diff --git a/src/components/layout/Sidebar.tsx b/src/components/layout/Sidebar.tsx
index dfcffc9..eaaf184 100644
--- a/src/components/layout/Sidebar.tsx
+++ b/src/components/layout/Sidebar.tsx
@@ -22,7 +22,10 @@ const settingsItems = [
 ]
 
 function hasAnyAdminPerm(permissions: string[]): boolean {
-  return permissions.includes('*') || permissions.some(p => p.startsWith('users:') || p.startsWith('roles:') || p.startsWith('api-keys:'))
+  return permissions.includes('*') || permissions.some(p =>
+    p.startsWith('users:') || p.startsWith('roles:') || p.startsWith('api-keys:') ||
+    p.startsWith('audit-logs:') || p.startsWith('monitor:')
+  )
 }
 
 export default function Sidebar() {
diff --git a/src/middleware.ts b/src/middleware.ts
index 728229d..7638eab 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -1,9 +1,10 @@
 // issue-ai/src/middleware.ts — 使用共享 middleware 工厂
+// 注意：移除 adminPaths，settings 页面的权限由各 API 自行检查
+// middleware 仅负责认证（登录检查），不负责角色鉴权
 import { createMiddleware } from '@shared/lib/auth/middleware'
 
 export const middleware = createMiddleware({
   localCookieName: 'session_issue',
-  adminPaths: ['/settings'],
   enableApiKey: true,
 })