diff --git a/apps/web/src/pages/health/AppointmentList.tsx b/apps/web/src/pages/health/AppointmentList.tsx
index b8bd509..be81e3d 100644
--- a/apps/web/src/pages/health/AppointmentList.tsx
+++ b/apps/web/src/pages/health/AppointmentList.tsx
@@ -26,6 +26,7 @@ import { doctorApi } from '../../api/health/doctors';
 import { StatusTag } from './components/StatusTag';
 import { PatientSelect } from './components/PatientSelect';
 import { DoctorSelect } from './components/DoctorSelect';
+import { AuthButton } from '../../components/AuthButton';
 
 /** 预约类型选项 */
 const APPOINTMENT_TYPE_OPTIONS = [
@@ -305,19 +306,21 @@ export default function AppointmentList() {
           return <span style={{ color: '#999' }}>无可用操作</span>;
         }
         return (
-          <Dropdown
-            menu={{
-              items: transitions.map((t) => ({
-                key: t.value,
-                label: t.label,
-                onClick: () => handleStatusChange(record, t.value),
-              })),
-            }}
-          >
-            <Button type="link" size="small">
-              状态变更 <DownOutlined />
-            </Button>
-          </Dropdown>
+          <AuthButton code="health.appointment.manage">
+            <Dropdown
+              menu={{
+                items: transitions.map((t) => ({
+                  key: t.value,
+                  label: t.label,
+                  onClick: () => handleStatusChange(record, t.value),
+                })),
+              }}
+            >
+              <Button type="link" size="small">
+                状态变更 <DownOutlined />
+              </Button>
+            </Dropdown>
+          </AuthButton>
         );
       },
     },
@@ -352,9 +355,11 @@ export default function AppointmentList() {
           </Space>
         </Col>
         <Col>
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-            新建预约
-          </Button>
+          <AuthButton code="health.appointment.manage">
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
+              新建预约
+            </Button>
+          </AuthButton>
         </Col>
       </Row>
 
diff --git a/apps/web/src/pages/health/ConsultationDetail.tsx b/apps/web/src/pages/health/ConsultationDetail.tsx
index ac7bd32..f99423d 100644
--- a/apps/web/src/pages/health/ConsultationDetail.tsx
+++ b/apps/web/src/pages/health/ConsultationDetail.tsx
@@ -6,6 +6,7 @@ import { consultationApi, type Session, type Message } from '../../api/health/co
 import { StatusTag } from './components/StatusTag';
 import { ImagePreview } from './components/ImagePreview';
 import { useThemeMode } from '../../hooks/useThemeMode';
+import { AuthButton } from '../../components/AuthButton';
 
 const PAGE_SIZE = 30;
 
@@ -276,21 +277,23 @@ export default function ConsultationDetail() {
           </Typography.Text>
         )}
         {session && !isClosed && (
-          <Popconfirm
-            title="确认关闭该咨询会话？"
-            onConfirm={handleClose}
-            okText="确认"
-            cancelText="取消"
-          >
-            <Button
-              size="small"
-              danger
-              icon={<CloseCircleOutlined />}
-              style={{ marginLeft: 'auto' }}
+          <AuthButton code="health.consultation.manage">
+            <Popconfirm
+              title="确认关闭该咨询会话？"
+              onConfirm={handleClose}
+              okText="确认"
+              cancelText="取消"
             >
-              关闭会话
-            </Button>
-          </Popconfirm>
+              <Button
+                size="small"
+                danger
+                icon={<CloseCircleOutlined />}
+                style={{ marginLeft: 'auto' }}
+              >
+                关闭会话
+              </Button>
+            </Popconfirm>
+          </AuthButton>
         )}
       </div>
 
diff --git a/apps/web/src/pages/health/ConsultationList.tsx b/apps/web/src/pages/health/ConsultationList.tsx
index b90511f..29e3833 100644
--- a/apps/web/src/pages/health/ConsultationList.tsx
+++ b/apps/web/src/pages/health/ConsultationList.tsx
@@ -20,6 +20,7 @@ import { PatientSelect } from './components/PatientSelect';
 import { DoctorSelect } from './components/DoctorSelect';
 import { ExportButton } from './components/ExportButton';
 import { useThemeMode } from '../../hooks/useThemeMode';
+import { AuthButton } from '../../components/AuthButton';
 
 const STATUS_OPTIONS = [
   { value: 'waiting', label: '等待中' },
@@ -258,26 +259,28 @@ export default function ConsultationList() {
       key: 'actions',
       width: 120,
       render: (_: unknown, record: Session) => (
-        <Space size={4}>
-          {record.status !== 'closed' && (
-            <Popconfirm
-              title="确认关闭该咨询会话？"
-              onConfirm={() => handleClose(record)}
-              okText="确认"
-              cancelText="取消"
-            >
-              <Button
-                type="link"
-                size="small"
-                danger
-                icon={<CloseCircleOutlined />}
-                loading={closingId === record.id}
+        <AuthButton code="health.consultation.manage">
+          <Space size={4}>
+            {record.status !== 'closed' && (
+              <Popconfirm
+                title="确认关闭该咨询会话？"
+                onConfirm={() => handleClose(record)}
+                okText="确认"
+                cancelText="取消"
               >
-                关闭
-              </Button>
-            </Popconfirm>
-          )}
-        </Space>
+                <Button
+                  type="link"
+                  size="small"
+                  danger
+                  icon={<CloseCircleOutlined />}
+                  loading={closingId === record.id}
+                >
+                  关闭
+                </Button>
+              </Popconfirm>
+            )}
+          </Space>
+        </AuthButton>
       ),
     },
   ];
@@ -305,16 +308,18 @@ export default function ConsultationList() {
           value={query.status}
           onChange={handleFilterChange}
         />
-        <Button
-          type="primary"
-          icon={<PlusOutlined />}
-          onClick={() => {
-            createForm.resetFields();
-            setCreateOpen(true);
-          }}
-        >
-          新建会话
-        </Button>
+        <AuthButton code="health.consultation.manage">
+          <Button
+            type="primary"
+            icon={<PlusOutlined />}
+            onClick={() => {
+              createForm.resetFields();
+              setCreateOpen(true);
+            }}
+          >
+            新建会话
+          </Button>
+        </AuthButton>
         <ExportButton
           fetchUrl="/health/consultation-sessions/export"
           params={exportParams}
diff --git a/apps/web/src/pages/health/DoctorList.tsx b/apps/web/src/pages/health/DoctorList.tsx
index 90af7e0..f8f2fab 100644
--- a/apps/web/src/pages/health/DoctorList.tsx
+++ b/apps/web/src/pages/health/DoctorList.tsx
@@ -22,6 +22,7 @@ import {
 } from '@ant-design/icons';
 import dayjs from 'dayjs';
 import { doctorApi, type Doctor, type CreateDoctorReq, type UpdateDoctorReq } from '../../api/health/doctors';
+import { AuthButton } from '../../components/AuthButton';
 
 /** 科室选项 — 可后续改为从字典接口获取 */
 const DEPARTMENT_OPTIONS = [
@@ -232,26 +233,28 @@ export default function DoctorList() {
       width: 140,
       fixed: 'right' as const,
       render: (_: unknown, record: Doctor) => (
-        <Space size="small">
-          <Button
-            type="link"
-            size="small"
-            icon={<EditOutlined />}
-            onClick={() => openEdit(record)}
-          >
-            编辑
-          </Button>
-          <Popconfirm
-            title="确定删除该医护？"
-            onConfirm={() => handleDelete(record.id)}
-            okText="确定"
-            cancelText="取消"
-          >
-            <Button type="link" size="small" danger icon={<DeleteOutlined />}>
-              删除
+        <AuthButton code="health.doctor.manage">
+          <Space size="small">
+            <Button
+              type="link"
+              size="small"
+              icon={<EditOutlined />}
+              onClick={() => openEdit(record)}
+            >
+              编辑
             </Button>
-          </Popconfirm>
-        </Space>
+            <Popconfirm
+              title="确定删除该医护？"
+              onConfirm={() => handleDelete(record.id)}
+              okText="确定"
+              cancelText="取消"
+            >
+              <Button type="link" size="small" danger icon={<DeleteOutlined />}>
+                删除
+              </Button>
+            </Popconfirm>
+          </Space>
+        </AuthButton>
       ),
     },
   ];
@@ -284,9 +287,11 @@ export default function DoctorList() {
           </Space>
         </Col>
         <Col>
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-            新建医护
-          </Button>
+          <AuthButton code="health.doctor.manage">
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
+              新建医护
+            </Button>
+          </AuthButton>
         </Col>
       </Row>
 
diff --git a/apps/web/src/pages/health/DoctorSchedule.tsx b/apps/web/src/pages/health/DoctorSchedule.tsx
index 8d3b111..6d2ffdc 100644
--- a/apps/web/src/pages/health/DoctorSchedule.tsx
+++ b/apps/web/src/pages/health/DoctorSchedule.tsx
@@ -30,6 +30,7 @@ import {
 import { DoctorSelect } from './components/DoctorSelect';
 import { CalendarView, type ScheduleItem } from './components/CalendarView';
 import { StatusTag } from './components/StatusTag';
+import { AuthButton } from '../../components/AuthButton';
 
 /** 时段选项 */
 const PERIOD_OPTIONS = [
@@ -258,16 +259,18 @@ export default function DoctorSchedule() {
       key: 'action',
       width: 120,
       render: (_: unknown, record: Schedule) => (
-        <Space size="small">
-          <Button
-            type="link"
-            size="small"
-            icon={<EditOutlined />}
-            onClick={() => openEdit(record)}
-          >
-            编辑
-          </Button>
-        </Space>
+        <AuthButton code="health.doctor.manage">
+          <Space size="small">
+            <Button
+              type="link"
+              size="small"
+              icon={<EditOutlined />}
+              onClick={() => openEdit(record)}
+            >
+              编辑
+            </Button>
+          </Space>
+        </AuthButton>
       ),
     },
   ];
@@ -309,9 +312,11 @@ export default function DoctorSchedule() {
         <Col flex="auto" />
         <Col>
           {selectedDoctorId && (
-            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-              新建排班
-            </Button>
+            <AuthButton code="health.doctor.manage">
+              <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
+                新建排班
+              </Button>
+            </AuthButton>
           )}
         </Col>
       </Row>
diff --git a/apps/web/src/pages/health/FollowUpTaskList.tsx b/apps/web/src/pages/health/FollowUpTaskList.tsx
index 0f946b1..f135db5 100644
--- a/apps/web/src/pages/health/FollowUpTaskList.tsx
+++ b/apps/web/src/pages/health/FollowUpTaskList.tsx
@@ -19,6 +19,7 @@ import { StatusTag } from './components/StatusTag';
 import { PatientSelect } from './components/PatientSelect';
 import { DoctorSelect } from './components/DoctorSelect';
 import { useThemeMode } from '../../hooks/useThemeMode';
+import { AuthButton } from '../../components/AuthButton';
 
 const STATUS_OPTIONS = [
   { value: 'pending', label: '待处理' },
@@ -289,34 +290,36 @@ export default function FollowUpTaskList() {
       key: 'actions',
       width: 220,
       render: (_: unknown, record: FollowUpTask) => (
-        <Space size={4}>
-          <Button
-            type="link"
-            size="small"
-            icon={<EditOutlined />}
-            onClick={() => openRecordModal(record)}
-          >
-            填写记录
-          </Button>
-          <Button
-            type="link"
-            size="small"
-            icon={<SwapOutlined />}
-            onClick={() => openAssignModal(record)}
-          >
-            分配
-          </Button>
-          <Popconfirm
-            title="确认删除该随访任务？"
-            onConfirm={() => handleDelete(record)}
-            okText="确认"
-            cancelText="取消"
-          >
-            <Button type="link" size="small" danger icon={<DeleteOutlined />}>
-              删除
+        <AuthButton code="health.follow-up.manage">
+          <Space size={4}>
+            <Button
+              type="link"
+              size="small"
+              icon={<EditOutlined />}
+              onClick={() => openRecordModal(record)}
+            >
+              填写记录
             </Button>
-          </Popconfirm>
-        </Space>
+            <Button
+              type="link"
+              size="small"
+              icon={<SwapOutlined />}
+              onClick={() => openAssignModal(record)}
+            >
+              分配
+            </Button>
+            <Popconfirm
+              title="确认删除该随访任务？"
+              onConfirm={() => handleDelete(record)}
+              okText="确认"
+              cancelText="取消"
+            >
+              <Button type="link" size="small" danger icon={<DeleteOutlined />}>
+                删除
+              </Button>
+            </Popconfirm>
+          </Space>
+        </AuthButton>
       ),
     },
   ];
@@ -344,16 +347,18 @@ export default function FollowUpTaskList() {
           value={query.status}
           onChange={(value) => handleFilterChange('status', value)}
         />
-        <Button
-          type="primary"
-          icon={<PlusOutlined />}
-          onClick={() => {
-            createForm.resetFields();
-            setCreateOpen(true);
-          }}
-        >
-          新建任务
-        </Button>
+        <AuthButton code="health.follow-up.manage">
+          <Button
+            type="primary"
+            icon={<PlusOutlined />}
+            onClick={() => {
+              createForm.resetFields();
+              setCreateOpen(true);
+            }}
+          >
+            新建任务
+          </Button>
+        </AuthButton>
         <span
           style={{
             fontSize: 13,
diff --git a/apps/web/src/pages/health/OfflineEventList.tsx b/apps/web/src/pages/health/OfflineEventList.tsx
index bb2f183..e75bc26 100644
--- a/apps/web/src/pages/health/OfflineEventList.tsx
+++ b/apps/web/src/pages/health/OfflineEventList.tsx
@@ -30,6 +30,7 @@ import {
   type OfflineEvent,
   type CreateOfflineEventReq,
 } from '../../api/health/points';
+import { AuthButton } from '../../components/AuthButton';
 
 /** 活动状态映射 */
 const STATUS_MAP: Record<string, { text: string; color: string }> = {
@@ -245,35 +246,37 @@ export default function OfflineEventList() {
       key: 'action',
       width: 200,
       render: (_: unknown, record: OfflineEvent) => (
-        <Space size="small">
-          <Button
-            type="link"
-            size="small"
-            icon={<EditOutlined />}
-            onClick={() => openEdit(record)}
-          >
-            编辑
-          </Button>
-          <Button
-            type="link"
-            size="small"
-            icon={<CheckCircleOutlined />}
-            onClick={() => handleCheckin(record)}
-            disabled={record.status === 'draft' || record.status === 'cancelled'}
-          >
-            签到
-          </Button>
-          <Popconfirm
-            title="确定删除该活动？"
-            onConfirm={() => handleDelete(record)}
-            okText="确定"
-            cancelText="取消"
-          >
-            <Button type="link" size="small" danger icon={<DeleteOutlined />}>
-              删除
+        <AuthButton code="health.points.manage">
+          <Space size="small">
+            <Button
+              type="link"
+              size="small"
+              icon={<EditOutlined />}
+              onClick={() => openEdit(record)}
+            >
+              编辑
             </Button>
-          </Popconfirm>
-        </Space>
+            <Button
+              type="link"
+              size="small"
+              icon={<CheckCircleOutlined />}
+              onClick={() => handleCheckin(record)}
+              disabled={record.status === 'draft' || record.status === 'cancelled'}
+            >
+              签到
+            </Button>
+            <Popconfirm
+              title="确定删除该活动？"
+              onConfirm={() => handleDelete(record)}
+              okText="确定"
+              cancelText="取消"
+            >
+              <Button type="link" size="small" danger icon={<DeleteOutlined />}>
+                删除
+              </Button>
+            </Popconfirm>
+          </Space>
+        </AuthButton>
       ),
     },
   ];
@@ -298,9 +301,11 @@ export default function OfflineEventList() {
           </Space>
         </Col>
         <Col>
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-            新建活动
-          </Button>
+          <AuthButton code="health.points.manage">
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
+              新建活动
+            </Button>
+          </AuthButton>
         </Col>
       </Row>
 
diff --git a/apps/web/src/pages/health/PatientDetail.tsx b/apps/web/src/pages/health/PatientDetail.tsx
index d8c004d..473b0df 100644
--- a/apps/web/src/pages/health/PatientDetail.tsx
+++ b/apps/web/src/pages/health/PatientDetail.tsx
@@ -16,6 +16,7 @@ import {
 } from 'antd';
 import { ArrowLeftOutlined, EditOutlined } from '@ant-design/icons';
 import { patientApi } from '../../api/health/patients';
+import { AuthButton } from '../../components/AuthButton';
 import type {
   PatientDetail as PatientDetailType,
   UpdatePatientReq,
@@ -187,9 +188,11 @@ export default function PatientDetail() {
               </Space>
             </div>
           </div>
-          <Button icon={<EditOutlined />} onClick={openEditModal}>
-            编辑信息
-          </Button>
+          <AuthButton code="health.patient.manage">
+            <Button icon={<EditOutlined />} onClick={openEditModal}>
+              编辑信息
+            </Button>
+          </AuthButton>
         </div>
         <Descriptions column={3} size="small">
           <Descriptions.Item label="性别">
diff --git a/apps/web/src/pages/health/PatientList.tsx b/apps/web/src/pages/health/PatientList.tsx
index af742a5..8bf3165 100644
--- a/apps/web/src/pages/health/PatientList.tsx
+++ b/apps/web/src/pages/health/PatientList.tsx
@@ -27,6 +27,7 @@ import type {
 import { StatusTag } from './components/StatusTag';
 import { GENDER_OPTIONS, BLOOD_TYPE_OPTIONS, STATUS_OPTIONS } from '../../constants/health';
 import { useThemeMode } from '../../hooks/useThemeMode';
+import { AuthButton } from '../../components/AuthButton';
 
 export default function PatientList() {
   const [patients, setPatients] = useState<PatientListItem[]>([]);
@@ -239,33 +240,35 @@ export default function PatientList() {
       key: 'actions',
       width: 140,
       render: (_: unknown, record: PatientListItem) => (
-        <Space size={4}>
-          <Button
-            size="small"
-            type="text"
-            icon={<EditOutlined />}
-            onClick={(e) => {
-              e.stopPropagation();
-              openEditModal(record);
-            }}
-            style={{ color: isDark ? '#94a3b8' : '#475569' }}
-          />
-          <Popconfirm
-            title="确定删除此患者？"
-            onConfirm={(e) => {
-              e?.stopPropagation();
-              handleDelete(record.id);
-            }}
-          >
+        <AuthButton code="health.patient.manage">
+          <Space size={4}>
             <Button
               size="small"
               type="text"
-              icon={<DeleteOutlined />}
-              danger
-              onClick={(e) => e.stopPropagation()}
+              icon={<EditOutlined />}
+              onClick={(e) => {
+                e.stopPropagation();
+                openEditModal(record);
+              }}
+              style={{ color: isDark ? '#94a3b8' : '#475569' }}
             />
-          </Popconfirm>
-        </Space>
+            <Popconfirm
+              title="确定删除此患者？"
+              onConfirm={(e) => {
+                e?.stopPropagation();
+                handleDelete(record.id);
+              }}
+            >
+              <Button
+                size="small"
+                type="text"
+                icon={<DeleteOutlined />}
+                danger
+                onClick={(e) => e.stopPropagation()}
+              />
+            </Popconfirm>
+          </Space>
+        </AuthButton>
       ),
     },
   ];
@@ -301,9 +304,11 @@ export default function PatientList() {
             options={STATUS_OPTIONS}
             style={{ width: 130, borderRadius: 8 }}
           />
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreateModal}>
-            新建患者
-          </Button>
+          <AuthButton code="health.patient.manage">
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreateModal}>
+              新建患者
+            </Button>
+          </AuthButton>
         </Space>
       </div>
 
diff --git a/apps/web/src/pages/health/PatientTagManage.tsx b/apps/web/src/pages/health/PatientTagManage.tsx
index e990514..3fa76d9 100644
--- a/apps/web/src/pages/health/PatientTagManage.tsx
+++ b/apps/web/src/pages/health/PatientTagManage.tsx
@@ -14,6 +14,7 @@ import { TagsOutlined, AppstoreOutlined } from '@ant-design/icons';
 import { patientApi, type TagItem } from '../../api/health/patients';
 import type { PatientListItem } from '../../api/health/patients';
 import { useThemeMode } from '../../hooks/useThemeMode';
+import { AuthButton } from '../../components/AuthButton';
 
 export default function PatientTagManage() {
   const [patients, setPatients] = useState<PatientListItem[]>([]);
@@ -178,14 +179,16 @@ export default function PatientTagManage() {
       key: 'actions',
       width: 120,
       render: (_: unknown, record: PatientListItem) => (
-        <Button
-          size="small"
-          type="link"
-          icon={<TagsOutlined />}
-          onClick={() => openTagModal(record)}
-        >
-          管理标签
-        </Button>
+        <AuthButton code="health.patient.manage">
+          <Button
+            size="small"
+            type="link"
+            icon={<TagsOutlined />}
+            onClick={() => openTagModal(record)}
+          >
+            管理标签
+          </Button>
+        </AuthButton>
       ),
     },
   ];
diff --git a/apps/web/src/pages/health/PointsOrderList.tsx b/apps/web/src/pages/health/PointsOrderList.tsx
index 3d3ab9a..6c26485 100644
--- a/apps/web/src/pages/health/PointsOrderList.tsx
+++ b/apps/web/src/pages/health/PointsOrderList.tsx
@@ -23,6 +23,7 @@ import {
   type PointsOrder,
 } from '../../api/health/points';
 import { patientApi } from '../../api/health/patients';
+import { AuthButton } from '../../components/AuthButton';
 
 /** 订单状态映射 */
 const STATUS_MAP: Record<string, { text: string; color: string }> = {
@@ -228,13 +229,15 @@ export default function PointsOrderList() {
           </Space>
         </Col>
         <Col>
-          <Button
-            type="primary"
-            icon={<CheckCircleOutlined />}
-            onClick={openVerifyModal}
-          >
-            核销订单
-          </Button>
+          <AuthButton code="health.points.manage">
+            <Button
+              type="primary"
+              icon={<CheckCircleOutlined />}
+              onClick={openVerifyModal}
+            >
+              核销订单
+            </Button>
+          </AuthButton>
         </Col>
       </Row>
 
diff --git a/apps/web/src/pages/health/PointsProductList.tsx b/apps/web/src/pages/health/PointsProductList.tsx
index e8cbe1c..b2a9bb3 100644
--- a/apps/web/src/pages/health/PointsProductList.tsx
+++ b/apps/web/src/pages/health/PointsProductList.tsx
@@ -26,6 +26,7 @@ import {
   type PointsProduct,
   type CreatePointsProductReq,
 } from '../../api/health/points';
+import { AuthButton } from '../../components/AuthButton';
 
 /** 商品类型映射 */
 const PRODUCT_TYPES: Record<string, string> = {
@@ -212,23 +213,25 @@ export default function PointsProductList() {
       key: 'action',
       width: 140,
       render: (_: unknown, record: PointsProduct) => (
-        <Space size="small">
-          <Button
-            type="link"
-            size="small"
-            icon={<EditOutlined />}
-            onClick={() => openEdit(record)}
-          >
-            编辑
-          </Button>
-          <Switch
-            size="small"
-            checked={record.is_active}
-            checkedChildren="上架"
-            unCheckedChildren="下架"
-            onChange={() => handleToggleActive(record)}
-          />
-        </Space>
+        <AuthButton code="health.points.manage">
+          <Space size="small">
+            <Button
+              type="link"
+              size="small"
+              icon={<EditOutlined />}
+              onClick={() => openEdit(record)}
+            >
+              编辑
+            </Button>
+            <Switch
+              size="small"
+              checked={record.is_active}
+              checkedChildren="上架"
+              unCheckedChildren="下架"
+              onChange={() => handleToggleActive(record)}
+            />
+          </Space>
+        </AuthButton>
       ),
     },
   ];
@@ -253,9 +256,11 @@ export default function PointsProductList() {
           </Space>
         </Col>
         <Col>
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-            新建商品
-          </Button>
+          <AuthButton code="health.points.manage">
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
+              新建商品
+            </Button>
+          </AuthButton>
         </Col>
       </Row>
 
diff --git a/apps/web/src/pages/health/PointsRuleList.tsx b/apps/web/src/pages/health/PointsRuleList.tsx
index 6d84d84..7d01a5e 100644
--- a/apps/web/src/pages/health/PointsRuleList.tsx
+++ b/apps/web/src/pages/health/PointsRuleList.tsx
@@ -26,6 +26,7 @@ import {
   type PointsRule,
   type CreatePointsRuleReq,
 } from '../../api/health/points';
+import { AuthButton } from '../../components/AuthButton';
 
 /** 事件类型映射 */
 const EVENT_TYPES: Record<string, string> = {
@@ -216,23 +217,25 @@ export default function PointsRuleList() {
       key: 'action',
       width: 200,
       render: (_: unknown, record: PointsRule) => (
-        <Space size="small">
-          <Button
-            type="link"
-            size="small"
-            icon={<EditOutlined />}
-            onClick={() => openEdit(record)}
-          >
-            编辑
-          </Button>
-          <Switch
-            size="small"
-            checked={record.is_active}
-            checkedChildren="启用"
-            unCheckedChildren="停用"
-            onChange={() => handleToggleActive(record)}
-          />
-        </Space>
+        <AuthButton code="health.points.manage">
+          <Space size="small">
+            <Button
+              type="link"
+              size="small"
+              icon={<EditOutlined />}
+              onClick={() => openEdit(record)}
+            >
+              编辑
+            </Button>
+            <Switch
+              size="small"
+              checked={record.is_active}
+              checkedChildren="启用"
+              unCheckedChildren="停用"
+              onChange={() => handleToggleActive(record)}
+            />
+          </Space>
+        </AuthButton>
       ),
     },
   ];
@@ -247,9 +250,11 @@ export default function PointsRuleList() {
           </span>
         </Col>
         <Col>
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-            新建规则
-          </Button>
+          <AuthButton code="health.points.manage">
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
+              新建规则
+            </Button>
+          </AuthButton>
         </Col>
       </Row>