diff --git a/src/main/java/com/cool/core/base/BaseController.java b/src/main/java/com/cool/core/base/BaseController.java
index f76ba45..42b5593 100644
--- a/src/main/java/com/cool/core/base/BaseController.java
+++ b/src/main/java/com/cool/core/base/BaseController.java
@@ -115,6 +115,7 @@ public abstract class BaseController<S extends BaseService<T>, T extends BaseEnt
     @Operation(summary = "新增", description = "新增信息，对应后端的实体类")
     @PostMapping("/add")
     protected R add(@RequestAttribute() JSONObject requestParams) {
+        checkPermission("add");
         String body = requestParams.getStr("body");
         if (JSONUtil.isTypeJSONArray(body)) {
             JSONArray array = JSONUtil.parseArray(body);
@@ -135,6 +136,7 @@ public abstract class BaseController<S extends BaseService<T>, T extends BaseEnt
     @PostMapping("/delete")
     protected R delete(HttpServletRequest request, @RequestBody Map<String, Object> params,
         @RequestAttribute() JSONObject requestParams) {
+        checkPermission("delete");
         service.delete(requestParams, Convert.toLongArray(getIds(params)));
         return R.ok();
     }
@@ -147,6 +149,7 @@ public abstract class BaseController<S extends BaseService<T>, T extends BaseEnt
     @Operation(summary = "修改", description = "根据ID修改")
     @PostMapping("/update")
     protected R update(@RequestBody T t, @RequestAttribute() JSONObject requestParams) {
+        checkPermission("update");
         Long id = t.getId();
         JSONObject info = JSONUtil.parseObj(JSONUtil.toJsonStr(service.getById(id)));
         requestParams.forEach(info::set);
@@ -286,4 +289,7 @@ public abstract class BaseController<S extends BaseService<T>, T extends BaseEnt
         page.setRecords(transformList(page.getRecords(), asType));
         return page;
     }
+
+    protected void checkPermission(String action) {
+    }
 }
\ No newline at end of file
diff --git a/src/main/java/com/cool/core/base/BaseEntity.java b/src/main/java/com/cool/core/base/BaseEntity.java
index fe88a73..0f0605c 100644
--- a/src/main/java/com/cool/core/base/BaseEntity.java
+++ b/src/main/java/com/cool/core/base/BaseEntity.java
@@ -31,6 +31,10 @@ public abstract class BaseEntity<T extends Model<T>> extends Model<T> implements
     @ColumnDefine(comment = "更新时间")
     protected Date updateTime;
 
+    @Column(isLogicDelete = true)
+    @ColumnDefine(comment = "删除标记 0:未删除 1:已删除", defaultValue = "0")
+    protected Integer delFlag;
+
     @Ignore
     @Column(ignore = true)
     @JsonIgnore
diff --git a/src/main/java/com/cool/core/security/JwtSecurityConfig.java b/src/main/java/com/cool/core/security/JwtSecurityConfig.java
index 6f9e722..b0f2c23 100644
--- a/src/main/java/com/cool/core/security/JwtSecurityConfig.java
+++ b/src/main/java/com/cool/core/security/JwtSecurityConfig.java
@@ -15,6 +15,7 @@ import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
 import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -32,6 +33,7 @@ import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandl
 import org.springframework.web.util.pattern.PathPattern;
 
 @EnableWebSecurity
+@EnableMethodSecurity
 @Configuration
 @Slf4j
 @RequiredArgsConstructor
diff --git a/src/main/java/com/cool/core/util/CoolSecurityUtil.java b/src/main/java/com/cool/core/util/CoolSecurityUtil.java
index 51e2265..7434635 100644
--- a/src/main/java/com/cool/core/util/CoolSecurityUtil.java
+++ b/src/main/java/com/cool/core/util/CoolSecurityUtil.java
@@ -85,7 +85,8 @@ public class CoolSecurityUtil {
      */
     public static void adminLogout(Long adminUserId, String username) {
         coolCache.del("admin:department:" + adminUserId, "admin:passwordVersion:" + adminUserId,
-            "admin:userInfo:" + adminUserId, "admin:userDetails:" + username);
+            "admin:userInfo:" + adminUserId, "admin:userDetails:" + username,
+            "admin:roleIds:" + adminUserId, "admin:perms:" + adminUserId);
     }
 
     /**
diff --git a/src/main/java/com/cool/modules/base/controller/admin/AdminBaseCodingController.java b/src/main/java/com/cool/modules/base/controller/admin/AdminBaseCodingController.java
index c1cce5c..5997b1e 100644
--- a/src/main/java/com/cool/modules/base/controller/admin/AdminBaseCodingController.java
+++ b/src/main/java/com/cool/modules/base/controller/admin/AdminBaseCodingController.java
@@ -24,14 +24,12 @@ public class AdminBaseCodingController {
 
     private final BaseCodingService baseCodingService;
 
-    @TokenIgnore
     @Operation(summary = "获取模块目录结构", description = "获取模块目录结构")
     @GetMapping("/getModuleTree")
     public R getModuleTree() {
         return R.ok(baseCodingService.getModuleTree());
     }
 
-    @TokenIgnore
     @Operation(summary = "创建代码", description = "创建代码")
     @PostMapping("/createCode")
     public R createCode(@RequestAttribute JSONObject requestParams) {
diff --git a/src/main/java/com/cool/modules/base/controller/admin/AdminBaseCommController.java b/src/main/java/com/cool/modules/base/controller/admin/AdminBaseCommController.java
index 451ab3c..c6c84bf 100644
--- a/src/main/java/com/cool/modules/base/controller/admin/AdminBaseCommController.java
+++ b/src/main/java/com/cool/modules/base/controller/admin/AdminBaseCommController.java
@@ -44,7 +44,6 @@ public class AdminBaseCommController {
 
     final private FileUploadStrategyFactory fileUploadStrategyFactory;
 
-    @TokenIgnore
     @Operation(summary = "实体信息与路径", description = "系统所有的实体信息与路径，供前端自动生成代码与服务")
     @GetMapping("/eps")
     public R eps() {
diff --git a/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysDepartmentController.java b/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysDepartmentController.java
index b969055..401161b 100644
--- a/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysDepartmentController.java
+++ b/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysDepartmentController.java
@@ -4,10 +4,12 @@ import cn.hutool.json.JSONObject;
 import com.cool.core.annotation.CoolRestController;
 import com.cool.core.base.BaseController;
 import com.cool.core.request.R;
+import com.cool.core.util.CoolSecurityUtil;
 import com.cool.modules.base.entity.sys.BaseSysDepartmentEntity;
 import com.cool.modules.base.service.sys.BaseSysDepartmentService;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.security.access.AccessDeniedException;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 
@@ -22,6 +24,13 @@ import java.util.List;
 public class AdminBaseSysDepartmentController
         extends BaseController<BaseSysDepartmentService, BaseSysDepartmentEntity> {
 
+    @Override
+    protected void checkPermission(String action) {
+        if (("add".equals(action) || "delete".equals(action) || "update".equals(action)) && !CoolSecurityUtil.isSuperAdmin()) {
+            throw new AccessDeniedException("仅超级管理员可操作部门");
+        }
+    }
+
     @Override
     protected void init(HttpServletRequest request, JSONObject requestParams) {
     }
diff --git a/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysRoleController.java b/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysRoleController.java
index cf760c8..25a5004 100644
--- a/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysRoleController.java
+++ b/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysRoleController.java
@@ -12,6 +12,7 @@ import com.cool.modules.base.service.sys.BaseSysRoleService;
 import com.mybatisflex.core.query.QueryWrapper;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.security.access.AccessDeniedException;
 
 /**
  * 系统角色
@@ -20,6 +21,15 @@ import jakarta.servlet.http.HttpServletRequest;
 @CoolRestController(api = { "add", "delete", "update", "page", "list", "info" })
 public class AdminBaseSysRoleController extends BaseController<BaseSysRoleService, BaseSysRoleEntity> {
 
+    @Override
+    protected void checkPermission(String action) {
+        if ("add".equals(action) || "delete".equals(action) || "update".equals(action)) {
+            if (!CoolSecurityUtil.isSuperAdmin()) {
+                throw new AccessDeniedException("仅超级管理员可操作角色");
+            }
+        }
+    }
+
     @Override
     protected void init(HttpServletRequest request, JSONObject requestParams) {
         JSONObject tokenInfo = requestParams.getJSONObject("tokenInfo");
diff --git a/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysUserController.java b/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysUserController.java
index aa15e18..a3cbd38 100644
--- a/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysUserController.java
+++ b/src/main/java/com/cool/modules/base/controller/admin/sys/AdminBaseSysUserController.java
@@ -8,9 +8,11 @@ import com.cool.modules.base.entity.sys.BaseSysUserEntity;
 import com.cool.modules.base.service.sys.BaseSysUserService;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.security.access.AccessDeniedException;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestAttribute;
 
+import com.cool.core.util.CoolSecurityUtil;
 import jakarta.servlet.http.HttpServletRequest;
 
 /**
@@ -20,6 +22,13 @@ import jakarta.servlet.http.HttpServletRequest;
 @CoolRestController(api = { "add", "delete", "update", "page", "info" })
 public class AdminBaseSysUserController extends BaseController<BaseSysUserService, BaseSysUserEntity> {
 
+    @Override
+    protected void checkPermission(String action) {
+        if ("delete".equals(action) && !CoolSecurityUtil.isSuperAdmin()) {
+            throw new AccessDeniedException("仅超级管理员可删除用户");
+        }
+    }
+
     @Override
     protected void init(HttpServletRequest request, JSONObject requestParams) {
     }
diff --git a/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysDepartmentServiceImpl.java b/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysDepartmentServiceImpl.java
index 4d059e9..b46bff2 100644
--- a/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysDepartmentServiceImpl.java
+++ b/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysDepartmentServiceImpl.java
@@ -5,8 +5,10 @@ import com.cool.core.base.BaseServiceImpl;
 import com.cool.core.exception.CoolPreconditions;
 import com.cool.core.util.CoolSecurityUtil;
 import com.cool.modules.base.entity.sys.BaseSysDepartmentEntity;
+import com.cool.modules.base.entity.sys.BaseSysRoleDepartmentEntity;
 import com.cool.modules.base.entity.sys.BaseSysUserEntity;
 import com.cool.modules.base.mapper.sys.BaseSysDepartmentMapper;
+import com.cool.modules.base.mapper.sys.BaseSysRoleDepartmentMapper;
 import com.cool.modules.base.mapper.sys.BaseSysUserMapper;
 import com.cool.modules.base.service.sys.BaseSysDepartmentService;
 import com.cool.modules.base.service.sys.BaseSysPermsService;
@@ -16,6 +18,7 @@ import java.util.ArrayList;
 import java.util.List;
 import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
 
 /**
  * 系统部门
@@ -30,6 +33,8 @@ public class BaseSysDepartmentServiceImpl extends
 
     final private BaseSysPermsService baseSysPermsService;
 
+    final private BaseSysRoleDepartmentMapper baseSysRoleDepartmentMapper;
+
     @Override
     public void order(List<BaseSysDepartmentEntity> list) {
         list.forEach(baseSysDepartmentEntity -> {
@@ -64,6 +69,7 @@ public class BaseSysDepartmentServiceImpl extends
     }
 
     @Override
+    @Transactional(rollbackFor = Exception.class)
     public boolean delete(JSONObject requestParams, Long... ids) {
         List<Long> allDeptIds = new ArrayList<>(List.of(ids));
         for (Long id : ids) {
@@ -72,6 +78,8 @@ public class BaseSysDepartmentServiceImpl extends
         long userCount = baseSysUserMapper.selectCountByQuery(
             QueryWrapper.create().in(BaseSysUserEntity::getDepartmentId, allDeptIds));
         CoolPreconditions.check(userCount > 0, "该部门或其子部门下存在用户，无法删除");
+        baseSysRoleDepartmentMapper.deleteByQuery(
+            QueryWrapper.create().in(BaseSysRoleDepartmentEntity::getDepartmentId, allDeptIds));
         return super.delete(ids);
     }
 
diff --git a/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysMenuServiceImpl.java b/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysMenuServiceImpl.java
index 0e3d930..3828c58 100644
--- a/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysMenuServiceImpl.java
+++ b/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysMenuServiceImpl.java
@@ -14,7 +14,9 @@ import com.cool.core.util.CompilerUtils;
 import com.cool.core.util.CoolSecurityUtil;
 import com.cool.core.util.PathUtils;
 import com.cool.modules.base.entity.sys.BaseSysMenuEntity;
+import com.cool.modules.base.entity.sys.BaseSysRoleMenuEntity;
 import com.cool.modules.base.mapper.sys.BaseSysMenuMapper;
+import com.cool.modules.base.mapper.sys.BaseSysRoleMenuMapper;
 import com.cool.modules.base.service.sys.BaseSysMenuService;
 import com.cool.modules.base.service.sys.BaseSysPermsService;
 import com.mybatisflex.core.query.QueryWrapper;
@@ -37,6 +39,8 @@ public class BaseSysMenuServiceImpl extends BaseServiceImpl<BaseSysMenuMapper, B
 
     final private CoolEps coolEps;
 
+    final private BaseSysRoleMenuMapper baseSysRoleMenuMapper;
+
     @Override
     public Object list(JSONObject requestParams, QueryWrapper queryWrapper) {
         List<BaseSysMenuEntity> list = baseSysPermsService.getMenus(CoolSecurityUtil.getAdminUsername());
@@ -71,6 +75,10 @@ public class BaseSysMenuServiceImpl extends BaseServiceImpl<BaseSysMenuMapper, B
 
     @Override
     public boolean delete(Long... ids) {
+        for (Long id : ids) {
+            baseSysRoleMenuMapper.deleteByQuery(
+                QueryWrapper.create().eq(BaseSysRoleMenuEntity::getMenuId, id));
+        }
         super.delete(ids);
         for (Long id : ids) {
             this.delChildMenu(id);
diff --git a/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysRoleServiceImpl.java b/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysRoleServiceImpl.java
index affa507..2ea1ffb 100644
--- a/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysRoleServiceImpl.java
+++ b/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysRoleServiceImpl.java
@@ -9,9 +9,11 @@ import com.cool.core.util.CoolSecurityUtil;
 import com.cool.modules.base.entity.sys.BaseSysRoleDepartmentEntity;
 import com.cool.modules.base.entity.sys.BaseSysRoleEntity;
 import com.cool.modules.base.entity.sys.BaseSysRoleMenuEntity;
+import com.cool.modules.base.entity.sys.BaseSysUserRoleEntity;
 import com.cool.modules.base.mapper.sys.BaseSysRoleDepartmentMapper;
 import com.cool.modules.base.mapper.sys.BaseSysRoleMapper;
 import com.cool.modules.base.mapper.sys.BaseSysRoleMenuMapper;
+import com.cool.modules.base.mapper.sys.BaseSysUserRoleMapper;
 import com.cool.modules.base.service.sys.BaseSysPermsService;
 import com.cool.modules.base.service.sys.BaseSysRoleService;
 import com.mybatisflex.core.query.QueryWrapper;
@@ -37,6 +39,8 @@ public class BaseSysRoleServiceImpl extends BaseServiceImpl<BaseSysRoleMapper, B
 
     final private BaseSysPermsService baseSysPermsService;
 
+    final private BaseSysUserRoleMapper baseSysUserRoleMapper;
+
     @Override
     public Object add(JSONObject requestParams, BaseSysRoleEntity entity) {
         BaseSysRoleEntity checkLabel = getOne(QueryWrapper.create().eq(BaseSysRoleEntity::getLabel, entity.getLabel()));
@@ -77,6 +81,12 @@ public class BaseSysRoleServiceImpl extends BaseServiceImpl<BaseSysRoleMapper, B
         if (type == ModifyEnum.DELETE) {
             Long[] ids = requestParams.get("ids", Long[].class);
             for (Long id : ids) {
+                baseSysRoleMenuMapper.deleteByQuery(
+                    QueryWrapper.create().eq(BaseSysRoleMenuEntity::getRoleId, id));
+                baseSysRoleDepartmentMapper.deleteByQuery(
+                    QueryWrapper.create().eq(BaseSysRoleDepartmentEntity::getRoleId, id));
+                baseSysUserRoleMapper.deleteByQuery(
+                    QueryWrapper.create().eq(BaseSysUserRoleEntity::getRoleId, id));
                 baseSysPermsService.refreshPermsByRoleId(id);
             }
         } else {
diff --git a/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysUserServiceImpl.java b/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysUserServiceImpl.java
index 0d57738..a03f123 100644
--- a/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysUserServiceImpl.java
+++ b/src/main/java/com/cool/modules/base/service/sys/impl/BaseSysUserServiceImpl.java
@@ -182,7 +182,16 @@ public class BaseSysUserServiceImpl extends BaseServiceImpl<BaseSysUserMapper, B
     @Override
     public void modifyAfter(JSONObject requestParams, BaseSysUserEntity baseSysUserEntity,
         ModifyEnum type) {
-        if (type != ModifyEnum.DELETE && requestParams.get("roleIdList", Long[].class) != null) {
+        if (type == ModifyEnum.DELETE) {
+            Long[] ids = requestParams.get("ids", Long[].class);
+            if (ids != null) {
+                for (Long id : ids) {
+                    baseSysUserRoleMapper.deleteByQuery(
+                        QueryWrapper.create().eq(BaseSysUserRoleEntity::getUserId, id));
+                    CoolSecurityUtil.adminLogout(id, null);
+                }
+            }
+        } else if (requestParams.get("roleIdList", Long[].class) != null) {
             Long[] roleIdList = requestParams.get("roleIdList", Long[].class);
             validateRoleAssignment(roleIdList);
             baseSysPermsService.updateUserRole(baseSysUserEntity.getId(), roleIdList);