATE = "user-update";
+    public final static String USER_DESTROY = "user-destroy";
+
 }
diff --git a/src/main/java/xyz/playedu/api/controller/backend/ResourceController.java b/src/main/java/xyz/playedu/api/controller/backend/ResourceController.java
index 23c9a16..37010b0 100644
--- a/src/main/java/xyz/playedu/api/controller/backend/ResourceController.java
+++ b/src/main/java/xyz/playedu/api/controller/backend/ResourceController.java
@@ -4,7 +4,6 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import xyz.playedu.api.constant.BackendConstant;
-import xyz.playedu.api.domain.AdminUser;
 import xyz.playedu.api.domain.Resource;
 import xyz.playedu.api.domain.ResourceCategory;
 import xyz.playedu.api.request.backend.ResourceRequest;
diff --git a/src/main/java/xyz/playedu/api/controller/backend/SystemController.java b/src/main/java/xyz/playedu/api/controller/backend/SystemController.java
index 256c261..639ec02 100644
--- a/src/main/java/xyz/playedu/api/controller/backend/SystemController.java
+++ b/src/main/java/xyz/playedu/api/controller/backend/SystemController.java
@@ -22,7 +22,7 @@ public class SystemController {
     public JsonResponse imageCaptcha() throws IOException {
         ImageCaptchaResult imageCaptchaResult = imageCaptchaService.generate();
 
-        HashMap<String, String> data = new HashMap();
+        HashMap<String, String> data = new HashMap<>();
         data.put("key", imageCaptchaResult.getKey());
         data.put("image", imageCaptchaResult.getImage());
 
diff --git a/src/main/java/xyz/playedu/api/controller/backend/UserController.java b/src/main/java/xyz/playedu/api/controller/backend/UserController.java
index 0947391..d4f85f2 100644
--- a/src/main/java/xyz/playedu/api/controller/backend/UserController.java
+++ b/src/main/java/xyz/playedu/api/controller/backend/UserController.java
@@ -5,8 +5,10 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationContext;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
+import xyz.playedu.api.constant.BPermissionConstant;
 import xyz.playedu.api.domain.User;
 import xyz.playedu.api.event.UserDestroyEvent;
+import xyz.playedu.api.middleware.BackendPermissionMiddleware;
 import xyz.playedu.api.request.backend.UserRequest;
 import xyz.playedu.api.service.UserService;
 import xyz.playedu.api.types.JsonResponse;
@@ -32,6 +34,7 @@ public class UserController {
     @Autowired
     private ApplicationContext applicationContext;
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.USER_INDEX)
     @GetMapping("/index")
     public JsonResponse index(
             @RequestParam(name = "page", defaultValue = "1") Integer page,
@@ -79,11 +82,13 @@ public class UserController {
         return JsonResponse.data(result);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.USER_STORE)
     @GetMapping("/create")
     public JsonResponse create() {
         return JsonResponse.data(null);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.USER_STORE)
     @PostMapping("/create")
     public JsonResponse store(@RequestBody @Validated UserRequest request) {
         if (userService.emailIsExists(request.getEmail())) {
@@ -118,6 +123,7 @@ public class UserController {
         return JsonResponse.success();
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.USER_UPDATE)
     @GetMapping("/{id}")
     public JsonResponse edit(@PathVariable(name = "id") Integer id) {
         User user = userService.getById(id);
@@ -131,6 +137,7 @@ public class UserController {
         return JsonResponse.data(data);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.USER_UPDATE)
     @PutMapping("/{id}")
     public JsonResponse update(@PathVariable(name = "id") Integer id, @RequestBody @Validated UserRequest request) {
         User user = userService.getById(id);
@@ -169,6 +176,7 @@ public class UserController {
         return JsonResponse.success();
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.USER_DESTROY)
     @DeleteMapping("/{id}")
     public JsonResponse destroy(@PathVariable(name = "id") Integer id) {
         User user = userService.getById(id);