diff --git a/crm-auth/src/main/java/com/crm/auth/service/impl/PermissionServiceImpl.java b/crm-auth/src/main/java/com/crm/auth/service/impl/PermissionServiceImpl.java
index 650533d..202d36e 100644
--- a/crm-auth/src/main/java/com/crm/auth/service/impl/PermissionServiceImpl.java
+++ b/crm-auth/src/main/java/com/crm/auth/service/impl/PermissionServiceImpl.java
@@ -1,6 +1,7 @@
 package com.crm.auth.service.impl;
 
 import cn.hutool.core.collection.CollUtil;
+import cn.hutool.core.util.StrUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.crm.auth.domain.entity.*;
 import com.crm.auth.mapper.*;
@@ -69,10 +70,36 @@ public class PermissionServiceImpl {
         }
         DataVisibilityContext.load(
                 new DataVisibility(userId, primaryDeptId, List.copyOf(deptIds), widest, expandedDeptIds));
-        return roles.stream()
+
+        // ── 权限码并集（ADR-0011）：收集用户所有角色授权的 button 节点 perms ──
+        List<String> authorities = new ArrayList<>();
+        if (CollUtil.isNotEmpty(userRoles)) {
+            try {
+                Set<Long> roleIds = userRoles.stream().map(SysUserRole::getRoleId).collect(Collectors.toSet());
+                List<SysRoleMenu> allRoleMenus = sysRoleMenuMapper.selectList(
+                        new LambdaQueryWrapper<SysRoleMenu>().in(SysRoleMenu::getRoleId, roleIds));
+                if (CollUtil.isNotEmpty(allRoleMenus)) {
+                    Set<Long> menuIds = allRoleMenus.stream()
+                            .map(SysRoleMenu::getMenuId).collect(Collectors.toSet());
+                    List<SysMenu> menus = sysMenuMapper.selectBatchIds(menuIds);
+                    menus.stream()
+                            .filter(m -> m.getMenuType() != null && m.getMenuType() == 3)
+                            .filter(m -> "enabled".equals(m.getStatus()))
+                            .map(SysMenu::getPerms)
+                            .filter(StrUtil::isNotBlank)
+                            .distinct()
+                            .forEach(authorities::add);
+                }
+            } catch (Exception e) {
+                log.debug("权限码并集查询失败（可能 sys_menu/sys_role_menu 表尚未创建），跳过", e);
+            }
+        }
+        // 角色编码追加在权限码之后（两者同为 Spring Security authority，hasRole/hasAuthority 各自匹配）
+        roles.stream()
                 .map(SysRole::getRoleCode)
                 .filter(Objects::nonNull)
-                .toList();
+                .forEach(authorities::add);
+        return authorities;
     }
 
     public List<SysMenu> getMenuTree(Long userId) {