diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/label/LabelController.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/label/LabelController.java
index 297209cb6..5a0dcb680 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/label/LabelController.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/label/LabelController.java
@@ -37,7 +37,7 @@ public class LabelController {
 
     @PostMapping("/create")
     @Operation(summary = "创建标签")
-    //@PreAuthorize("@ss.hasPermission('system:label:create')")
+    @PreAuthorize("@ss.hasPermission('sysTagDesignManager:create')")
     @OperateLog(enable = false)
     public CommonResult<Long> createLabel(@Valid @RequestBody LabelSaveReqVO createReqVO) {
         return success(labelService.createLabel(createReqVO));
@@ -45,7 +45,7 @@ public class LabelController {
 
     @PutMapping("/update")
     @Operation(summary = "更新标签")
-    //@PreAuthorize("@ss.hasPermission('system:label:update')")
+    @PreAuthorize("@ss.hasPermission('sysTagDesignManager:update')")
     @OperateLog(enable = false)
     public CommonResult<Boolean> updateLabel(@Valid @RequestBody LabelSaveReqVO updateReqVO) {
         labelService.updateLabel(updateReqVO);
@@ -55,7 +55,7 @@ public class LabelController {
     @DeleteMapping("/delete")
     @Operation(summary = "删除标签")
     @Parameter(name = "id", description = "编号", required = true)
-    //@PreAuthorize("@ss.hasPermission('system:label:delete')")
+    @PreAuthorize("@ss.hasPermission('sysTagDesignManager:delete')")
     public CommonResult<Boolean> deleteLabel(@RequestParam("id") Long id) {
         labelService.deleteLabel(id);
         return success(true);
@@ -90,7 +90,7 @@ public class LabelController {
 
     @GetMapping("/group-list")
     @Operation(summary = "获得分组标签列表")
-    //@PreAuthorize("@ss.hasPermission('system:label:query')")
+    @PreAuthorize("@ss.hasAnyPermissions('system:label-template:query','sysTagDesignManager:query')")
     @OperateLog(enable = false)
     public CommonResult<Map<String, List<LabelRespVO>>> getGroupList(@RequestParam(value = "organId", required = false) Long organId) {
         return success(labelService.getGroupList(organId));
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/labeltemplate/LabelTemplateController.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/labeltemplate/LabelTemplateController.java
index b70693f5a..1e95e771e 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/labeltemplate/LabelTemplateController.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/labeltemplate/LabelTemplateController.java
@@ -87,7 +87,7 @@ public class LabelTemplateController {
     @GetMapping("/getDefault")
     @Operation(summary = "获得默认标签模板")
     @Parameter(name = "type", description = "标签类型", required = true, example = "1024")
-    @PreAuthorize("@ss.hasPermission('system:label-template:query')")
+    @PreAuthorize("@ss.hasAnyPermissions('system:label-template:query','sysTagDesignManager:query')")
     @OperateLog(enable = false)
     public CommonResult<LabelTemplateRespVO> getDefaultLabelTemplate(@RequestParam("type") String type) {
         return success(labelTemplateService.getDefaultLabelTemplate(type));
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java
index a4a7ce9e2..3fcfe7e05 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java
@@ -39,7 +39,9 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.cache.annotation.CacheEvict;
 import org.springframework.cache.annotation.Cacheable;
 import org.springframework.cache.annotation.Caching;
+import org.springframework.data.redis.core.Cursor;
 import org.springframework.data.redis.core.RedisTemplate;
+import org.springframework.data.redis.core.ScanOptions;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -205,14 +207,15 @@ public class PermissionServiceImpl implements PermissionService {
         // 角色菜单权限发生修改，通知刷新本地缓存
         if (CollectionUtil.isNotEmpty(createMenuIds) || CollectionUtil.isNotEmpty(deleteMenuIds)) {
             CompletableFuture.runAsync(() -> {
-                // 当前操作人和所操作的目标菜单机构不同时，清空MENU_ROLE_ID_LIST:目标机构id:菜单id的缓存
+                // 当前操作人和所操作的目标菜单机构不同时，清空MENU_ROLE_ID_LIST:*:菜单id的缓存
                 if (ObjectUtil.notEqual(finalOrganId, currentOrganId)) {
                     // 获取新增和删除菜单id的并集
                     Collection<Long> delMenuIds = CollUtil.union(createMenuIds, deleteMenuIds);
-                    // 构建批量删除的key集合
-                    Set<String> delKeys = delMenuIds.stream().map(menuId -> String.format(String.valueOf(new StringBuffer(RedisKeyConstants.MENU_ROLE_ID_LIST).append(":%s:%s")), finalOrganId, menuId)).collect(Collectors.toSet());
-                    Long batchDelNum = redisTemplate.delete(delKeys);
-                    log.info("[assignRoleMenu] 批量删除redis[MENU_ROLE_ID_LIST]数量:{}", batchDelNum);
+                    delMenuIds.forEach(delMenuId -> {
+                        String patternKey = String.format(String.valueOf(new StringBuffer(RedisKeyConstants.MENU_ROLE_ID_LIST).append(":*:%s")), delMenuId);
+                        Long batchDelNum = scanAndDelKeys(patternKey);
+                        log.info("[assignRoleMenu] 批量删除redis[{}]数量:{}", patternKey, batchDelNum);
+                    });
                 }
                 redisTemplate.convertAndSend(RedisRefreshChannelTopicConstants.PERMISSION_REFRESH, "");
             }).exceptionally(e -> {
@@ -222,6 +225,26 @@ public class PermissionServiceImpl implements PermissionService {
         }
     }
 
+    /**
+     * scan所有匹配的redis key并删除
+     *
+     * @param keyPattern 模糊匹配的表达式
+     */
+    private Long scanAndDelKeys(String keyPattern) {
+        // 根据keyPattern scan匹配的redis key
+        List<String> delKeys = new ArrayList<>();
+        Cursor<String> cursor = redisTemplate.scan(ScanOptions.scanOptions().match(keyPattern).count(200).build());
+        while (cursor.hasNext()) {
+            delKeys.add(cursor.next());
+        }
+        cursor.close();
+        // 删除匹配到的key
+        if (CollectionUtil.isNotEmpty(delKeys)) {
+            redisTemplate.delete(delKeys);
+        }
+        return 0L;
+    }
+
     @Override
     @Transactional(rollbackFor = Exception.class)
     @Caching(evict = {
@@ -362,14 +385,15 @@ public class PermissionServiceImpl implements PermissionService {
         // 角色菜单权限发生修改，通知刷新本地缓存
         if (CollectionUtil.isNotEmpty(createRoleUserIds) || CollectionUtil.isNotEmpty(deleteRoleUserIds)) {
             CompletableFuture.runAsync(() -> {
-                // 当前操作人和所操作的目标菜单机构不同时，清空USER_ROLE_ID_LIST:目标机构id:用户id的缓存
+                // 当前操作人和所操作的目标菜单机构不同时，清空USER_ROLE_ID_LIST:*:用户id的缓存
                 if (ObjectUtil.notEqual(finalOrganId, currentOrganId)) {
                     // 获取新增和删除用户id的并集
                     Collection<Long> delRoleUserIds = CollUtil.union(createRoleUserIds, deleteRoleUserIds);
-                    // 构建批量删除的key集合
-                    Set<String> delKeys = delRoleUserIds.stream().map(userId -> String.format(String.valueOf(new StringBuffer(RedisKeyConstants.USER_ROLE_ID_LIST).append(":%s:%s")), finalOrganId, userId)).collect(Collectors.toSet());
-                    Long batchDelNum = redisTemplate.delete(delKeys);
-                    log.info("[batchAssignRoleUsers] 批量删除redis[USER_ROLE_ID_LIST]数量:{}", batchDelNum);
+                    delRoleUserIds.forEach(delRoleUserId -> {
+                        String patternKey = String.format(String.valueOf(new StringBuffer(RedisKeyConstants.USER_ROLE_ID_LIST).append(":*:%s")), delRoleUserId);
+                        Long batchDelNum = scanAndDelKeys(patternKey);
+                        log.info("[batchAssignRoleUsers] 批量删除redis[{}]数量:{}", patternKey, batchDelNum);
+                    });
                 }
                 redisTemplate.convertAndSend(RedisRefreshChannelTopicConstants.PERMISSION_REFRESH, "");
             }).exceptionally(e -> {