diff --git a/powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/SystemInfoController.java b/powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/SystemInfoController.java
index 728454c0..6621a7bd 100644
--- a/powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/SystemInfoController.java
+++ b/powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/SystemInfoController.java
@@ -10,6 +10,9 @@ import org.springframework.web.bind.annotation.RestController;
 import tech.powerjob.common.OmsConstant;
 import tech.powerjob.common.enums.InstanceStatus;
 import tech.powerjob.common.response.ResultDTO;
+import tech.powerjob.server.auth.Permission;
+import tech.powerjob.server.auth.RoleScope;
+import tech.powerjob.server.auth.interceptor.ApiPermission;
 import tech.powerjob.server.common.constants.SwitchableStatus;
 import tech.powerjob.server.common.module.WorkerInfo;
 import tech.powerjob.server.persistence.remote.model.AppInfoDO;
@@ -50,6 +53,7 @@ public class SystemInfoController {
     private final WorkerClusterQueryService workerClusterQueryService;
 
     @GetMapping("/listWorker")
+    @ApiPermission(name = "System-ListWorker", roleScope = RoleScope.APP, requiredPermission = Permission.READ)
     public ResultDTO<List<WorkerStatusVO>> listWorker(Long appId) {
 
         List<WorkerInfo> workerInfos = workerClusterQueryService.getAllWorkers(appId);
@@ -57,6 +61,7 @@ public class SystemInfoController {
     }
 
     @GetMapping("/overview")
+    @ApiPermission(name = "System-Overview", roleScope = RoleScope.APP, requiredPermission = Permission.READ)
     public ResultDTO<SystemOverviewVO> getSystemOverview(Long appId) {
 
         SystemOverviewVO overview = new SystemOverviewVO();