From c63c517b4fed7c01e60e8174a673cf24d890e786 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=BA=8C=E4=B8=AB=E8=AE=B2=E6=A2=B5?= <eryajf@163.com>
Date: Sun, 16 Aug 2026 11:23:53 +0800
Subject: [PATCH] feat(nacos): add access control support

---
 .../connection/ConnectionDialog.vue           |  102 +-
 .../src/components/layout/ContentArea.vue     |    7 +
 .../components/nacos/NacosAccessControl.vue   |  686 ++++++
 .../nacos/NacosAccessControlConsole.vue       |   95 +
 .../components/nacos/NacosAdminConsole.vue    |   10 +-
 .../nacos/NacosNamespaceMultiSelect.vue       |  128 ++
 .../nacos/NacosRoleAccessControl.vue          |  967 ++++++++
 .../NacosAccessControlConsole.spec.ts         |  210 ++
 .../__tests__/NacosAdminConsoleLayout.spec.ts |    5 +
 .../NacosNamespaceMultiSelect.spec.ts         |   15 +
 .../__tests__/NacosRoleAccessControl.spec.ts  |   50 +
 .../src/components/sidebar/ConnectionTree.vue |    5 +-
 .../sidebar/SidebarTreeRuntimeHost.vue        |   51 +-
 .../src/components/sidebar/TreeItem.vue       |    5 +
 .../sidebar/VisibleNacosNamespacesDialog.vue  |    4 +-
 .../SidebarTreeRuntimeHost.expansion.spec.ts  |   78 +-
 .../VisibleNacosNamespacesDialog.spec.ts      |   11 +
 .../src/i18n/__tests__/backendErrors.spec.ts  |   16 +
 apps/desktop/src/i18n/backend-errors.ts       |    5 +
 apps/desktop/src/i18n/locales/en.ts           |  173 +-
 apps/desktop/src/i18n/locales/es.ts           |   12 +
 apps/desktop/src/i18n/locales/it.ts           |   12 +
 apps/desktop/src/i18n/locales/ja.ts           |   12 +
 apps/desktop/src/i18n/locales/ko.ts           |    9 +
 .../src/i18n/locales/nacosAccessControl.ts    |  162 ++
 apps/desktop/src/i18n/locales/pt-BR.ts        |   12 +
 apps/desktop/src/i18n/locales/zh-CN.ts        |  173 +-
 apps/desktop/src/i18n/locales/zh-TW.ts        |   13 +
 .../connection/nacosConnectionDialog.spec.ts  |   17 +-
 .../lib/__tests__/nacos/nacosAdmin.spec.ts    |   21 +
 .../nacos/nacosNamespaceVisibility.spec.ts    |   13 +-
 .../sidebarConnectionStateFilter.spec.ts      |   16 +-
 .../sidebar/sidebarTreeItemLayout.spec.ts     |    4 +-
 .../__tests__/sidebar/treeNodeClick.spec.ts   |   26 +-
 apps/desktop/src/lib/backend/api.ts           |   13 +
 apps/desktop/src/lib/backend/http.ts          |   64 +
 apps/desktop/src/lib/backend/nacos-tauri.ts   |   64 +
 apps/desktop/src/lib/nacos/nacosAdmin.ts      |   39 +-
 .../src/lib/nacos/nacosNamespaceVisibility.ts |    9 +
 .../src/lib/sidebar/sidebarActiveTabTarget.ts |   12 +
 .../src/lib/sidebar/sidebarSearchTree.ts      |   26 +-
 .../src/lib/sidebar/sidebarTreeItemLayout.ts  |    2 +
 apps/desktop/src/lib/sidebar/treeNodeClick.ts |    9 +-
 apps/desktop/src/lib/sidebar/treeNodeIcon.ts  |    1 +
 apps/desktop/src/lib/tabs/tabPresentation.ts  |    5 +
 ...nnectionStore.nacosNamespaceAccess.spec.ts |  102 +
 .../__tests__/connectionStore.timeout.spec.ts |   26 +
 apps/desktop/src/stores/connectionStore.ts    |   28 +-
 apps/desktop/src/types/database.ts            |    2 +
 apps/desktop/src/types/nacos.ts               |  172 +-
 crates/dbx-core/src/connection.rs             |    9 +-
 crates/dbx-core/src/nacos/access_control.rs   | 1464 ++++++++++++
 crates/dbx-core/src/nacos/config.rs           |   36 +
 crates/dbx-core/src/nacos/http.rs             | 2028 ++++++++++++++++-
 crates/dbx-core/src/nacos/mod.rs              |    5 +
 crates/dbx-core/src/nacos/namespace_access.rs |  835 +++++++
 crates/dbx-core/src/nacos/port.rs             |   82 +
 crates/dbx-core/src/nacos/prometheus.rs       |    1 +
 crates/dbx-core/src/nacos/service.rs          |  254 ++-
 crates/dbx-core/src/nacos/types.rs            |  428 ++++
 crates/dbx-web/src/main.rs                    |   13 +
 crates/dbx-web/src/routes/connection.rs       |   15 +-
 crates/dbx-web/src/routes/nacos.rs            |  195 ++
 .../app-tests/sidebarTreeAffordances.test.ts  |    2 +-
 src-tauri/src/commands/connection.rs          |    3 +-
 src-tauri/src/commands/nacos_cmd.rs           |  115 +
 src-tauri/src/lib.rs                          |   13 +
 67 files changed, 9062 insertions(+), 135 deletions(-)
 create mode 100644 apps/desktop/src/components/nacos/NacosAccessControl.vue
 create mode 100644 apps/desktop/src/components/nacos/NacosAccessControlConsole.vue
 create mode 100644 apps/desktop/src/components/nacos/NacosNamespaceMultiSelect.vue
 create mode 100644 apps/desktop/src/components/nacos/NacosRoleAccessControl.vue
 create mode 100644 apps/desktop/src/components/nacos/__tests__/NacosAccessControlConsole.spec.ts
 create mode 100644 apps/desktop/src/components/nacos/__tests__/NacosNamespaceMultiSelect.spec.ts
 create mode 100644 apps/desktop/src/components/nacos/__tests__/NacosRoleAccessControl.spec.ts
 create mode 100644 apps/desktop/src/components/sidebar/__tests__/VisibleNacosNamespacesDialog.spec.ts
 create mode 100644 apps/desktop/src/i18n/locales/nacosAccessControl.ts
 create mode 100644 apps/desktop/src/stores/__tests__/connectionStore.nacosNamespaceAccess.spec.ts
 create mode 100644 crates/dbx-core/src/nacos/access_control.rs
 create mode 100644 crates/dbx-core/src/nacos/namespace_access.rs

diff --git a/apps/desktop/src/components/connection/ConnectionDialog.vue b/apps/desktop/src/components/connection/ConnectionDialog.vue
index 1ff7ba37a3..42a43547d3 100644
--- a/apps/desktop/src/components/connection/ConnectionDialog.vue
+++ b/apps/desktop/src/components/connection/ConnectionDialog.vue
@@ -69,8 +69,8 @@ import { normalizeRabbitmqAddresses } from "@/lib/connection/rabbitmqAddresses";
 import { detectMqUiAuthKind, isMqAuthKindAllowedForSystem, type MqUiAuthKind } from "@/lib/connection/mqAuth";
 import { driverInstallProgressChannel, driverInstallProgressPercent, isDriverInstallProgressForOperation, type DriverInstallProgress } from "@/lib/connection/driverInstallProgressUi";
 import { requiresSqlServerLegacyCompatibilityComponent, setSqlServerLegacyCompatibilityConfig, sqlServerUsesLegacyCompatibility, SQLSERVER_LEGACY_COMPATIBILITY_DRIVER_KEY } from "@/lib/connection/sqlServerLegacyCompatibility";
-import { normalizeNacosEndpoint, normalizeNacosMetricsUrl } from "@/lib/nacos/nacosAdmin";
-import { nacosNamespaceIdentity, normalizeNacosNamespaceSelection, normalizeNacosNamespacesForDisplay } from "@/lib/nacos/nacosNamespaceVisibility";
+import { normalizeNacosEndpoint, normalizeNacosMetricsUrl, parseNacosManagedNamespaces } from "@/lib/nacos/nacosAdmin";
+import { loadReadableNacosNamespaces, nacosNamespaceIdentity, normalizeNacosNamespaceSelection } from "@/lib/nacos/nacosNamespaceVisibility";
 import {
   ArrowLeft,
   ArrowDown,
@@ -821,11 +821,12 @@ const mqKafkaSaslMechanismOptions = [
   { value: "SCRAM-SHA-512", label: "SCRAM-SHA-512" },
 ];
 const nacosImplementation = ref<NacosImplementation>("nacos");
-// Nacos 2 and 3 expose different API planes (and Nacos 3 commonly needs a
-// separate Console address). New connections must therefore choose an
-// explicit version instead of relying on endpoint-shape guessing.
+// Nacos 2 and 3 expose different API planes. New connections must therefore
+// choose an explicit version instead of relying on endpoint-shape guessing.
 const nacosVersionMode = ref<NacosVersionMode>("v2");
 const nacosServerAddr = ref("");
+const nacosOrdinaryAccount = ref(false);
+const nacosManagedNamespacesText = ref("");
 const nacosRNacosConsoleAddr = ref("");
 const nacosHistoryEnabled = ref(false);
 const nacosConsoleAuthKind = ref<NacosRNacosConsoleAuth["kind"]>("inherit");
@@ -1390,6 +1391,8 @@ function resetNacosFields(config?: Partial<NacosAdminConfig>) {
   const serverAddr = config?.serverAddr?.trim() || "";
   const contextPath = config?.contextPath?.trim() || "";
   nacosServerAddr.value = serverAddr && contextPath && contextPath !== "/" && !serverAddr.endsWith(contextPath) ? `${serverAddr.replace(/\/+$/, "")}/${contextPath.replace(/^\/+/, "")}` : serverAddr;
+  nacosOrdinaryAccount.value = !!config?.managedNamespaces?.length;
+  nacosManagedNamespacesText.value = (config?.managedNamespaces || []).join("\n");
   nacosRNacosConsoleAddr.value = config?.rnacosConsoleAddr?.trim() || "";
   nacosHistoryEnabled.value = config?.rnacosHistoryEnabled ?? !!config?.rnacosConsoleAddr;
   const consoleAuth = config?.rnacosConsoleAuth || { kind: "inherit" };
@@ -1731,12 +1734,16 @@ function buildNacosAdminConfig(): NacosAdminConfig {
   if (nacosImplementation.value === "rnacos" && normalized.warnings.length) {
     throw new Error(t("connection.nacosRNacosOpenApiRequired"));
   }
-  const rnacosExtensionsEnabled = nacosImplementation.value === "rnacos" && nacosHistoryEnabled.value;
-  const rnacosConsoleConfigured = rnacosExtensionsEnabled && !!nacosRNacosConsoleAddr.value.trim();
-  if (rnacosExtensionsEnabled && !rnacosConsoleConfigured) {
+  const rnacosConsoleConfigured = nacosImplementation.value === "rnacos" && !!nacosRNacosConsoleAddr.value.trim();
+  if (nacosImplementation.value === "rnacos" && nacosHistoryEnabled.value && !rnacosConsoleConfigured) {
     throw new Error(t("connection.nacosRNacosConsoleUrlRequired"));
   }
   let rnacosConsoleAuth: NacosRNacosConsoleAuth | undefined;
+  const usesManagedNamespaces = nacosImplementation.value === "nacos" && nacosAuthKind.value === "usernamePassword" && nacosOrdinaryAccount.value;
+  const managedNamespaces = usesManagedNamespaces ? parseNacosManagedNamespaces(nacosManagedNamespacesText.value) : [];
+  if (usesManagedNamespaces && managedNamespaces.length === 0) {
+    throw new Error(t("nacos.nacosOrdinaryNamespacesRequired"));
+  }
   let metricsUrl: string | undefined;
   if (nacosMetricsMode.value === "custom") {
     try {
@@ -1762,7 +1769,8 @@ function buildNacosAdminConfig(): NacosAdminConfig {
     versionMode: nacosImplementation.value === "nacos" ? nacosVersionMode.value : undefined,
     serverAddr: normalized.serverAddr,
     contextPath: normalized.contextPath || undefined,
-    rnacosConsoleAddr: rnacosExtensionsEnabled ? nacosRNacosConsoleAddr.value.trim() || undefined : undefined,
+    managedNamespaces: managedNamespaces.length ? managedNamespaces : undefined,
+    rnacosConsoleAddr: rnacosConsoleConfigured ? nacosRNacosConsoleAddr.value.trim() : undefined,
     rnacosHistoryEnabled: nacosImplementation.value === "rnacos" ? nacosHistoryEnabled.value : undefined,
     rnacosConsoleAuth,
     auth: buildNacosAuth(),
@@ -4426,7 +4434,7 @@ async function openVisibleNacosNamespacesPicker() {
       one_time: true,
     };
     await api.connectDb(draftConfig);
-    const namespaces = normalizeNacosNamespacesForDisplay(await api.nacosListNamespaces(draftId));
+    const namespaces = await loadReadableNacosNamespaces(draftId, api);
     visibleNacosNamespaces.value = [...namespaces].sort((left, right) => nacosNamespaceLabel(left).localeCompare(nacosNamespaceLabel(right)));
     const configured = form.value.visible_databases;
     const initialSelection = Array.isArray(configured) ? normalizeVisibleNacosNamespaceSelection(configured, visibleNacosNamespaces.value) : visibleNacosNamespaces.value.map(nacosNamespaceValue);
@@ -4510,7 +4518,7 @@ function initialProductionDatabaseSelection(databaseNames: string[]): string[] {
 
 async function loadProductionDatabaseNames(connectionId: string, config: ConnectionConfig): Promise<string[]> {
   if (config.db_type === "nacos") {
-    return normalizeNacosNamespacesForDisplay(await api.nacosListNamespaces(connectionId)).map((namespace) => namespace.namespace);
+    return (await loadReadableNacosNamespaces(connectionId, api)).map((namespace) => namespace.namespace);
   }
   if (config.db_type === "redis") {
     return (await api.redisListDatabases(connectionId)).map((database) => String(database.db));
@@ -6316,6 +6324,29 @@ function openExternalUrl(url: string) {
                         <PasswordInput v-model="nacosPassword" />
                       </div>
                     </div>
+                    <div v-if="nacosImplementation === 'nacos' && nacosAuthKind === 'usernamePassword'" data-nacos-ordinary-user-toggle class="mt-4 border-t pt-4">
+                      <div class="flex items-start justify-between gap-4">
+                        <span class="min-w-0">
+                          <span class="block text-sm font-medium">{{ t("nacos.nacosOrdinaryAccount") }}</span>
+                          <span class="mt-0.5 block text-xs leading-5 text-muted-foreground">{{ t("nacos.nacosOrdinaryAccountHint") }}</span>
+                        </span>
+                        <Switch v-model="nacosOrdinaryAccount" class="mt-0.5 shrink-0" />
+                      </div>
+                      <div v-if="nacosOrdinaryAccount" class="mt-3 grid gap-1.5 pl-0 sm:pl-4">
+                        <div class="flex items-center justify-between gap-3">
+                          <Label>{{ t("nacos.nacosManagedNamespaces") }}</Label>
+                          <span class="text-[11px] text-muted-foreground">{{ t("nacos.nacosManagedNamespacesSeparator") }}</span>
+                        </div>
+                        <textarea
+                          v-model="nacosManagedNamespacesText"
+                          data-nacos-managed-namespaces
+                          rows="2"
+                          class="min-h-14 resize-y rounded-md border border-input bg-background px-3 py-2 text-sm shadow-sm outline-none placeholder:text-muted-foreground focus-visible:ring-1 focus-visible:ring-ring"
+                          :placeholder="t('nacos.nacosManagedNamespacesPlaceholder')"
+                        />
+                        <p class="text-[11px] leading-4 text-muted-foreground">{{ t("nacos.nacosManagedNamespacesHint") }}</p>
+                      </div>
+                    </div>
                   </section>
 
                   <section data-nacos-advanced-hint class="flex items-start gap-3 rounded-lg border border-dashed bg-muted/20 px-4 py-3">
@@ -7707,38 +7738,35 @@ function openExternalUrl(url: string) {
                           <span class="text-xs text-muted-foreground">{{ t("nacos.nacosEnabled") }}</span>
                         </label>
                       </div>
-                      <template v-if="nacosHistoryEnabled">
+                      <div class="grid gap-1.5">
+                        <Label>{{ t("connection.nacosRNacosConsoleUrl") }}</Label>
+                        <Input v-model="nacosRNacosConsoleAddr" :placeholder="t('connection.nacosRNacosConsoleUrlPlaceholder')" />
+                        <p class="text-[11px] leading-4 text-muted-foreground">{{ t("nacos.nacosRnacosConsoleUrlHint") }}</p>
+                      </div>
+                      <template v-if="nacosRNacosConsoleAddr.trim()">
                         <div class="grid gap-1.5">
-                          <Label>{{ t("connection.nacosRNacosConsoleUrl") }}</Label>
-                          <Input v-model="nacosRNacosConsoleAddr" :placeholder="t('connection.nacosRNacosConsoleUrlPlaceholder')" />
-                          <p class="text-[11px] leading-4 text-muted-foreground">{{ t("nacos.nacosRnacosConsoleUrlHint") }}</p>
+                          <Label>{{ t("connection.nacosConsoleAuthentication") }}</Label>
+                          <div class="flex items-center gap-1 rounded-md border bg-muted/20 p-0.5">
+                            <Button type="button" size="sm" class="h-8 flex-1" :variant="nacosConsoleAuthKind === 'inherit' ? 'default' : 'ghost'" :disabled="nacosAuthKind === 'none'" @click="nacosConsoleAuthKind = 'inherit'">
+                              {{ t("connection.nacosConsoleAuthInherit") }}
+                            </Button>
+                            <Button type="button" size="sm" class="h-8 flex-1" :variant="nacosConsoleAuthKind === 'usernamePassword' ? 'default' : 'ghost'" @click="nacosConsoleAuthKind = 'usernamePassword'">
+                              {{ t("connection.nacosConsoleAuthSeparate") }}
+                            </Button>
+                          </div>
+                          <p v-if="nacosConsoleAuthKind === 'inherit' && nacosAuthKind === 'none'" class="text-xs text-destructive">{{ t("connection.nacosConsoleAuthPrimaryNone") }}</p>
                         </div>
-                        <template v-if="nacosRNacosConsoleAddr.trim()">
+                        <div v-if="nacosConsoleAuthKind === 'usernamePassword'" class="grid gap-4 sm:grid-cols-2">
                           <div class="grid gap-1.5">
-                            <Label>{{ t("connection.nacosConsoleAuthentication") }}</Label>
-                            <div class="flex items-center gap-1 rounded-md border bg-muted/20 p-0.5">
-                              <Button type="button" size="sm" class="h-8 flex-1" :variant="nacosConsoleAuthKind === 'inherit' ? 'default' : 'ghost'" :disabled="nacosAuthKind === 'none'" @click="nacosConsoleAuthKind = 'inherit'">
-                                {{ t("connection.nacosConsoleAuthInherit") }}
-                              </Button>
-                              <Button type="button" size="sm" class="h-8 flex-1" :variant="nacosConsoleAuthKind === 'usernamePassword' ? 'default' : 'ghost'" @click="nacosConsoleAuthKind = 'usernamePassword'">
-                                {{ t("connection.nacosConsoleAuthSeparate") }}
-                              </Button>
-                            </div>
-                            <p v-if="nacosConsoleAuthKind === 'inherit' && nacosAuthKind === 'none'" class="text-xs text-destructive">{{ t("connection.nacosConsoleAuthPrimaryNone") }}</p>
+                            <Label>{{ t("connection.nacosConsoleUser") }}</Label>
+                            <Input v-model="nacosConsoleUsername" />
                           </div>
-                          <div v-if="nacosConsoleAuthKind === 'usernamePassword'" class="grid gap-4 sm:grid-cols-2">
-                            <div class="grid gap-1.5">
-                              <Label>{{ t("connection.nacosConsoleUser") }}</Label>
-                              <Input v-model="nacosConsoleUsername" />
-                            </div>
-                            <div class="grid gap-1.5">
-                              <Label>{{ t("connection.nacosConsolePassword") }}</Label>
-                              <PasswordInput v-model="nacosConsolePassword" />
-                            </div>
+                          <div class="grid gap-1.5">
+                            <Label>{{ t("connection.nacosConsolePassword") }}</Label>
+                            <PasswordInput v-model="nacosConsolePassword" />
                           </div>
-                        </template>
+                        </div>
                       </template>
-                      <p v-else class="text-[11px] leading-4 text-muted-foreground">{{ t("nacos.nacosRnacosDisabledHint") }}</p>
                     </div>
 
                     <label class="flex items-start justify-between gap-4 border-t pt-4">
diff --git a/apps/desktop/src/components/layout/ContentArea.vue b/apps/desktop/src/components/layout/ContentArea.vue
index 50a7d28d0c..89dbca9001 100644
--- a/apps/desktop/src/components/layout/ContentArea.vue
+++ b/apps/desktop/src/components/layout/ContentArea.vue
@@ -94,6 +94,7 @@ const ElasticsearchJsonResponsePanel = defineAsyncComponent(() => import("@/comp
 const MqAdminConsole = defineAsyncComponent(() => import("@/components/mq/MqAdminConsole.vue"));
 const MqttAdminConsole = defineAsyncComponent(() => import("@/components/mqtt/MqttAdminConsole.vue"));
 const NacosAdminConsole = defineAsyncComponent(() => import("@/components/nacos/NacosAdminConsole.vue"));
+const NacosAccessControlConsole = defineAsyncComponent(() => import("@/components/nacos/NacosAccessControlConsole.vue"));
 const NacosDashboard = defineAsyncComponent(() => import("@/components/nacos/NacosDashboard.vue"));
 const DatabaseBrowser = defineAsyncComponent(() => import("@/components/objects/DatabaseBrowser.vue"));
 const ObjectBrowser = defineAsyncComponent(() => import("@/components/objects/ObjectBrowser.vue"));
@@ -2032,6 +2033,12 @@ defineExpose({ focusSearch, refreshData, refreshQueryEditorCompletionCache, hand
       </div>
     </template>
 
+    <template v-else-if="activeTab.mode === 'nacos-access-control'">
+      <div class="flex-1 min-h-0">
+        <NacosAccessControlConsole :key="activeTab.id" :connection-id="activeTab.connectionId" :read-only="activeConnection?.read_only ?? false" />
+      </div>
+    </template>
+
     <!-- ZooKeeper mode: znode browser -->
     <template v-else-if="activeTab.mode === 'zookeeper'">
       <div class="flex-1 min-h-0">
diff --git a/apps/desktop/src/components/nacos/NacosAccessControl.vue b/apps/desktop/src/components/nacos/NacosAccessControl.vue
new file mode 100644
index 0000000000..7c2c985bea
--- /dev/null
+++ b/apps/desktop/src/components/nacos/NacosAccessControl.vue
@@ -0,0 +1,686 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, watch } from "vue";
+import { KeyRound, Loader2, Pencil, Plus, RefreshCw, Search, ShieldCheck, Trash2, UserRound } from "@lucide/vue";
+import { useI18n } from "vue-i18n";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Switch } from "@/components/ui/switch";
+import NacosNamespaceMultiSelect from "@/components/nacos/NacosNamespaceMultiSelect.vue";
+import * as api from "@/lib/backend/api";
+import { executeWithProductionContextGuard } from "@/lib/database/productionExecutionGuard";
+import { normalizeNacosNamespacesForDisplay } from "@/lib/nacos/nacosNamespaceVisibility";
+import { useConnectionStore } from "@/stores/connectionStore";
+import type { NacosConnectionInfo, NacosNamespaceInfo, NacosNamespacePrivilege, NacosOperationCapability, NacosRoleBinding, NacosUserInfo } from "@/types/nacos";
+
+const props = defineProps<{
+  connectionId: string;
+  connectionInfo: NacosConnectionInfo | null;
+  readOnly?: boolean;
+  tab: "users" | "roles";
+}>();
+
+const { t } = useI18n();
+const connectionStore = useConnectionStore();
+
+type UserDialogMode = "create" | "edit" | "reset";
+
+const users = ref<NacosUserInfo[]>([]);
+const usersLoading = ref(false);
+const usersError = ref("");
+const userSearch = ref("");
+const userPageNo = ref(1);
+const userPageSize = ref(20);
+const userTotal = ref(0);
+
+const roles = ref<NacosRoleBinding[]>([]);
+const rolesLoading = ref(false);
+const rolesError = ref("");
+const roleUsername = ref("");
+const roleName = ref("");
+const rolePageNo = ref(1);
+const rolePageSize = ref(20);
+const roleTotal = ref(0);
+
+const userDialogOpen = ref(false);
+const userDialogMode = ref<UserDialogMode>("create");
+const userDialogError = ref("");
+const userSaving = ref(false);
+const userForm = ref(createUserForm());
+const userFormNamespaces = ref<NacosNamespaceInfo[]>([]);
+const userFormNamespacesLoading = ref(false);
+const userFormNamespacesError = ref("");
+const pendingUserDelete = ref<NacosUserInfo | null>(null);
+const deletingUser = ref(false);
+const roleDialogOpen = ref(false);
+const roleDialogError = ref("");
+const roleSaving = ref(false);
+const roleForm = ref({ username: "", role: "" });
+const pendingRoleDelete = ref<NacosRoleBinding | null>(null);
+const deletingRole = ref(false);
+
+const rnacosAuthOpen = ref(false);
+const rnacosAuthLoading = ref(false);
+const rnacosCaptchaImage = ref("");
+const rnacosCaptcha = ref("");
+const rnacosAuthError = ref("");
+let rnacosRetry: (() => Promise<void>) | null = null;
+
+const accessControl = computed(() => props.connectionInfo?.capabilities.accessControl);
+const mode = computed(() => accessControl.value?.mode ?? "unavailable");
+const isRNacos = computed(() => mode.value === "embeddedRoles");
+const userTotalPages = computed(() => Math.max(1, Math.ceil(userTotal.value / Math.max(1, userPageSize.value))));
+const roleTotalPages = computed(() => Math.max(1, Math.ceil(roleTotal.value / Math.max(1, rolePageSize.value))));
+
+function createUserForm() {
+  return {
+    username: "",
+    password: "",
+    nickname: "",
+    enabled: true,
+    roles: [] as string[],
+    whitelistIsAll: true,
+    whitelist: [] as string[],
+    blacklistIsAll: false,
+    blacklist: [] as string[],
+  };
+}
+
+function operationCapability(value: NacosOperationCapability | undefined): NacosOperationCapability {
+  return value ?? { supported: false, reason: "notVerified" };
+}
+
+function capabilityReason(capability: NacosOperationCapability) {
+  if (props.readOnly) return t("nacos.capabilityReadOnly");
+  switch (capability.reason) {
+    case "implementationReadOnly":
+      return t("nacos.capabilityReadOnlyWrite");
+    case "versionUnsupported":
+      return t("nacos.capabilityVersionUnsupported");
+    case "endpointUnavailable":
+      return t("nacos.capabilityEndpointUnavailable");
+    default:
+      return t("nacos.capabilityNotVerified");
+  }
+}
+
+function isWritable(capability: NacosOperationCapability | undefined) {
+  return !props.readOnly && operationCapability(capability).supported;
+}
+
+async function confirmAccessMutation(reviewText: string) {
+  const confirmed = await executeWithProductionContextGuard({
+    connection: connectionStore.getConfig(props.connectionId),
+    database: "",
+    reviewText,
+    source: t("production.sourceAdmin"),
+    execute: async () => true,
+  });
+  return confirmed === true;
+}
+
+function listUsersCapability() {
+  return operationCapability(accessControl.value?.listUsers);
+}
+
+function createUserCapability() {
+  return operationCapability(accessControl.value?.createUser);
+}
+
+function updateUserCapability() {
+  return operationCapability(accessControl.value?.updateUser);
+}
+
+function deleteUserCapability() {
+  return operationCapability(accessControl.value?.deleteUser);
+}
+
+function listRolesCapability() {
+  return operationCapability(accessControl.value?.listRoleBindings);
+}
+
+function assignRoleCapability() {
+  return operationCapability(accessControl.value?.assignRole);
+}
+
+function removeRoleCapability() {
+  return operationCapability(accessControl.value?.removeRole);
+}
+
+function privilegeFromForm(): NacosNamespacePrivilege {
+  return {
+    // r-nacos derives this read-only state from its privilege flags; its
+    // update API accepts only the whitelist and blacklist options below.
+    enabled: true,
+    whitelistIsAll: userForm.value.whitelistIsAll,
+    whitelist: [...userForm.value.whitelist],
+    blacklistIsAll: userForm.value.blacklistIsAll,
+    blacklist: [...userForm.value.blacklist],
+  };
+}
+
+function captchaImageSource(image: string) {
+  return image.startsWith("data:") ? image : `data:image/png;base64,${image}`;
+}
+
+async function withRNacosAuthentication(action: () => Promise<void>) {
+  try {
+    await action();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!message.includes("[rnacosConsoleCaptchaRequired]")) throw error;
+    rnacosRetry = action;
+    await requestRNacosAuthentication();
+  }
+}
+
+async function requestRNacosAuthentication() {
+  rnacosAuthLoading.value = true;
+  rnacosAuthError.value = "";
+  rnacosCaptcha.value = "";
+  try {
+    const challenge = await api.nacosGetRNacosConsoleCaptcha(props.connectionId);
+    if (!challenge.required) {
+      await api.nacosLoginRNacosConsole(props.connectionId);
+      const retry = rnacosRetry;
+      rnacosRetry = null;
+      if (retry) await retry();
+      return;
+    }
+    if (!challenge.image) throw new Error(t("nacos.rnacosCaptchaUnavailable"));
+    rnacosCaptchaImage.value = captchaImageSource(challenge.image);
+    rnacosAuthOpen.value = true;
+  } catch (error) {
+    rnacosAuthError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    rnacosAuthLoading.value = false;
+  }
+}
+
+async function submitRNacosAuthentication() {
+  if (!rnacosCaptcha.value.trim()) {
+    rnacosAuthError.value = t("nacos.rnacosCaptchaRequired");
+    return;
+  }
+  rnacosAuthLoading.value = true;
+  rnacosAuthError.value = "";
+  try {
+    await api.nacosLoginRNacosConsole(props.connectionId, rnacosCaptcha.value);
+    rnacosAuthOpen.value = false;
+    const retry = rnacosRetry;
+    rnacosRetry = null;
+    if (retry) await retry();
+  } catch (error) {
+    rnacosAuthError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    rnacosAuthLoading.value = false;
+  }
+}
+
+async function loadUsers(page = userPageNo.value) {
+  if (!listUsersCapability().supported) return;
+  usersLoading.value = true;
+  usersError.value = "";
+  userPageNo.value = page;
+  try {
+    await withRNacosAuthentication(async () => {
+      const result = await api.nacosListUsers(props.connectionId, {
+        username: userSearch.value.trim() || undefined,
+        pageNo: userPageNo.value,
+        pageSize: userPageSize.value,
+      });
+      users.value = result.items;
+      userTotal.value = result.totalCount;
+    });
+  } catch (error) {
+    usersError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    usersLoading.value = false;
+  }
+}
+
+async function loadRoles(page = rolePageNo.value) {
+  if (!listRolesCapability().supported) return;
+  rolesLoading.value = true;
+  rolesError.value = "";
+  rolePageNo.value = page;
+  try {
+    const result = await api.nacosListRoleBindings(props.connectionId, {
+      username: roleUsername.value.trim() || undefined,
+      role: roleName.value.trim() || undefined,
+      pageNo: rolePageNo.value,
+      pageSize: rolePageSize.value,
+    });
+    roles.value = result.items;
+    roleTotal.value = result.totalCount;
+  } catch (error) {
+    rolesError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    rolesLoading.value = false;
+  }
+}
+
+async function loadUserFormNamespaces(force = false) {
+  if (!isRNacos.value || userFormNamespacesLoading.value || (userFormNamespaces.value.length && !force)) return;
+  userFormNamespacesLoading.value = true;
+  userFormNamespacesError.value = "";
+  try {
+    userFormNamespaces.value = normalizeNacosNamespacesForDisplay(await api.nacosListNamespaces(props.connectionId));
+  } catch (error) {
+    userFormNamespacesError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    userFormNamespacesLoading.value = false;
+  }
+}
+
+function openCreateUser() {
+  userDialogMode.value = "create";
+  userDialogError.value = "";
+  userForm.value = createUserForm();
+  userDialogOpen.value = true;
+  void loadUserFormNamespaces();
+}
+
+function openEditUser(user: NacosUserInfo) {
+  userDialogMode.value = isRNacos.value ? "edit" : "reset";
+  userDialogError.value = "";
+  const privilege = user.namespacePrivilege;
+  userForm.value = {
+    username: user.username,
+    password: "",
+    nickname: user.nickname ?? "",
+    enabled: user.enabled ?? true,
+    roles: [...user.roles],
+    whitelistIsAll: privilege?.whitelistIsAll ?? true,
+    whitelist: [...(privilege?.whitelist ?? [])],
+    blacklistIsAll: privilege?.blacklistIsAll ?? false,
+    blacklist: [...(privilege?.blacklist ?? [])],
+  };
+  userDialogOpen.value = true;
+  void loadUserFormNamespaces();
+}
+
+watch(
+  () => props.connectionId,
+  () => {
+    userFormNamespaces.value = [];
+    userFormNamespacesError.value = "";
+  },
+);
+
+function toggleRNacosRole(role: string, checked: boolean) {
+  const next = new Set(userForm.value.roles);
+  if (checked) next.add(role);
+  else next.delete(role);
+  userForm.value.roles = [...next];
+}
+
+async function saveUser() {
+  if (userSaving.value) return;
+  const username = userForm.value.username.trim();
+  if (!username || (userDialogMode.value !== "edit" && !userForm.value.password)) {
+    userDialogError.value = t("nacos.userCredentialsRequired");
+    return;
+  }
+  if (!(await confirmAccessMutation(`${userDialogMode.value === "create" ? t("nacos.createUser") : t("nacos.save")}: ${username}`))) return;
+  userSaving.value = true;
+  userDialogError.value = "";
+  try {
+    await withRNacosAuthentication(async () => {
+      if (userDialogMode.value === "create") {
+        await api.nacosCreateUser(props.connectionId, {
+          username,
+          password: userForm.value.password,
+          nickname: isRNacos.value ? userForm.value.nickname.trim() || undefined : undefined,
+          enabled: isRNacos.value ? userForm.value.enabled : undefined,
+          roles: isRNacos.value ? userForm.value.roles : [],
+          namespacePrivilege: isRNacos.value ? privilegeFromForm() : undefined,
+        });
+      } else {
+        await api.nacosUpdateUser(props.connectionId, {
+          username,
+          password: userForm.value.password,
+          nickname: isRNacos.value ? userForm.value.nickname.trim() || undefined : undefined,
+          enabled: isRNacos.value ? userForm.value.enabled : undefined,
+          roles: isRNacos.value ? userForm.value.roles : undefined,
+          namespacePrivilege: isRNacos.value ? privilegeFromForm() : undefined,
+        });
+      }
+      userDialogOpen.value = false;
+      await loadUsers(1);
+    });
+  } catch (error) {
+    userDialogError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    userSaving.value = false;
+  }
+}
+
+async function deleteUser() {
+  const user = pendingUserDelete.value;
+  if (!user || deletingUser.value) return;
+  if (!(await confirmAccessMutation(`${t("nacos.deleteUser")}: ${user.username}`))) return;
+  deletingUser.value = true;
+  try {
+    await withRNacosAuthentication(async () => {
+      await api.nacosDeleteUser(props.connectionId, user.username);
+      pendingUserDelete.value = null;
+      await loadUsers(Math.min(userPageNo.value, userTotalPages.value));
+    });
+  } catch (error) {
+    usersError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    deletingUser.value = false;
+  }
+}
+
+function openAssignRole() {
+  roleDialogError.value = "";
+  roleForm.value = { username: roleUsername.value.trim(), role: "" };
+  roleDialogOpen.value = true;
+}
+
+async function assignRole() {
+  if (roleSaving.value) return;
+  if (!roleForm.value.username.trim() || !roleForm.value.role.trim()) {
+    roleDialogError.value = t("nacos.roleBindingRequired");
+    return;
+  }
+  if (!(await confirmAccessMutation(`${t("nacos.assignRole")}: ${roleForm.value.username.trim()} · ${roleForm.value.role.trim()}`))) return;
+  roleSaving.value = true;
+  roleDialogError.value = "";
+  try {
+    await api.nacosAssignRole(props.connectionId, { username: roleForm.value.username.trim(), role: roleForm.value.role.trim() });
+    roleDialogOpen.value = false;
+    await loadRoles(1);
+  } catch (error) {
+    roleDialogError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    roleSaving.value = false;
+  }
+}
+
+async function removeRole() {
+  const binding = pendingRoleDelete.value;
+  if (!binding || deletingRole.value) return;
+  if (!(await confirmAccessMutation(`${t("nacos.removeRole")}: ${binding.username} · ${binding.role}`))) return;
+  deletingRole.value = true;
+  try {
+    await api.nacosRemoveRole(props.connectionId, binding);
+    pendingRoleDelete.value = null;
+    await loadRoles(Math.min(rolePageNo.value, roleTotalPages.value));
+  } catch (error) {
+    rolesError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    deletingRole.value = false;
+  }
+}
+
+watch(
+  () => props.tab,
+  (tab) => {
+    if (tab === "users") void loadUsers(1);
+    else void loadRoles(1);
+  },
+);
+
+watch(
+  () => props.connectionId,
+  () => {
+    users.value = [];
+    roles.value = [];
+    userPageNo.value = 1;
+    rolePageNo.value = 1;
+    if (props.tab === "users") void loadUsers(1);
+    else void loadRoles(1);
+  },
+);
+
+onMounted(() => {
+  if (props.tab === "users") void loadUsers(1);
+  else void loadRoles(1);
+});
+</script>
+
+<template>
+  <section class="flex h-full min-h-0 flex-col bg-background">
+    <template v-if="tab === 'users'">
+      <header class="flex shrink-0 flex-wrap items-center gap-2 border-b bg-muted/20 px-4 py-2.5">
+        <div class="relative min-w-48 max-w-xl flex-1">
+          <Input v-model="userSearch" class="h-8 pr-8" :placeholder="t('nacos.searchUsers')" @keyup.enter="loadUsers(1)" />
+          <Search class="pointer-events-none absolute right-2.5 top-2 h-4 w-4 text-muted-foreground" />
+        </div>
+        <div class="flex-1" />
+        <Button size="sm" variant="outline" class="h-8 w-8 px-0" :disabled="usersLoading || !listUsersCapability().supported" :title="!listUsersCapability().supported ? capabilityReason(listUsersCapability()) : t('nacos.refresh')" :aria-label="t('nacos.refresh')" @click="loadUsers(1)">
+          <Loader2 v-if="usersLoading" class="h-3.5 w-3.5 animate-spin" />
+          <RefreshCw v-else class="h-3.5 w-3.5" />
+        </Button>
+        <Button size="sm" class="h-8 gap-1.5" :disabled="!isWritable(createUserCapability())" :title="!isWritable(createUserCapability()) ? capabilityReason(createUserCapability()) : undefined" @click="openCreateUser">
+          <Plus class="h-3.5 w-3.5" />
+          {{ t("nacos.createUser") }}
+        </Button>
+      </header>
+      <div v-if="!listUsersCapability().supported" class="border-b bg-muted/30 px-3 py-2 text-xs text-muted-foreground">{{ capabilityReason(listUsersCapability()) }}</div>
+      <div v-if="usersError" class="border-b px-3 py-2 text-xs text-destructive">{{ usersError }}</div>
+      <div class="min-h-0 flex-1 overflow-auto">
+        <table class="w-full min-w-[680px] text-sm">
+          <thead class="sticky top-0 z-10 bg-muted/70 text-left text-xs text-muted-foreground">
+            <tr class="border-b">
+              <th class="px-3 py-2 font-medium">{{ t("nacos.username") }}</th>
+              <th class="px-3 py-2 font-medium">{{ t("nacos.nickname") }}</th>
+              <th class="px-3 py-2 font-medium">{{ t("nacos.roles") }}</th>
+              <th class="px-3 py-2 font-medium">{{ t("nacos.state") }}</th>
+              <th class="w-32 px-3 py-2 text-right font-medium">{{ t("nacos.actions") }}</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr v-for="user in users" :key="user.username" class="border-b hover:bg-accent/40">
+              <td class="px-3 py-2 font-medium">{{ user.username }}</td>
+              <td class="px-3 py-2 text-muted-foreground">{{ user.nickname || "-" }}</td>
+              <td class="px-3 py-2">
+                <div class="flex flex-wrap gap-1">
+                  <Badge v-for="role in user.roles" :key="role" variant="outline" class="font-normal">{{ isRNacos ? t(`nacos.rnacosRole${role}`) : role }}</Badge
+                  ><span v-if="!user.roles.length" class="text-muted-foreground">-</span>
+                </div>
+              </td>
+              <td class="px-3 py-2">
+                <Badge v-if="isRNacos" :variant="user.enabled === false ? 'outline' : 'secondary'" :class="user.enabled === false ? 'text-muted-foreground' : 'text-emerald-700 dark:text-emerald-300'">{{ user.enabled === false ? t("nacos.disabled") : t("nacos.enabled") }}</Badge
+                ><span v-else class="text-muted-foreground">-</span>
+              </td>
+              <td class="px-3 py-2">
+                <div class="flex justify-end gap-1">
+                  <Button size="sm" variant="ghost" class="h-7 w-7 p-0" :disabled="!isWritable(updateUserCapability())" :title="isRNacos ? t('nacos.editUser') : t('nacos.resetUserPassword')" @click="openEditUser(user)"
+                    ><Pencil v-if="isRNacos" class="h-3.5 w-3.5" /><KeyRound v-else class="h-3.5 w-3.5" /></Button
+                  ><Button size="sm" variant="ghost" class="h-7 w-7 p-0 text-destructive hover:text-destructive" :disabled="!isWritable(deleteUserCapability())" :title="t('nacos.deleteUser')" @click="pendingUserDelete = user"><Trash2 class="h-3.5 w-3.5" /></Button>
+                </div>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        <div v-if="!usersLoading && !users.length" class="flex h-full min-h-48 items-center justify-center text-sm text-muted-foreground"><UserRound class="mr-2 h-4 w-4" />{{ t("nacos.noUsers") }}</div>
+      </div>
+      <footer class="flex shrink-0 items-center justify-between border-t bg-muted/10 px-4 py-2 text-xs text-muted-foreground">
+        <span>{{ t("nacos.total", { count: userTotal }) }}</span>
+        <div class="flex items-center gap-2">
+          <Button size="sm" variant="outline" class="h-7" :disabled="userPageNo <= 1 || usersLoading" @click="loadUsers(userPageNo - 1)">{{ t("nacos.prev") }}</Button
+          ><span>{{ userPageNo }} / {{ userTotalPages }}</span
+          ><Button size="sm" variant="outline" class="h-7" :disabled="userPageNo >= userTotalPages || usersLoading" @click="loadUsers(userPageNo + 1)">{{ t("nacos.next") }}</Button>
+        </div>
+      </footer>
+    </template>
+
+    <template v-else>
+      <header class="flex shrink-0 flex-wrap items-center gap-2 border-b bg-muted/20 px-4 py-2.5">
+        <Input v-model="roleUsername" class="h-8 min-w-44 max-w-sm flex-1" :placeholder="t('nacos.filterUsername')" @keyup.enter="loadRoles(1)" />
+        <Input v-model="roleName" class="h-8 min-w-44 max-w-sm flex-1" :placeholder="t('nacos.filterRole')" @keyup.enter="loadRoles(1)" />
+        <div class="flex-1" />
+        <Button size="sm" variant="outline" class="h-8 w-8 px-0" :disabled="rolesLoading || !listRolesCapability().supported" :title="!listRolesCapability().supported ? capabilityReason(listRolesCapability()) : t('nacos.refresh')" :aria-label="t('nacos.refresh')" @click="loadRoles(1)"
+          ><Loader2 v-if="rolesLoading" class="h-3.5 w-3.5 animate-spin" /><RefreshCw v-else class="h-3.5 w-3.5"
+        /></Button>
+        <Button size="sm" class="h-8 gap-1.5" :disabled="!isWritable(assignRoleCapability())" :title="!isWritable(assignRoleCapability()) ? capabilityReason(assignRoleCapability()) : undefined" @click="openAssignRole"><Plus class="h-3.5 w-3.5" />{{ t("nacos.assignRole") }}</Button>
+      </header>
+      <div v-if="rolesError" class="border-b px-3 py-2 text-xs text-destructive">{{ rolesError }}</div>
+      <div class="min-h-0 flex-1 overflow-auto">
+        <table class="w-full min-w-[520px] text-sm">
+          <thead class="sticky top-0 z-10 bg-muted/70 text-left text-xs text-muted-foreground">
+            <tr class="border-b">
+              <th class="px-3 py-2 font-medium">{{ t("nacos.username") }}</th>
+              <th class="px-3 py-2 font-medium">{{ t("nacos.role") }}</th>
+              <th class="w-24 px-3 py-2 text-right font-medium">{{ t("nacos.actions") }}</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr v-for="binding in roles" :key="`${binding.username}:${binding.role}`" class="border-b hover:bg-accent/40">
+              <td class="px-3 py-2 font-medium">{{ binding.username }}</td>
+              <td class="px-3 py-2">
+                <Badge variant="outline" class="font-normal">{{ binding.role }}</Badge>
+              </td>
+              <td class="px-3 py-2 text-right">
+                <span :title="binding.role === 'ROLE_ADMIN' ? t('nacos.protectedRole') : undefined"
+                  ><Button size="sm" variant="ghost" class="h-7 w-7 p-0 text-destructive hover:text-destructive" :disabled="binding.role === 'ROLE_ADMIN' || !isWritable(removeRoleCapability())" :aria-label="t('nacos.removeRole')" @click="pendingRoleDelete = binding"
+                    ><Trash2 class="h-3.5 w-3.5" /></Button
+                ></span>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        <div v-if="!rolesLoading && !roles.length" class="flex h-full min-h-48 items-center justify-center text-sm text-muted-foreground"><ShieldCheck class="mr-2 h-4 w-4" />{{ t("nacos.noRoleBindings") }}</div>
+      </div>
+      <footer class="flex shrink-0 items-center justify-between border-t bg-muted/10 px-4 py-2 text-xs text-muted-foreground">
+        <span>{{ t("nacos.total", { count: roleTotal }) }}</span>
+        <div class="flex items-center gap-2">
+          <Button size="sm" variant="outline" class="h-7" :disabled="rolePageNo <= 1 || rolesLoading" @click="loadRoles(rolePageNo - 1)">{{ t("nacos.prev") }}</Button
+          ><span>{{ rolePageNo }} / {{ roleTotalPages }}</span
+          ><Button size="sm" variant="outline" class="h-7" :disabled="rolePageNo >= roleTotalPages || rolesLoading" @click="loadRoles(rolePageNo + 1)">{{ t("nacos.next") }}</Button>
+        </div>
+      </footer>
+    </template>
+  </section>
+
+  <Dialog v-model:open="userDialogOpen"
+    ><DialogContent class="max-h-[88vh] overflow-auto sm:max-w-xl"
+      ><DialogHeader
+        ><DialogTitle>{{ t(`nacos.${userDialogMode}UserTitle`) }}</DialogTitle
+        ><DialogDescription>{{ t(`nacos.${userDialogMode}UserDescription`) }}</DialogDescription></DialogHeader
+      >
+      <div class="space-y-4">
+        <div class="grid gap-1.5">
+          <Label for="nacos-user-name">{{ t("nacos.username") }}</Label
+          ><Input id="nacos-user-name" v-model="userForm.username" :disabled="userDialogMode !== 'create'" autocomplete="off" />
+        </div>
+        <div class="grid gap-1.5">
+          <Label for="nacos-user-password">{{ t("nacos.password") }}</Label
+          ><Input id="nacos-user-password" v-model="userForm.password" type="password" autocomplete="new-password" :placeholder="userDialogMode === 'edit' ? t('nacos.passwordUnchanged') : undefined" />
+        </div>
+        <template v-if="isRNacos && userDialogMode !== 'reset'"
+          ><div class="grid gap-1.5">
+            <Label for="nacos-user-nickname">{{ t("nacos.nickname") }}</Label
+            ><Input id="nacos-user-nickname" v-model="userForm.nickname" />
+          </div>
+          <div class="flex items-center justify-between rounded-md border px-3 py-2">
+            <div>
+              <div class="text-sm font-medium">{{ t("nacos.enabled") }}</div>
+              <div class="text-xs text-muted-foreground">{{ t("nacos.rnacosUserEnabledHint") }}</div>
+            </div>
+            <Switch v-model="userForm.enabled" />
+          </div>
+          <fieldset class="space-y-2 rounded-md border p-3">
+            <legend class="px-1 text-sm font-medium">{{ t("nacos.roles") }}</legend>
+            <label v-for="role in ['0', '1', '2']" :key="role" class="flex items-start gap-2 text-sm"
+              ><input type="checkbox" :checked="userForm.roles.includes(role)" @change="toggleRNacosRole(role, ($event.target as HTMLInputElement).checked)" /><span
+                ><span class="font-medium">{{ t(`nacos.rnacosRole${role}`) }}</span
+                ><span class="ml-2 text-xs text-muted-foreground">{{ t(`nacos.rnacosRole${role}Hint`) }}</span></span
+              ></label
+            >
+          </fieldset>
+          <fieldset class="space-y-3 rounded-md border p-3">
+            <legend class="px-1 text-sm font-medium">{{ t("nacos.namespacePrivileges") }}</legend>
+            <div class="space-y-1.5">
+              <div class="flex items-center justify-between">
+                <Label>{{ t("nacos.namespaceWhitelist") }}</Label
+                ><label class="flex items-center gap-2 text-xs text-muted-foreground"><Switch v-model="userForm.whitelistIsAll" size="sm" />{{ t("nacos.allNamespaces") }}</label>
+              </div>
+              <NacosNamespaceMultiSelect v-if="!userForm.whitelistIsAll" v-model="userForm.whitelist" :namespaces="userFormNamespaces" :loading="userFormNamespacesLoading" :error="userFormNamespacesError" @retry="loadUserFormNamespaces(true)" />
+            </div>
+            <div class="space-y-1.5">
+              <div class="flex items-center justify-between">
+                <Label>{{ t("nacos.namespaceBlacklist") }}</Label
+                ><label class="flex items-center gap-2 text-xs text-muted-foreground"><Switch v-model="userForm.blacklistIsAll" size="sm" />{{ t("nacos.allNamespaces") }}</label>
+              </div>
+              <NacosNamespaceMultiSelect v-if="!userForm.blacklistIsAll" v-model="userForm.blacklist" :namespaces="userFormNamespaces" :loading="userFormNamespacesLoading" :error="userFormNamespacesError" @retry="loadUserFormNamespaces(true)" />
+            </div></fieldset
+        ></template>
+        <p v-if="userDialogError" class="text-sm text-destructive">{{ userDialogError }}</p>
+      </div>
+      <DialogFooter
+        ><Button variant="outline" :disabled="userSaving" @click="userDialogOpen = false">{{ t("nacos.cancel") }}</Button
+        ><Button :disabled="userSaving" @click="saveUser"><Loader2 v-if="userSaving" class="mr-2 h-4 w-4 animate-spin" />{{ t("nacos.save") }}</Button></DialogFooter
+      ></DialogContent
+    ></Dialog
+  >
+
+  <Dialog v-model:open="roleDialogOpen"
+    ><DialogContent class="sm:max-w-md"
+      ><DialogHeader
+        ><DialogTitle>{{ t("nacos.assignRoleTitle") }}</DialogTitle
+        ><DialogDescription>{{ t("nacos.assignRoleDescription") }}</DialogDescription></DialogHeader
+      >
+      <div class="space-y-4">
+        <div class="grid gap-1.5">
+          <Label for="nacos-role-user">{{ t("nacos.username") }}</Label
+          ><Input id="nacos-role-user" v-model="roleForm.username" />
+        </div>
+        <div class="grid gap-1.5">
+          <Label for="nacos-role-name">{{ t("nacos.role") }}</Label
+          ><Input id="nacos-role-name" v-model="roleForm.role" placeholder="ROLE_USER" />
+        </div>
+        <p v-if="roleDialogError" class="text-sm text-destructive">{{ roleDialogError }}</p>
+      </div>
+      <DialogFooter
+        ><Button variant="outline" :disabled="roleSaving" @click="roleDialogOpen = false">{{ t("nacos.cancel") }}</Button
+        ><Button :disabled="roleSaving" @click="assignRole"><Loader2 v-if="roleSaving" class="mr-2 h-4 w-4 animate-spin" />{{ t("nacos.assignRole") }}</Button></DialogFooter
+      ></DialogContent
+    ></Dialog
+  >
+
+  <Dialog :open="!!pendingUserDelete" @update:open="!$event && (pendingUserDelete = null)"
+    ><DialogContent class="sm:max-w-md"
+      ><DialogHeader
+        ><DialogTitle>{{ t("nacos.deleteUserTitle") }}</DialogTitle
+        ><DialogDescription>{{ t("nacos.deleteUserDescription", { username: pendingUserDelete?.username }) }}</DialogDescription></DialogHeader
+      ><DialogFooter
+        ><Button variant="outline" :disabled="deletingUser" @click="pendingUserDelete = null">{{ t("nacos.cancel") }}</Button
+        ><Button variant="destructive" :disabled="deletingUser" @click="deleteUser"><Loader2 v-if="deletingUser" class="mr-2 h-4 w-4 animate-spin" />{{ t("nacos.delete") }}</Button></DialogFooter
+      ></DialogContent
+    ></Dialog
+  >
+  <Dialog :open="!!pendingRoleDelete" @update:open="!$event && (pendingRoleDelete = null)"
+    ><DialogContent class="sm:max-w-md"
+      ><DialogHeader
+        ><DialogTitle>{{ t("nacos.removeRoleTitle") }}</DialogTitle
+        ><DialogDescription>{{ t("nacos.removeRoleDescription", pendingRoleDelete ?? {}) }}</DialogDescription></DialogHeader
+      ><DialogFooter
+        ><Button variant="outline" :disabled="deletingRole" @click="pendingRoleDelete = null">{{ t("nacos.cancel") }}</Button
+        ><Button variant="destructive" :disabled="deletingRole" @click="removeRole"><Loader2 v-if="deletingRole" class="mr-2 h-4 w-4 animate-spin" />{{ t("nacos.removeRole") }}</Button></DialogFooter
+      ></DialogContent
+    ></Dialog
+  >
+  <Dialog v-model:open="rnacosAuthOpen"
+    ><DialogContent class="sm:max-w-sm"
+      ><DialogHeader
+        ><DialogTitle>{{ t("nacos.rnacosConsoleAuthTitle") }}</DialogTitle
+        ><DialogDescription>{{ t("nacos.rnacosAccessControlAuthDescription") }}</DialogDescription></DialogHeader
+      >
+      <div class="space-y-3">
+        <img v-if="rnacosCaptchaImage" :src="rnacosCaptchaImage" class="h-16 w-full rounded border object-contain" :alt="t('nacos.rnacosCaptchaLabel')" /><Input v-model="rnacosCaptcha" :placeholder="t('nacos.rnacosCaptchaPlaceholder')" @keyup.enter="submitRNacosAuthentication" />
+        <p v-if="rnacosAuthError" class="text-sm text-destructive">{{ rnacosAuthError }}</p>
+      </div>
+      <DialogFooter
+        ><Button variant="outline" :disabled="rnacosAuthLoading" @click="requestRNacosAuthentication">{{ t("nacos.rnacosRefreshCaptcha") }}</Button
+        ><Button :disabled="rnacosAuthLoading" @click="submitRNacosAuthentication"><Loader2 v-if="rnacosAuthLoading" class="mr-2 h-4 w-4 animate-spin" />{{ t("nacos.rnacosConsoleAuthSubmit") }}</Button></DialogFooter
+      ></DialogContent
+    ></Dialog
+  >
+</template>
diff --git a/apps/desktop/src/components/nacos/NacosAccessControlConsole.vue b/apps/desktop/src/components/nacos/NacosAccessControlConsole.vue
new file mode 100644
index 0000000000..18443e1541
--- /dev/null
+++ b/apps/desktop/src/components/nacos/NacosAccessControlConsole.vue
@@ -0,0 +1,95 @@
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { KeyRound, Loader2, RefreshCw, ShieldCheck, UsersRound } from "@lucide/vue";
+import { useI18n } from "vue-i18n";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import NacosAccessControl from "@/components/nacos/NacosAccessControl.vue";
+import NacosRoleAccessControl from "@/components/nacos/NacosRoleAccessControl.vue";
+import * as api from "@/lib/backend/api";
+import { useConnectionStore } from "@/stores/connectionStore";
+import type { NacosConnectionInfo } from "@/types/nacos";
+
+const props = defineProps<{
+  connectionId: string;
+  readOnly?: boolean;
+}>();
+
+type AccessTab = "users" | "roles";
+
+const { t } = useI18n();
+const connectionStore = useConnectionStore();
+const connectionInfo = ref<NacosConnectionInfo | null>(null);
+const connectionError = ref("");
+const loading = ref(false);
+const activeTab = ref<AccessTab>("users");
+
+const accessControl = computed(() => connectionInfo.value?.capabilities.accessControl);
+const supportsUsers = computed(() => accessControl.value?.listUsers.supported === true);
+const supportsRoles = computed(() => accessControl.value?.mode === "roleBindings" && accessControl.value.listRoleBindings.supported === true);
+const enhancedWorkspace = computed(() => accessControl.value?.enhancedWorkspace === true);
+const permissionWorkspaceUnavailable = computed(() => accessControl.value?.mode === "roleBindings" && accessControl.value.listPermissions?.supported === false && accessControl.value.listPermissions.reason !== "versionUnsupported");
+
+async function loadConnectionInfo() {
+  loading.value = true;
+  connectionError.value = "";
+  try {
+    await connectionStore.ensureConnected(props.connectionId);
+    connectionInfo.value = await api.nacosTestConnection(props.connectionId);
+    if (!supportsUsers.value && supportsRoles.value) activeTab.value = "roles";
+  } catch (error) {
+    connectionInfo.value = null;
+    connectionError.value = error instanceof Error ? error.message : String(error);
+  } finally {
+    loading.value = false;
+  }
+}
+
+watch(
+  () => props.connectionId,
+  () => void loadConnectionInfo(),
+  { immediate: true },
+);
+</script>
+
+<template>
+  <section class="flex h-full min-h-0 flex-col bg-background">
+    <header class="flex h-14 shrink-0 flex-wrap items-center gap-3 border-b px-4">
+      <div class="flex rounded-md border p-0.5 shadow-sm">
+        <Button size="sm" class="h-8 gap-1.5 px-3 text-sm" :variant="activeTab === 'users' ? 'secondary' : 'ghost'" :disabled="!supportsUsers" @click="activeTab = 'users'">
+          <UsersRound class="h-4 w-4" />
+          {{ t("nacos.users") }}
+        </Button>
+        <Button v-if="supportsRoles" size="sm" class="h-8 gap-1.5 px-3 text-sm" :variant="activeTab === 'roles' ? 'secondary' : 'ghost'" @click="activeTab = 'roles'">
+          <KeyRound class="h-4 w-4" />
+          {{ t("nacos.roleBindings") }}
+        </Button>
+      </div>
+      <div class="hidden h-5 w-px bg-border sm:block" />
+      <div class="flex min-w-0 items-center gap-1.5 text-xs text-muted-foreground">
+        <ShieldCheck class="h-3.5 w-3.5 shrink-0 text-sky-600" />
+        <span class="font-medium text-foreground/75">{{ t("nacos.accessControlTitle") }}</span>
+        <span class="hidden truncate lg:inline">{{ t("nacos.accessControlDescription") }}</span>
+      </div>
+      <Badge v-if="connectionInfo?.serverVersion" variant="secondary">{{ connectionInfo.serverVersion }}</Badge>
+      <div class="flex-1" />
+      <Badge v-if="readOnly" variant="outline">{{ t("nacos.readOnly") }}</Badge>
+      <Button size="sm" variant="outline" class="h-8 gap-1.5" :disabled="loading" @click="loadConnectionInfo">
+        <RefreshCw class="h-3.5 w-3.5" :class="loading ? 'animate-spin' : ''" />
+        {{ t("nacos.refresh") }}
+      </Button>
+    </header>
+
+    <div v-if="permissionWorkspaceUnavailable" class="border-b border-amber-300 bg-amber-50 px-4 py-2 text-xs text-amber-900 dark:bg-amber-950/20 dark:text-amber-200">{{ t("nacos.accessPermissionEndpointUnavailable") }}</div>
+    <div v-if="connectionError" class="mx-4 mt-3 rounded border border-destructive/30 bg-destructive/5 px-3 py-2 text-sm text-destructive">{{ connectionError }}</div>
+    <div v-else-if="loading && !connectionInfo" class="flex min-h-0 flex-1 items-center justify-center text-sm text-muted-foreground">
+      <Loader2 class="mr-2 h-4 w-4 animate-spin" />
+      {{ t("nacos.loading") }}
+    </div>
+    <template v-else-if="connectionInfo">
+      <div v-if="!supportsUsers && !supportsRoles" class="m-4 rounded border bg-muted/40 px-3 py-2 text-sm text-muted-foreground">{{ t("nacos.accessControlUnavailable") }}</div>
+      <NacosRoleAccessControl v-if="enhancedWorkspace && accessControl" :connection-id="connectionId" :capabilities="accessControl" :read-only="readOnly" :tab="activeTab" @select-user="activeTab = 'users'" @select-role="activeTab = 'roles'" />
+      <NacosAccessControl v-else-if="supportsUsers || supportsRoles" :connection-id="connectionId" :connection-info="connectionInfo" :read-only="readOnly" :tab="activeTab" />
+    </template>
+  </section>
+</template>
diff --git a/apps/desktop/src/components/nacos/NacosAdminConsole.vue b/apps/desktop/src/components/nacos/NacosAdminConsole.vue
index 41120f177e..6c711466a7 100644
--- a/apps/desktop/src/components/nacos/NacosAdminConsole.vue
+++ b/apps/desktop/src/components/nacos/NacosAdminConsole.vue
@@ -44,7 +44,7 @@ import {
 } from "@/lib/nacos/nacosAdmin";
 import { createNacosNamespaceRequestGuard, subscribeNacosNamespacesChanged, type NacosNamespacesChangedDetail } from "@/lib/nacos/nacosNamespaceCache";
 import { nacosInstanceMatchesPatch, nacosInstanceRefIdentity, nacosIpAddressIsValid, nacosServiceDetailMatches } from "@/lib/nacos/nacosServiceManagement";
-import { nacosNamespaceIdentity, normalizeNacosNamespacesForDisplay } from "@/lib/nacos/nacosNamespaceVisibility";
+import { loadReadableNacosNamespaces, nacosNamespaceIdentity } from "@/lib/nacos/nacosNamespaceVisibility";
 import { copyToClipboard, readTextFromClipboard } from "@/lib/common/clipboard";
 import { trimmedSelectionLayer } from "@/lib/editor/codemirrorTrimmedSelectionLayer";
 import { safeLocalStorageGet, safeLocalStorageSet } from "@/lib/backend/safeStorage";
@@ -1112,9 +1112,9 @@ async function loadBatchNamespaces(options: { force?: boolean } = {}) {
   const connectionId = props.connectionId;
   const requestId = batchNamespacesRequestGuard.start(connectionId);
   try {
-    const namespaces = await api.nacosListNamespaces(connectionId);
+    const namespaces = await loadReadableNacosNamespaces(connectionId, api);
     if (!batchNamespacesRequestGuard.isCurrent(requestId, props.connectionId)) return;
-    batchNamespaces.value = normalizeNacosNamespacesForDisplay(namespaces);
+    batchNamespaces.value = namespaces;
   } catch (error) {
     if (!batchNamespacesRequestGuard.isCurrent(requestId, props.connectionId)) return;
     batchError.value = error instanceof Error ? error.message : String(error);
@@ -1126,9 +1126,9 @@ async function loadBatchTargetNamespaces(connectionId: string, options: { force?
   if (!options.force && batchTargetConnectionId.value === connectionId && batchTargetNamespaces.value.length) return;
   const requestId = batchTargetNamespacesRequestGuard.start(connectionId);
   try {
-    const namespaces = await api.nacosListNamespaces(connectionId);
+    const namespaces = await loadReadableNacosNamespaces(connectionId, api);
     if (!batchTargetNamespacesRequestGuard.isCurrent(requestId, connectionId) || batchTargetConnectionId.value !== connectionId) return;
-    batchTargetNamespaces.value = normalizeNacosNamespacesForDisplay(namespaces);
+    batchTargetNamespaces.value = namespaces;
   } catch (error) {
     if (!batchTargetNamespacesRequestGuard.isCurrent(requestId, connectionId) || batchTargetConnectionId.value !== connectionId) return;
     batchError.value = error instanceof Error ? error.message : String(error);
diff --git a/apps/desktop/src/components/nacos/NacosNamespaceMultiSelect.vue b/apps/desktop/src/components/nacos/NacosNamespaceMultiSelect.vue
new file mode 100644
index 0000000000..a2fead1354
--- /dev/null
+++ b/apps/desktop/src/components/nacos/NacosNamespaceMultiSelect.vue
@@ -0,0 +1,128 @@
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { Check, ChevronDown, Loader2, Search, X } from "@lucide/vue";
+import { useI18n } from "vue-i18n";
+import { Input } from "@/components/ui/input";
+import { Popover, PopoverContent, PopoverTrigger } from "@/components/ui/popover";
+import { nacosNamespaceIdentity, normalizeNacosNamespacesForDisplay } from "@/lib/nacos/nacosNamespaceVisibility";
+import type { NacosNamespaceInfo } from "@/types/nacos";
+
+const props = withDefaults(
+  defineProps<{
+    modelValue: string[];
+    namespaces: NacosNamespaceInfo[];
+    loading?: boolean;
+    error?: string;
+    disabled?: boolean;
+  }>(),
+  {
+    loading: false,
+    error: "",
+    disabled: false,
+  },
+);
+
+const emit = defineEmits<{
+  "update:modelValue": [value: string[]];
+  retry: [];
+}>();
+
+const { t } = useI18n();
+const open = ref(false);
+const search = ref("");
+
+const options = computed(() => {
+  const normalized = normalizeNacosNamespacesForDisplay(props.namespaces).map((item) => ({
+    value: nacosNamespaceIdentity(item.namespace),
+    label: item.namespaceShowName || nacosNamespaceIdentity(item.namespace),
+  }));
+  const seen = new Set(normalized.map((item) => item.value));
+  for (const value of props.modelValue) {
+    if (!seen.has(value)) normalized.push({ value, label: value });
+  }
+  return normalized;
+});
+
+const optionLabels = computed(() => new Map(options.value.map((item) => [item.value, item.label])));
+const selected = computed(() => new Set(props.modelValue));
+const filteredOptions = computed(() => {
+  const query = search.value.trim().toLocaleLowerCase();
+  if (!query) return options.value;
+  return options.value.filter((item) => item.value.toLocaleLowerCase().includes(query) || item.label.toLocaleLowerCase().includes(query));
+});
+
+watch(open, (value) => {
+  if (!value) search.value = "";
+});
+
+function toggle(value: string) {
+  const next = new Set(props.modelValue);
+  if (next.has(value)) next.delete(value);
+  else next.add(value);
+  emit("update:modelValue", [...next]);
+}
+
+function remove(value: string) {
+  emit(
+    "update:modelValue",
+    props.modelValue.filter((item) => item !== value),
+  );
+}
+</script>
+
+<template>
+  <Popover v-model:open="open">
+    <PopoverTrigger as-child>
+      <button
+        type="button"
+        data-nacos-namespace-multiselect
+        class="flex min-h-9 w-full items-center gap-1.5 rounded-md border border-input bg-background px-2.5 py-1.5 text-left text-sm shadow-sm outline-none transition-colors hover:bg-muted/30 focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50"
+        :disabled="disabled"
+      >
+        <span v-if="!modelValue.length" class="min-w-0 flex-1 truncate text-muted-foreground">{{ t("nacos.namespaceSelectPlaceholder") }}</span>
+        <span v-else class="flex min-w-0 flex-1 flex-wrap gap-1">
+          <span v-for="value in modelValue" :key="value" class="inline-flex max-w-full items-center gap-1 rounded border bg-muted/60 px-1.5 py-0.5 text-xs">
+            <span class="truncate">{{ optionLabels.get(value) || value }}</span>
+            <span
+              role="button"
+              tabindex="0"
+              class="shrink-0 rounded-sm text-muted-foreground hover:text-foreground"
+              :aria-label="t('nacos.namespaceRemoveSelection', { namespace: optionLabels.get(value) || value })"
+              @click.stop="remove(value)"
+              @keydown.enter.stop.prevent="remove(value)"
+              @keydown.space.stop.prevent="remove(value)"
+            >
+              <X class="h-3 w-3" />
+            </span>
+          </span>
+        </span>
+        <Loader2 v-if="loading" class="h-3.5 w-3.5 shrink-0 animate-spin text-muted-foreground" />
+        <ChevronDown v-else class="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
+      </button>
+    </PopoverTrigger>
+    <PopoverContent align="start" side="bottom" class="z-[80] w-[var(--reka-popover-trigger-width)] gap-1 p-1.5" @open-auto-focus.prevent>
+      <div class="relative">
+        <Search class="pointer-events-none absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-muted-foreground" />
+        <Input v-model="search" class="h-8 pl-8 text-sm" :placeholder="t('nacos.namespaceSearchPlaceholder')" autofocus />
+      </div>
+      <div class="max-h-52 overflow-y-auto py-1">
+        <div v-if="loading" class="flex items-center gap-2 px-2 py-3 text-xs text-muted-foreground"><Loader2 class="h-3.5 w-3.5 animate-spin" />{{ t("nacos.loading") }}</div>
+        <div v-else-if="error" class="space-y-2 px-2 py-2 text-xs text-destructive">
+          <p class="break-words">{{ error }}</p>
+          <button type="button" class="text-foreground underline underline-offset-2" @click="emit('retry')">{{ t("nacos.retryNamespaceList") }}</button>
+        </div>
+        <div v-else-if="!filteredOptions.length" class="px-2 py-3 text-xs text-muted-foreground">{{ t("nacos.noNamespacesAvailable") }}</div>
+        <template v-else>
+          <button v-for="option in filteredOptions" :key="option.value" type="button" class="flex w-full items-center gap-2 rounded-sm px-2 py-1.5 text-left text-sm hover:bg-accent focus-visible:bg-accent focus-visible:outline-none" @click="toggle(option.value)">
+            <span class="flex h-4 w-4 shrink-0 items-center justify-center rounded border" :class="selected.has(option.value) ? 'border-primary bg-primary text-primary-foreground' : 'border-input'">
+              <Check v-if="selected.has(option.value)" class="h-3 w-3" />
+            </span>
+            <span class="min-w-0 flex-1 truncate">{{ option.label }}</span>
+            <span v-if="option.label !== option.value" class="max-w-40 truncate text-xs text-muted-foreground">{{ option.value }}</span>
+          </button>
+        </template>
+      </div>
+      <div v-if="modelValue.length" class="border-t px-2 pt-1.5 text-[11px] text-muted-foreground">{{ t("nacos.namespaceSelectedCount", { count: modelValue.length }) }}</div>
+    </PopoverContent>
+  </Popover>
+</template>
diff --git a/apps/desktop/src/components/nacos/NacosRoleAccessControl.vue b/apps/desktop/src/components/nacos/NacosRoleAccessControl.vue
new file mode 100644
index 0000000000..271ed72be8
--- /dev/null
+++ b/apps/desktop/src/components/nacos/NacosRoleAccessControl.vue
@@ -0,0 +1,967 @@
+<script setup lang="ts">
+import { computed, onMounted, reactive, ref, watch } from "vue";
+import { AlertTriangle, Check, ChevronLeft, ChevronRight, CircleAlert, KeyRound, Link2, Loader2, LockKeyhole, Pencil, Plus, RefreshCw, RotateCcw, Search, Shield, ShieldCheck, Trash2, UserRound, X } from "@lucide/vue";
+import { useI18n } from "vue-i18n";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import * as api from "@/lib/backend/api";
+import { executeWithProductionContextGuard } from "@/lib/database/productionExecutionGuard";
+import { mergeNacosNamespacePermissionAssignments, type NacosNamespacePermissionAction } from "@/lib/nacos/nacosAdmin";
+import { useConnectionStore } from "@/stores/connectionStore";
+import type { NacosAccessControlCapabilities, NacosAccessControlSnapshot, NacosAccessOperationRequest, NacosAccessOperationResult, NacosPermissionDraft, NacosPermissionInfo, NacosUserInfo } from "@/types/nacos";
+
+const props = defineProps<{
+  connectionId: string;
+  capabilities: NacosAccessControlCapabilities;
+  readOnly?: boolean;
+  tab: "users" | "roles";
+}>();
+const emit = defineEmits<{
+  (event: "select-user"): void;
+  (event: "select-role"): void;
+}>();
+
+type PermissionAction = NacosNamespacePermissionAction;
+type PermissionAssignment = { namespaceId: string; action: PermissionAction };
+
+const { t } = useI18n();
+const connectionStore = useConnectionStore();
+const snapshot = ref<NacosAccessControlSnapshot | null>(null);
+const loading = ref(false);
+const error = ref("");
+const search = ref("");
+const page = ref(1);
+const pageSize = 30;
+const selectedUserName = ref("");
+const selectedRoleName = ref("");
+
+const userDialog = ref<"create" | "roles" | "password" | "delete" | null>(null);
+const userForm = reactive({ username: "", password: "", roles: [] as string[], confirmation: "" });
+const roleDialog = ref<"create" | "edit" | "delete" | null>(null);
+const roleForm = reactive({
+  role: "",
+  members: [] as string[],
+  newUsers: [] as Array<{ username: string; password: string }>,
+  permissions: [] as PermissionAssignment[],
+  confirmation: "",
+});
+const availableNamespaceSearch = ref("");
+const grantedNamespaceSearch = ref("");
+const selectedAvailableNamespaceIds = ref<string[]>([]);
+const selectedGrantedNamespaceIds = ref<string[]>([]);
+const formError = ref("");
+const saving = ref(false);
+const operationOpen = ref(false);
+const operation = ref<NacosAccessOperationResult | null>(null);
+const pendingAdvancedPermission = ref<NacosPermissionInfo | null>(null);
+const advancedPermissionConfirmation = ref("");
+const retryPasswords = reactive<Record<string, string>>({});
+
+const users = computed(() => snapshot.value?.users ?? []);
+const roles = computed(() => snapshot.value?.roles ?? []);
+const normalizedSearch = computed(() => search.value.trim().toLocaleLowerCase());
+const filteredUsers = computed(() => users.value.filter((user) => user.username.toLocaleLowerCase().includes(normalizedSearch.value)));
+const filteredRoles = computed(() => roles.value.filter((role) => role.role.toLocaleLowerCase().includes(normalizedSearch.value)));
+const currentItems = computed(() => (props.tab === "users" ? filteredUsers.value : filteredRoles.value));
+const totalPages = computed(() => Math.max(1, Math.ceil(currentItems.value.length / pageSize)));
+const pagedUsers = computed(() => filteredUsers.value.slice((page.value - 1) * pageSize, page.value * pageSize));
+const pagedRoles = computed(() => filteredRoles.value.slice((page.value - 1) * pageSize, page.value * pageSize));
+const selectedUser = computed(() => users.value.find((user) => user.username === selectedUserName.value) ?? null);
+const selectedRole = computed(() => roles.value.find((role) => role.role === selectedRoleName.value) ?? null);
+const roleMembers = computed(() => (snapshot.value?.roleBindings ?? []).filter((binding) => binding.role === selectedRoleName.value).map((binding) => binding.username));
+const rolePermissions = computed(() => (snapshot.value?.permissions ?? []).filter((permission) => permission.role === selectedRoleName.value));
+const managedRolePermissions = computed(() => rolePermissions.value.filter(isManagedPermission));
+const advancedRolePermissions = computed(() => rolePermissions.value.filter((permission) => !isManagedPermission(permission)));
+const assignableRoles = computed(() => roles.value.filter((role) => role.administrator || role.permissionCount > 0));
+const namespaceOptions = computed(() =>
+  (snapshot.value?.namespaces ?? []).map((namespace) => ({
+    id: namespace.namespace || "public",
+    name: namespace.namespaceShowName || namespace.namespace || "public",
+  })),
+);
+const grantedNamespaceIds = computed(() => new Set(roleForm.permissions.map((permission) => permission.namespaceId)));
+const availableNamespaces = computed(() =>
+  filterNamespaces(
+    namespaceOptions.value.filter((namespace) => !grantedNamespaceIds.value.has(namespace.id)),
+    availableNamespaceSearch.value,
+  ),
+);
+const grantedNamespaces = computed(() =>
+  filterNamespaces(
+    roleForm.permissions.map((permission) => ({
+      ...permission,
+      name: namespaceOptions.value.find((namespace) => namespace.id === permission.namespaceId)?.name ?? permission.namespaceId,
+    })),
+    grantedNamespaceSearch.value,
+  ),
+);
+const selectedUserPermissions = computed(() => effectivePermissions(selectedUser.value));
+const operationNeedsPasswords = computed(() => operation.value?.steps.filter((step) => ["failed", "skipped"].includes(step.status) && step.needsPassword) ?? []);
+const adminConfirmationTarget = computed(() => {
+  if (!selectedRole.value?.administrator) return "";
+  const current = snapshot.value?.currentUsername;
+  if (current && roleMembers.value.includes(current) && !roleForm.members.includes(current)) return current;
+  return "ROLE_ADMIN";
+});
+const adminMembersChanged = computed(() => {
+  if (!selectedRole.value?.administrator) return false;
+  const before = [...roleMembers.value].sort().join("\n");
+  const after = [...roleForm.members].sort().join("\n");
+  return before !== after || roleForm.newUsers.length > 0;
+});
+const canCreateUser = computed(() => !props.readOnly && props.capabilities.createUser.supported);
+const canUpdateUser = computed(() => !props.readOnly && props.capabilities.updateUser.supported);
+const canDeleteUser = computed(() => !props.readOnly && props.capabilities.deleteUser.supported);
+const canAssignRole = computed(() => !props.readOnly && props.capabilities.assignRole.supported);
+const canRemoveRole = computed(() => !props.readOnly && props.capabilities.removeRole.supported);
+const canGrantPermission = computed(() => !props.readOnly && props.capabilities.grantPermission.supported);
+const canRevokePermission = computed(() => !props.readOnly && props.capabilities.revokePermission.supported);
+const canCreateRole = computed(() => canAssignRole.value && canGrantPermission.value);
+const canEditUserRoles = computed(() => canAssignRole.value || canRemoveRole.value);
+const canEditRole = computed(() => canAssignRole.value || canRemoveRole.value || canGrantPermission.value || canRevokePermission.value || canCreateUser.value);
+
+function setHasAdded(before: Iterable<string>, after: Iterable<string>) {
+  const original = new Set(before);
+  return [...after].some((value) => !original.has(value));
+}
+
+function permissionActions(assignments: PermissionAssignment[]) {
+  return new Map(assignments.map((permission) => [permission.namespaceId, permission.action]));
+}
+
+const userOperationWritable = computed(() => {
+  if (props.readOnly) return false;
+  if (userDialog.value === "password") return canUpdateUser.value;
+  if (userDialog.value === "create") {
+    return canCreateUser.value && (!userForm.roles.length || canAssignRole.value);
+  }
+  if (userDialog.value === "roles") {
+    const original = selectedUser.value?.roles ?? [];
+    const addsRoles = setHasAdded(original, userForm.roles);
+    const removesRoles = setHasAdded(userForm.roles, original);
+    return (!addsRoles || canAssignRole.value) && (!removesRoles || canRemoveRole.value);
+  }
+  if (userDialog.value === "delete") {
+    return canDeleteUser.value && (!(selectedUser.value?.roles.length ?? 0) || canRemoveRole.value);
+  }
+  return false;
+});
+
+const roleOperationWritable = computed(() => {
+  if (props.readOnly) return false;
+  if (roleDialog.value === "create") {
+    return canAssignRole.value && canGrantPermission.value && (!roleForm.newUsers.length || canCreateUser.value);
+  }
+  if (roleDialog.value === "delete") {
+    return (!roleMembers.value.length || canRemoveRole.value) && (!rolePermissions.value.length || canRevokePermission.value);
+  }
+  if (roleDialog.value !== "edit") return false;
+
+  const nextMembers = [...roleForm.members, ...roleForm.newUsers.map((user) => user.username.trim()).filter(Boolean)];
+  const addsMembers = setHasAdded(roleMembers.value, nextMembers);
+  const removesMembers = setHasAdded(nextMembers, roleMembers.value);
+  const beforePermissions = permissionActions(mergeNacosNamespacePermissionAssignments(managedRolePermissions.value));
+  const afterPermissions = permissionActions(roleForm.permissions);
+  let grantsPermissions = false;
+  let revokesPermissions = false;
+  for (const [namespaceId, action] of afterPermissions) {
+    const previous = beforePermissions.get(namespaceId);
+    if (previous !== action) grantsPermissions = true;
+    if (previous && previous !== action) revokesPermissions = true;
+  }
+  for (const namespaceId of beforePermissions.keys()) {
+    if (!afterPermissions.has(namespaceId)) revokesPermissions = true;
+  }
+  return (!roleForm.newUsers.length || canCreateUser.value) && (!addsMembers || canAssignRole.value) && (!removesMembers || canRemoveRole.value) && (!grantsPermissions || canGrantPermission.value) && (!revokesPermissions || canRevokePermission.value);
+});
+
+async function loadSnapshot(preserveSelection = true) {
+  loading.value = true;
+  error.value = "";
+  try {
+    snapshot.value = await api.nacosAccessSnapshot(props.connectionId);
+    if (!preserveSelection || !users.value.some((user) => user.username === selectedUserName.value)) {
+      selectedUserName.value = users.value[0]?.username ?? "";
+    }
+    if (!preserveSelection || !roles.value.some((role) => role.role === selectedRoleName.value)) {
+      selectedRoleName.value = roles.value[0]?.role ?? "";
+    }
+  } catch (cause) {
+    error.value = cause instanceof Error ? cause.message : String(cause);
+  } finally {
+    loading.value = false;
+  }
+}
+
+function isManagedPermission(permission: NacosPermissionInfo) {
+  return permission.parsedScope?.kind === "namespace" && ["r", "w", "rw"].includes(permission.actionRaw);
+}
+
+function namespaceName(permission: NacosPermissionInfo) {
+  const id = permission.parsedScope?.namespaceId;
+  if (!id) return permission.resourceRaw;
+  const namespace = namespaceOptions.value.find((item) => item.id === id);
+  return namespace ? namespace.name : `${id} (${t("nacos.accessDeletedNamespace")})`;
+}
+
+function actionLabel(action: string) {
+  if (action === "r") return t("nacos.accessReadOnly");
+  if (action === "w") return t("nacos.accessWriteOnly");
+  if (action === "rw") return t("nacos.accessReadWrite");
+  return action;
+}
+
+function mergeAction(left: string, right: string) {
+  if (left === right) return left;
+  const read = [left, right].some((value) => value === "r" || value === "rw");
+  const write = [left, right].some((value) => value === "w" || value === "rw");
+  return read && write ? "rw" : read ? "r" : write ? "w" : right;
+}
+
+function effectivePermissionKey(permission: NacosPermissionInfo) {
+  if (permission.parsedScope?.kind === "namespace") return `namespace:${permission.parsedScope.namespaceId ?? ""}`;
+  if (permission.resourceRaw === ":*:*" || permission.resourceRaw === "public:*:*") return "namespace:public";
+  return `raw:${permission.resourceRaw}`;
+}
+
+function effectivePermissions(user: NacosUserInfo | null) {
+  if (!user || !snapshot.value) return [];
+  if (user.roles.includes("ROLE_ADMIN")) {
+    return [{ resourceRaw: "*:*:*", action: "rw", name: t("nacos.accessAllResources"), sources: ["ROLE_ADMIN"], advanced: false }];
+  }
+  const grouped = new Map<string, { resourceRaw: string; action: string; name: string; sources: string[]; advanced: boolean }>();
+  for (const permission of snapshot.value.permissions.filter((item) => user.roles.includes(item.role))) {
+    const key = effectivePermissionKey(permission);
+    const existing = grouped.get(key);
+    if (existing) {
+      if (existing.resourceRaw === ":*:*" && permission.resourceRaw === "public:*:*") existing.resourceRaw = permission.resourceRaw;
+      existing.action = mergeAction(existing.action, permission.actionRaw);
+      existing.sources.push(permission.role);
+    } else {
+      grouped.set(key, {
+        resourceRaw: permission.resourceRaw,
+        action: permission.actionRaw,
+        name: namespaceName(permission),
+        sources: [permission.role],
+        advanced: !isManagedPermission(permission),
+      });
+    }
+  }
+  return [...grouped.values()].map((item) => ({ ...item, sources: [...new Set(item.sources)].sort() }));
+}
+
+async function confirmAccessMutation(reviewText: string) {
+  const confirmed = await executeWithProductionContextGuard({
+    connection: connectionStore.getConfig(props.connectionId),
+    database: "",
+    reviewText,
+    source: t("production.sourceAdmin"),
+    execute: async () => true,
+  });
+  return confirmed === true;
+}
+
+function operationReviewText(request: NacosAccessOperationRequest) {
+  switch (request.kind) {
+    case "createUser":
+      return `${t("nacos.createUser")}: ${request.username}`;
+    case "updateUserRoles":
+      return `${t("nacos.accessUserDialog.roles")}: ${request.username}`;
+    case "deleteUser":
+      return `${t("nacos.deleteUser")}: ${request.username}`;
+    case "createRole":
+      return `${t("nacos.accessCreateRole")}: ${request.role}`;
+    case "updateRole":
+      return `${t("nacos.accessRoleDialog.edit")}: ${request.role}`;
+    case "deleteRole":
+      return `${t("nacos.accessDeleteRole")}: ${request.role}`;
+    case "revokePermission":
+      return `${t("nacos.accessRevokeRawPermission")}: ${request.permission.role}`;
+  }
+}
+
+function toggle(values: string[], value: string, checked: boolean) {
+  const next = new Set(values);
+  if (checked) next.add(value);
+  else next.delete(value);
+  return [...next];
+}
+
+function openCreateUser() {
+  Object.assign(userForm, { username: "", password: "", roles: [], confirmation: "" });
+  formError.value = "";
+  userDialog.value = "create";
+}
+
+function openUserRoles() {
+  if (!selectedUser.value) return;
+  Object.assign(userForm, { username: selectedUser.value.username, password: "", roles: [...selectedUser.value.roles], confirmation: "" });
+  formError.value = "";
+  userDialog.value = "roles";
+}
+
+function openUserPassword() {
+  if (!selectedUser.value) return;
+  Object.assign(userForm, { username: selectedUser.value.username, password: "", roles: [], confirmation: "" });
+  formError.value = "";
+  userDialog.value = "password";
+}
+
+function openDeleteUser() {
+  if (!selectedUser.value) return;
+  Object.assign(userForm, { username: selectedUser.value.username, password: "", roles: [], confirmation: "" });
+  formError.value = "";
+  userDialog.value = "delete";
+}
+
+function resetRoleForm(role = "") {
+  Object.assign(roleForm, { role, members: [], newUsers: [], permissions: [], confirmation: "" });
+  availableNamespaceSearch.value = "";
+  grantedNamespaceSearch.value = "";
+  selectedAvailableNamespaceIds.value = [];
+  selectedGrantedNamespaceIds.value = [];
+}
+
+function openCreateRole() {
+  resetRoleForm();
+  formError.value = "";
+  roleDialog.value = "create";
+}
+
+function openEditRole() {
+  if (!selectedRole.value) return;
+  resetRoleForm(selectedRole.value.role);
+  roleForm.members = [...roleMembers.value];
+  roleForm.permissions = mergeNacosNamespacePermissionAssignments(managedRolePermissions.value);
+  formError.value = "";
+  roleDialog.value = "edit";
+}
+
+function openDeleteRole() {
+  if (!selectedRole.value) return;
+  roleForm.confirmation = "";
+  formError.value = "";
+  roleDialog.value = "delete";
+}
+
+function openMemberUser(username: string) {
+  selectedUserName.value = username;
+  emit("select-user");
+}
+
+function openAssociatedRole(role: string) {
+  selectedRoleName.value = role;
+  emit("select-role");
+}
+
+function filterNamespaces<T extends { id?: string; namespaceId?: string; name: string }>(items: T[], query: string) {
+  const normalized = query.trim().toLocaleLowerCase();
+  if (!normalized) return items;
+  return items.filter((item) => `${item.name} ${item.id ?? item.namespaceId ?? ""}`.toLocaleLowerCase().includes(normalized));
+}
+
+function moveNamespacesToGranted() {
+  const selected = new Set(selectedAvailableNamespaceIds.value);
+  for (const namespace of namespaceOptions.value) {
+    if (selected.has(namespace.id) && !grantedNamespaceIds.value.has(namespace.id)) {
+      roleForm.permissions.push({ namespaceId: namespace.id, action: "rw" });
+    }
+  }
+  selectedAvailableNamespaceIds.value = [];
+}
+
+function removeGrantedNamespaces() {
+  const selected = new Set(selectedGrantedNamespaceIds.value);
+  roleForm.permissions = roleForm.permissions.filter((permission) => !selected.has(permission.namespaceId));
+  selectedGrantedNamespaceIds.value = [];
+}
+
+function setPermissionAction(namespaceId: string, action: PermissionAction) {
+  const permission = roleForm.permissions.find((item) => item.namespaceId === namespaceId);
+  if (permission) permission.action = action;
+}
+
+function addNewUser() {
+  roleForm.newUsers.push({ username: "", password: "" });
+}
+
+async function submitUser() {
+  formError.value = "";
+  if (userDialog.value === "password") {
+    if (!userForm.password) return void (formError.value = t("nacos.accessPasswordRequired"));
+    if (!(await confirmAccessMutation(`${t("nacos.accessUserDialog.password")}: ${userForm.username}`))) return;
+    saving.value = true;
+    try {
+      await api.nacosUpdateUser(props.connectionId, { username: userForm.username, password: userForm.password });
+      userDialog.value = null;
+    } catch (cause) {
+      formError.value = cause instanceof Error ? cause.message : String(cause);
+    } finally {
+      saving.value = false;
+    }
+    return;
+  }
+  let req: NacosAccessOperationRequest;
+  if (userDialog.value === "create") {
+    if (!userForm.username.trim() || !userForm.password) return void (formError.value = t("nacos.accessCredentialsRequired"));
+    req = { kind: "createUser", username: userForm.username.trim(), password: userForm.password, roles: userForm.roles, confirmation: userForm.confirmation || undefined };
+  } else if (userDialog.value === "roles") {
+    req = { kind: "updateUserRoles", username: userForm.username, roles: userForm.roles, confirmation: userForm.confirmation || undefined };
+  } else {
+    req = { kind: "deleteUser", username: userForm.username, confirmation: userForm.confirmation || undefined };
+  }
+  await runOperation(req, () => (userDialog.value = null));
+}
+
+async function submitRole() {
+  formError.value = "";
+  if (roleDialog.value === "delete") {
+    await runOperation({ kind: "deleteRole", role: roleForm.role, confirmation: roleForm.confirmation || undefined }, () => (roleDialog.value = null));
+    return;
+  }
+  if (!roleForm.role.trim() || (!roleForm.members.length && !roleForm.newUsers.length)) {
+    formError.value = t("nacos.accessRoleMemberRequired");
+    return;
+  }
+  const editingAdministrator = roleDialog.value === "edit" && selectedRole.value?.administrator;
+  if (!editingAdministrator && !roleForm.permissions.length) {
+    formError.value = t("nacos.accessRolePermissionRequired");
+    return;
+  }
+  if (roleForm.newUsers.some((user) => !user.username.trim() || !user.password)) {
+    formError.value = t("nacos.accessInlineUserRequired");
+    return;
+  }
+  const permissions: NacosPermissionDraft[] = roleForm.permissions.map((permission) => ({ namespaceIds: [permission.namespaceId], action: permission.action }));
+  const common = {
+    role: roleForm.role.trim(),
+    members: roleForm.members,
+    newUsers: roleForm.newUsers.map((user) => ({ username: user.username.trim(), password: user.password })),
+    permissions,
+    confirmation: roleForm.confirmation || undefined,
+  };
+  const req: NacosAccessOperationRequest = roleDialog.value === "create" ? { kind: "createRole", ...common } : { kind: "updateRole", ...common };
+  await runOperation(req, () => (roleDialog.value = null));
+}
+
+async function runOperation(req: NacosAccessOperationRequest, close: () => void) {
+  if (!(await confirmAccessMutation(operationReviewText(req)))) return;
+  saving.value = true;
+  formError.value = "";
+  try {
+    operation.value = await api.nacosStartAccessOperation(props.connectionId, req);
+    close();
+    operationOpen.value = true;
+    await loadSnapshot();
+  } catch (cause) {
+    formError.value = cause instanceof Error ? cause.message : String(cause);
+  } finally {
+    saving.value = false;
+  }
+}
+
+async function retryOperation() {
+  if (!operation.value) return;
+  if (!(await confirmAccessMutation(`${t("nacos.accessRetryFailed")}: ${operation.value.operationId}`))) return;
+  saving.value = true;
+  try {
+    operation.value = await api.nacosRetryAccessOperation(props.connectionId, {
+      operationId: operation.value.operationId,
+      credentials: operationNeedsPasswords.value.map((step) => ({ username: step.target, password: retryPasswords[step.target] ?? "" })),
+    });
+    await loadSnapshot();
+  } catch (cause) {
+    error.value = cause instanceof Error ? cause.message : String(cause);
+  } finally {
+    saving.value = false;
+  }
+}
+
+async function undoOperation() {
+  if (!operation.value) return;
+  if (!(await confirmAccessMutation(`${t("nacos.accessUndoCreated")}: ${operation.value.operationId}`))) return;
+  saving.value = true;
+  try {
+    operation.value = await api.nacosUndoAccessOperation(props.connectionId, operation.value.operationId);
+    await loadSnapshot();
+  } catch (cause) {
+    error.value = cause instanceof Error ? cause.message : String(cause);
+  } finally {
+    saving.value = false;
+  }
+}
+
+async function revokeAdvancedPermission() {
+  if (!pendingAdvancedPermission.value) return;
+  await runOperation(
+    {
+      kind: "revokePermission",
+      permission: pendingAdvancedPermission.value,
+      confirmation: advancedPermissionConfirmation.value || undefined,
+    },
+    () => (pendingAdvancedPermission.value = null),
+  );
+}
+
+watch(
+  () => props.connectionId,
+  () => void loadSnapshot(false),
+);
+watch(
+  () => props.tab,
+  () => {
+    search.value = "";
+    page.value = 1;
+  },
+);
+watch(normalizedSearch, () => (page.value = 1));
+onMounted(() => void loadSnapshot(false));
+</script>
+
+<template>
+  <section class="flex min-h-0 flex-1 bg-background">
+    <aside class="flex w-64 shrink-0 flex-col border-r bg-muted/10">
+      <div class="flex h-12 shrink-0 items-center gap-2 border-b px-3">
+        <div class="relative min-w-0 flex-1">
+          <Search class="pointer-events-none absolute left-2.5 top-2 h-3.5 w-3.5 text-muted-foreground" />
+          <Input v-model="search" class="h-8 pl-8" :placeholder="tab === 'users' ? t('nacos.searchUsers') : t('nacos.accessSearchRoles')" />
+        </div>
+        <Button size="sm" variant="ghost" class="h-8 w-8 p-0" :aria-label="t('nacos.refresh')" :disabled="loading" @click="loadSnapshot()">
+          <RefreshCw class="h-3.5 w-3.5" :class="loading ? 'animate-spin' : ''" />
+        </Button>
+      </div>
+
+      <div class="min-h-0 flex-1 overflow-auto p-2">
+        <template v-if="tab === 'users'">
+          <button v-for="user in pagedUsers" :key="user.username" class="mb-0.5 flex h-10 w-full items-center gap-2 rounded px-2 text-left text-sm hover:bg-accent" :class="selectedUserName === user.username ? 'bg-accent text-accent-foreground' : ''" @click="selectedUserName = user.username">
+            <UserRound class="h-4 w-4 shrink-0 text-muted-foreground" />
+            <span class="min-w-0 flex-1 truncate font-medium">{{ user.username }}</span>
+            <Badge v-if="user.roles.includes('ROLE_ADMIN')" variant="secondary" class="h-5 px-1.5 text-[10px]">Admin</Badge>
+          </button>
+        </template>
+        <template v-else>
+          <button v-for="role in pagedRoles" :key="role.role" class="mb-0.5 flex min-h-11 w-full items-center gap-2 rounded px-2 py-1.5 text-left text-sm hover:bg-accent" :class="selectedRoleName === role.role ? 'bg-accent text-accent-foreground' : ''" @click="selectedRoleName = role.role">
+            <ShieldCheck class="h-4 w-4 shrink-0" :class="role.complete ? 'text-emerald-600' : 'text-amber-600'" />
+            <span class="min-w-0 flex-1">
+              <span class="block truncate font-medium">{{ role.role }}</span>
+              <span class="block text-[11px] text-muted-foreground">{{ t("nacos.accessRoleCounts", { members: role.memberCount, permissions: role.permissionCount }) }}</span>
+            </span>
+          </button>
+        </template>
+        <div v-if="!loading && !currentItems.length" class="flex h-32 items-center justify-center px-4 text-center text-xs text-muted-foreground">{{ tab === "users" ? t("nacos.noUsers") : t("nacos.accessNoRoles") }}</div>
+      </div>
+
+      <div class="shrink-0 space-y-2 border-t p-2">
+        <Button class="h-8 w-full" :disabled="tab === 'users' ? !canCreateUser : !canCreateRole" @click="tab === 'users' ? openCreateUser() : openCreateRole()"><Plus class="mr-1.5 h-3.5 w-3.5" />{{ tab === "users" ? t("nacos.createUser") : t("nacos.accessCreateRole") }}</Button>
+        <div class="flex h-7 items-center justify-between px-1 text-xs text-muted-foreground">
+          <span>{{ currentItems.length }}</span>
+          <div class="flex items-center gap-1">
+            <Button size="sm" variant="ghost" class="h-7 w-7 p-0" :disabled="page <= 1" @click="page--"><ChevronLeft class="h-3.5 w-3.5" /></Button><span class="w-10 text-center">{{ page }}/{{ totalPages }}</span
+            ><Button size="sm" variant="ghost" class="h-7 w-7 p-0" :disabled="page >= totalPages" @click="page++"><ChevronRight class="h-3.5 w-3.5" /></Button>
+          </div>
+        </div>
+      </div>
+    </aside>
+
+    <main class="min-w-0 flex-1 overflow-auto">
+      <div v-if="error" class="m-4 flex items-start gap-2 rounded border border-destructive/30 bg-destructive/5 px-3 py-2 text-sm text-destructive"><CircleAlert class="mt-0.5 h-4 w-4 shrink-0" />{{ error }}</div>
+      <div v-else-if="loading && !snapshot" class="flex h-full items-center justify-center text-sm text-muted-foreground"><Loader2 class="mr-2 h-4 w-4 animate-spin" />{{ t("nacos.loading") }}</div>
+
+      <template v-else-if="tab === 'users' && selectedUser">
+        <header class="flex min-h-16 items-center gap-3 border-b px-5 py-3">
+          <div class="flex h-9 w-9 items-center justify-center rounded border bg-muted/30"><UserRound class="h-4 w-4" /></div>
+          <div class="min-w-0 flex-1">
+            <h2 class="truncate text-base font-semibold">{{ selectedUser.username }}</h2>
+            <p class="text-xs text-muted-foreground">{{ t("nacos.accessUserSubtitle") }}</p>
+          </div>
+          <Button size="sm" variant="outline" :disabled="!canUpdateUser" @click="openUserPassword"><KeyRound class="mr-1.5 h-3.5 w-3.5" />{{ t("nacos.resetUserPassword") }}</Button>
+          <Button size="sm" variant="ghost" class="text-destructive hover:text-destructive" :disabled="!canDeleteUser || (!!selectedUser.roles.length && !canRemoveRole)" @click="openDeleteUser"
+            ><Trash2 class="h-4 w-4" /><span class="sr-only">{{ t("nacos.deleteUser") }}</span></Button
+          >
+        </header>
+        <div class="mx-auto max-w-5xl px-5 py-5">
+          <section class="mb-7">
+            <div class="mb-3 flex items-start justify-between gap-3">
+              <div>
+                <h3 class="text-sm font-semibold">{{ t("nacos.accessAssociatedRoles") }}</h3>
+                <p class="mt-0.5 text-xs text-muted-foreground">{{ t("nacos.accessAssociatedRolesHint") }}</p>
+              </div>
+              <div class="flex shrink-0 items-center gap-2">
+                <Badge variant="secondary" class="font-normal">{{ selectedUser.roles.length }}</Badge>
+                <Button size="sm" variant="outline" :disabled="!canEditUserRoles" @click="openUserRoles"><Pencil class="mr-1.5 h-3.5 w-3.5" />{{ t("nacos.edit") }}</Button>
+              </div>
+            </div>
+            <div v-if="selectedUser.roles.length" class="flex flex-wrap gap-1.5 rounded border bg-muted/20 p-1.5">
+              <button
+                v-for="role in selectedUser.roles"
+                :key="role"
+                type="button"
+                class="group flex h-9 w-52 items-center gap-2 rounded border bg-background px-2 text-left text-sm transition-colors hover:border-primary/40 hover:bg-accent focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                :title="t('nacos.accessOpenRole', { role })"
+                @click="openAssociatedRole(role)"
+              >
+                <span class="flex h-6 w-6 shrink-0 items-center justify-center rounded-full border bg-muted/30"><Shield class="h-3.5 w-3.5" /></span>
+                <span class="min-w-0 flex-1 truncate font-medium">{{ role }}</span>
+                <Link2 class="h-3.5 w-3.5 shrink-0 text-muted-foreground transition-colors group-hover:text-foreground" />
+              </button>
+            </div>
+            <div v-else class="flex h-20 items-center justify-center rounded border text-sm text-muted-foreground">{{ t("nacos.accessNoAssociatedRoles") }}</div>
+          </section>
+          <section>
+            <div class="mb-3">
+              <h3 class="text-sm font-semibold">{{ t("nacos.accessEffectivePermissions") }}</h3>
+              <p class="mt-0.5 text-xs text-muted-foreground">{{ t("nacos.accessEffectivePermissionsHint") }}</p>
+            </div>
+            <div class="overflow-hidden rounded border">
+              <table class="w-full text-sm">
+                <thead class="bg-muted/40 text-left text-xs text-muted-foreground">
+                  <tr>
+                    <th class="px-3 py-2 font-medium">{{ t("nacos.namespace") }}</th>
+                    <th class="w-32 px-3 py-2 font-medium">{{ t("nacos.accessAction") }}</th>
+                    <th class="px-3 py-2 font-medium">{{ t("nacos.accessSourceRole") }}</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  <tr v-for="permission in selectedUserPermissions" :key="permission.resourceRaw" class="border-t">
+                    <td class="px-3 py-2.5">
+                      <div class="font-medium">{{ permission.name }}</div>
+                      <code v-if="permission.name !== permission.resourceRaw" class="mt-0.5 block text-xs font-normal text-muted-foreground">{{ permission.resourceRaw }}</code>
+                    </td>
+                    <td class="px-3 py-2.5">
+                      <Badge variant="outline" class="font-normal">{{ actionLabel(permission.action) }}</Badge>
+                    </td>
+                    <td class="px-3 py-2.5">
+                      <div class="flex flex-wrap gap-1">
+                        <Badge v-for="source in permission.sources" :key="source" variant="secondary" class="font-normal">{{ source }}</Badge>
+                      </div>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+              <div v-if="!selectedUserPermissions.length" class="flex h-24 items-center justify-center text-sm text-muted-foreground">{{ t("nacos.accessNoEffectivePermissions") }}</div>
+            </div>
+          </section>
+        </div>
+      </template>
+
+      <template v-else-if="tab === 'roles' && selectedRole">
+        <header class="flex min-h-16 items-center gap-3 border-b px-5 py-3">
+          <div class="flex h-9 w-9 items-center justify-center rounded border bg-muted/30"><ShieldCheck class="h-4 w-4" /></div>
+          <div class="min-w-0 flex-1">
+            <div class="flex items-center gap-2">
+              <h2 class="truncate text-base font-semibold">{{ selectedRole.role }}</h2>
+              <Badge v-if="selectedRole.administrator" variant="secondary">{{ t("nacos.accessGlobalAdministrator") }}</Badge
+              ><Badge v-else-if="!selectedRole.complete" variant="outline" class="border-amber-400 text-amber-700">{{ t("nacos.accessNeedsRepair") }}</Badge>
+            </div>
+            <p class="text-xs text-muted-foreground">{{ t("nacos.accessRoleSubtitle", { members: selectedRole.memberCount }) }}</p>
+          </div>
+          <Button size="sm" variant="outline" :disabled="!canEditRole" @click="openEditRole"><Pencil class="mr-1.5 h-3.5 w-3.5" />{{ t("nacos.edit") }}</Button>
+          <Button v-if="!selectedRole.administrator" size="sm" variant="ghost" class="text-destructive hover:text-destructive" :disabled="readOnly || (!!roleMembers.length && !canRemoveRole) || (!!rolePermissions.length && !canRevokePermission)" @click="openDeleteRole"
+            ><Trash2 class="h-4 w-4" /><span class="sr-only">{{ t("nacos.accessDeleteRole") }}</span></Button
+          >
+        </header>
+        <div class="mx-auto max-w-5xl px-5 py-5">
+          <div v-if="!selectedRole.complete" class="mb-5 flex items-start gap-2 rounded border border-amber-300 bg-amber-50 px-3 py-2 text-sm text-amber-900 dark:bg-amber-950/20 dark:text-amber-200"><AlertTriangle class="mt-0.5 h-4 w-4 shrink-0" />{{ t("nacos.accessIncompleteRoleHint") }}</div>
+          <section class="mb-7">
+            <div class="mb-3">
+              <h3 class="text-sm font-semibold">{{ t("nacos.accessPermissionScope") }}</h3>
+              <p class="mt-0.5 text-xs text-muted-foreground">{{ t("nacos.accessPermissionScopeHint") }}</p>
+            </div>
+            <div v-if="selectedRole.administrator" class="flex items-center gap-3 border-y py-4">
+              <LockKeyhole class="h-5 w-5 text-amber-600" />
+              <div>
+                <div class="text-sm font-medium">{{ t("nacos.accessAllResources") }}</div>
+                <div class="text-xs text-muted-foreground">{{ t("nacos.accessAdminBypassHint") }}</div>
+              </div>
+            </div>
+            <div v-else class="overflow-hidden rounded border">
+              <table class="w-full text-sm">
+                <thead class="bg-muted/40 text-left text-xs text-muted-foreground">
+                  <tr>
+                    <th class="px-3 py-2 font-medium">{{ t("nacos.namespace") }}</th>
+                    <th class="w-36 px-3 py-2 font-medium">{{ t("nacos.accessAction") }}</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  <tr v-for="permission in managedRolePermissions" :key="`${permission.resourceRaw}:${permission.actionRaw}`" class="border-t">
+                    <td class="px-3 py-2.5">
+                      <div class="font-medium">{{ namespaceName(permission) }}</div>
+                      <code v-if="namespaceName(permission) !== permission.resourceRaw" class="mt-0.5 block text-xs font-normal text-muted-foreground">{{ permission.resourceRaw }}</code>
+                    </td>
+                    <td class="px-3 py-2.5">
+                      <Badge variant="outline" class="font-normal">{{ actionLabel(permission.actionRaw) }}</Badge>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+              <div v-if="!managedRolePermissions.length" class="flex h-20 items-center justify-center text-sm text-muted-foreground">{{ t("nacos.accessNoRolePermissions") }}</div>
+            </div>
+          </section>
+          <section class="mb-7">
+            <div class="mb-3 flex items-start justify-between gap-3">
+              <div>
+                <h3 class="text-sm font-semibold">{{ t("nacos.accessMembers") }}</h3>
+                <p class="mt-0.5 text-xs text-muted-foreground">{{ t("nacos.accessMembersHint") }}</p>
+              </div>
+              <Badge variant="secondary" class="shrink-0 font-normal">{{ roleMembers.length }}</Badge>
+            </div>
+            <div v-if="roleMembers.length" class="flex flex-wrap gap-1.5 rounded border bg-muted/20 p-1.5">
+              <button
+                v-for="member in roleMembers"
+                :key="member"
+                type="button"
+                class="group flex h-9 w-52 items-center gap-2 rounded border bg-background px-2 text-left text-sm transition-colors hover:border-primary/40 hover:bg-accent focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                :title="t('nacos.accessOpenUser', { username: member })"
+                @click="openMemberUser(member)"
+              >
+                <span class="flex h-6 w-6 shrink-0 items-center justify-center rounded-full border bg-muted/30"><UserRound class="h-3.5 w-3.5" /></span>
+                <span class="min-w-0 flex-1 truncate font-medium">{{ member }}</span>
+                <Link2 class="h-3.5 w-3.5 shrink-0 text-muted-foreground transition-colors group-hover:text-foreground" />
+              </button>
+            </div>
+            <div v-else class="flex h-20 items-center justify-center rounded border text-sm text-muted-foreground">{{ t("nacos.accessNoMembers") }}</div>
+          </section>
+          <section v-if="advancedRolePermissions.length">
+            <div class="mb-3">
+              <h3 class="text-sm font-semibold">{{ t("nacos.accessAdvancedPermissions") }}</h3>
+              <p class="mt-0.5 text-xs text-muted-foreground">{{ t("nacos.accessAdvancedPermissionsHint") }}</p>
+            </div>
+            <div class="divide-y rounded border">
+              <div v-for="permission in advancedRolePermissions" :key="`${permission.resourceRaw}:${permission.actionRaw}`" class="flex items-center gap-3 px-3 py-2.5 text-sm">
+                <code class="min-w-0 flex-1 truncate">{{ permission.resourceRaw }}</code
+                ><Badge variant="outline">{{ permission.actionRaw }}</Badge
+                ><Button
+                  size="sm"
+                  variant="ghost"
+                  class="h-7 w-7 p-0 text-destructive hover:text-destructive"
+                  :disabled="!canRevokePermission"
+                  :aria-label="t('nacos.accessRevokeRawPermission')"
+                  @click="
+                    pendingAdvancedPermission = permission;
+                    advancedPermissionConfirmation = '';
+                  "
+                  ><Trash2 class="h-3.5 w-3.5"
+                /></Button>
+              </div>
+            </div>
+          </section>
+        </div>
+      </template>
+
+      <div v-else-if="!loading" class="flex h-full items-center justify-center text-sm text-muted-foreground">{{ t("nacos.accessSelectItem") }}</div>
+    </main>
+  </section>
+
+  <Dialog :open="!!userDialog" @update:open="!$event && (userDialog = null)">
+    <DialogContent class="max-h-[88vh] overflow-auto sm:max-w-lg">
+      <DialogHeader
+        ><DialogTitle>{{ t(`nacos.accessUserDialog.${userDialog}`) }}</DialogTitle
+        ><DialogDescription>{{ t(`nacos.accessUserDialog.${userDialog}Hint`, { username: userForm.username }) }}</DialogDescription></DialogHeader
+      >
+      <div v-if="userDialog === 'create' || userDialog === 'password'" class="space-y-4">
+        <div v-if="userDialog === 'create'" class="grid gap-1.5">
+          <Label for="access-user-name">{{ t("nacos.username") }}</Label
+          ><Input id="access-user-name" v-model="userForm.username" autocomplete="off" />
+        </div>
+        <div class="grid gap-1.5">
+          <Label for="access-user-password">{{ t("nacos.password") }}</Label
+          ><Input id="access-user-password" v-model="userForm.password" type="password" autocomplete="new-password" />
+        </div>
+      </div>
+      <div v-if="userDialog === 'create' || userDialog === 'roles'" class="space-y-2">
+        <Label>{{ t("nacos.accessAssociatedRoles") }}</Label>
+        <div class="max-h-52 overflow-auto rounded border p-2">
+          <label v-for="role in assignableRoles" :key="role.role" class="flex min-h-9 items-center gap-2 rounded px-2 text-sm hover:bg-muted/60"
+            ><input
+              type="checkbox"
+              :checked="userForm.roles.includes(role.role)"
+              :disabled="userDialog === 'roles' && (selectedUser?.roles.includes(role.role) ?? false) ? !canRemoveRole : !canAssignRole"
+              @change="userForm.roles = toggle(userForm.roles, role.role, ($event.target as HTMLInputElement).checked)"
+            /><Shield class="h-3.5 w-3.5 text-muted-foreground" /><span class="min-w-0 flex-1 truncate">{{ role.role }}</span
+            ><span v-if="!role.complete" class="text-xs text-amber-600">{{ t("nacos.accessNeedsRepair") }}</span></label
+          >
+          <div v-if="!assignableRoles.length" class="p-3 text-center text-xs text-muted-foreground">{{ t("nacos.accessNoAssignableRoles") }}</div>
+        </div>
+      </div>
+      <div v-if="userDialog === 'delete'" class="rounded border border-destructive/30 bg-destructive/5 p-3 text-sm text-destructive">{{ t("nacos.deleteUserDescription", { username: userForm.username }) }}</div>
+      <div v-if="userForm.roles.includes('ROLE_ADMIN') || (snapshot?.currentUsername === userForm.username && userDialog !== 'password')" class="grid gap-1.5">
+        <Label for="access-user-confirm">{{ t("nacos.accessTypeUsername", { value: userForm.username }) }}</Label
+        ><Input id="access-user-confirm" v-model="userForm.confirmation" autocomplete="off" />
+      </div>
+      <p v-if="formError" class="text-sm text-destructive">{{ formError }}</p>
+      <DialogFooter
+        ><Button variant="outline" :disabled="saving" @click="userDialog = null">{{ t("nacos.cancel") }}</Button
+        ><Button :variant="userDialog === 'delete' ? 'destructive' : 'default'" :disabled="saving || !userOperationWritable" @click="submitUser"><Loader2 v-if="saving" class="mr-2 h-4 w-4 animate-spin" />{{ userDialog === "delete" ? t("nacos.delete") : t("nacos.save") }}</Button></DialogFooter
+      >
+    </DialogContent>
+  </Dialog>
+
+  <Dialog :open="!!roleDialog" @update:open="!$event && (roleDialog = null)">
+    <DialogContent class="max-h-[90vh] overflow-auto sm:max-w-2xl">
+      <DialogHeader
+        ><DialogTitle>{{ t(`nacos.accessRoleDialog.${roleDialog}`) }}</DialogTitle
+        ><DialogDescription>{{ t(`nacos.accessRoleDialog.${roleDialog}Hint`) }}</DialogDescription></DialogHeader
+      >
+      <template v-if="roleDialog !== 'delete'">
+        <div class="space-y-5">
+          <div class="grid gap-1.5">
+            <Label for="access-role-name">{{ t("nacos.role") }}</Label
+            ><Input id="access-role-name" v-model="roleForm.role" :disabled="roleDialog === 'edit'" placeholder="app_developer" />
+          </div>
+          <section>
+            <div class="mb-2 flex items-end justify-between">
+              <div>
+                <Label>{{ t("nacos.accessMembers") }}</Label>
+                <p class="mt-0.5 text-xs text-muted-foreground">{{ t("nacos.accessMembersRequiredHint") }}</p>
+              </div>
+              <Button size="sm" variant="outline" :disabled="!canCreateUser || !canAssignRole" @click="addNewUser"><Plus class="mr-1 h-3.5 w-3.5" />{{ t("nacos.accessInlineCreateUser") }}</Button>
+            </div>
+            <div class="max-h-44 overflow-auto rounded border p-2">
+              <label v-for="user in users" :key="user.username" class="flex min-h-9 items-center gap-2 rounded px-2 text-sm hover:bg-muted/60"
+                ><input
+                  type="checkbox"
+                  :checked="roleForm.members.includes(user.username)"
+                  :disabled="roleDialog === 'edit' && roleMembers.includes(user.username) ? !canRemoveRole : !canAssignRole"
+                  @change="roleForm.members = toggle(roleForm.members, user.username, ($event.target as HTMLInputElement).checked)"
+                /><UserRound class="h-3.5 w-3.5 text-muted-foreground" />{{ user.username }}</label
+              >
+            </div>
+            <div v-for="(user, index) in roleForm.newUsers" :key="index" class="mt-2 grid grid-cols-[1fr_1fr_32px] gap-2">
+              <Input v-model="user.username" :placeholder="t('nacos.username')" /><Input v-model="user.password" type="password" :placeholder="t('nacos.password')" /><Button size="sm" variant="ghost" class="h-9 w-8 p-0" @click="roleForm.newUsers.splice(index, 1)"><X class="h-4 w-4" /></Button>
+            </div>
+          </section>
+          <section v-if="selectedRole?.administrator && roleDialog === 'edit'" class="rounded border border-amber-300 bg-amber-50 p-3 text-sm text-amber-900 dark:bg-amber-950/20 dark:text-amber-200">
+            <div class="flex gap-2"><LockKeyhole class="mt-0.5 h-4 w-4 shrink-0" />{{ t("nacos.accessAdminPermissionImmutable") }}</div>
+          </section>
+          <section v-else>
+            <div class="mb-2">
+              <div>
+                <Label>{{ t("nacos.accessPermissionScope") }}</Label>
+                <p class="mt-0.5 text-xs text-muted-foreground">{{ t("nacos.accessPermissionRequiredHint") }}</p>
+              </div>
+            </div>
+            <div class="grid min-h-[17rem] grid-cols-[minmax(0,1fr)_2.5rem_minmax(0,1.15fr)] gap-2 sm:gap-3">
+              <div class="flex min-h-0 flex-col overflow-hidden rounded border">
+                <div class="border-b bg-muted/30 px-3 py-2 text-sm font-medium">{{ t("nacos.accessUnassignedNamespaces") }}</div>
+                <div class="border-b p-2">
+                  <div class="relative"><Search class="pointer-events-none absolute left-2.5 top-2 h-3.5 w-3.5 text-muted-foreground" /><Input v-model="availableNamespaceSearch" class="h-8 pl-8 text-sm" :placeholder="t('nacos.accessSearchNamespaces')" /></div>
+                </div>
+                <div class="min-h-0 flex-1 overflow-auto p-1.5">
+                  <label v-for="namespace in availableNamespaces" :key="namespace.id" class="flex min-h-9 items-center gap-2 rounded px-2 text-sm hover:bg-muted/60">
+                    <input type="checkbox" :checked="selectedAvailableNamespaceIds.includes(namespace.id)" @change="selectedAvailableNamespaceIds = toggle(selectedAvailableNamespaceIds, namespace.id, ($event.target as HTMLInputElement).checked)" />
+                    <span class="min-w-0 flex-1 truncate">{{ namespace.name }}</span>
+                    <code v-if="namespace.name !== namespace.id" class="truncate text-[10px] text-muted-foreground">{{ namespace.id }}</code>
+                  </label>
+                  <div v-if="!availableNamespaces.length" class="flex h-24 items-center justify-center px-3 text-center text-xs text-muted-foreground">{{ t("nacos.accessNoUnassignedNamespaces") }}</div>
+                </div>
+              </div>
+              <div class="flex flex-col items-center justify-center gap-2">
+                <Button size="sm" variant="outline" class="h-8 w-8 p-0" :disabled="!selectedAvailableNamespaceIds.length || !canGrantPermission" :aria-label="t('nacos.accessGrantNamespaces')" @click="moveNamespacesToGranted"><ChevronRight class="h-4 w-4" /></Button>
+                <Button size="sm" variant="outline" class="h-8 w-8 p-0" :disabled="!selectedGrantedNamespaceIds.length || !canRevokePermission" :aria-label="t('nacos.accessRevokeNamespaces')" @click="removeGrantedNamespaces"><ChevronLeft class="h-4 w-4" /></Button>
+              </div>
+              <div class="flex min-h-0 flex-col overflow-hidden rounded border">
+                <div class="border-b bg-muted/30 px-3 py-2 text-sm font-medium">{{ t("nacos.accessGrantedNamespaces") }}</div>
+                <div class="border-b p-2">
+                  <div class="relative"><Search class="pointer-events-none absolute left-2.5 top-2 h-3.5 w-3.5 text-muted-foreground" /><Input v-model="grantedNamespaceSearch" class="h-8 pl-8 text-sm" :placeholder="t('nacos.accessSearchNamespaces')" /></div>
+                </div>
+                <div class="min-h-0 flex-1 overflow-auto p-1.5">
+                  <div v-for="namespace in grantedNamespaces" :key="namespace.namespaceId" class="flex min-h-10 items-center gap-2 rounded px-2 text-sm hover:bg-muted/60">
+                    <input type="checkbox" :checked="selectedGrantedNamespaceIds.includes(namespace.namespaceId)" @change="selectedGrantedNamespaceIds = toggle(selectedGrantedNamespaceIds, namespace.namespaceId, ($event.target as HTMLInputElement).checked)" />
+                    <span class="min-w-0 flex-1 truncate font-medium">{{ namespace.name }}</span>
+                    <div class="flex shrink-0 items-center gap-2">
+                      <label
+                        v-for="action in ['r', 'w', 'rw'] as PermissionAction[]"
+                        :key="action"
+                        class="flex h-7 cursor-pointer items-center gap-1.5 rounded border px-2 text-xs transition-colors"
+                        :class="namespace.action === action ? 'border-primary/40 bg-primary/5 font-medium text-foreground' : 'border-transparent text-muted-foreground hover:bg-muted'"
+                      >
+                        <input
+                          type="checkbox"
+                          class="h-3.5 w-3.5 accent-primary"
+                          :checked="namespace.action === action"
+                          :disabled="!canGrantPermission || (roleDialog === 'edit' && managedRolePermissions.some((permission) => permission.parsedScope?.namespaceId === namespace.namespaceId) && !canRevokePermission)"
+                          @change="setPermissionAction(namespace.namespaceId, action)"
+                        />
+                        {{ actionLabel(action) }}
+                      </label>
+                    </div>
+                  </div>
+                  <div v-if="!grantedNamespaces.length" class="flex h-24 items-center justify-center px-3 text-center text-xs text-muted-foreground">{{ t("nacos.accessNoGrantedNamespaces") }}</div>
+                </div>
+              </div>
+            </div>
+          </section>
+          <div v-if="roleDialog === 'edit' && adminMembersChanged" class="grid gap-1.5">
+            <Label for="access-role-confirm">{{ t("nacos.accessTypeUsername", { value: adminConfirmationTarget }) }}</Label
+            ><Input id="access-role-confirm" v-model="roleForm.confirmation" />
+          </div>
+        </div>
+      </template>
+      <template v-else
+        ><div class="rounded border border-destructive/30 bg-destructive/5 p-3 text-sm text-destructive">{{ t("nacos.accessDeleteRoleHint", { role: roleForm.role }) }}</div>
+        <div class="grid gap-1.5">
+          <Label for="access-delete-role-confirm">{{ t("nacos.accessTypeRole", { value: roleForm.role }) }}</Label
+          ><Input id="access-delete-role-confirm" v-model="roleForm.confirmation" /></div
+      ></template>
+      <p v-if="formError" class="text-sm text-destructive">{{ formError }}</p>
+      <DialogFooter
+        ><Button variant="outline" :disabled="saving" @click="roleDialog = null">{{ t("nacos.cancel") }}</Button
+        ><Button :variant="roleDialog === 'delete' ? 'destructive' : 'default'" :disabled="saving || !roleOperationWritable" @click="submitRole"><Loader2 v-if="saving" class="mr-2 h-4 w-4 animate-spin" />{{ roleDialog === "delete" ? t("nacos.delete") : t("nacos.save") }}</Button></DialogFooter
+      >
+    </DialogContent>
+  </Dialog>
+
+  <Dialog v-model:open="operationOpen">
+    <DialogContent class="sm:max-w-xl"
+      ><DialogHeader
+        ><DialogTitle>{{ t("nacos.accessOperationResult") }}</DialogTitle
+        ><DialogDescription>{{ t(`nacos.accessOperationStatus.${operation?.status ?? "running"}`) }}</DialogDescription></DialogHeader
+      >
+      <div class="max-h-80 divide-y overflow-auto rounded border">
+        <div v-for="step in operation?.steps" :key="step.id" class="flex items-start gap-3 px-3 py-2.5">
+          <Check v-if="step.status === 'succeeded' || step.status === 'compensated'" class="mt-0.5 h-4 w-4 shrink-0 text-emerald-600" /><CircleAlert v-else-if="step.status === 'failed'" class="mt-0.5 h-4 w-4 shrink-0 text-destructive" /><Loader2
+            v-else-if="step.status === 'running'"
+            class="mt-0.5 h-4 w-4 shrink-0 animate-spin"
+          />
+          <div v-else class="mt-1 h-3 w-3 shrink-0 rounded-full border" />
+          <div class="min-w-0 flex-1">
+            <div class="text-sm font-medium">{{ t(`nacos.accessStep.${step.action}`) }}</div>
+            <div class="truncate text-xs text-muted-foreground">{{ step.target }}</div>
+            <div v-if="step.message" class="mt-1 text-xs text-destructive">{{ step.message }}</div>
+            <Input v-if="['failed', 'skipped'].includes(step.status) && step.needsPassword" v-model="retryPasswords[step.target]" type="password" class="mt-2 h-8" :placeholder="t('nacos.accessReenterPassword')" />
+          </div>
+        </div>
+      </div>
+      <DialogFooter
+        ><Button v-if="operation?.canUndo" variant="outline" :disabled="saving" @click="undoOperation"><RotateCcw class="mr-1.5 h-3.5 w-3.5" />{{ t("nacos.accessUndoCreated") }}</Button
+        ><Button v-if="operation?.canRetry" :disabled="saving" @click="retryOperation"><RefreshCw class="mr-1.5 h-3.5 w-3.5" />{{ t("nacos.accessRetryFailed") }}</Button
+        ><Button v-else @click="operationOpen = false">{{ t("nacos.close") }}</Button></DialogFooter
+      ></DialogContent
+    >
+  </Dialog>
+
+  <Dialog :open="!!pendingAdvancedPermission" @update:open="!$event && (pendingAdvancedPermission = null)">
+    <DialogContent class="sm:max-w-md"
+      ><DialogHeader
+        ><DialogTitle>{{ t("nacos.accessRevokeRawPermission") }}</DialogTitle
+        ><DialogDescription>{{ t("nacos.accessRevokeRawPermissionHint") }}</DialogDescription></DialogHeader
+      >
+      <div class="rounded border bg-muted/30 p-3 text-sm">
+        <code class="block break-all">{{ pendingAdvancedPermission?.resourceRaw }}</code>
+        <div class="mt-2 text-xs text-muted-foreground">{{ pendingAdvancedPermission?.role }} · {{ pendingAdvancedPermission?.actionRaw }}</div>
+      </div>
+      <div class="grid gap-1.5">
+        <Label for="access-raw-confirm">{{ t("nacos.accessTypeRole", { value: pendingAdvancedPermission?.role }) }}</Label
+        ><Input id="access-raw-confirm" v-model="advancedPermissionConfirmation" />
+      </div>
+      <p v-if="formError" class="text-sm text-destructive">{{ formError }}</p>
+      <DialogFooter
+        ><Button variant="outline" :disabled="saving" @click="pendingAdvancedPermission = null">{{ t("nacos.cancel") }}</Button
+        ><Button variant="destructive" :disabled="saving || !canRevokePermission" @click="revokeAdvancedPermission"><Loader2 v-if="saving" class="mr-2 h-4 w-4 animate-spin" />{{ t("nacos.accessRevokeRawPermission") }}</Button></DialogFooter
+      ></DialogContent
+    >
+  </Dialog>
+</template>
diff --git a/apps/desktop/src/components/nacos/__tests__/NacosAccessControlConsole.spec.ts b/apps/desktop/src/components/nacos/__tests__/NacosAccessControlConsole.spec.ts
new file mode 100644
index 0000000000..8c4fef8134
--- /dev/null
+++ b/apps/desktop/src/components/nacos/__tests__/NacosAccessControlConsole.spec.ts
@@ -0,0 +1,210 @@
+/** @vitest-environment happy-dom */
+
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { createApp, nextTick, type App } from "vue";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { NacosConnectionInfo } from "@/types/nacos";
+
+const mocks = vi.hoisted(() => ({
+  connectionInfo: null as NacosConnectionInfo | null,
+  ensureConnected: vi.fn(async () => undefined),
+}));
+
+vi.mock("@/lib/backend/api", () => ({
+  nacosTestConnection: vi.fn(async () => {
+    if (!mocks.connectionInfo) throw new Error("missing Nacos connection fixture");
+    return mocks.connectionInfo;
+  }),
+}));
+
+vi.mock("@/stores/connectionStore", () => ({
+  useConnectionStore: () => ({ ensureConnected: mocks.ensureConnected }),
+}));
+
+vi.mock("vue-i18n", () => ({
+  useI18n: () => ({ t: (key: string) => key }),
+}));
+
+vi.mock("@/components/nacos/NacosAccessControl.vue", async () => {
+  const { h } = await import("vue");
+  return {
+    default: {
+      props: ["tab"],
+      setup: (props: { tab: string }) => () => h("div", { "data-testid": "nacos-access-control-workspace", "data-tab": props.tab }),
+    },
+  };
+});
+
+vi.mock("@/components/nacos/NacosRoleAccessControl.vue", async () => {
+  const { h } = await import("vue");
+  return {
+    default: {
+      props: ["capabilities"],
+      setup: (props: { capabilities: { createUser: { supported: boolean } } }) => () =>
+        h("div", {
+          "data-testid": "nacos-role-access-control-workspace",
+          "data-can-create-user": String(props.capabilities.createUser.supported),
+        }),
+    },
+  };
+});
+
+import NacosAccessControlConsole from "../NacosAccessControlConsole.vue";
+
+const source = readFileSync(resolve(process.cwd(), "apps/desktop/src/components/nacos/NacosAccessControlConsole.vue"), "utf8");
+const legacySource = readFileSync(resolve(process.cwd(), "apps/desktop/src/components/nacos/NacosAccessControl.vue"), "utf8");
+const treeItemSource = readFileSync(resolve(process.cwd(), "apps/desktop/src/components/sidebar/TreeItem.vue"), "utf8");
+const connectionTreeSource = readFileSync(resolve(process.cwd(), "apps/desktop/src/components/sidebar/ConnectionTree.vue"), "utf8");
+const connectionStoreSource = readFileSync(resolve(process.cwd(), "apps/desktop/src/stores/connectionStore.ts"), "utf8");
+const mountedApps: Array<{ app: App; host: HTMLElement }> = [];
+
+async function settle() {
+  for (let index = 0; index < 4; index += 1) {
+    await Promise.resolve();
+    await nextTick();
+  }
+}
+
+afterEach(() => {
+  for (const { app, host } of mountedApps.splice(0)) {
+    app.unmount();
+    host.remove();
+  }
+  mocks.connectionInfo = null;
+  vi.clearAllMocks();
+});
+
+describe("NacosAccessControlConsole", () => {
+  it("uses the access-control header pattern for its navigation", () => {
+    expect(source).toContain('class="flex h-14 shrink-0 flex-wrap items-center gap-3 border-b px-4"');
+    expect(source).toContain('class="flex rounded-md border p-0.5 shadow-sm"');
+    expect(source).toContain("<UsersRound");
+    expect(source).toContain("<KeyRound");
+    expect(source).toContain('t("nacos.accessControlTitle")');
+    expect(source).toContain('t("nacos.accessControlDescription")');
+  });
+
+  it("only submits r-nacos namespace privilege fields supported by its API", () => {
+    expect(legacySource).not.toContain("privilegeEnabled");
+    expect(legacySource).toContain("whitelistIsAll: userForm.value.whitelistIsAll");
+    expect(legacySource).toContain("blacklistIsAll: userForm.value.blacklistIsAll");
+    expect(legacySource).toContain('import NacosNamespaceMultiSelect from "@/components/nacos/NacosNamespaceMultiSelect.vue"');
+    expect(legacySource).toContain('v-model="userForm.whitelist"');
+    expect(legacySource).toContain('v-model="userForm.blacklist"');
+    expect(legacySource).toContain("whitelist: [...userForm.value.whitelist]");
+    expect(legacySource).toContain("blacklist: [...userForm.value.blacklist]");
+    expect(legacySource).not.toContain('<textarea v-model="userForm.whitelist"');
+    expect(legacySource).not.toContain('<textarea v-model="userForm.blacklist"');
+  });
+
+  it("switches tabs when navigating between associated users and roles", () => {
+    expect(source).toContain("@select-user=\"activeTab = 'users'\"");
+    expect(source).toContain("@select-role=\"activeTab = 'roles'\"");
+  });
+
+  it("keeps the roles-only workspace reachable without an unavailable banner", () => {
+    expect(source).toContain('if (!supportsUsers.value && supportsRoles.value) activeTab.value = "roles"');
+    expect(source).toContain('v-if="!supportsUsers && !supportsRoles"');
+    expect(connectionStoreSource).toContain("sidebarSnapshot.accessControl.listUsers.supported === true ||");
+    expect(connectionStoreSource).toContain("sidebarSnapshot.accessControl.listRoleBindings.supported === true");
+  });
+
+  it("keeps the roles-only workspace visible alongside the permission warning", async () => {
+    const unsupported = { supported: false, reason: "permissionDenied" as const };
+    mocks.connectionInfo = {
+      serverAddr: "http://127.0.0.1:8848",
+      displayServerAddr: "http://127.0.0.1:8848",
+      namespace: "",
+      auth: "usernamePassword",
+      capabilities: {
+        supportsConfigManagement: true,
+        supportsServiceManagement: true,
+        supportsInstanceUpdate: true,
+        supportsRawApi: true,
+        accessControl: {
+          mode: "roleBindings",
+          listUsers: unsupported,
+          createUser: unsupported,
+          updateUser: unsupported,
+          deleteUser: unsupported,
+          listRoleBindings: { supported: true },
+          assignRole: unsupported,
+          removeRole: unsupported,
+          listPermissions: unsupported,
+          grantPermission: unsupported,
+          revokePermission: unsupported,
+          enhancedWorkspace: false,
+          supportsNamespacePrivileges: false,
+        },
+      },
+    };
+
+    const host = document.createElement("div");
+    document.body.append(host);
+    const app = createApp(NacosAccessControlConsole, { connectionId: "nacos-1" });
+    mountedApps.push({ app, host });
+    app.mount(host);
+    await settle();
+
+    expect(host.textContent).toContain("nacos.accessPermissionEndpointUnavailable");
+    const workspace = host.querySelector('[data-testid="nacos-access-control-workspace"]');
+    expect(workspace).not.toBeNull();
+    expect(workspace?.getAttribute("data-tab")).toBe("roles");
+  });
+
+  it("shares the directory-detail workspace across supported Nacos versions", () => {
+    expect(source).toContain('import NacosRoleAccessControl from "@/components/nacos/NacosRoleAccessControl.vue"');
+    expect(source).toContain('<NacosRoleAccessControl v-if="enhancedWorkspace && accessControl"');
+    expect(source).toContain(':capabilities="accessControl"');
+  });
+
+  it("keeps the enhanced read workspace visible when writes are permission denied", async () => {
+    const unsupported = { supported: false, reason: "permissionDenied" as const };
+    const supported = { supported: true };
+    mocks.connectionInfo = {
+      serverAddr: "http://127.0.0.1:8848",
+      displayServerAddr: "http://127.0.0.1:8848",
+      namespace: "",
+      auth: "usernamePassword",
+      capabilities: {
+        supportsConfigManagement: true,
+        supportsServiceManagement: true,
+        supportsInstanceUpdate: true,
+        supportsRawApi: true,
+        accessControl: {
+          mode: "roleBindings",
+          listUsers: supported,
+          createUser: unsupported,
+          updateUser: unsupported,
+          deleteUser: unsupported,
+          listRoleBindings: supported,
+          assignRole: unsupported,
+          removeRole: unsupported,
+          listPermissions: supported,
+          grantPermission: unsupported,
+          revokePermission: unsupported,
+          enhancedWorkspace: true,
+          supportsNamespacePrivileges: false,
+        },
+      },
+    };
+
+    const host = document.createElement("div");
+    document.body.append(host);
+    const app = createApp(NacosAccessControlConsole, { connectionId: "nacos-read-only" });
+    mountedApps.push({ app, host });
+    app.mount(host);
+    await settle();
+
+    const workspace = host.querySelector('[data-testid="nacos-role-access-control-workspace"]');
+    expect(workspace).not.toBeNull();
+    expect(workspace?.getAttribute("data-can-create-user")).toBe("false");
+  });
+
+  it("internationalizes the sidebar entry, including trees persisted with the old label", () => {
+    expect(connectionStoreSource).toContain('label: "nacos.accessControlSidebarLabel"');
+    expect(treeItemSource).toContain('if (node.type === "nacos-access-control") return t("nacos.accessControlSidebarLabel")');
+    expect(connectionTreeSource).toContain('node.type === "nacos-access-control" ? t("nacos.accessControlSidebarLabel") : node.label');
+  });
+});
diff --git a/apps/desktop/src/components/nacos/__tests__/NacosAdminConsoleLayout.spec.ts b/apps/desktop/src/components/nacos/__tests__/NacosAdminConsoleLayout.spec.ts
index 0710655da8..1cc51e6c17 100644
--- a/apps/desktop/src/components/nacos/__tests__/NacosAdminConsoleLayout.spec.ts
+++ b/apps/desktop/src/components/nacos/__tests__/NacosAdminConsoleLayout.spec.ts
@@ -4,6 +4,11 @@ import { describe, expect, it } from "vitest";
 const source = readFileSync(new URL("../NacosAdminConsole.vue", import.meta.url), "utf8");
 
 describe("NacosAdminConsole config workbench layout", () => {
+  it("keeps access control outside the namespace-scoped workbench", () => {
+    expect(source).not.toContain("NacosAccessControl");
+    expect(source).toContain('type AdminTab = "configs" | "services";');
+  });
+
   it("keeps the editor as the final and primary workbench surface", () => {
     const contextBar = source.indexOf('class="nacos-config-context-bar');
     const inspector = source.indexOf('class="nacos-config-inspector');
diff --git a/apps/desktop/src/components/nacos/__tests__/NacosNamespaceMultiSelect.spec.ts b/apps/desktop/src/components/nacos/__tests__/NacosNamespaceMultiSelect.spec.ts
new file mode 100644
index 0000000000..0d5903e79c
--- /dev/null
+++ b/apps/desktop/src/components/nacos/__tests__/NacosNamespaceMultiSelect.spec.ts
@@ -0,0 +1,15 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const source = readFileSync(new URL("../NacosNamespaceMultiSelect.vue", import.meta.url), "utf8");
+
+describe("NacosNamespaceMultiSelect", () => {
+  it("renders selected namespaces as removable tags and keeps the dropdown open for multi-selection", () => {
+    expect(source).toContain("data-nacos-namespace-multiselect");
+    expect(source).toContain('v-for="value in modelValue"');
+    expect(source).toContain('@click.stop="remove(value)"');
+    expect(source).toContain('@click="toggle(option.value)"');
+    expect(source).toContain("selected.has(option.value)");
+    expect(source).toContain("nacos.namespaceSearchPlaceholder");
+  });
+});
diff --git a/apps/desktop/src/components/nacos/__tests__/NacosRoleAccessControl.spec.ts b/apps/desktop/src/components/nacos/__tests__/NacosRoleAccessControl.spec.ts
new file mode 100644
index 0000000000..69ee408098
--- /dev/null
+++ b/apps/desktop/src/components/nacos/__tests__/NacosRoleAccessControl.spec.ts
@@ -0,0 +1,50 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const source = readFileSync(new URL("../NacosRoleAccessControl.vue", import.meta.url), "utf8");
+
+describe("NacosRoleAccessControl", () => {
+  it("uses a directory-detail layout for both users and roles", () => {
+    expect(source).toContain('class="flex w-64 shrink-0 flex-col border-r');
+    expect(source).toContain("v-if=\"tab === 'users'\"");
+    expect(source).toContain("v-else-if=\"tab === 'roles' && selectedRole\"");
+  });
+
+  it("keeps role creation complete with per-namespace permissions", () => {
+    expect(source).toContain("roleForm.newUsers");
+    expect(source).toContain("moveNamespacesToGranted");
+    expect(source).toContain('action: "rw"');
+    expect(source).toContain("setPermissionAction");
+    expect(source).toContain("accessUnassignedNamespaces");
+    expect(source).toContain("accessGrantedNamespaces");
+    expect(source).toContain('kind: "createRole"');
+  });
+
+  it("merges split permission rows before editing an existing role", () => {
+    expect(source).toContain("mergeNacosNamespacePermissionAssignments(managedRolePermissions.value)");
+  });
+
+  it("gates every mutation by its probed operation capability", () => {
+    expect(source).toContain("capabilities: NacosAccessControlCapabilities");
+    expect(source).toContain("const canCreateUser = computed");
+    expect(source).toContain("const canGrantPermission = computed");
+    expect(source).toContain("const userOperationWritable = computed");
+    expect(source).toContain("const roleOperationWritable = computed");
+    expect(source).toContain(':disabled="saving || !userOperationWritable"');
+    expect(source).toContain(':disabled="saving || !roleOperationWritable"');
+  });
+
+  it("surfaces partial operations instead of hiding them in a toast", () => {
+    expect(source).toContain("operationNeedsPasswords");
+    expect(source).toContain("nacosRetryAccessOperation");
+    expect(source).toContain("nacosUndoAccessOperation");
+    expect(source).toContain("accessOperationResult");
+  });
+
+  it("renders associated roles with the same navigable card pattern as role members", () => {
+    expect(source).toContain('v-if="selectedUser.roles.length" class="flex flex-wrap gap-1.5 rounded border bg-muted/20 p-1.5"');
+    expect(source).toContain(":title=\"t('nacos.accessOpenRole', { role })\"");
+    expect(source).toContain('@click="openAssociatedRole(role)"');
+    expect(source).toContain('emit("select-role")');
+  });
+});
diff --git a/apps/desktop/src/components/sidebar/ConnectionTree.vue b/apps/desktop/src/components/sidebar/ConnectionTree.vue
index 7cd41714e2..480a39d263 100644
--- a/apps/desktop/src/components/sidebar/ConnectionTree.vue
+++ b/apps/desktop/src/components/sidebar/ConnectionTree.vue
@@ -626,7 +626,10 @@ const filteredNodes = computed(() => {
   nodes = filterGloballyIndexedRegexTables(nodes);
 
   const q = deferredSearchQuery.value;
-  nodes = filterSidebarTree(nodes, q, searchCollapsedIds.value, searchableNodeTypes.value, { regexMode: regexMode.value });
+  nodes = filterSidebarTree(nodes, q, searchCollapsedIds.value, searchableNodeTypes.value, {
+    regexMode: regexMode.value,
+    resolveLabel: (node) => (node.type === "nacos-access-control" ? t("nacos.accessControlSidebarLabel") : node.label),
+  });
   if (q && !regexMode.value) {
     nodes = filterSidebarSearchRootsByConnectionState(nodes, store.connectedIds);
   }
diff --git a/apps/desktop/src/components/sidebar/SidebarTreeRuntimeHost.vue b/apps/desktop/src/components/sidebar/SidebarTreeRuntimeHost.vue
index d8b45a1bfc..da0f6af079 100644
--- a/apps/desktop/src/components/sidebar/SidebarTreeRuntimeHost.vue
+++ b/apps/desktop/src/components/sidebar/SidebarTreeRuntimeHost.vue
@@ -101,7 +101,7 @@ import {
   usesTreeSchemaMode,
   isSingleDatabase,
 } from "@/lib/database/databaseCapabilities";
-import { copyDisplayPathForTreeNode, copyNameForTreeNode, isDirectNavigationTreeNode, isDocumentBrowserTreeNode, objectSourceTargetForTreeNode, shouldRunTreeNodeRowAction, treeNodeRowAction, treeNodeRowDoubleClickAction } from "@/lib/sidebar/treeNodeClick";
+import { copyDisplayPathForTreeNode, copyNameForTreeNode, isDirectNavigationTreeNode, isDocumentBrowserTreeNode, isRepeatableNavigationTreeNode, objectSourceTargetForTreeNode, shouldRunTreeNodeRowAction, treeNodeRowAction, treeNodeRowDoubleClickAction } from "@/lib/sidebar/treeNodeClick";
 import { customTypeCapabilities, supportsTypeObjectSource } from "@/lib/database/databaseObjectCapabilities";
 import { mongoCollectionTableTypeFromNode, mongoDropIndexFailureCount } from "@/lib/sidebar/mongoCollectionMutation";
 import { dataTabOpenModeFromTreeClick, type DataTabOpenMode } from "@/lib/sidebar/dataTabOpenPolicy";
@@ -313,6 +313,16 @@ const props = defineProps<{
 
 const activeNode = shallowRef<TreeNode>(props.node);
 let acceptedSelectionIds: readonly string[] | null = null;
+let latestNavigationRequestId = 0;
+
+function beginNavigationRequest(): number {
+  latestNavigationRequestId += 1;
+  return latestNavigationRequestId;
+}
+
+function isCurrentNavigationRequest(requestId: number): boolean {
+  return requestId === latestNavigationRequestId;
+}
 
 function releaseActiveNodeReference(nodeIds: readonly string[]) {
   activeNode.value = releaseRemovedSidebarActionTarget(activeNode.value, nodeIds);
@@ -599,25 +609,32 @@ function isGroupLabel(node: TreeNode): boolean {
   return groupTypes.has(node.type);
 }
 
-async function openDirectNavigationNode(node: TreeNode) {
+async function openDirectNavigationNode(node: TreeNode, requestId: number) {
   if (!node.connectionId) return;
-  await connectionStore.ensureConnected(node.connectionId);
-  const connectionName = connectionStore.getConfig(node.connectionId)?.name || "Consul";
+  const isNacosNavigation = node.type === "nacos-namespace" || node.type === "nacos-access-control";
+  await connectionStore.ensureConnected(node.connectionId, isNacosNavigation ? { verifyHealth: false } : undefined);
+  if (!isCurrentNavigationRequest(requestId)) return;
+  const connectionName = connectionStore.getConfig(node.connectionId)?.name || (isNacosNavigation ? "Nacos" : "Consul");
   if (node.type === "consul-root") {
     queryStore.createTab(node.connectionId, "", `${connectionName}:keys`, "consul");
     refreshActiveKvBrowserAfterOpen("consul", node.connectionId);
   } else if (node.type === "consul-overview") {
     queryStore.createTab(node.connectionId, "", `${connectionName}:${t("consul.ui.overview")}`, "consul-overview");
+  } else if (node.type === "nacos-namespace") {
+    queryStore.openNacosAdmin(node.connectionId, { namespace: node.nacosNamespace || "", namespaceName: node.nacosNamespaceName || node.label });
+  } else if (node.type === "nacos-access-control") {
+    queryStore.createTab(node.connectionId, "", `${connectionName}:access-control`, "nacos-access-control");
   }
 }
 
-async function toggle() {
+async function toggle(requestId = beginNavigationRequest()) {
   const node = activeNode.value;
   const treeLoadSearchOptions = sidebarTreeContext?.getTreeLoadSearchOptions?.(node);
   if (isDirectNavigationTreeNode(node.type)) {
     try {
-      await openDirectNavigationNode(node);
+      await openDirectNavigationNode(node, requestId);
     } catch (e: any) {
+      if (!isCurrentNavigationRequest(requestId)) return;
       const errMsg = e?.message || String(e);
       if (errMsg.includes(CONNECTION_ATTEMPT_CANCELLED_MESSAGE)) return;
       toast(t("connection.connectFailed", { message: translateBackendError(t, e) }), 5000);
@@ -764,9 +781,6 @@ async function toggle() {
       await connectionStore.ensureConnected(node.connectionId);
       const topicFromId = node.id.endsWith(":mqtt-topic:__console__") ? undefined : node.id.split(":mqtt-topic:")[1] || node.label;
       queryStore.openMqttAdmin(node.connectionId, topicFromId ? { initialTopic: topicFromId } : undefined);
-    } else if (node.type === "nacos-namespace" && node.connectionId) {
-      await connectionStore.ensureConnected(node.connectionId);
-      queryStore.openNacosAdmin(node.connectionId, { namespace: node.nacosNamespace || "", namespaceName: node.nacosNamespaceName || node.label });
     } else if (node.type === "etcd-root" && node.connectionId) {
       await connectionStore.ensureConnected(node.connectionId);
       const tabTitle = `${connectionStore.getConfig(node.connectionId)?.name || "etcd"}:keys`;
@@ -872,6 +886,7 @@ async function toggle() {
     }
     emitNodeToggled(node, wasExpanded);
   } catch (e: any) {
+    if (!isCurrentNavigationRequest(requestId)) return;
     if (!wasExpanded) node.isExpanded = false;
     const errMsg = e?.message || String(e);
     if (errMsg.includes(CONNECTION_ATTEMPT_CANCELLED_MESSAGE)) return;
@@ -880,7 +895,7 @@ async function toggle() {
   }
 }
 
-function runRowClickAction(clickDetail: number) {
+function runRowClickAction(clickDetail: number, requestId: number) {
   const node = activeNode.value;
   if (node.type === "load-more") {
     if (clickDetail > 1) return;
@@ -897,7 +912,10 @@ function runRowClickAction(clickDetail: number) {
     return;
   }
   const action = treeNodeRowAction(node.type, canExpand.value, settingsStore.editorSettings.sidebarActivation, currentDatabaseType(), settingsStore.editorSettings.sidebarOpenDatabaseOnSingleClick, canOpenObjectBrowser.value);
-  if (!shouldRunTreeNodeRowAction(action, clickDetail, isGroupLabel(node))) return;
+  // WebKit can keep incrementing click.detail while the pointer moves quickly
+  // between adjacent rows. Nacos entries are idempotent navigation targets, so
+  // do not mistake that rapid one-click switching for a double-click toggle.
+  if (!shouldRunTreeNodeRowAction(action, clickDetail, isGroupLabel(node) || isRepeatableNavigationTreeNode(node.type))) return;
   if (action === "open-data") {
     scheduleOpenData(node);
   } else if (action === "open-object-browser") {
@@ -914,7 +932,7 @@ function runRowClickAction(clickDetail: number) {
   } else if (isDocumentBrowserTreeNode(node.type)) {
     openMongoTreeData(node);
   } else if (action === "toggle") {
-    toggle();
+    void toggle(requestId);
   }
 }
 
@@ -4811,7 +4829,7 @@ function buildSpecialSidebarMenu(context: SidebarMenuFactoryContext): boolean {
     return true;
   }
 
-  if (node.type === "etcd-root" || node.type === "etcd-dashboard" || node.type === "etcd-access-control" || node.type === "zookeeper-root" || node.type === "consul-root" || node.type === "consul-overview") {
+  if (node.type === "nacos-access-control" || node.type === "etcd-root" || node.type === "etcd-dashboard" || node.type === "etcd-access-control" || node.type === "zookeeper-root" || node.type === "consul-root" || node.type === "consul-overview") {
     items.push({ label: t("contextMenu.openConnection"), action: toggle, icon: Database });
     return true;
   }
@@ -5398,16 +5416,19 @@ function buildContextMenu(node: TreeNode): ContextMenuItem[] {
 }
 
 function handleRowClick(node: TreeNode, clickDetail: number) {
+  const requestId = beginNavigationRequest();
   activateRuntimeNode(node);
-  runRowClickAction(clickDetail);
+  runRowClickAction(clickDetail, requestId);
 }
 
 function handleRowDoubleClick(node: TreeNode, event: MouseEvent) {
+  beginNavigationRequest();
   activateRuntimeNode(node);
   onDoubleClick(event);
 }
 
 function handleRowKeydown(node: TreeNode, event: KeyboardEvent) {
+  beginNavigationRequest();
   activateRuntimeNode(node);
   onKeydown(event);
 }
@@ -5439,7 +5460,7 @@ function requestPaste(node: TreeNode): boolean {
 
 function toggleNode(node: TreeNode) {
   activateRuntimeNode(node);
-  void toggle();
+  void toggle(beginNavigationRequest());
 }
 
 defineExpose({
diff --git a/apps/desktop/src/components/sidebar/TreeItem.vue b/apps/desktop/src/components/sidebar/TreeItem.vue
index da532913a1..bba7e15214 100644
--- a/apps/desktop/src/components/sidebar/TreeItem.vue
+++ b/apps/desktop/src/components/sidebar/TreeItem.vue
@@ -282,6 +282,8 @@ function getIconInfo(node: TreeNode): { icon: any; colorClass: string } | null {
       return { icon: FolderOpen, colorClass: "text-sky-400" };
     case "nacos-namespace":
       return { icon: FolderOpen, colorClass: "text-sky-500" };
+    case "nacos-access-control":
+      return { icon: ShieldCheck, colorClass: "text-sky-500" };
     case "etcd-root":
       return { icon: Database, colorClass: "text-sky-500" };
     case "etcd-dashboard":
@@ -364,6 +366,9 @@ function isGroupLabel(node: TreeNode): boolean {
 function displayLabel(node: TreeNode): string {
   if (node.type === "load-more") return t(node.label);
   if (node.type === "object-browser") return t(node.label, { count: node.objectCount ?? 0 });
+  // Use the canonical key for persisted trees created before this label was
+  // internationalized; those nodes may still contain the old Chinese text.
+  if (node.type === "nacos-access-control") return t("nacos.accessControlSidebarLabel");
   if (node.type === "user-admin" || node.type === "dameng-users" || node.type === "dameng-roles" || node.type === "dameng-job-admin") return t(node.label);
   if (node.type === "linked-server-root") return t(node.label);
   if (node.type === "saved-sql-root") return t(node.label);
diff --git a/apps/desktop/src/components/sidebar/VisibleNacosNamespacesDialog.vue b/apps/desktop/src/components/sidebar/VisibleNacosNamespacesDialog.vue
index bddd0a4a16..bfa319ccd4 100644
--- a/apps/desktop/src/components/sidebar/VisibleNacosNamespacesDialog.vue
+++ b/apps/desktop/src/components/sidebar/VisibleNacosNamespacesDialog.vue
@@ -7,7 +7,7 @@ import { Dialog, DialogContent, DialogFooter, DialogHeader, DialogTitle } from "
 import { Input } from "@/components/ui/input";
 import { useConnectionStore } from "@/stores/connectionStore";
 import * as api from "@/lib/backend/api";
-import { normalizeNacosNamespaceSelection, normalizeNacosNamespacesForDisplay } from "@/lib/nacos/nacosNamespaceVisibility";
+import { loadReadableNacosNamespaces, normalizeNacosNamespaceSelection } from "@/lib/nacos/nacosNamespaceVisibility";
 import type { NacosNamespaceInfo } from "@/types/nacos";
 
 const props = defineProps<{
@@ -65,7 +65,7 @@ async function loadNamespaces() {
   searchText.value = "";
   try {
     await connectionStore.ensureConnected(props.connectionId);
-    const fetched = normalizeNacosNamespacesForDisplay(await api.nacosListNamespaces(props.connectionId));
+    const fetched = await loadReadableNacosNamespaces(props.connectionId, api);
     namespaces.value = [...fetched].sort((left, right) => nacosNamespaceLabel(left).localeCompare(nacosNamespaceLabel(right)));
     connectionStore.recordPrimaryVisibleObjectNames(props.connectionId, namespaces.value.map(nacosNamespaceValue));
     const configured = connection.value?.visible_databases;
diff --git a/apps/desktop/src/components/sidebar/__tests__/SidebarTreeRuntimeHost.expansion.spec.ts b/apps/desktop/src/components/sidebar/__tests__/SidebarTreeRuntimeHost.expansion.spec.ts
index 12ae1ac59c..b4d7a825be 100644
--- a/apps/desktop/src/components/sidebar/__tests__/SidebarTreeRuntimeHost.expansion.spec.ts
+++ b/apps/desktop/src/components/sidebar/__tests__/SidebarTreeRuntimeHost.expansion.spec.ts
@@ -13,7 +13,8 @@ const connectionStore = {
   sidebarSearchQuery: "",
   canUseLoadedTreeNodeToggle: vi.fn(() => true),
   releaseCollapsedTreeNodeChildren: vi.fn(),
-  getConfig: vi.fn(() => ({ db_type: "mysql" })),
+  getConfig: vi.fn(() => ({ db_type: "mysql", name: "connection" })),
+  ensureConnected: vi.fn(async () => undefined),
   loadPackageMembers: vi.fn(async (node: TreeNode) => {
     node.isExpanded = true;
   }),
@@ -22,13 +23,18 @@ const connectionStore = {
   }),
 };
 
+const queryStore = {
+  createTab: vi.fn(),
+  openNacosAdmin: vi.fn(),
+};
+
 vi.mock("@/stores/connectionStore", () => ({
   CONNECTION_ATTEMPT_CANCELLED_MESSAGE: "connection attempt cancelled",
   useConnectionStore: () => connectionStore,
 }));
 
-vi.mock("@/stores/queryStore", () => ({ useQueryStore: () => ({}) }));
-vi.mock("@/stores/settingsStore", () => ({ useSettingsStore: () => ({ editorSettings: {} }) }));
+vi.mock("@/stores/queryStore", () => ({ useQueryStore: () => queryStore }));
+vi.mock("@/stores/settingsStore", () => ({ useSettingsStore: () => ({ editorSettings: { sidebarActivation: "single" } }) }));
 vi.mock("@/stores/savedSqlStore", () => ({ useSavedSqlStore: () => ({}) }));
 vi.mock("@/composables/useToast", () => ({ useToast: () => ({ toast: vi.fn() }) }));
 vi.mock("@/composables/useSqlHighlighter", () => ({ useSqlHighlighter: () => ({ highlight: vi.fn() }) }));
@@ -49,7 +55,7 @@ afterEach(() => {
   connectionStore.sidebarSearchQuery = "";
   vi.clearAllMocks();
   connectionStore.canUseLoadedTreeNodeToggle.mockReturnValue(true);
-  connectionStore.getConfig.mockReturnValue({ db_type: "mysql" });
+  connectionStore.getConfig.mockReturnValue({ db_type: "mysql", name: "connection" });
 });
 
 describe("SidebarTreeRuntimeHost expansion", () => {
@@ -122,6 +128,70 @@ describe("SidebarTreeRuntimeHost expansion", () => {
     expect(toggled).toHaveBeenCalledWith(packageNode, true);
   });
 
+  it("keeps the latest Nacos navigation click when connection checks finish out of order", async () => {
+    let resolveNamespaceConnection!: () => void;
+    let resolveAccessControlConnection!: () => void;
+    const namespaceConnection = new Promise<void>((resolve) => {
+      resolveNamespaceConnection = resolve;
+    });
+    const accessControlConnection = new Promise<void>((resolve) => {
+      resolveAccessControlConnection = resolve;
+    });
+    connectionStore.ensureConnected.mockImplementationOnce(() => namespaceConnection).mockImplementationOnce(() => accessControlConnection);
+    connectionStore.getConfig.mockReturnValue({ db_type: "nacos", name: "local-nacos-v2" });
+
+    const namespaceNode: TreeNode = {
+      id: "nacos:nacos-namespace:public",
+      label: "public",
+      type: "nacos-namespace",
+      connectionId: "nacos",
+      nacosNamespace: "",
+      nacosNamespaceName: "public",
+    };
+    const accessControlNode: TreeNode = {
+      id: "nacos:nacos-access-control",
+      label: "nacos.accessControlSidebarLabel",
+      type: "nacos-access-control",
+      connectionId: "nacos",
+      // Persisted/reused tree state must not turn an application entry point
+      // back into a generic expand/collapse action on the first click.
+      isExpanded: true,
+      children: [],
+    };
+    connectionStore.treeNodes = [namespaceNode, accessControlNode];
+
+    const host = ref<InstanceType<typeof SidebarTreeRuntimeHost> | null>(null);
+    const app = createApp(
+      defineComponent({
+        setup: () => () => h(SidebarTreeRuntimeHost, { ref: host, node: namespaceNode, depth: 0 }),
+      }),
+    );
+    mountedApps.push(app);
+    const container = document.createElement("div");
+    document.body.append(container);
+    app.use(i18n);
+    app.mount(container);
+    await nextTick();
+
+    expect(host.value).not.toBeNull();
+    host.value!.handleRowClick(namespaceNode, 1);
+    host.value!.handleRowClick(accessControlNode, 1);
+
+    await vi.waitFor(() => expect(connectionStore.ensureConnected).toHaveBeenCalledTimes(2));
+    expect(connectionStore.ensureConnected).toHaveBeenNthCalledWith(1, "nacos", { verifyHealth: false });
+    expect(connectionStore.ensureConnected).toHaveBeenNthCalledWith(2, "nacos", { verifyHealth: false });
+
+    resolveAccessControlConnection();
+    await vi.waitFor(() => expect(queryStore.createTab).toHaveBeenCalledWith("nacos", "", "local-nacos-v2:access-control", "nacos-access-control"));
+    expect(accessControlNode.isExpanded).toBe(true);
+
+    resolveNamespaceConnection();
+    await namespaceConnection;
+    await nextTick();
+
+    expect(queryStore.openNacosAdmin).not.toHaveBeenCalled();
+  });
+
   it("expands an unloaded object group without leaking the regex source as a search filter", async () => {
     const group: TreeNode = {
       id: "mysql:basic:__tables",
diff --git a/apps/desktop/src/components/sidebar/__tests__/VisibleNacosNamespacesDialog.spec.ts b/apps/desktop/src/components/sidebar/__tests__/VisibleNacosNamespacesDialog.spec.ts
new file mode 100644
index 0000000000..8fa0c885e4
--- /dev/null
+++ b/apps/desktop/src/components/sidebar/__tests__/VisibleNacosNamespacesDialog.spec.ts
@@ -0,0 +1,11 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const source = readFileSync(new URL("../VisibleNacosNamespacesDialog.vue", import.meta.url), "utf8");
+
+describe("VisibleNacosNamespacesDialog", () => {
+  it("offers only namespaces readable by the current Nacos connection", () => {
+    expect(source).toContain("loadReadableNacosNamespaces(props.connectionId, api)");
+    expect(source).toContain("recordPrimaryVisibleObjectNames(props.connectionId, namespaces.value.map(nacosNamespaceValue))");
+  });
+});
diff --git a/apps/desktop/src/i18n/__tests__/backendErrors.spec.ts b/apps/desktop/src/i18n/__tests__/backendErrors.spec.ts
index 188864ad5a..1481fae0ea 100644
--- a/apps/desktop/src/i18n/__tests__/backendErrors.spec.ts
+++ b/apps/desktop/src/i18n/__tests__/backendErrors.spec.ts
@@ -55,6 +55,22 @@ const WINDOWS_JRE_REMOVE_ERROR = [
 // Every backend message changed away from hardcoded Chinese, paired with the
 // key and params it must resolve to.
 const CASES: { name: string; message: string; key: string; params?: Record<string, string> }[] = [
+  {
+    name: "Nacos ordinary user must configure managed namespaces when namespace discovery is forbidden",
+    message: "Failed to list Nacos namespaces: NACOS_ERROR[v3ManagedNamespacesRequired]: access denied",
+    key: "nacos.nacosManagedNamespacesRequired",
+  },
+  {
+    name: "Nacos ordinary user must configure managed namespaces when authorization management is forbidden",
+    message: "NACOS_ERROR[managedNamespacesRequired]: 403 Forbidden",
+    key: "nacos.nacosManagedNamespacesRequired",
+  },
+  {
+    name: "Nacos 3 managed namespace permission check failed",
+    message: 'NACOS_ERROR[managedNamespaceAccessDenied]: One or more configured namespace IDs are not readable: namespace "team-a" naming: forbidden',
+    key: "nacos.nacosManagedNamespaceAccessDenied",
+    params: { detail: 'namespace "team-a" naming: forbidden' },
+  },
   {
     name: "Apache Phoenix JDBC driver missing",
     message: PHOENIX_DRIVER_NOT_INSTALLED_ERROR,
diff --git a/apps/desktop/src/i18n/backend-errors.ts b/apps/desktop/src/i18n/backend-errors.ts
index 1b3200d22d..78d9ff8936 100644
--- a/apps/desktop/src/i18n/backend-errors.ts
+++ b/apps/desktop/src/i18n/backend-errors.ts
@@ -96,6 +96,10 @@ const patterns: [RegExp, string][] = [
   [/GBASEDBTSERVER[\s\S]*DBSERVERNAME[\s\S]*DBSERVERALIASES/, "connection.gbaseServerMismatch"],
   [/^ai\.configNameExists:(.+)$/, "ai.configNameExists"],
 
+  // Ordinary users may not enumerate namespaces or authorization data through Nacos management APIs.
+  [/NACOS_ERROR\[(?:v3ManagedNamespacesRequired|managedNamespacesRequired)\]:[\s\S]*$/, "nacos.nacosManagedNamespacesRequired"],
+  [/NACOS_ERROR\[managedNamespaceAccessDenied\]: One or more configured namespace IDs are not readable: ([\s\S]+)$/, "nacos.nacosManagedNamespaceAccessDenied"],
+
   // Tunnel / proxy test messages
   [/^HTTP CONNECT proxy connection successful \((\d+)\)$/, "settings.tunnelsHttpTestSuccess"],
   [/^SOCKS5 proxy connection successful$/, "settings.tunnelsSocks5TestSuccess"],
@@ -152,6 +156,7 @@ const paramNames: Record<string, string | string[]> = {
   "connection.driverNotInstalled": "driver",
   "connection.jreNotInstalled": "jre",
   "ai.configNameExists": "name",
+  "nacos.nacosManagedNamespaceAccessDenied": "detail",
   "settings.tunnelsHttpTestSuccess": "code",
   "settings.tunnelsProxyTimedOut": "duration",
   "settings.tunnelsProxyConnectFailed": "error",
diff --git a/apps/desktop/src/i18n/locales/en.ts b/apps/desktop/src/i18n/locales/en.ts
index 2aa5b5a89f..783d5a7c30 100644
--- a/apps/desktop/src/i18n/locales/en.ts
+++ b/apps/desktop/src/i18n/locales/en.ts
@@ -1340,6 +1340,7 @@ export default {
     etcd: "etcd",
     etcdDashboard: "etcd Dashboard",
     etcdAccessControl: "etcd Access Control",
+    nacosAccessControl: "Nacos Access Control",
     zookeeper: "ZooKeeper",
     consul: "Consul",
     mongo: "Mongo",
@@ -7586,6 +7587,161 @@ export default {
     dashboardEmptyPushes: "Empty pushes",
     configs: "Configs",
     services: "Services",
+    loading: "Loading...",
+    accessControlSidebarLabel: "Users & Roles",
+    accessControlTitle: "Access control",
+    accessControlDescription: "Manage Nacos users and role assignments",
+    users: "Users",
+    roleBindings: "Roles",
+    accessControlUnavailable: "User and role management is unavailable for this connection.",
+    accessPermissionEndpointUnavailable: "Namespace permissions are unavailable to the current account. User and role bindings remain visible in compatibility mode.",
+    searchUsers: "Search users",
+    filterUsername: "Filter username",
+    filterRole: "Filter role",
+    username: "Username",
+    password: "Password",
+    passwordUnchanged: "Leave empty to keep the current password",
+    nickname: "Nickname",
+    roles: "Roles",
+    role: "Role",
+    disabled: "Disabled",
+    createUser: "Create user",
+    editUser: "Edit user",
+    resetUserPassword: "Reset password",
+    deleteUser: "Delete user",
+    noUsers: "No users found",
+    noRoleBindings: "No role bindings found",
+    createUserTitle: "Create Nacos user",
+    createUserDescription: "Create a user for this Nacos service.",
+    editUserTitle: "Edit r-nacos user",
+    editUserDescription: "Update the user profile, roles, and namespace privileges.",
+    resetUserTitle: "Reset Nacos user password",
+    resetUserDescription: "Set a new password for this user.",
+    userCredentialsRequired: "Username and password are required.",
+    deleteUserTitle: "Delete Nacos user",
+    deleteUserDescription: "Delete user {username}? This cannot be undone.",
+    rnacosUserEnabledHint: "Disabled users cannot sign in to r-nacos.",
+    rnacosRole0: "Manager",
+    rnacosRole0Hint: "Full console management access",
+    rnacosRole1: "Developer",
+    rnacosRole1Hint: "Configuration and service development access",
+    rnacosRole2: "Visitor",
+    rnacosRole2Hint: "Read-only console access",
+    namespacePrivileges: "Namespace privileges",
+    namespaceWhitelist: "Namespace whitelist",
+    namespaceBlacklist: "Namespace blacklist",
+    namespaceListPlaceholder: "One namespace per line or comma-separated",
+    namespaceSelectPlaceholder: "Select namespaces",
+    namespaceSearchPlaceholder: "Search namespaces",
+    namespaceSelectedCount: "{count} selected",
+    namespaceRemoveSelection: "Remove {namespace}",
+    noNamespacesAvailable: "No namespaces available",
+    retryNamespaceList: "Try again",
+    assignRole: "Assign role",
+    assignRoleTitle: "Assign Nacos role",
+    assignRoleDescription: "Bind a role to one Nacos user.",
+    roleBindingRequired: "Username and role are required.",
+    removeRole: "Remove role",
+    removeRoleTitle: "Remove Nacos role",
+    removeRoleDescription: "Remove role {role} from user {username}?",
+    protectedRole: "The built-in administrator role cannot be removed from DBX.",
+    close: "Close",
+    accessSearchRoles: "Search roles",
+    accessRoleCounts: "{members} members · {permissions} permissions",
+    accessNoRoles: "No roles found",
+    accessUserSubtitle: "Roles and effective namespace access",
+    accessAssociatedRoles: "Associated roles",
+    accessAssociatedRolesHint: "Permissions are inherited from every associated role.",
+    accessNoAssociatedRoles: "No roles associated",
+    accessEffectivePermissions: "Effective permissions",
+    accessEffectivePermissionsHint: "Combined access with the role that grants each permission.",
+    accessAction: "Action",
+    accessSourceRole: "Source role",
+    accessNoEffectivePermissions: "This user has no effective permissions",
+    accessGlobalAdministrator: "Global administrator",
+    accessNeedsRepair: "Needs repair",
+    accessRoleSubtitle: "{members} associated members",
+    accessIncompleteRoleHint: "This historical role has no members or namespace permissions. Add both before saving changes.",
+    accessPermissionScope: "Permission scope",
+    accessPermissionScopeHint: "Namespace rules managed by this role.",
+    accessAllResources: "All resources",
+    accessAdminBypassHint: "ROLE_ADMIN bypasses ordinary namespace permission checks.",
+    accessNoRolePermissions: "No namespace permissions configured",
+    accessMembers: "Members",
+    accessMembersHint: "Users currently associated with this role.",
+    accessNoMembers: "No associated members",
+    accessOpenUser: "View user {username}",
+    accessOpenRole: "View role {role}",
+    accessAdvancedPermissions: "Advanced permissions",
+    accessAdvancedPermissionsHint: "Raw rules are preserved exactly and are not overwritten by namespace editing.",
+    accessRevokeRawPermission: "Revoke raw permission",
+    accessRevokeRawPermissionHint: "This removes exactly the displayed role, resource, and action tuple.",
+    accessSelectItem: "Select an item from the directory",
+    accessCreateRole: "Create role",
+    accessDeleteRole: "Delete role",
+    accessReadOnly: "Read only",
+    accessWriteOnly: "Write only",
+    accessReadWrite: "Read and write",
+    accessDeletedNamespace: "deleted namespace",
+    accessPasswordRequired: "Enter a new password.",
+    accessCredentialsRequired: "Username and password are required.",
+    accessRoleMemberRequired: "A role requires at least one member.",
+    accessRolePermissionRequired: "A role requires at least one namespace permission.",
+    accessInlineUserRequired: "Every new user requires a username and password.",
+    accessNoAssignableRoles: "No complete roles are available",
+    accessTypeUsername: "Type {value} to confirm this high-risk account change",
+    accessMembersRequiredHint: "Select existing users or create users inline. At least one is required.",
+    accessInlineCreateUser: "Create user inline",
+    accessAdminPermissionImmutable: "The global administrator permission is built into Nacos and cannot be edited as namespace rules.",
+    accessPermissionRequiredHint: "Select namespaces, then set the action for each one.",
+    accessUnassignedNamespaces: "Unassigned namespaces",
+    accessGrantedNamespaces: "Granted namespaces",
+    accessSearchNamespaces: "Search namespaces",
+    accessNoUnassignedNamespaces: "No namespaces available to add",
+    accessNoGrantedNamespaces: "Select namespaces to grant access",
+    accessGrantNamespaces: "Grant selected namespaces",
+    accessRevokeNamespaces: "Remove selected namespaces",
+    accessDeleteRoleHint: "Deleting {role} removes every permission and member binding. Successful deletions are not restored after a partial failure.",
+    accessTypeRole: "Type {value} to confirm role deletion",
+    accessOperationResult: "Operation result",
+    accessReenterPassword: "Enter the password again to retry",
+    accessUndoCreated: "Undo created items",
+    accessRetryFailed: "Retry failed steps",
+    accessUserDialog: {
+      create: "Create user",
+      createHint: "Create an account and optionally associate existing roles.",
+      roles: "Edit user roles",
+      rolesHint: "Update roles associated with {username}.",
+      password: "Reset password",
+      passwordHint: "Set a new password for {username}.",
+      delete: "Delete user",
+      deleteHint: "Review role integrity before deleting {username}.",
+    },
+    accessRoleDialog: {
+      create: "Create role",
+      createHint: "Configure members and namespace permissions together.",
+      edit: "Edit role",
+      editHint: "Changes are applied as a reconciled set of member and permission operations.",
+      delete: "Delete role",
+      deleteHint: "This operation can partially succeed and cannot be undone automatically.",
+    },
+    accessOperationStatus: {
+      running: "The operation is still running.",
+      partial: "Some steps succeeded and some require attention.",
+      succeeded: "Every step completed successfully.",
+      failed: "The operation did not complete.",
+      undoing: "Created items are being removed.",
+      undone: "Created items were removed.",
+    },
+    accessStep: {
+      createUser: "Create user",
+      deleteUser: "Delete user",
+      assignRole: "Associate role",
+      removeRole: "Remove role association",
+      grantPermission: "Grant permission",
+      revokePermission: "Revoke permission",
+    },
+    rnacosAccessControlAuthDescription: "Enter the r-nacos console verification code to manage users and roles.",
     raw: "Raw",
     namespace: "Namespace",
     createNamespace: "Create Namespace",
@@ -7828,6 +7984,15 @@ export default {
     nacosConnectionPlanDescription: "Choose the service implementation and API version.",
     nacosServiceAddress: "Service address",
     nacosServiceAddressHint: "Enter the service address. The default port is 8848, for example http://host:8848/nacos.",
+    nacosManagedNamespaces: "Managed namespace IDs",
+    nacosManagedNamespacesPlaceholder: "For example: public, team-a",
+    nacosManagedNamespacesHint: "Enter the namespace IDs this ordinary user can access, separated by commas or new lines. The connection test verifies configuration and service read access for each ID.",
+    nacosOrdinaryAccount: "Ordinary user",
+    nacosOrdinaryAccountHint: "If the account above is an ordinary user, enable this option and select its authorized namespaces; otherwise the connection will not work correctly.",
+    nacosManagedNamespacesSeparator: "Comma or new line separated",
+    nacosOrdinaryNamespacesRequired: "Enter at least one namespace ID that this ordinary user is allowed to manage.",
+    nacosManagedNamespacesRequired: "This Nacos ordinary user cannot list namespaces or authorization data. Enter at least one namespace ID it is allowed to manage and try again.",
+    nacosManagedNamespaceAccessDenied: "These namespaces failed the configuration or service read-access check: {detail}",
     nacosAuth: "Authentication",
     nacosAuthHint: "These credentials are used for connection tests and daily management.",
     nacosUsernamePassword: "Username / password",
@@ -7839,11 +8004,11 @@ export default {
     nacosAdvancedDescription: "These settings have safe defaults and usually only need adjustment for custom deployments, metrics, or r-nacos extensions.",
     nacosPageSizeHint: "Used for configuration and service lists; 1–500 items per page.",
     nacosMetricsHint: "Query metrics from the service address automatically; choose a custom URL when the metrics endpoint differs.",
-    nacosRnacosExtension: "r-nacos extensions",
-    nacosRnacosExtensionHint: "Enables config history, config descriptions, and disabled-instance management.",
+    nacosRnacosExtension: "r-nacos console features",
+    nacosRnacosExtensionHint: "The console address and credentials enable user management, configuration details, and disabled-instance management. Configuration history is controlled separately below.",
     nacosEnabled: "Enabled",
-    nacosRnacosConsoleUrlHint: "Usually http://host:10848.",
-    nacosRnacosDisabledHint: "When disabled, only the service address is used; basic configuration and service management remain available.",
+    nacosRnacosConsoleUrlHint: "Usually http://host:10848. Required for r-nacos user management and other console features.",
+    nacosRnacosDisabledHint: "Configuration history is disabled. User management remains available when a console address and credentials are configured.",
     nacosTlsHint: "Enable only for a trusted self-signed HTTPS certificate.",
     nacosVisibleNamespacesTitle: "Choose visible namespaces",
     nacosVisibleNamespacesDetailLabel: "Visible namespaces",
diff --git a/apps/desktop/src/i18n/locales/es.ts b/apps/desktop/src/i18n/locales/es.ts
index 17df959117..25f17a9947 100644
--- a/apps/desktop/src/i18n/locales/es.ts
+++ b/apps/desktop/src/i18n/locales/es.ts
@@ -1,6 +1,7 @@
 import { withEnglishFallback } from "./fallback";
 import docs from "./docs/es";
 import { consulUiMessages } from "./consulUi";
+import { nacosAccessControlMessages, nacosAccessControlTabs } from "./nacosAccessControl";
 import { sqlServerTraceMessages as sqlServerTrace } from "./sqlServerTraceMessages";
 
 const consul = {
@@ -1369,6 +1370,7 @@ export default withEnglishFallback({
     gridfs: "GridFS",
     etcdDashboard: "Panel de etcd",
     etcdAccessControl: "Control de acceso de etcd",
+    ...nacosAccessControlTabs,
   },
   executionSummary: {
     empty: "Sin resumen",
@@ -6196,6 +6198,7 @@ export default withEnglishFallback({
     runInBackground: "Ejecutar en segundo plano",
   },
   nacos: {
+    ...nacosAccessControlMessages,
     dashboard: "Panel",
     dashboardTitle: "Panel de operaciones",
     dashboardUpdatedAt: "Actualizado {time}",
@@ -6511,6 +6514,15 @@ export default withEnglishFallback({
     nacosConnectionPlanDescription: "Elige la implementación del servicio y la versión de la API.",
     nacosServiceAddress: "Dirección del servicio",
     nacosServiceAddressHint: "Introduce la dirección del servicio. El puerto predeterminado es 8848, por ejemplo http://host:8848/nacos.",
+    nacosManagedNamespaces: "ID de espacios administrados",
+    nacosManagedNamespacesPlaceholder: "Por ejemplo: public, team-a",
+    nacosManagedNamespacesHint: "Introduzca los ID accesibles para este usuario normal, separados por comas o líneas. La prueba de conexión valida la lectura de configuraciones y servicios para cada ID.",
+    nacosOrdinaryAccount: "Usuario normal",
+    nacosOrdinaryAccountHint: "Si la cuenta anterior es un usuario normal, active esta opción y seleccione sus espacios autorizados; de lo contrario, la conexión no funcionará correctamente.",
+    nacosManagedNamespacesSeparator: "Separados por comas o líneas",
+    nacosOrdinaryNamespacesRequired: "Introduzca al menos un ID de espacio que este usuario normal pueda administrar.",
+    nacosManagedNamespacesRequired: "Este usuario normal de Nacos no puede listar los espacios ni los datos de autorización. Introduzca al menos un ID que tenga permiso para administrar y vuelva a intentarlo.",
+    nacosManagedNamespaceAccessDenied: "Estos espacios no superaron la comprobación de lectura de configuraciones o servicios: {detail}",
     nacosAuth: "Autenticación",
     nacosAuthHint: "Estas credenciales se usan para probar la conexión y para la administración diaria.",
     nacosUsernamePassword: "Usuario / contraseña",
diff --git a/apps/desktop/src/i18n/locales/it.ts b/apps/desktop/src/i18n/locales/it.ts
index 371e11c78c..8a203445d0 100644
--- a/apps/desktop/src/i18n/locales/it.ts
+++ b/apps/desktop/src/i18n/locales/it.ts
@@ -1,6 +1,7 @@
 import { withEnglishFallback } from "./fallback";
 import docs from "./docs/it";
 import { consulUiMessages } from "./consulUi";
+import { nacosAccessControlMessages, nacosAccessControlTabs } from "./nacosAccessControl";
 import { sqlServerTraceMessages as sqlServerTrace } from "./sqlServerTraceMessages";
 const consul = {
   ...consulUiMessages,
@@ -1367,6 +1368,7 @@ export default withEnglishFallback({
     gridfs: "GridFS",
     etcdDashboard: "etcd dashboard",
     etcdAccessControl: "controllo accessi etcd",
+    ...nacosAccessControlTabs,
   },
   executionSummary: {
     empty: "Nessun riepilogo",
@@ -6196,6 +6198,7 @@ export default withEnglishFallback({
     runInBackground: "Esegui in background",
   },
   nacos: {
+    ...nacosAccessControlMessages,
     dashboard: "Dashboard",
     dashboardTitle: "Dashboard operativa",
     dashboardUpdatedAt: "Aggiornato {time}",
@@ -6511,6 +6514,15 @@ export default withEnglishFallback({
     nacosConnectionPlanDescription: "Scegli l'implementazione del servizio e la versione API.",
     nacosServiceAddress: "Indirizzo del servizio",
     nacosServiceAddressHint: "Inserisci l'indirizzo del servizio. La porta predefinita è 8848, ad esempio http://host:8848/nacos.",
+    nacosManagedNamespaces: "ID namespace gestiti",
+    nacosManagedNamespacesPlaceholder: "Ad esempio: public, team-a",
+    nacosManagedNamespacesHint: "Inserire gli ID accessibili a questo utente normale, separati da virgole o righe. Il test di connessione verifica la lettura di configurazioni e servizi per ogni ID.",
+    nacosOrdinaryAccount: "Utente normale",
+    nacosOrdinaryAccountHint: "Se l'account sopra è un utente normale, attivare questa opzione e selezionare i namespace autorizzati; altrimenti la connessione non funzionerà correttamente.",
+    nacosManagedNamespacesSeparator: "Separati da virgole o righe",
+    nacosOrdinaryNamespacesRequired: "Inserire almeno un ID namespace che questo utente normale può gestire.",
+    nacosManagedNamespacesRequired: "Questo utente normale Nacos non può elencare i namespace o i dati di autorizzazione. Inserire almeno un ID che è autorizzato a gestire e riprovare.",
+    nacosManagedNamespaceAccessDenied: "Questi namespace non hanno superato il controllo di lettura di configurazioni o servizi: {detail}",
     nacosAuth: "Autenticazione",
     nacosAuthHint: "Queste credenziali vengono usate per i test di connessione e la gestione quotidiana.",
     nacosUsernamePassword: "Nome utente / password",
diff --git a/apps/desktop/src/i18n/locales/ja.ts b/apps/desktop/src/i18n/locales/ja.ts
index e0e83c0f90..54453e19b8 100644
--- a/apps/desktop/src/i18n/locales/ja.ts
+++ b/apps/desktop/src/i18n/locales/ja.ts
@@ -1,6 +1,7 @@
 import { withEnglishFallback } from "./fallback";
 import docs from "./docs/ja";
 import { consulUiMessages } from "./consulUi";
+import { nacosAccessControlMessages, nacosAccessControlTabs } from "./nacosAccessControl";
 import { sqlServerTraceMessages as sqlServerTrace } from "./sqlServerTraceMessages";
 
 const consul = {
@@ -1389,6 +1390,7 @@ export default withEnglishFallback({
     gridfs: "GridFS",
     etcdDashboard: "etcd ダッシュボード",
     etcdAccessControl: "etcd アクセス制御",
+    ...nacosAccessControlTabs,
   },
   executionSummary: {
     empty: "サマリーはありません",
@@ -6249,6 +6251,7 @@ export default withEnglishFallback({
     exportCancelled: "エクスポートがキャンセルされました",
   },
   nacos: {
+    ...nacosAccessControlMessages,
     dashboard: "ダッシュボード",
     dashboardTitle: "運用ダッシュボード",
     dashboardUpdatedAt: "更新 {time}",
@@ -6564,6 +6567,15 @@ export default withEnglishFallback({
     nacosConnectionPlanDescription: "サービス実装と API バージョンを選択します。",
     nacosServiceAddress: "サービスアドレス",
     nacosServiceAddressHint: "サービスアドレスを入力してください。既定のポートは 8848 です（例: http://host:8848/nacos）。",
+    nacosManagedNamespaces: "管理対象の名前空間 ID",
+    nacosManagedNamespacesPlaceholder: "例: public, team-a",
+    nacosManagedNamespacesHint: "この一般ユーザーがアクセスできる名前空間 ID をカンマまたは改行区切りで入力してください。接続テストで各 ID の設定・サービス読み取り権限を確認します。",
+    nacosOrdinaryAccount: "一般ユーザー",
+    nacosOrdinaryAccountHint: "上記のアカウントが一般ユーザーの場合、この項目を有効にしてアクセス権のある名前空間を指定してください。指定しないと接続後に正常に使用できません。",
+    nacosManagedNamespacesSeparator: "カンマまたは改行区切り",
+    nacosOrdinaryNamespacesRequired: "一般ユーザーが管理を許可された名前空間 ID を 1 つ以上入力してください。",
+    nacosManagedNamespacesRequired: "この Nacos 一般ユーザーは名前空間または権限情報を一覧表示できません。管理を許可された名前空間 ID を 1 つ以上入力して再試行してください。",
+    nacosManagedNamespaceAccessDenied: "次の名前空間は設定またはサービスの読み取り権限チェックに失敗しました: {detail}",
     nacosAuth: "認証",
     nacosAuthHint: "接続テストと日常の管理に使用する認証情報です。",
     nacosUsernamePassword: "ユーザー名 / パスワード",
diff --git a/apps/desktop/src/i18n/locales/ko.ts b/apps/desktop/src/i18n/locales/ko.ts
index 50e3c26f80..bc0855e7d6 100644
--- a/apps/desktop/src/i18n/locales/ko.ts
+++ b/apps/desktop/src/i18n/locales/ko.ts
@@ -7274,6 +7274,15 @@ export default withEnglishFallback({
     nacosConnectionPlanDescription: "서비스 구현과 API 버전을 선택합니다.",
     nacosServiceAddress: "서비스 주소",
     nacosServiceAddressHint: "서비스 주소를 입력하세요. 기본 포트는 8848입니다(예: http://host:8848/nacos).",
+    nacosManagedNamespaces: "관리할 네임스페이스 ID",
+    nacosManagedNamespacesPlaceholder: "예: public, team-a",
+    nacosManagedNamespacesHint: "이 일반 사용자가 접근할 수 있는 네임스페이스 ID를 쉼표 또는 줄바꿈으로 입력하세요. 연결 테스트에서 각 ID의 구성 및 서비스 읽기 권한을 확인합니다.",
+    nacosOrdinaryAccount: "일반 사용자",
+    nacosOrdinaryAccountHint: "위 계정이 일반 사용자인 경우 이 옵션을 켜고 권한이 있는 네임스페이스를 지정하세요. 지정하지 않으면 연결 후 정상적으로 사용할 수 없습니다.",
+    nacosManagedNamespacesSeparator: "쉼표 또는 줄바꿈으로 구분",
+    nacosOrdinaryNamespacesRequired: "일반 사용자가 관리할 수 있는 네임스페이스 ID를 하나 이상 입력하세요.",
+    nacosManagedNamespacesRequired: "이 Nacos 일반 사용자는 네임스페이스 또는 권한 정보를 조회할 수 없습니다. 관리 권한이 있는 네임스페이스 ID를 하나 이상 입력한 후 다시 시도하세요.",
+    nacosManagedNamespaceAccessDenied: "다음 네임스페이스가 구성 또는 서비스 읽기 권한 검사에 실패했습니다: {detail}",
     nacosAuth: "인증",
     nacosAuthHint: "이 자격 증명은 연결 테스트와 일상적인 관리에 사용됩니다.",
     nacosUsernamePassword: "사용자 이름 / 비밀번호",
diff --git a/apps/desktop/src/i18n/locales/nacosAccessControl.ts b/apps/desktop/src/i18n/locales/nacosAccessControl.ts
new file mode 100644
index 0000000000..3b86eb7bbe
--- /dev/null
+++ b/apps/desktop/src/i18n/locales/nacosAccessControl.ts
@@ -0,0 +1,162 @@
+// Shared English fallback for locales that have not yet translated the Nacos access-control workspace.
+export const nacosAccessControlTabs = {
+  nacosAccessControl: "Nacos Access Control",
+};
+
+export const nacosAccessControlMessages = {
+  loading: "Loading...",
+  accessControlSidebarLabel: "Users & Roles",
+  accessControlTitle: "Access control",
+  accessControlDescription: "Manage Nacos users and role assignments",
+  users: "Users",
+  roleBindings: "Roles",
+  accessControlUnavailable: "User and role management is unavailable for this connection.",
+  accessPermissionEndpointUnavailable: "Namespace permissions are unavailable to the current account. User and role bindings remain visible in compatibility mode.",
+  searchUsers: "Search users",
+  filterUsername: "Filter username",
+  filterRole: "Filter role",
+  username: "Username",
+  password: "Password",
+  passwordUnchanged: "Leave empty to keep the current password",
+  nickname: "Nickname",
+  roles: "Roles",
+  role: "Role",
+  disabled: "Disabled",
+  createUser: "Create user",
+  editUser: "Edit user",
+  resetUserPassword: "Reset password",
+  deleteUser: "Delete user",
+  noUsers: "No users found",
+  noRoleBindings: "No role bindings found",
+  createUserTitle: "Create Nacos user",
+  createUserDescription: "Create a user for this Nacos service.",
+  editUserTitle: "Edit r-nacos user",
+  editUserDescription: "Update the user profile, roles, and namespace privileges.",
+  resetUserTitle: "Reset Nacos user password",
+  resetUserDescription: "Set a new password for this user.",
+  userCredentialsRequired: "Username and password are required.",
+  deleteUserTitle: "Delete Nacos user",
+  deleteUserDescription: "Delete user {username}? This cannot be undone.",
+  rnacosUserEnabledHint: "Disabled users cannot sign in to r-nacos.",
+  rnacosRole0: "Manager",
+  rnacosRole0Hint: "Full console management access",
+  rnacosRole1: "Developer",
+  rnacosRole1Hint: "Configuration and service development access",
+  rnacosRole2: "Visitor",
+  rnacosRole2Hint: "Read-only console access",
+  namespacePrivileges: "Namespace privileges",
+  namespaceWhitelist: "Namespace whitelist",
+  namespaceBlacklist: "Namespace blacklist",
+  namespaceListPlaceholder: "One namespace per line or comma-separated",
+  namespaceSelectPlaceholder: "Select namespaces",
+  namespaceSearchPlaceholder: "Search namespaces",
+  namespaceSelectedCount: "{count} selected",
+  namespaceRemoveSelection: "Remove {namespace}",
+  noNamespacesAvailable: "No namespaces available",
+  retryNamespaceList: "Try again",
+  assignRole: "Assign role",
+  assignRoleTitle: "Assign Nacos role",
+  assignRoleDescription: "Bind a role to one Nacos user.",
+  roleBindingRequired: "Username and role are required.",
+  removeRole: "Remove role",
+  removeRoleTitle: "Remove Nacos role",
+  removeRoleDescription: "Remove role {role} from user {username}?",
+  protectedRole: "The built-in administrator role cannot be removed from DBX.",
+  close: "Close",
+  accessSearchRoles: "Search roles",
+  accessRoleCounts: "{members} members / {permissions} permissions",
+  accessNoRoles: "No roles found",
+  accessUserSubtitle: "Roles and effective namespace access",
+  accessAssociatedRoles: "Associated roles",
+  accessAssociatedRolesHint: "Permissions are inherited from every associated role.",
+  accessNoAssociatedRoles: "No roles associated",
+  accessEffectivePermissions: "Effective permissions",
+  accessEffectivePermissionsHint: "Combined access with the role that grants each permission.",
+  accessAction: "Action",
+  accessSourceRole: "Source role",
+  accessNoEffectivePermissions: "This user has no effective permissions",
+  accessGlobalAdministrator: "Global administrator",
+  accessNeedsRepair: "Needs repair",
+  accessRoleSubtitle: "{members} associated members",
+  accessIncompleteRoleHint: "This historical role has no members or namespace permissions. Add both before saving changes.",
+  accessPermissionScope: "Permission scope",
+  accessPermissionScopeHint: "Namespace rules managed by this role.",
+  accessAllResources: "All resources",
+  accessAdminBypassHint: "ROLE_ADMIN bypasses ordinary namespace permission checks.",
+  accessNoRolePermissions: "No namespace permissions configured",
+  accessMembers: "Members",
+  accessMembersHint: "Users currently associated with this role.",
+  accessNoMembers: "No associated members",
+  accessOpenUser: "View user {username}",
+  accessOpenRole: "View role {role}",
+  accessAdvancedPermissions: "Advanced permissions",
+  accessAdvancedPermissionsHint: "Raw rules are preserved exactly and are not overwritten by namespace editing.",
+  accessRevokeRawPermission: "Revoke raw permission",
+  accessRevokeRawPermissionHint: "This removes exactly the displayed role, resource, and action tuple.",
+  accessSelectItem: "Select an item from the directory",
+  accessCreateRole: "Create role",
+  accessDeleteRole: "Delete role",
+  accessReadOnly: "Read only",
+  accessWriteOnly: "Write only",
+  accessReadWrite: "Read and write",
+  accessDeletedNamespace: "deleted namespace",
+  accessPasswordRequired: "Enter a new password.",
+  accessCredentialsRequired: "Username and password are required.",
+  accessRoleMemberRequired: "A role requires at least one member.",
+  accessRolePermissionRequired: "A role requires at least one namespace permission.",
+  accessInlineUserRequired: "Every new user requires a username and password.",
+  accessNoAssignableRoles: "No complete roles are available",
+  accessTypeUsername: "Type {value} to confirm this high-risk account change",
+  accessMembersRequiredHint: "Select existing users or create users inline. At least one is required.",
+  accessInlineCreateUser: "Create user inline",
+  accessAdminPermissionImmutable: "The global administrator permission is built into Nacos and cannot be edited as namespace rules.",
+  accessPermissionRequiredHint: "Select namespaces, then set the action for each one.",
+  accessUnassignedNamespaces: "Unassigned namespaces",
+  accessGrantedNamespaces: "Granted namespaces",
+  accessSearchNamespaces: "Search namespaces",
+  accessNoUnassignedNamespaces: "No namespaces available to add",
+  accessNoGrantedNamespaces: "Select namespaces to grant access",
+  accessGrantNamespaces: "Grant selected namespaces",
+  accessRevokeNamespaces: "Remove selected namespaces",
+  accessDeleteRoleHint: "Deleting {role} removes every permission and member binding. Successful deletions are not restored after a partial failure.",
+  accessTypeRole: "Type {value} to confirm role deletion",
+  accessOperationResult: "Operation result",
+  accessReenterPassword: "Enter the password again to retry",
+  accessUndoCreated: "Undo created items",
+  accessRetryFailed: "Retry failed steps",
+  accessUserDialog: {
+    create: "Create user",
+    createHint: "Create an account and optionally associate existing roles.",
+    roles: "Edit user roles",
+    rolesHint: "Update roles associated with {username}.",
+    password: "Reset password",
+    passwordHint: "Set a new password for {username}.",
+    delete: "Delete user",
+    deleteHint: "Review role integrity before deleting {username}.",
+  },
+  accessRoleDialog: {
+    create: "Create role",
+    createHint: "Configure members and namespace permissions together.",
+    edit: "Edit role",
+    editHint: "Changes are applied as a reconciled set of member and permission operations.",
+    delete: "Delete role",
+    deleteHint: "This operation can partially succeed and cannot be undone automatically.",
+  },
+  accessOperationStatus: {
+    running: "The operation is still running.",
+    partial: "Some steps succeeded and some require attention.",
+    succeeded: "Every step completed successfully.",
+    failed: "The operation did not complete.",
+    undoing: "Created items are being removed.",
+    undone: "Created items were removed.",
+  },
+  accessStep: {
+    createUser: "Create user",
+    deleteUser: "Delete user",
+    assignRole: "Associate role",
+    removeRole: "Remove role association",
+    grantPermission: "Grant permission",
+    revokePermission: "Revoke permission",
+  },
+  rnacosAccessControlAuthDescription: "Enter the r-nacos console verification code to manage users and roles.",
+};
diff --git a/apps/desktop/src/i18n/locales/pt-BR.ts b/apps/desktop/src/i18n/locales/pt-BR.ts
index bae38a16a7..fc677d614d 100644
--- a/apps/desktop/src/i18n/locales/pt-BR.ts
+++ b/apps/desktop/src/i18n/locales/pt-BR.ts
@@ -1,6 +1,7 @@
 import { withEnglishFallback } from "./fallback";
 import docs from "./docs/pt-BR";
 import { consulUiMessages } from "./consulUi";
+import { nacosAccessControlMessages, nacosAccessControlTabs } from "./nacosAccessControl";
 import { sqlServerTraceMessages as sqlServerTrace } from "./sqlServerTraceMessages";
 
 const consul = {
@@ -1369,6 +1370,7 @@ export default withEnglishFallback({
     gridfs: "GridFS",
     etcdDashboard: "painel etcd",
     etcdAccessControl: "controle de acesso do etcd",
+    ...nacosAccessControlTabs,
   },
   executionSummary: {
     empty: "Nenhum resumo",
@@ -6198,6 +6200,7 @@ export default withEnglishFallback({
     exportCancelled: "Exportação cancelada",
   },
   nacos: {
+    ...nacosAccessControlMessages,
     dashboard: "Painel",
     dashboardTitle: "Painel de operações",
     dashboardUpdatedAt: "Atualizado {time}",
@@ -6513,6 +6516,15 @@ export default withEnglishFallback({
     nacosConnectionPlanDescription: "Escolha a implementação do serviço e a versão da API.",
     nacosServiceAddress: "Endereço do serviço",
     nacosServiceAddressHint: "Informe o endereço do serviço. A porta padrão é 8848, por exemplo http://host:8848/nacos.",
+    nacosManagedNamespaces: "IDs de namespaces gerenciados",
+    nacosManagedNamespacesPlaceholder: "Por exemplo: public, team-a",
+    nacosManagedNamespacesHint: "Informe os IDs acessíveis para este usuário comum, separados por vírgulas ou linhas. O teste de conexão valida a leitura de configurações e serviços para cada ID.",
+    nacosOrdinaryAccount: "Usuário comum",
+    nacosOrdinaryAccountHint: "Se a conta acima for um usuário comum, ative esta opção e selecione os namespaces autorizados; caso contrário, a conexão não funcionará corretamente.",
+    nacosManagedNamespacesSeparator: "Separados por vírgulas ou linhas",
+    nacosOrdinaryNamespacesRequired: "Informe pelo menos um ID de namespace que este usuário comum pode gerenciar.",
+    nacosManagedNamespacesRequired: "Este usuário comum do Nacos não pode listar namespaces nem dados de autorização. Informe pelo menos um ID que ele tenha permissão para gerenciar e tente novamente.",
+    nacosManagedNamespaceAccessDenied: "Estes namespaces falharam na verificação de leitura de configurações ou serviços: {detail}",
     nacosAuth: "Autenticação",
     nacosAuthHint: "Essas credenciais são usadas nos testes de conexão e no gerenciamento diário.",
     nacosUsernamePassword: "Usuário / senha",
diff --git a/apps/desktop/src/i18n/locales/zh-CN.ts b/apps/desktop/src/i18n/locales/zh-CN.ts
index f4d0f3cfad..83ab72585b 100644
--- a/apps/desktop/src/i18n/locales/zh-CN.ts
+++ b/apps/desktop/src/i18n/locales/zh-CN.ts
@@ -1264,6 +1264,7 @@ export default withEnglishFallback({
     etcd: "etcd",
     etcdDashboard: "etcd 大盘",
     etcdAccessControl: "etcd 访问控制",
+    nacosAccessControl: "Nacos 用户和角色",
     zookeeper: "ZooKeeper",
     consul: "Consul",
     mongo: "Mongo",
@@ -7570,6 +7571,161 @@ export default withEnglishFallback({
     dashboardEmptyPushes: "空推送",
     configs: "配置",
     services: "服务",
+    loading: "加载中...",
+    accessControlSidebarLabel: "用户和角色",
+    accessControlTitle: "访问控制",
+    accessControlDescription: "管理 Nacos 用户和角色权限",
+    users: "用户",
+    roleBindings: "角色",
+    accessControlUnavailable: "当前连接无法使用用户和角色管理。",
+    accessPermissionEndpointUnavailable: "当前账号无法访问命名空间权限接口，用户和角色绑定将以兼容模式展示。",
+    searchUsers: "搜索用户",
+    filterUsername: "筛选用户名",
+    filterRole: "筛选角色",
+    username: "用户名",
+    password: "密码",
+    passwordUnchanged: "留空则保持当前密码",
+    nickname: "昵称",
+    roles: "角色",
+    role: "角色",
+    disabled: "已禁用",
+    createUser: "新建用户",
+    editUser: "编辑用户",
+    resetUserPassword: "重置密码",
+    deleteUser: "删除用户",
+    noUsers: "暂无用户",
+    noRoleBindings: "暂无角色绑定",
+    createUserTitle: "新建 Nacos 用户",
+    createUserDescription: "为当前 Nacos 服务新建用户。",
+    editUserTitle: "编辑 r-nacos 用户",
+    editUserDescription: "更新用户资料、角色和命名空间权限。",
+    resetUserTitle: "重置 Nacos 用户密码",
+    resetUserDescription: "为该用户设置新密码。",
+    userCredentialsRequired: "用户名和密码不能为空。",
+    deleteUserTitle: "删除 Nacos 用户",
+    deleteUserDescription: "确定删除用户 {username} 吗？此操作不可撤销。",
+    rnacosUserEnabledHint: "禁用的用户无法登录 r-nacos。",
+    rnacosRole0: "管理员",
+    rnacosRole0Hint: "拥有完整控制台管理权限",
+    rnacosRole1: "开发者",
+    rnacosRole1Hint: "拥有配置和服务开发权限",
+    rnacosRole2: "访客",
+    rnacosRole2Hint: "拥有控制台只读权限",
+    namespacePrivileges: "命名空间权限",
+    namespaceWhitelist: "命名空间白名单",
+    namespaceBlacklist: "命名空间黑名单",
+    namespaceListPlaceholder: "每行一个命名空间，或用逗号分隔",
+    namespaceSelectPlaceholder: "选择命名空间",
+    namespaceSearchPlaceholder: "搜索命名空间",
+    namespaceSelectedCount: "已选择 {count} 个",
+    namespaceRemoveSelection: "移除 {namespace}",
+    noNamespacesAvailable: "暂无可选命名空间",
+    retryNamespaceList: "重新加载",
+    assignRole: "分配角色",
+    assignRoleTitle: "分配 Nacos 角色",
+    assignRoleDescription: "将一个角色绑定到指定 Nacos 用户。",
+    roleBindingRequired: "用户名和角色不能为空。",
+    removeRole: "移除角色",
+    removeRoleTitle: "移除 Nacos 角色",
+    removeRoleDescription: "确定从用户 {username} 移除角色 {role} 吗？",
+    protectedRole: "DBX 不允许移除内置管理员角色。",
+    close: "关闭",
+    accessSearchRoles: "搜索角色",
+    accessRoleCounts: "{members} 位成员 · {permissions} 条权限",
+    accessNoRoles: "暂无角色",
+    accessUserSubtitle: "关联角色与最终生效的命名空间权限",
+    accessAssociatedRoles: "关联角色",
+    accessAssociatedRolesHint: "用户会继承所有关联角色的权限。",
+    accessNoAssociatedRoles: "尚未关联角色",
+    accessEffectivePermissions: "有效权限",
+    accessEffectivePermissionsHint: "合并展示最终权限，并标明每项权限的来源角色。",
+    accessAction: "动作",
+    accessSourceRole: "来源角色",
+    accessNoEffectivePermissions: "该用户暂无有效权限",
+    accessGlobalAdministrator: "全局管理员",
+    accessNeedsRepair: "需要修复",
+    accessRoleSubtitle: "已关联 {members} 位成员",
+    accessIncompleteRoleHint: "这是一个历史异常角色，缺少成员或命名空间权限。保存修改前必须补齐两项配置。",
+    accessPermissionScope: "权限范围",
+    accessPermissionScopeHint: "由该角色管理的命名空间权限规则。",
+    accessAllResources: "全部资源",
+    accessAdminBypassHint: "ROLE_ADMIN 会绕过普通命名空间权限检查。",
+    accessNoRolePermissions: "尚未配置命名空间权限",
+    accessMembers: "关联成员",
+    accessMembersHint: "当前与该角色关联的用户。",
+    accessNoMembers: "尚未关联成员",
+    accessOpenUser: "查看用户 {username}",
+    accessOpenRole: "查看角色 {role}",
+    accessAdvancedPermissions: "高级权限",
+    accessAdvancedPermissionsHint: "原始权限会被完整保留，不会被普通命名空间编辑覆盖。",
+    accessRevokeRawPermission: "撤销原始权限",
+    accessRevokeRawPermissionHint: "仅撤销当前显示的角色、资源和动作三元组。",
+    accessSelectItem: "请从左侧目录选择一项",
+    accessCreateRole: "新建角色",
+    accessDeleteRole: "删除角色",
+    accessReadOnly: "只读",
+    accessWriteOnly: "只写",
+    accessReadWrite: "读写",
+    accessDeletedNamespace: "已删除命名空间",
+    accessPasswordRequired: "请输入新密码。",
+    accessCredentialsRequired: "用户名和密码不能为空。",
+    accessRoleMemberRequired: "角色至少需要一位成员。",
+    accessRolePermissionRequired: "角色至少需要一条命名空间权限。",
+    accessInlineUserRequired: "每个待创建用户都必须填写用户名和密码。",
+    accessNoAssignableRoles: "暂无可分配的完整角色",
+    accessTypeUsername: "输入 {value} 确认此次高风险账号变更",
+    accessMembersRequiredHint: "选择已有用户或直接创建新用户，至少需要一位成员。",
+    accessInlineCreateUser: "同时创建用户",
+    accessAdminPermissionImmutable: "全局管理员权限由 Nacos 内置，不能按普通命名空间权限编辑。",
+    accessPermissionRequiredHint: "选择命名空间后，为每一项分别设置权限动作。",
+    accessUnassignedNamespaces: "未授权命名空间",
+    accessGrantedNamespaces: "已授权命名空间",
+    accessSearchNamespaces: "搜索命名空间",
+    accessNoUnassignedNamespaces: "没有可添加的命名空间",
+    accessNoGrantedNamespaces: "请选择需要授权的命名空间",
+    accessGrantNamespaces: "授予选中的命名空间",
+    accessRevokeNamespaces: "移除选中的命名空间",
+    accessDeleteRoleHint: "删除 {role} 会移除其全部权限和成员绑定。部分成功后，已删除内容不会自动恢复。",
+    accessTypeRole: "输入 {value} 确认删除角色",
+    accessOperationResult: "操作结果",
+    accessReenterPassword: "重新输入密码后重试",
+    accessUndoCreated: "撤销本次创建",
+    accessRetryFailed: "重试失败项",
+    accessUserDialog: {
+      create: "新建用户",
+      createHint: "创建账号，并可同时关联已有角色。",
+      roles: "编辑用户角色",
+      rolesHint: "调整用户 {username} 关联的角色。",
+      password: "重置密码",
+      passwordHint: "为用户 {username} 设置新密码。",
+      delete: "删除用户",
+      deleteHint: "删除 {username} 前会检查角色完整性。",
+    },
+    accessRoleDialog: {
+      create: "新建角色",
+      createHint: "一次完成角色成员和命名空间权限配置。",
+      edit: "编辑角色",
+      editHint: "成员和权限变更会经过服务端对账后按步骤执行。",
+      delete: "删除角色",
+      deleteHint: "此操作可能部分成功，且不支持自动恢复已删除内容。",
+    },
+    accessOperationStatus: {
+      running: "操作仍在执行中。",
+      partial: "部分步骤成功，仍有步骤需要处理。",
+      succeeded: "所有步骤均已成功完成。",
+      failed: "操作未能完成。",
+      undoing: "正在移除本次创建的内容。",
+      undone: "本次创建的内容已移除。",
+    },
+    accessStep: {
+      createUser: "创建用户",
+      deleteUser: "删除用户",
+      assignRole: "关联角色",
+      removeRole: "移除角色关联",
+      grantPermission: "授予权限",
+      revokePermission: "撤销权限",
+    },
+    rnacosAccessControlAuthDescription: "请输入 r-nacos 控制台验证码，以管理用户和角色。",
     raw: "Raw",
     namespace: "命名空间",
     createNamespace: "新建命名空间",
@@ -7812,6 +7968,15 @@ export default withEnglishFallback({
     nacosConnectionPlanDescription: "选择服务实现和 API 版本。",
     nacosServiceAddress: "服务地址",
     nacosServiceAddressHint: "填写服务地址即可，默认端口为 8848，例如 http://主机:8848/nacos。",
+    nacosManagedNamespaces: "可管理命名空间 ID",
+    nacosManagedNamespacesPlaceholder: "例如：public, team-a",
+    nacosManagedNamespacesHint: "填写该普通用户有权访问的命名空间 ID，支持逗号或换行分隔；连接测试会逐项验证配置与服务读取权限。",
+    nacosOrdinaryAccount: "普通用户",
+    nacosOrdinaryAccountHint: "如果上方填写的是普通用户，请开启此选项并指定该用户有权限的命名空间，否则连接后将无法正常使用。",
+    nacosManagedNamespacesSeparator: "逗号或换行分隔",
+    nacosOrdinaryNamespacesRequired: "普通用户至少需要填写一个有权管理的命名空间 ID。",
+    nacosManagedNamespacesRequired: "当前 Nacos 普通用户无权获取命名空间目录或权限管理信息，请填写至少一个有权管理的命名空间 ID 后重试。",
+    nacosManagedNamespaceAccessDenied: "以下命名空间未通过配置或服务读取权限校验：{detail}",
     nacosAuth: "认证",
     nacosAuthHint: "认证信息同时用于连接测试和日常管理。",
     nacosUsernamePassword: "账号密码",
@@ -7823,11 +7988,11 @@ export default withEnglishFallback({
     nacosAdvancedDescription: "这些参数均有安全默认值，通常只有自定义部署、指标采集或 r-nacos 扩展能力需要调整。",
     nacosPageSizeHint: "用于配置和服务列表，每页 1–500 条。",
     nacosMetricsHint: "自动使用服务地址查询指标；若指标端点不同，请选择“自定义地址”。",
-    nacosRnacosExtension: "r-nacos 扩展控制台",
-    nacosRnacosExtensionHint: "启用后可使用配置历史、配置描述和禁用实例管理。",
+    nacosRnacosExtension: "r-nacos 控制台功能",
+    nacosRnacosExtensionHint: "控制台地址和凭据用于用户管理、配置详情和禁用实例管理；配置历史由下方开关单独控制。",
     nacosEnabled: "启用",
-    nacosRnacosConsoleUrlHint: "通常为 http://主机:10848。",
-    nacosRnacosDisabledHint: "未启用时仅使用服务地址，基础配置和服务管理仍可用。",
+    nacosRnacosConsoleUrlHint: "通常为 http://主机:10848。r-nacos 用户管理及其他控制台功能需要此地址。",
+    nacosRnacosDisabledHint: "配置历史已禁用；只要配置了控制台地址和凭据，用户管理仍可使用。",
     nacosTlsHint: "仅在使用自签名 HTTPS 证书且确认目标可信时开启。",
     nacosVisibleNamespacesTitle: "选择显示的命名空间",
     nacosVisibleNamespacesDetailLabel: "可见命名空间",
diff --git a/apps/desktop/src/i18n/locales/zh-TW.ts b/apps/desktop/src/i18n/locales/zh-TW.ts
index 697cd2b1d9..12ae6668c2 100644
--- a/apps/desktop/src/i18n/locales/zh-TW.ts
+++ b/apps/desktop/src/i18n/locales/zh-TW.ts
@@ -1,6 +1,7 @@
 import { withEnglishFallback } from "./fallback";
 import docs from "./docs/zh-TW";
 import { consulUiMessages } from "./consulUi";
+import { nacosAccessControlMessages, nacosAccessControlTabs } from "./nacosAccessControl";
 import { sqlServerTraceMessages as sqlServerTrace } from "./sqlServerTraceMessages";
 
 const consul = {
@@ -1368,6 +1369,7 @@ export default withEnglishFallback({
     gridfs: "GridFS",
     etcdDashboard: "etcd 儀表板",
     etcdAccessControl: "etcd 存取控制",
+    ...nacosAccessControlTabs,
   },
   executionSummary: {
     empty: "無摘要",
@@ -5535,6 +5537,8 @@ export default withEnglishFallback({
     runInBackground: "背景執行",
   },
   nacos: {
+    ...nacosAccessControlMessages,
+    accessControlSidebarLabel: "使用者和角色",
     dashboard: "儀表板",
     dashboardTitle: "運行儀表板",
     dashboardUpdatedAt: "更新於 {time}",
@@ -5850,6 +5854,15 @@ export default withEnglishFallback({
     nacosConnectionPlanDescription: "選擇服務實作與 API 版本。",
     nacosServiceAddress: "服務位址",
     nacosServiceAddressHint: "填寫服務位址即可，預設連接埠為 8848，例如 http://host:8848/nacos。",
+    nacosManagedNamespaces: "可管理命名空間 ID",
+    nacosManagedNamespacesPlaceholder: "例如：public, team-a",
+    nacosManagedNamespacesHint: "填寫該一般使用者有權存取的命名空間 ID，支援逗號或換行分隔；連線測試會逐項驗證設定與服務讀取權限。",
+    nacosOrdinaryAccount: "一般使用者",
+    nacosOrdinaryAccountHint: "如果上方填寫的是一般使用者，請開啟此選項並指定該使用者有權限的命名空間，否則連線後將無法正常使用。",
+    nacosManagedNamespacesSeparator: "以逗號或換行分隔",
+    nacosOrdinaryNamespacesRequired: "一般使用者至少需要填寫一個有權管理的命名空間 ID。",
+    nacosManagedNamespacesRequired: "目前的 Nacos 一般使用者無權取得命名空間目錄或權限管理資訊，請填寫至少一個有權管理的命名空間 ID 後重試。",
+    nacosManagedNamespaceAccessDenied: "以下命名空間未通過設定或服務讀取權限驗證：{detail}",
     nacosAuth: "驗證",
     nacosAuthHint: "這些驗證資訊會用於連線測試與日常管理。",
     nacosUsernamePassword: "使用者名稱 / 密碼",
diff --git a/apps/desktop/src/lib/__tests__/connection/nacosConnectionDialog.spec.ts b/apps/desktop/src/lib/__tests__/connection/nacosConnectionDialog.spec.ts
index f6029c92f8..8133478fb4 100644
--- a/apps/desktop/src/lib/__tests__/connection/nacosConnectionDialog.spec.ts
+++ b/apps/desktop/src/lib/__tests__/connection/nacosConnectionDialog.spec.ts
@@ -24,7 +24,13 @@ describe("Nacos connection dialog layout", () => {
     expect(main).toContain('t("nacos.nacosAdvancedHint")');
     expect(main).toContain("@click=\"configTab = 'advanced'\"");
     expect(main).toContain('v-model="nacosServerAddr"');
-    expect(main).not.toContain('v-model="nacosV3ConsoleAddr"');
+    expect(main).toContain('v-model="nacosManagedNamespacesText"');
+    expect(main).toContain('t("nacos.nacosManagedNamespacesHint")');
+    expect(main).toContain("data-nacos-ordinary-user-toggle");
+    expect(main).toContain('v-model="nacosOrdinaryAccount"');
+    expect(main).toContain("nacosAuthKind === 'usernamePassword'");
+    expect(main).toContain("nacosImplementation === 'nacos' && nacosAuthKind === 'usernamePassword'");
+    expect(main).not.toContain("nacosVersionMode === 'v3' && nacosAuthKind === 'usernamePassword'");
     expect(main).not.toContain('v-model="nacosNamespace"');
     expect(main).toContain('t("nacos.nacosAuthHint")');
     expect(main).not.toContain('v-model="nacosMetricsMode"');
@@ -40,8 +46,8 @@ describe("Nacos connection dialog layout", () => {
     expect(advanced).not.toContain("配置上下文路径");
     expect(advanced).toContain('v-model="nacosMetricsMode"');
     expect(advanced).toContain('v-model="nacosRNacosConsoleAddr"');
-    expect(advanced).toContain('v-if="nacosHistoryEnabled"');
-    expect(advanced).toContain('t("nacos.nacosRnacosDisabledHint")');
+    expect(advanced).toContain('v-if="nacosRNacosConsoleAddr.trim()"');
+    expect(advanced).toContain('v-model="nacosHistoryEnabled"');
     expect(advanced).toContain('v-model="nacosTlsSkipVerify"');
     expect(advanced).toContain('v-model.number="nacosPageSize"');
   });
@@ -52,6 +58,7 @@ describe("Nacos connection dialog layout", () => {
     expect(source).not.toContain("DBX 不需要配置该地址");
     const mainStart = source.indexOf("data-nacos-profile-selector");
     const mainEnd = source.indexOf("<!-- Redis: host, port, user, password, ssl -->", mainStart);
+    expect(source.slice(mainStart, mainEnd)).toContain("data-nacos-managed-namespaces");
     expect(source.slice(mainStart, mainEnd)).not.toContain('placeholder="http://127.0.0.1:8080"');
     expect(source).not.toContain("http://127.0.0.1:8010");
     expect(source).not.toContain("http://127.0.0.1:8818");
@@ -60,7 +67,7 @@ describe("Nacos connection dialog layout", () => {
   it("uses a dedicated namespace selector instead of the database selector", () => {
     expect(source).toContain('t("nacos.nacosVisibleNamespacesTitle")');
     expect(source).toContain("openVisibleNacosNamespacesPicker");
-    expect(source).toContain("api.nacosListNamespaces(draftId)");
+    expect(source).toContain("loadReadableNacosNamespaces(draftId, api)");
     expect(source).toContain("showVisibleNacosNamespacesDialog");
   });
 
@@ -68,7 +75,7 @@ describe("Nacos connection dialog layout", () => {
     expect(source).toContain('form.value.db_type === "nacos"');
     expect(source).toContain("production.allNamespaces");
     expect(source).toContain("production.namespacePickerTitle");
-    expect(source).toContain("api.nacosListNamespaces(connectionId)");
+    expect(source).toContain("loadReadableNacosNamespaces(connectionId, api)");
     expect(source).toContain("nacosNamespaceIdentity(name)");
   });
 });
diff --git a/apps/desktop/src/lib/__tests__/nacos/nacosAdmin.spec.ts b/apps/desktop/src/lib/__tests__/nacos/nacosAdmin.spec.ts
index 42fbbfa2f4..8ff654e7ca 100644
--- a/apps/desktop/src/lib/__tests__/nacos/nacosAdmin.spec.ts
+++ b/apps/desktop/src/lib/__tests__/nacos/nacosAdmin.spec.ts
@@ -18,9 +18,11 @@ import {
   isNacosErrorCode,
   isNacosConfigSaveSnapshotCurrent,
   isNacosConfigDeleteSnapshotInScope,
+  mergeNacosNamespacePermissionAssignments,
   nacosConfigFileExtension,
   nacosMetricsCandidates,
   normalizeNacosMetricsUrl,
+  parseNacosManagedNamespaces,
   parseNacosRawBody,
   parseNacosRawQuery,
   normalizeNacosEndpoint,
@@ -79,6 +81,7 @@ describe("nacosAdmin helpers", () => {
     expect(() => normalizeNacosMetricsUrl("http://localhost/metrics#fragment")).toThrow(/fragment/);
     expect(() => normalizeNacosMetricsUrl("http://localhost/metrics#")).toThrow(/fragment/);
   });
+
   it("parses raw query and body text", () => {
     expect(parseNacosRawQuery("?dataId=a&group=DEFAULT_GROUP")).toEqual({ dataId: "a", group: "DEFAULT_GROUP" });
     expect(parseNacosRawQuery("")).toBeUndefined();
@@ -86,6 +89,24 @@ describe("nacosAdmin helpers", () => {
     expect(parseNacosRawBody("plain text")).toBe("plain text");
   });
 
+  it("parses, trims, and deduplicates managed namespace IDs", () => {
+    expect(parseNacosManagedNamespaces(" public, team-a\nteam-a，team-b\n\n")).toEqual(["public", "team-a", "team-b"]);
+    expect(parseNacosManagedNamespaces("  ")).toEqual([]);
+  });
+
+  it("combines split read and write permission rows before role editing", () => {
+    expect(
+      mergeNacosNamespacePermissionAssignments([
+        { actionRaw: "r", parsedScope: { kind: "namespace", namespaceId: "team-a" } },
+        { actionRaw: "w", parsedScope: { kind: "namespace", namespaceId: "team-a" } },
+        { actionRaw: "r", parsedScope: { kind: "namespace", namespaceId: "team-b" } },
+      ]),
+    ).toEqual([
+      { namespaceId: "team-a", action: "rw" },
+      { namespaceId: "team-b", action: "r" },
+    ]);
+  });
+
   it("builds raw requests and detects mutations", () => {
     const req = buildNacosRawRequest("post", " /v1/cs/configs ", "a=1", '{"b":2}');
     expect(req).toEqual({ method: "post", path: "/v1/cs/configs", query: { a: "1" }, body: { b: 2 } });
diff --git a/apps/desktop/src/lib/__tests__/nacos/nacosNamespaceVisibility.spec.ts b/apps/desktop/src/lib/__tests__/nacos/nacosNamespaceVisibility.spec.ts
index 920b53f080..80eaa3e6c4 100644
--- a/apps/desktop/src/lib/__tests__/nacos/nacosNamespaceVisibility.spec.ts
+++ b/apps/desktop/src/lib/__tests__/nacos/nacosNamespaceVisibility.spec.ts
@@ -1,5 +1,5 @@
-import { describe, expect, it } from "vitest";
-import { filterNacosNamespacesForSidebar, normalizeNacosNamespaceSelection, normalizeNacosNamespacesForDisplay } from "@/lib/nacos/nacosNamespaceVisibility";
+import { describe, expect, it, vi } from "vitest";
+import { filterNacosNamespacesForSidebar, loadReadableNacosNamespaces, normalizeNacosNamespaceSelection, normalizeNacosNamespacesForDisplay } from "@/lib/nacos/nacosNamespaceVisibility";
 import { nacosVisibleNamespaceSummary } from "@/lib/sidebar/sidebarVisibleFilterSummary";
 
 const namespaces = [
@@ -41,3 +41,12 @@ describe("filterNacosNamespacesForSidebar", () => {
     });
   });
 });
+
+describe("loadReadableNacosNamespaces", () => {
+  it("uses the backend-filtered list without per-namespace frontend probes", async () => {
+    const nacosListNamespaces = vi.fn().mockResolvedValue([namespaces[1]]);
+
+    await expect(loadReadableNacosNamespaces("nacos", { nacosListNamespaces })).resolves.toEqual([namespaces[1]]);
+    expect(nacosListNamespaces).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/apps/desktop/src/lib/__tests__/sidebar/sidebarConnectionStateFilter.spec.ts b/apps/desktop/src/lib/__tests__/sidebar/sidebarConnectionStateFilter.spec.ts
index de664b2e7c..bd9d0c2408 100644
--- a/apps/desktop/src/lib/__tests__/sidebar/sidebarConnectionStateFilter.spec.ts
+++ b/apps/desktop/src/lib/__tests__/sidebar/sidebarConnectionStateFilter.spec.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { filterSidebarTreeToConnectedConnections } from "@/lib/sidebar/sidebarSearchTree";
+import { filterSidebarTree, filterSidebarTreeToConnectedConnections } from "@/lib/sidebar/sidebarSearchTree";
 import type { TreeNode } from "@/types/database";
 
 function connection(id: string): TreeNode {
@@ -38,3 +38,17 @@ describe("connected sidebar connection filter", () => {
     expect(filterSidebarTreeToConnectedConnections(tree, new Set(["first"]))).toBe(tree);
   });
 });
+
+describe("sidebar tree translated labels", () => {
+  it("matches an application entry by its localized display label", () => {
+    const node: TreeNode = {
+      id: "nacos:nacos-access-control",
+      label: "nacos.accessControlSidebarLabel",
+      type: "nacos-access-control",
+      connectionId: "nacos",
+    };
+
+    expect(filterSidebarTree([node], "Nacos Access Control", new Set(), undefined, () => "Nacos Access Control")).toEqual([node]);
+    expect(filterSidebarTree([node], "Nacos 用户和角色", new Set(), undefined, () => "Nacos 用户和角色")).toEqual([node]);
+  });
+});
diff --git a/apps/desktop/src/lib/__tests__/sidebar/sidebarTreeItemLayout.spec.ts b/apps/desktop/src/lib/__tests__/sidebar/sidebarTreeItemLayout.spec.ts
index ea1ce586b5..18c0f7ef71 100644
--- a/apps/desktop/src/lib/__tests__/sidebar/sidebarTreeItemLayout.spec.ts
+++ b/apps/desktop/src/lib/__tests__/sidebar/sidebarTreeItemLayout.spec.ts
@@ -27,7 +27,9 @@ describe("sidebar tree item layout", () => {
     expect(alignedCommentLeadingWidth(undefined, true)).toBeUndefined();
   });
 
-  it("renders etcd leaf actions without expanders", () => {
+  it("renders navigation leaf actions without expanders", () => {
+    expect(canTreeNodeShowExpander({ type: "nacos-namespace", childCount: 0 })).toBe(false);
+    expect(canTreeNodeShowExpander({ type: "nacos-access-control", childCount: 0 })).toBe(false);
     expect(canTreeNodeShowExpander({ type: "etcd-root", childCount: 0 })).toBe(false);
     expect(canTreeNodeShowExpander({ type: "etcd-dashboard", childCount: 0 })).toBe(false);
     expect(canTreeNodeShowExpander({ type: "etcd-access-control", childCount: 0 })).toBe(false);
diff --git a/apps/desktop/src/lib/__tests__/sidebar/treeNodeClick.spec.ts b/apps/desktop/src/lib/__tests__/sidebar/treeNodeClick.spec.ts
index e706be2cdd..98a26a97f1 100644
--- a/apps/desktop/src/lib/__tests__/sidebar/treeNodeClick.spec.ts
+++ b/apps/desktop/src/lib/__tests__/sidebar/treeNodeClick.spec.ts
@@ -1,5 +1,15 @@
 import { describe, expect, it } from "vitest";
-import { isDirectNavigationTreeNode, objectSourceKindForTreeNode, objectSourceTargetForTreeNode, shouldActivateTreeNodeOnSingleClick, shouldOpenObjectBrowserOnSingleClick, treeNodeRowAction, treeNodeRowDoubleClickAction } from "@/lib/sidebar/treeNodeClick";
+import {
+  isDirectNavigationTreeNode,
+  isRepeatableNavigationTreeNode,
+  objectSourceKindForTreeNode,
+  objectSourceTargetForTreeNode,
+  shouldActivateTreeNodeOnSingleClick,
+  shouldOpenObjectBrowserOnSingleClick,
+  shouldRunTreeNodeRowAction,
+  treeNodeRowAction,
+  treeNodeRowDoubleClickAction,
+} from "@/lib/sidebar/treeNodeClick";
 
 describe("treeNodeClick", () => {
   it("opens synonym nodes as synonym source", () => {
@@ -44,6 +54,20 @@ describe("treeNodeClick", () => {
     expect(treeNodeRowAction("consul-overview", false, "double")).toBe("toggle");
   });
 
+  it("keeps Nacos namespace and access-control navigation responsive during rapid row switching", () => {
+    for (const type of ["nacos-namespace", "nacos-access-control"] as const) {
+      expect(isDirectNavigationTreeNode(type), type).toBe(true);
+      expect(shouldActivateTreeNodeOnSingleClick(type, "double"), type).toBe(true);
+      const action = treeNodeRowAction(type, false, "double");
+      expect(action, type).toBe("toggle");
+      expect(isRepeatableNavigationTreeNode(type), type).toBe(true);
+      expect(shouldRunTreeNodeRowAction(action, 2, isRepeatableNavigationTreeNode(type)), type).toBe(true);
+    }
+
+    expect(isRepeatableNavigationTreeNode("database")).toBe(false);
+    expect(shouldRunTreeNodeRowAction("toggle", 2, false)).toBe(false);
+  });
+
   it("opens the connection database browser only when the capability is enabled", () => {
     expect(treeNodeRowDoubleClickAction("connection", false, "single", true, "postgres", true)).toBe("open-database-browser");
     expect(treeNodeRowDoubleClickAction("connection", false, "double", true, "postgres", false)).toBe("toggle");
diff --git a/apps/desktop/src/lib/backend/api.ts b/apps/desktop/src/lib/backend/api.ts
index 3d63a28a0d..cdd95dd5df 100644
--- a/apps/desktop/src/lib/backend/api.ts
+++ b/apps/desktop/src/lib/backend/api.ts
@@ -357,6 +357,7 @@ export const listSqlFilesInFolder = forward("listSqlFilesInFolder");
 // Nacos
 export const nacosTestConnection = forward("nacosTestConnection");
 export const nacosListNamespaces = forward("nacosListNamespaces");
+export const nacosSidebarSnapshot = forward("nacosSidebarSnapshot");
 export const nacosCreateNamespace = forward("nacosCreateNamespace");
 export const nacosUpdateNamespace = forward("nacosUpdateNamespace");
 export const nacosListConfigs = forward("nacosListConfigs");
@@ -375,6 +376,18 @@ export const nacosGetConfigHistory = forward("nacosGetConfigHistory");
 export const nacosRollbackConfig = forward("nacosRollbackConfig");
 export const nacosGetRNacosConsoleCaptcha = forward("nacosGetRNacosConsoleCaptcha");
 export const nacosLoginRNacosConsole = forward("nacosLoginRNacosConsole");
+export const nacosListUsers = forward("nacosListUsers");
+export const nacosCreateUser = forward("nacosCreateUser");
+export const nacosUpdateUser = forward("nacosUpdateUser");
+export const nacosDeleteUser = forward("nacosDeleteUser");
+export const nacosListRoleBindings = forward("nacosListRoleBindings");
+export const nacosAssignRole = forward("nacosAssignRole");
+export const nacosRemoveRole = forward("nacosRemoveRole");
+export const nacosAccessSnapshot = forward("nacosAccessSnapshot");
+export const nacosStartAccessOperation = forward("nacosStartAccessOperation");
+export const nacosGetAccessOperation = forward("nacosGetAccessOperation");
+export const nacosRetryAccessOperation = forward("nacosRetryAccessOperation");
+export const nacosUndoAccessOperation = forward("nacosUndoAccessOperation");
 export const nacosListServices = forward("nacosListServices");
 export const nacosGetService = forward("nacosGetService");
 export const nacosCreateService = forward("nacosCreateService");
diff --git a/apps/desktop/src/lib/backend/http.ts b/apps/desktop/src/lib/backend/http.ts
index d63c7d35c9..ce487c97dd 100644
--- a/apps/desktop/src/lib/backend/http.ts
+++ b/apps/desktop/src/lib/backend/http.ts
@@ -185,6 +185,17 @@ import type {
   NacosConfigUpsert,
   NacosConnectionInfo,
   NacosRNacosConsoleCaptcha,
+  NacosUserQuery,
+  NacosUserList,
+  NacosUserCreate,
+  NacosUserUpdate,
+  NacosRoleQuery,
+  NacosRoleList,
+  NacosRoleBinding,
+  NacosAccessControlSnapshot,
+  NacosAccessOperationRequest,
+  NacosAccessOperationResult,
+  NacosAccessOperationRetry,
   NacosInstanceInfo,
   NacosInstanceRef,
   NacosInstanceRegistration,
@@ -194,6 +205,7 @@ import type {
   NacosDashboardSnapshot,
   NacosNamespaceCreate,
   NacosNamespaceInfo,
+  NacosNamespaceSidebarSnapshot,
   NacosNamespaceUpdate,
   NacosRawRequest,
   NacosRawResponse,
@@ -3162,6 +3174,10 @@ export async function nacosListNamespaces(connectionId: string): Promise<NacosNa
   return post("/api/nacos/namespaces/list", { connectionId });
 }
 
+export async function nacosSidebarSnapshot(connectionId: string): Promise<NacosNamespaceSidebarSnapshot> {
+  return post("/api/nacos/sidebar/snapshot", { connectionId });
+}
+
 export async function nacosCreateNamespace(connectionId: string, req: NacosNamespaceCreate): Promise<void> {
   return post("/api/nacos/namespaces/create", { connectionId, req });
 }
@@ -3303,6 +3319,54 @@ export async function nacosLoginRNacosConsole(connectionId: string, captcha?: st
   return post("/api/nacos/rnacos-console/login", { connectionId, captcha });
 }
 
+export async function nacosListUsers(connectionId: string, query: NacosUserQuery): Promise<NacosUserList> {
+  return post("/api/nacos/users/list", { connectionId, query });
+}
+
+export async function nacosCreateUser(connectionId: string, req: NacosUserCreate): Promise<void> {
+  return post("/api/nacos/users/create", { connectionId, req });
+}
+
+export async function nacosUpdateUser(connectionId: string, req: NacosUserUpdate): Promise<void> {
+  return post("/api/nacos/users/update", { connectionId, req });
+}
+
+export async function nacosDeleteUser(connectionId: string, username: string): Promise<void> {
+  return post("/api/nacos/users/delete", { connectionId, username });
+}
+
+export async function nacosListRoleBindings(connectionId: string, query: NacosRoleQuery): Promise<NacosRoleList> {
+  return post("/api/nacos/roles/list", { connectionId, query });
+}
+
+export async function nacosAssignRole(connectionId: string, binding: NacosRoleBinding): Promise<void> {
+  return post("/api/nacos/roles/assign", { connectionId, binding });
+}
+
+export async function nacosRemoveRole(connectionId: string, binding: NacosRoleBinding): Promise<void> {
+  return post("/api/nacos/roles/remove", { connectionId, binding });
+}
+
+export async function nacosAccessSnapshot(connectionId: string): Promise<NacosAccessControlSnapshot> {
+  return post("/api/nacos/access/snapshot", { connectionId });
+}
+
+export async function nacosStartAccessOperation(connectionId: string, req: NacosAccessOperationRequest): Promise<NacosAccessOperationResult> {
+  return post("/api/nacos/access/operations/start", { connectionId, req });
+}
+
+export async function nacosGetAccessOperation(connectionId: string, operationId: string): Promise<NacosAccessOperationResult> {
+  return post("/api/nacos/access/operations/get", { connectionId, operationId });
+}
+
+export async function nacosRetryAccessOperation(connectionId: string, retry: NacosAccessOperationRetry): Promise<NacosAccessOperationResult> {
+  return post("/api/nacos/access/operations/retry", { connectionId, retry });
+}
+
+export async function nacosUndoAccessOperation(connectionId: string, operationId: string): Promise<NacosAccessOperationResult> {
+  return post("/api/nacos/access/operations/undo", { connectionId, operationId });
+}
+
 export async function nacosListServices(connectionId: string, query: NacosServiceQuery): Promise<NacosServiceList> {
   return post("/api/nacos/services/list", { connectionId, query });
 }
diff --git a/apps/desktop/src/lib/backend/nacos-tauri.ts b/apps/desktop/src/lib/backend/nacos-tauri.ts
index 975ee0ab26..1495c0d3ea 100644
--- a/apps/desktop/src/lib/backend/nacos-tauri.ts
+++ b/apps/desktop/src/lib/backend/nacos-tauri.ts
@@ -20,6 +20,17 @@ import type {
   NacosDashboardQuery,
   NacosDashboardSnapshot,
   NacosRNacosConsoleCaptcha,
+  NacosUserQuery,
+  NacosUserList,
+  NacosUserCreate,
+  NacosUserUpdate,
+  NacosRoleQuery,
+  NacosRoleList,
+  NacosRoleBinding,
+  NacosAccessControlSnapshot,
+  NacosAccessOperationRequest,
+  NacosAccessOperationResult,
+  NacosAccessOperationRetry,
   NacosInstanceInfo,
   NacosInstanceRef,
   NacosInstanceRegistration,
@@ -27,6 +38,7 @@ import type {
   NacosInstanceUpdateRequest,
   NacosNamespaceCreate,
   NacosNamespaceInfo,
+  NacosNamespaceSidebarSnapshot,
   NacosNamespaceUpdate,
   NacosRawRequest,
   NacosRawResponse,
@@ -45,6 +57,10 @@ export async function nacosListNamespaces(connectionId: string): Promise<NacosNa
   return invoke("nacos_list_namespaces", { connectionId });
 }
 
+export async function nacosSidebarSnapshot(connectionId: string): Promise<NacosNamespaceSidebarSnapshot> {
+  return invoke("nacos_sidebar_snapshot", { connectionId });
+}
+
 export async function nacosCreateNamespace(connectionId: string, req: NacosNamespaceCreate): Promise<void> {
   return invoke("nacos_create_namespace", { connectionId, req });
 }
@@ -121,6 +137,54 @@ export async function nacosLoginRNacosConsole(connectionId: string, captcha?: st
   return invoke("nacos_login_rnacos_console", { connectionId, captcha });
 }
 
+export async function nacosListUsers(connectionId: string, query: NacosUserQuery): Promise<NacosUserList> {
+  return invoke("nacos_list_users", { connectionId, query });
+}
+
+export async function nacosCreateUser(connectionId: string, req: NacosUserCreate): Promise<void> {
+  return invoke("nacos_create_user", { connectionId, req });
+}
+
+export async function nacosUpdateUser(connectionId: string, req: NacosUserUpdate): Promise<void> {
+  return invoke("nacos_update_user", { connectionId, req });
+}
+
+export async function nacosDeleteUser(connectionId: string, username: string): Promise<void> {
+  return invoke("nacos_delete_user", { connectionId, username });
+}
+
+export async function nacosListRoleBindings(connectionId: string, query: NacosRoleQuery): Promise<NacosRoleList> {
+  return invoke("nacos_list_role_bindings", { connectionId, query });
+}
+
+export async function nacosAssignRole(connectionId: string, binding: NacosRoleBinding): Promise<void> {
+  return invoke("nacos_assign_role", { connectionId, binding });
+}
+
+export async function nacosRemoveRole(connectionId: string, binding: NacosRoleBinding): Promise<void> {
+  return invoke("nacos_remove_role", { connectionId, binding });
+}
+
+export async function nacosAccessSnapshot(connectionId: string): Promise<NacosAccessControlSnapshot> {
+  return invoke("nacos_access_snapshot", { connectionId });
+}
+
+export async function nacosStartAccessOperation(connectionId: string, req: NacosAccessOperationRequest): Promise<NacosAccessOperationResult> {
+  return invoke("nacos_start_access_operation", { connectionId, req });
+}
+
+export async function nacosGetAccessOperation(connectionId: string, operationId: string): Promise<NacosAccessOperationResult> {
+  return invoke("nacos_get_access_operation", { connectionId, operationId });
+}
+
+export async function nacosRetryAccessOperation(connectionId: string, retry: NacosAccessOperationRetry): Promise<NacosAccessOperationResult> {
+  return invoke("nacos_retry_access_operation", { connectionId, retry });
+}
+
+export async function nacosUndoAccessOperation(connectionId: string, operationId: string): Promise<NacosAccessOperationResult> {
+  return invoke("nacos_undo_access_operation", { connectionId, operationId });
+}
+
 export async function nacosListServices(connectionId: string, query: NacosServiceQuery): Promise<NacosServiceList> {
   return invoke("nacos_list_services", { connectionId, query });
 }
diff --git a/apps/desktop/src/lib/nacos/nacosAdmin.ts b/apps/desktop/src/lib/nacos/nacosAdmin.ts
index eae21668ce..7a3f70c4cb 100644
--- a/apps/desktop/src/lib/nacos/nacosAdmin.ts
+++ b/apps/desktop/src/lib/nacos/nacosAdmin.ts
@@ -1,4 +1,4 @@
-import type { NacosConfigHistoryItem, NacosConfigItem, NacosConfigKey, NacosContentMatch, NacosImplementation, NacosInstanceInfo, NacosRawRequest, NacosServiceInfo, NacosVersionMode } from "@/types/nacos";
+import type { NacosConfigHistoryItem, NacosConfigItem, NacosConfigKey, NacosContentMatch, NacosImplementation, NacosInstanceInfo, NacosPermissionInfo, NacosRawRequest, NacosServiceInfo, NacosVersionMode } from "@/types/nacos";
 import { diffArrays, diffChars } from "diff";
 
 export type NacosRawTemplateKey = "serverState" | "namespaceList" | "configDetail" | "serviceList" | "instanceList";
@@ -162,6 +162,43 @@ export function parseNacosRawQuery(text: string): Record<string, string> | undef
   return Object.fromEntries(new URLSearchParams(trimmed).entries());
 }
 
+export function parseNacosManagedNamespaces(text: string): string[] {
+  return [
+    ...new Set(
+      text
+        .split(/[\n,，]+/)
+        .map((value) => value.trim())
+        .filter(Boolean),
+    ),
+  ];
+}
+
+export type NacosNamespacePermissionAction = "r" | "w" | "rw";
+
+export interface NacosNamespacePermissionAssignment {
+  namespaceId: string;
+  action: NacosNamespacePermissionAction;
+}
+
+/**
+ * The Nacos permission table may store read and write as separate rows for the
+ * same role and namespace. The editor exposes one assignment per namespace, so
+ * combine those rows before populating the form to avoid dropping either half
+ * when an unchanged role is saved.
+ */
+export function mergeNacosNamespacePermissionAssignments(permissions: Pick<NacosPermissionInfo, "actionRaw" | "parsedScope">[]): NacosNamespacePermissionAssignment[] {
+  const assignments = new Map<string, NacosNamespacePermissionAction>();
+  for (const permission of permissions) {
+    const namespaceId = permission.parsedScope?.namespaceId;
+    if (!namespaceId || !["r", "w", "rw"].includes(permission.actionRaw)) continue;
+    const current = assignments.get(namespaceId);
+    const readable = current?.includes("r") || permission.actionRaw.includes("r");
+    const writable = current?.includes("w") || permission.actionRaw.includes("w");
+    assignments.set(namespaceId, readable && writable ? "rw" : readable ? "r" : "w");
+  }
+  return [...assignments].map(([namespaceId, action]) => ({ namespaceId, action }));
+}
+
 export function parseNacosRawBody(text: string): unknown {
   const trimmed = text.trim();
   if (!trimmed) return undefined;
diff --git a/apps/desktop/src/lib/nacos/nacosNamespaceVisibility.ts b/apps/desktop/src/lib/nacos/nacosNamespaceVisibility.ts
index e129bd8dd8..a7c1f29f02 100644
--- a/apps/desktop/src/lib/nacos/nacosNamespaceVisibility.ts
+++ b/apps/desktop/src/lib/nacos/nacosNamespaceVisibility.ts
@@ -1,5 +1,14 @@
 import type { NacosNamespaceInfo } from "@/types/nacos";
 
+type NacosNamespaceAccessClient = {
+  nacosListNamespaces(connectionId: string): Promise<NacosNamespaceInfo[]>;
+};
+
+/** The backend applies account authorization or an explicitly configured namespace scope. */
+export async function loadReadableNacosNamespaces(connectionId: string, client: NacosNamespaceAccessClient): Promise<NacosNamespaceInfo[]> {
+  return normalizeNacosNamespacesForDisplay(await client.nacosListNamespaces(connectionId));
+}
+
 /**
  * Nacos 2/r-nacos may represent the default namespace with an empty ID, while
  * Nacos 3 returns the concrete `public` ID. Older backend builds could expose
diff --git a/apps/desktop/src/lib/sidebar/sidebarActiveTabTarget.ts b/apps/desktop/src/lib/sidebar/sidebarActiveTabTarget.ts
index 1e335dcf0e..59840cb9bb 100644
--- a/apps/desktop/src/lib/sidebar/sidebarActiveTabTarget.ts
+++ b/apps/desktop/src/lib/sidebar/sidebarActiveTabTarget.ts
@@ -48,6 +48,10 @@ export type ActiveTabSidebarTarget =
       type: "etcd-access-control";
       connectionId: string;
     }
+  | {
+      type: "nacos-access-control";
+      connectionId: string;
+    }
   | {
       type: "zookeeper-root";
       connectionId: string;
@@ -161,6 +165,10 @@ export function activeTabSidebarTarget(tab: QueryTab | undefined | null): Active
     return { type: "etcd-access-control", connectionId: tab.connectionId };
   }
 
+  if (tab.mode === "nacos-access-control") {
+    return { type: "nacos-access-control", connectionId: tab.connectionId };
+  }
+
   if (tab.mode === "zookeeper") {
     return { type: "zookeeper-root", connectionId: tab.connectionId };
   }
@@ -252,6 +260,10 @@ export function matchesTarget(node: TreeNode, target: ActiveTabSidebarTarget): b
     return node.type === "etcd-access-control" && node.connectionId === target.connectionId;
   }
 
+  if (target.type === "nacos-access-control") {
+    return node.type === "nacos-access-control" && node.connectionId === target.connectionId;
+  }
+
   if (target.type === "zookeeper-root") {
     return node.type === "zookeeper-root" && node.connectionId === target.connectionId;
   }
diff --git a/apps/desktop/src/lib/sidebar/sidebarSearchTree.ts b/apps/desktop/src/lib/sidebar/sidebarSearchTree.ts
index 3c63736063..5f5bd366aa 100644
--- a/apps/desktop/src/lib/sidebar/sidebarSearchTree.ts
+++ b/apps/desktop/src/lib/sidebar/sidebarSearchTree.ts
@@ -15,12 +15,12 @@ function bestMatch(matchLabel: SidebarLabelMatcher, label: string, comment?: str
   return best;
 }
 
-function normalizedLabel(node: TreeNode): string {
+function normalizedLabel(node: TreeNode, resolveLabel?: (node: TreeNode) => string): string {
   // Keep the original case. The matcher lowercases internally for comparison;
   // preserving case here lets it tokenize camelCase labels ("camelCaseTable"
   // -> "camel" | "Case" | "Table") instead of treating them as one lowercase
   // blob.
-  return node.label;
+  return resolveLabel?.(node) ?? node.label;
 }
 
 function findNodePath(nodes: readonly TreeNode[], targetNodeId: string, ancestors: readonly TreeNode[] = []): readonly TreeNode[] | undefined {
@@ -53,10 +53,18 @@ export function resolveSidebarObjectSearchFilter(nodes: readonly TreeNode[], tar
   return preservesSubtree ? "" : query;
 }
 
-export function filterSidebarTree(nodes: TreeNode[], query: string, collapsedIds: ReadonlySet<string>, searchableNodeTypes?: ReadonlySet<TreeNodeType>, options?: SidebarSearchMatcherOptions): TreeNode[] {
-  const matchLabel = query ? createSidebarLabelMatcher(query, options) : undefined;
+export interface SidebarTreeSearchMatcherOptions extends SidebarSearchMatcherOptions {
+  resolveLabel?: (node: TreeNode) => string;
+}
+
+export function filterSidebarTree(nodes: TreeNode[], query: string, collapsedIds: ReadonlySet<string>, searchableNodeTypes?: ReadonlySet<TreeNodeType>, options?: SidebarTreeSearchMatcherOptions | ((node: TreeNode) => string)): TreeNode[] {
+  // Accept the pre-regex label resolver form as well as the options object so
+  // callers can use localized synthetic labels without losing regex matching.
+  const resolveLabel = typeof options === "function" ? options : options?.resolveLabel;
+  const matcherOptions = typeof options === "function" ? undefined : options;
+  const matchLabel = query ? createSidebarLabelMatcher(query, matcherOptions) : undefined;
   if (!matchLabel && searchableNodeTypes === undefined) return nodes;
-  return filterSidebarTreeWithMatcher(nodes, matchLabel, collapsedIds, searchableNodeTypes);
+  return filterSidebarTreeWithMatcher(nodes, matchLabel, collapsedIds, searchableNodeTypes, resolveLabel);
 }
 
 export function reuseLiveSidebarTreeNodes(indexedNodes: TreeNode[], liveNodes: readonly TreeNode[]): TreeNode[] {
@@ -312,7 +320,7 @@ function preservedSearchChildren(node: TreeNode, collapsedIds: ReadonlySet<strin
   return node.children.filter((child) => !hiddenSearchNodeTypes.has(child.type)).map((child) => applySearchCollapsedState(child, collapsedIds));
 }
 
-function filterSidebarTreeWithMatcher(nodes: TreeNode[], matchLabel: SidebarLabelMatcher | undefined, collapsedIds: ReadonlySet<string>, searchableNodeTypes?: ReadonlySet<TreeNodeType>): TreeNode[] {
+function filterSidebarTreeWithMatcher(nodes: TreeNode[], matchLabel: SidebarLabelMatcher | undefined, collapsedIds: ReadonlySet<string>, searchableNodeTypes?: ReadonlySet<TreeNodeType>, resolveLabel?: (node: TreeNode) => string): TreeNode[] {
   const filteredNodes: { node: TreeNode; score: number }[] = [];
 
   for (const node of nodes) {
@@ -320,7 +328,7 @@ function filterSidebarTreeWithMatcher(nodes: TreeNode[], matchLabel: SidebarLabe
     if (node.type === "object-browser" && node.hiddenChildren) {
       const matches = node.hiddenChildren.flatMap((child) => {
         if (searchableNodeTypes && !searchableNodeTypes.has(child.type)) return [];
-        const match = matchLabel?.(normalizedLabel(child));
+        const match = matchLabel?.(normalizedLabel(child, resolveLabel));
         if (matchLabel && !match) return [];
         return [{ node: child, score: match?.score ?? 0 }];
       });
@@ -328,7 +336,7 @@ function filterSidebarTreeWithMatcher(nodes: TreeNode[], matchLabel: SidebarLabe
       continue;
     }
 
-    const label = normalizedLabel(node);
+    const label = normalizedLabel(node, resolveLabel);
     const canSelfMatch = !searchableNodeTypes || searchableNodeTypes.has(node.type);
     const selfMatch = canSelfMatch ? (matchLabel ? bestMatch(matchLabel, label, node.comment, node.searchAliases) : { score: 0 }) : null;
     // Type-only filtering keeps matching rows and their ancestor path, but not
@@ -340,7 +348,7 @@ function filterSidebarTreeWithMatcher(nodes: TreeNode[], matchLabel: SidebarLabe
     // Connection utility entries are synthetic navigation actions, not schema
     // search results. Keep real loaded descendants for connection-name matches,
     // but do not let those actions make a disconnected result look expanded.
-    const filteredChildren = preservesSubtree ? preservedSearchChildren(node, collapsedIds) : node.children ? filterSidebarTreeWithMatcher(node.children, matchLabel, collapsedIds, searchableNodeTypes) : undefined;
+    const filteredChildren = preservesSubtree ? preservedSearchChildren(node, collapsedIds) : node.children ? filterSidebarTreeWithMatcher(node.children, matchLabel, collapsedIds, searchableNodeTypes, resolveLabel) : undefined;
 
     if (selfMatch || (filteredChildren && filteredChildren.length > 0)) {
       if (!node.children || preservesTypeMatchedTable) {
diff --git a/apps/desktop/src/lib/sidebar/sidebarTreeItemLayout.ts b/apps/desktop/src/lib/sidebar/sidebarTreeItemLayout.ts
index 9878e80405..33b47f48c1 100644
--- a/apps/desktop/src/lib/sidebar/sidebarTreeItemLayout.ts
+++ b/apps/desktop/src/lib/sidebar/sidebarTreeItemLayout.ts
@@ -20,6 +20,8 @@ const leafTypes: Set<TreeNodeType> = new Set([
   "etcd-root",
   "etcd-dashboard",
   "etcd-access-control",
+  "nacos-namespace",
+  "nacos-access-control",
   "zookeeper-root",
   "consul-root",
   "consul-overview",
diff --git a/apps/desktop/src/lib/sidebar/treeNodeClick.ts b/apps/desktop/src/lib/sidebar/treeNodeClick.ts
index 651acaca26..3c628a07cb 100644
--- a/apps/desktop/src/lib/sidebar/treeNodeClick.ts
+++ b/apps/desktop/src/lib/sidebar/treeNodeClick.ts
@@ -16,6 +16,8 @@ const toggleLeafNodeTypes = new Set<TreeNodeType>([
   "etcd-root",
   "etcd-dashboard",
   "etcd-access-control",
+  "nacos-namespace",
+  "nacos-access-control",
   "zookeeper-root",
   "consul-root",
   "consul-overview",
@@ -31,12 +33,17 @@ const toggleLeafNodeTypes = new Set<TreeNodeType>([
 // These are application entry points rather than database objects. They should
 // always navigate on a single click, even when the user prefers double-click
 // activation for ordinary tree objects.
-const directNavigationTreeNodeTypes = new Set<TreeNodeType>(["consul-root", "consul-overview"]);
+const directNavigationTreeNodeTypes = new Set<TreeNodeType>(["consul-root", "consul-overview", "nacos-namespace", "nacos-access-control"]);
+const repeatableNavigationTreeNodeTypes = new Set<TreeNodeType>(["nacos-namespace", "nacos-access-control"]);
 
 export function isDirectNavigationTreeNode(type: TreeNodeType): boolean {
   return directNavigationTreeNodeTypes.has(type);
 }
 
+export function isRepeatableNavigationTreeNode(type: TreeNodeType): boolean {
+  return repeatableNavigationTreeNodeTypes.has(type);
+}
+
 export function shouldActivateTreeNodeOnSingleClick(type: TreeNodeType, activation: SidebarActivation = "single"): boolean {
   return activation !== "double" || isDirectNavigationTreeNode(type);
 }
diff --git a/apps/desktop/src/lib/sidebar/treeNodeIcon.ts b/apps/desktop/src/lib/sidebar/treeNodeIcon.ts
index dbe37760f1..70cbd30a6d 100644
--- a/apps/desktop/src/lib/sidebar/treeNodeIcon.ts
+++ b/apps/desktop/src/lib/sidebar/treeNodeIcon.ts
@@ -33,6 +33,7 @@ export function getTreeNodeIconInfo(node: TreeNode): TreeNodeIconInfo | null {
       return { icon: FolderOpen, colorClass: "text-sky-500" };
     case "etcd-dashboard":
       return { icon: Gauge, colorClass: "text-sky-500" };
+    case "nacos-access-control":
     case "etcd-access-control":
       return { icon: ShieldCheck, colorClass: "text-sky-500" };
     case "zookeeper-root":
diff --git a/apps/desktop/src/lib/tabs/tabPresentation.ts b/apps/desktop/src/lib/tabs/tabPresentation.ts
index 5d3b808abe..1c463c15ab 100644
--- a/apps/desktop/src/lib/tabs/tabPresentation.ts
+++ b/apps/desktop/src/lib/tabs/tabPresentation.ts
@@ -115,6 +115,10 @@ export function tabDisplayTitle(tab: QueryTab, t: Translate): string {
     if (compact) return connectionDisplayName(tab.connectionId);
     return `${connectionDisplayName(tab.connectionId)}@${t("tabs.etcdAccessControl")}`;
   }
+  if (tab.mode === "nacos-access-control") {
+    if (compact) return connectionDisplayName(tab.connectionId);
+    return `${connectionDisplayName(tab.connectionId)}@${t("tabs.nacosAccessControl")}`;
+  }
   if (tab.mode === "zookeeper") {
     if (compact) return connectionDisplayName(tab.connectionId);
     return `${connectionDisplayName(tab.connectionId)}@keys`;
@@ -440,6 +444,7 @@ export function tabModeLabel(tab: QueryTab, t: Translate): string {
   if (tab.mode === "etcd") return t("tabs.etcd");
   if (tab.mode === "etcd-dashboard") return t("tabs.etcdDashboard");
   if (tab.mode === "etcd-access-control") return t("tabs.etcdAccessControl");
+  if (tab.mode === "nacos-access-control") return t("tabs.nacosAccessControl");
   if (tab.mode === "zookeeper") return t("tabs.zookeeper");
   if (tab.mode === "consul") return t("tabs.consul");
   if (tab.mode === "consul-overview") return t("consul.ui.overview");
diff --git a/apps/desktop/src/stores/__tests__/connectionStore.nacosNamespaceAccess.spec.ts b/apps/desktop/src/stores/__tests__/connectionStore.nacosNamespaceAccess.spec.ts
new file mode 100644
index 0000000000..1c61a5d322
--- /dev/null
+++ b/apps/desktop/src/stores/__tests__/connectionStore.nacosNamespaceAccess.spec.ts
@@ -0,0 +1,102 @@
+import { createPinia, setActivePinia } from "pinia";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { ConnectionConfig, TreeNode } from "@/types/database";
+
+function installLocalStorage() {
+  const data = new Map<string, string>();
+  vi.stubGlobal("localStorage", {
+    getItem: vi.fn((key: string) => data.get(key) ?? null),
+    setItem: vi.fn((key: string, value: string) => data.set(key, value)),
+    removeItem: vi.fn((key: string) => data.delete(key)),
+  });
+}
+
+describe("connectionStore Nacos namespace access", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.unstubAllGlobals();
+    installLocalStorage();
+    setActivePinia(createPinia());
+  });
+
+  async function loadNacosTree(listUsersSupported: boolean, listRoleBindingsSupported = false) {
+    const connection = {
+      id: "nacos-bb",
+      name: "Nacos bb",
+      db_type: "nacos",
+      host: "127.0.0.1",
+      port: 8848,
+      username: "bb",
+      password: "secret",
+      database: "",
+      visible_databases: ["aa", "bb", "cc", ""],
+    } as ConnectionConfig;
+    // The backend has already removed `bb` and `public`, which the restricted
+    // account cannot read even when the server's raw list endpoint exposes them.
+    const readableNamespaces = ["aa", "cc"].map((namespace) => ({
+      namespace,
+      namespaceShowName: namespace || "public",
+    }));
+    const nacosListConfigs = vi.fn();
+    const nacosSidebarSnapshot = vi.fn().mockResolvedValue({
+      namespaces: readableNamespaces,
+      accessControl: {
+        listUsers: { supported: listUsersSupported },
+        listRoleBindings: { supported: listRoleBindingsSupported },
+      },
+    });
+
+    vi.doMock("@/lib/backend/tauriRuntime", () => ({ isTauriRuntime: () => false }));
+    vi.doMock("@/lib/backend/api", () => ({
+      checkConnectionHealth: vi.fn().mockResolvedValue(undefined),
+      deleteSchemaCachePrefix: vi.fn().mockResolvedValue(undefined),
+      listInstalledAgents: vi.fn().mockResolvedValue([]),
+      loadSchemaCache: vi.fn().mockResolvedValue(null),
+      nacosListConfigs,
+      nacosSidebarSnapshot,
+      saveConnections: vi.fn().mockResolvedValue(undefined),
+      saveSchemaCache: vi.fn().mockResolvedValue(undefined),
+      saveSidebarLayout: vi.fn().mockResolvedValue(undefined),
+    }));
+
+    const { useConnectionStore } = await import("@/stores/connectionStore");
+    const store = useConnectionStore();
+    const root: TreeNode = {
+      id: connection.id,
+      label: connection.name,
+      type: "connection",
+      connectionId: connection.id,
+      isExpanded: false,
+      children: [],
+    };
+    store.connections = [connection];
+    store.treeNodes = [root];
+    store.connectedIds.add(connection.id);
+
+    await store.loadNacosNamespaces(connection.id, { force: true });
+
+    return { root, store, nacosListConfigs, nacosSidebarSnapshot };
+  }
+
+  it("hides unreadable namespaces without adding per-namespace sidebar requests", async () => {
+    const { root, store, nacosListConfigs, nacosSidebarSnapshot } = await loadNacosTree(false);
+
+    expect(nacosListConfigs).not.toHaveBeenCalled();
+    expect(nacosSidebarSnapshot).toHaveBeenCalledTimes(1);
+    expect(root.children?.filter((node) => node.type === "nacos-namespace").map((node) => node.label)).toEqual(["aa", "cc"]);
+    expect(store.getSidebarVisibleFilterSummary("nacos-bb")).toEqual({ mode: "namespace", isActive: false, selected: 2, total: 2 });
+    expect(root.children?.some((node) => node.type === "nacos-access-control")).toBe(false);
+  });
+
+  it("shows access control when the current account can list users", async () => {
+    const { root } = await loadNacosTree(true);
+
+    expect(root.children?.find((node) => node.type === "nacos-access-control")?.label).toBe("nacos.accessControlSidebarLabel");
+  });
+
+  it("shows access control for a roles-only account", async () => {
+    const { root } = await loadNacosTree(false, true);
+
+    expect(root.children?.find((node) => node.type === "nacos-access-control")?.label).toBe("nacos.accessControlSidebarLabel");
+  });
+});
diff --git a/apps/desktop/src/stores/__tests__/connectionStore.timeout.spec.ts b/apps/desktop/src/stores/__tests__/connectionStore.timeout.spec.ts
index d44b990663..c60a605b82 100644
--- a/apps/desktop/src/stores/__tests__/connectionStore.timeout.spec.ts
+++ b/apps/desktop/src/stores/__tests__/connectionStore.timeout.spec.ts
@@ -67,6 +67,32 @@ describe("connectionStore timeout recovery", () => {
     expect(store.connectedIds.has(connection.id)).toBe(true);
   }, 10_000);
 
+  it("does not block pure navigation on a connected health check", async () => {
+    const checkConnectionHealth = vi.fn(() => new Promise(() => undefined));
+    const connectDb = vi.fn().mockResolvedValue(undefined);
+
+    vi.doMock("@/lib/backend/tauriRuntime", () => ({ isTauriRuntime: () => false }));
+    vi.doMock("@/lib/backend/api", () => ({
+      checkConnectionHealth,
+      connectDb,
+      deleteSchemaCachePrefix: vi.fn().mockResolvedValue(undefined),
+      saveConnections: vi.fn().mockResolvedValue(undefined),
+      saveSidebarLayout: vi.fn().mockResolvedValue(undefined),
+    }));
+
+    const { useConnectionStore } = await import("@/stores/connectionStore");
+    const store = useConnectionStore();
+    const connection = postgresConnection();
+    store.connections = [connection];
+    store.connectedIds.add(connection.id);
+
+    await store.ensureConnected(connection.id, { verifyHealth: false });
+
+    expect(checkConnectionHealth).not.toHaveBeenCalled();
+    expect(connectDb).not.toHaveBeenCalled();
+    expect(store.connectedIds.has(connection.id)).toBe(true);
+  });
+
   it("normalizes missing keepalive interval to 30 seconds", async () => {
     vi.doMock("@/lib/backend/tauriRuntime", () => ({ isTauriRuntime: () => false }));
     vi.doMock("@/lib/backend/api", () => ({
diff --git a/apps/desktop/src/stores/connectionStore.ts b/apps/desktop/src/stores/connectionStore.ts
index 87d1913df1..d190a39011 100644
--- a/apps/desktop/src/stores/connectionStore.ts
+++ b/apps/desktop/src/stores/connectionStore.ts
@@ -3370,8 +3370,12 @@ export const useConnectionStore = defineStore("connection", () => {
     invalidateObjectBrowserRowsCache({ connectionId, database });
   }
 
-  async function ensureConnected(connectionId: string, options: { activate?: boolean } = {}) {
+  async function ensureConnected(connectionId: string, options: { activate?: boolean; verifyHealth?: boolean } = {}) {
     if (connectedIds.value.has(connectionId)) {
+      // Pure navigation can safely trust the existing connected state. Its
+      // destination will perform the real API request, while blocking here on
+      // a health probe makes an otherwise local tab switch take up to 5s.
+      if (options.verifyHealth === false) return;
       if (hasRecentConnectionHealthCheck(connectionId)) return;
       // Optimistic: verify backend pool is actually healthy
       try {
@@ -4067,7 +4071,8 @@ export const useConnectionStore = defineStore("connection", () => {
       load = reclaimTreeNodeLoad(load, node);
       if (useCachedChildren(node, options, load)) return;
 
-      const namespaces = normalizeNacosNamespacesForDisplay(await api.nacosListNamespaces(connectionId));
+      const sidebarSnapshot = await api.nacosSidebarSnapshot(connectionId);
+      const namespaces = normalizeNacosNamespacesForDisplay(sidebarSnapshot.namespaces);
       const visibleNamespaces = filterNacosNamespacesForSidebar(namespaces, getConfig(connectionId)?.visible_databases);
       const sorted = [...visibleNamespaces].sort((left, right) => {
         const leftLabel = left.namespaceShowName || left.namespace || "public";
@@ -4080,9 +4085,8 @@ export const useConnectionStore = defineStore("connection", () => {
         connectionId,
         namespaces.map((namespace) => namespace.namespace),
       );
-      setChildren(
-        targetNode,
-        sorted.map((namespace) => {
+      const children: TreeNode[] = [
+        ...sorted.map((namespace) => {
           const value = namespace.namespace || "";
           const label = namespace.namespaceShowName || value || "public";
           return {
@@ -4096,7 +4100,19 @@ export const useConnectionStore = defineStore("connection", () => {
             objectCount: namespace.configCount,
           };
         }),
-      );
+      ];
+      if (sidebarSnapshot.accessControl.listUsers.supported === true || sidebarSnapshot.accessControl.listRoleBindings.supported === true) {
+        children.push({
+          id: `${connectionId}:nacos-access-control`,
+          label: "nacos.accessControlSidebarLabel",
+          type: "nacos-access-control" as const,
+          connectionId,
+          database: "",
+          isExpanded: false,
+          children: [],
+        });
+      }
+      setChildren(targetNode, children);
       targetNode.isExpanded = true;
     } catch (e) {
       recordMetadataLoadError(connectionId, e, load);
diff --git a/apps/desktop/src/types/database.ts b/apps/desktop/src/types/database.ts
index adf4d03eeb..9a7639b609 100644
--- a/apps/desktop/src/types/database.ts
+++ b/apps/desktop/src/types/database.ts
@@ -939,6 +939,7 @@ export type TreeNodeType =
   | "redis-db"
   | "mq-tenant"
   | "nacos-namespace"
+  | "nacos-access-control"
   | "etcd-root"
   | "etcd-dashboard"
   | "etcd-access-control"
@@ -1182,6 +1183,7 @@ export interface QueryTab {
     | "mqtt"
     | "nacos"
     | "nacos-dashboard"
+    | "nacos-access-control"
     | "databases"
     | "objects"
     | "structure"
diff --git a/apps/desktop/src/types/nacos.ts b/apps/desktop/src/types/nacos.ts
index 785d7ed719..0d55a9cf79 100644
--- a/apps/desktop/src/types/nacos.ts
+++ b/apps/desktop/src/types/nacos.ts
@@ -8,6 +8,26 @@ export interface NacosCapabilities {
   /** Naming capabilities are intentionally granular: servers such as r-nacos
    * can expose discovery reads without supporting the official write APIs. */
   serviceManagement?: NacosServiceCapabilities;
+  accessControl?: NacosAccessControlCapabilities;
+}
+
+export type NacosAccessControlMode = "unavailable" | "roleBindings" | "embeddedRoles";
+
+export interface NacosAccessControlCapabilities {
+  mode: NacosAccessControlMode;
+  listUsers: NacosOperationCapability;
+  createUser: NacosOperationCapability;
+  updateUser: NacosOperationCapability;
+  deleteUser: NacosOperationCapability;
+  listRoleBindings: NacosOperationCapability;
+  assignRole: NacosOperationCapability;
+  removeRole: NacosOperationCapability;
+  listPermissions: NacosOperationCapability;
+  grantPermission: NacosOperationCapability;
+  revokePermission: NacosOperationCapability;
+  /** All read endpoints required by the directory-detail workspace are available. */
+  enhancedWorkspace: boolean;
+  supportsNamespacePrivileges: boolean;
 }
 
 export interface NacosServiceCapabilities {
@@ -22,7 +42,7 @@ export interface NacosServiceCapabilities {
   deregisterInstance: NacosOperationCapability;
 }
 
-export type NacosCapabilityReason = "implementationReadOnly" | "versionUnsupported" | "endpointUnavailable" | "notVerified" | "connectionReadOnly";
+export type NacosCapabilityReason = "implementationReadOnly" | "versionUnsupported" | "endpointUnavailable" | "notVerified" | "connectionReadOnly" | "permissionDenied";
 
 export interface NacosOperationCapability {
   supported: boolean;
@@ -44,6 +64,149 @@ export interface NacosRNacosConsoleCaptcha {
   image?: string;
 }
 
+export interface NacosNamespacePrivilege {
+  enabled: boolean;
+  whitelistIsAll: boolean;
+  whitelist: string[];
+  blacklistIsAll: boolean;
+  blacklist: string[];
+}
+
+export interface NacosUserQuery {
+  username?: string;
+  pageNo?: number;
+  pageSize?: number;
+}
+
+export interface NacosUserInfo {
+  username: string;
+  nickname?: string;
+  enabled?: boolean;
+  roles: string[];
+  namespacePrivilege?: NacosNamespacePrivilege;
+  source?: string;
+}
+
+export interface NacosUserList {
+  pageNo: number;
+  pageSize: number;
+  totalCount: number;
+  items: NacosUserInfo[];
+}
+
+export interface NacosUserCreate {
+  username: string;
+  password: string;
+  nickname?: string;
+  enabled?: boolean;
+  roles: string[];
+  namespacePrivilege?: NacosNamespacePrivilege;
+}
+
+export interface NacosUserUpdate {
+  username: string;
+  password?: string;
+  nickname?: string;
+  enabled?: boolean;
+  roles?: string[];
+  namespacePrivilege?: NacosNamespacePrivilege;
+}
+
+export interface NacosRoleQuery {
+  username?: string;
+  role?: string;
+  pageNo?: number;
+  pageSize?: number;
+}
+
+export interface NacosRoleBinding {
+  username: string;
+  role: string;
+}
+
+export interface NacosRoleList {
+  pageNo: number;
+  pageSize: number;
+  totalCount: number;
+  items: NacosRoleBinding[];
+}
+
+export type NacosPermissionScopeKind = "namespace" | "global" | "custom" | "unknown";
+
+export interface NacosPermissionScope {
+  kind: NacosPermissionScopeKind;
+  namespaceId?: string;
+}
+
+export interface NacosPermissionInfo {
+  role: string;
+  resourceRaw: string;
+  actionRaw: string;
+  parsedScope?: NacosPermissionScope;
+}
+
+export interface NacosRoleSummary {
+  role: string;
+  memberCount: number;
+  permissionCount: number;
+  complete: boolean;
+  administrator: boolean;
+}
+
+export interface NacosAccessControlSnapshot {
+  users: NacosUserInfo[];
+  roleBindings: NacosRoleBinding[];
+  permissions: NacosPermissionInfo[];
+  roles: NacosRoleSummary[];
+  namespaces: NacosNamespaceInfo[];
+  currentUsername?: string;
+}
+
+export interface NacosNewUserDraft {
+  username: string;
+  password: string;
+}
+
+export interface NacosPermissionDraft {
+  namespaceIds: string[];
+  action: "r" | "w" | "rw";
+}
+
+export type NacosAccessOperationRequest =
+  | { kind: "createUser"; username: string; password: string; roles: string[]; confirmation?: string }
+  | { kind: "createRole"; role: string; members: string[]; newUsers: NacosNewUserDraft[]; permissions: NacosPermissionDraft[]; confirmation?: string }
+  | { kind: "updateUserRoles"; username: string; roles: string[]; confirmation?: string }
+  | { kind: "updateRole"; role: string; members: string[]; newUsers: NacosNewUserDraft[]; permissions: NacosPermissionDraft[]; confirmation?: string }
+  | { kind: "deleteUser"; username: string; confirmation?: string }
+  | { kind: "deleteRole"; role: string; confirmation?: string }
+  | { kind: "revokePermission"; permission: NacosPermissionInfo; confirmation?: string };
+
+export type NacosAccessOperationStatus = "running" | "partial" | "succeeded" | "failed" | "undoing" | "undone";
+export type NacosAccessOperationStepStatus = "pending" | "running" | "succeeded" | "failed" | "skipped" | "compensated";
+
+export interface NacosAccessOperationStep {
+  id: string;
+  action: string;
+  target: string;
+  status: NacosAccessOperationStepStatus;
+  retryable: boolean;
+  needsPassword: boolean;
+  message?: string;
+}
+
+export interface NacosAccessOperationResult {
+  operationId: string;
+  status: NacosAccessOperationStatus;
+  steps: NacosAccessOperationStep[];
+  canRetry: boolean;
+  canUndo: boolean;
+}
+
+export interface NacosAccessOperationRetry {
+  operationId: string;
+  credentials: NacosNewUserDraft[];
+}
+
 export interface NacosNamespaceInfo {
   namespace: string;
   namespaceShowName: string;
@@ -53,6 +216,11 @@ export interface NacosNamespaceInfo {
   namespaceType?: number;
 }
 
+export interface NacosNamespaceSidebarSnapshot {
+  namespaces: NacosNamespaceInfo[];
+  accessControl: NacosAccessControlCapabilities;
+}
+
 export interface NacosNamespaceCreate {
   namespaceId?: string;
   namespaceName: string;
@@ -81,6 +249,8 @@ export interface NacosAdminConfig {
   versionMode?: NacosVersionMode;
   serverAddr: string;
   contextPath?: string;
+  /** Namespace IDs used when an official Nacos ordinary user cannot enumerate namespaces or authorization data. */
+  managedNamespaces?: string[];
   rnacosConsoleAddr?: string;
   /** Undefined keeps the legacy behaviour: history is enabled when a console address exists. */
   rnacosHistoryEnabled?: boolean;
diff --git a/crates/dbx-core/src/connection.rs b/crates/dbx-core/src/connection.rs
index abdd6ad7cd..e71d8c21c7 100644
--- a/crates/dbx-core/src/connection.rs
+++ b/crates/dbx-core/src/connection.rs
@@ -2933,6 +2933,11 @@ impl AppState {
 
         let (host, port) = self.connection_host_port(connection_id, config).await?;
         let nacos_config = nacos_config.with_server_endpoint(&host, port)?;
+        let transport_layers = self.resolved_transport_layers(config).await?;
+        if transport_layers.is_empty() {
+            return Ok(nacos_config);
+        }
+
         if nacos_config.rnacos_console_addr.is_empty() {
             return Ok(nacos_config);
         }
@@ -2946,10 +2951,6 @@ impl AppState {
         let console_port = console_url
             .port_or_known_default()
             .ok_or_else(|| "r-nacos console address does not include a port".to_string())?;
-        let transport_layers = self.resolved_transport_layers(config).await?;
-        if transport_layers.is_empty() {
-            return Ok(nacos_config);
-        }
         let console_transport_id = rnacos_console_transport_id(connection_id);
         let local_port = match db::transport_layer_tunnel::start_transport_layers(
             &console_transport_id,
diff --git a/crates/dbx-core/src/nacos/access_control.rs b/crates/dbx-core/src/nacos/access_control.rs
new file mode 100644
index 0000000000..3471373979
--- /dev/null
+++ b/crates/dbx-core/src/nacos/access_control.rs
@@ -0,0 +1,1464 @@
+use std::collections::{BTreeMap, BTreeSet, HashMap};
+use std::sync::{Arc, Mutex, OnceLock, Weak};
+use std::time::{Duration, Instant};
+
+use crate::nacos::port::NacosAdmin;
+use crate::nacos::types::*;
+
+const PAGE_SIZE: u32 = 500;
+const OPERATION_TTL: Duration = Duration::from_secs(30 * 60);
+const ADMIN_ROLE: &str = "ROLE_ADMIN";
+
+#[derive(Clone, Debug)]
+enum StepCommand {
+    CreateUser { username: String },
+    DeleteUser { username: String },
+    DeleteCreatedUser { username: String },
+    AssignRole { username: String, role: String, undo_removal: RoleRemovalMode },
+    RemoveRole { username: String, role: String, mode: RoleRemovalMode },
+    GrantPermission(NacosPermissionInfo),
+    RevokePermission(NacosPermissionInfo),
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum RoleRemovalMode {
+    PreserveRole,
+    DeleteRole,
+}
+
+#[derive(Clone, Copy)]
+enum ExecutionStrategy {
+    ContinueAfterFailure,
+    StopAfterFailure,
+}
+
+fn operation_for_command(command: &StepCommand) -> NacosAccessControlOperation {
+    match command {
+        StepCommand::CreateUser { .. } => NacosAccessControlOperation::CreateUser,
+        StepCommand::DeleteUser { .. } | StepCommand::DeleteCreatedUser { .. } => {
+            NacosAccessControlOperation::DeleteUser
+        }
+        StepCommand::AssignRole { .. } => NacosAccessControlOperation::AssignRole,
+        StepCommand::RemoveRole { .. } => NacosAccessControlOperation::RemoveRole,
+        StepCommand::GrantPermission(_) => NacosAccessControlOperation::GrantPermission,
+        StepCommand::RevokePermission(_) => NacosAccessControlOperation::RevokePermission,
+    }
+}
+
+fn ensure_commands_supported(
+    capabilities: &NacosAccessControlCapabilities,
+    commands: &[StepCommand],
+) -> Result<(), String> {
+    for command in commands {
+        let operation = operation_for_command(command);
+        let capability = capabilities.operation(operation);
+        if !capability.supported {
+            return Err(format!(
+                "NACOS_ERROR[unsupportedOperation]: Nacos access-control operation {operation:?} is unavailable ({:?})",
+                capability.reason.unwrap_or(NacosCapabilityReason::NotVerified)
+            ));
+        }
+    }
+    Ok(())
+}
+
+type OperationPlan = (Vec<StepCommand>, HashMap<String, String>, bool);
+type ValidatedMembers = (Vec<String>, HashMap<String, String>, Vec<StepCommand>);
+
+#[derive(Clone)]
+struct StoredOperation {
+    connection_id: String,
+    connection_fingerprint: String,
+    result: NacosAccessOperationResult,
+    failed: Vec<(usize, StepCommand)>,
+    undo: Vec<StepCommand>,
+    undoable: bool,
+    execution_strategy: ExecutionStrategy,
+    expires_at: Instant,
+}
+
+fn operations() -> &'static Mutex<HashMap<String, StoredOperation>> {
+    static OPERATIONS: OnceLock<Mutex<HashMap<String, StoredOperation>>> = OnceLock::new();
+    OPERATIONS.get_or_init(|| Mutex::new(HashMap::new()))
+}
+
+fn connection_operation_lock(connection_id: &str) -> Arc<tokio::sync::Mutex<()>> {
+    static LOCKS: OnceLock<Mutex<HashMap<String, Weak<tokio::sync::Mutex<()>>>>> = OnceLock::new();
+    let mut locks = LOCKS.get_or_init(|| Mutex::new(HashMap::new())).lock().unwrap_or_else(|error| error.into_inner());
+    locks.retain(|_, lock| lock.strong_count() > 0);
+    if let Some(lock) = locks.get(connection_id).and_then(Weak::upgrade) {
+        return lock;
+    }
+    let lock = Arc::new(tokio::sync::Mutex::new(()));
+    locks.insert(connection_id.to_string(), Arc::downgrade(&lock));
+    lock
+}
+
+fn cleanup_operations(registry: &mut HashMap<String, StoredOperation>) {
+    let now = Instant::now();
+    registry.retain(|_, operation| operation.expires_at > now);
+}
+
+pub async fn load_snapshot(admin: Arc<dyn NacosAdmin>) -> Result<NacosAccessControlSnapshot, String> {
+    let (mut users, role_bindings, permissions, namespaces) = tokio::try_join!(
+        list_all_users(admin.clone()),
+        list_all_role_bindings(admin.clone()),
+        list_all_permissions(admin.clone()),
+        admin.list_namespaces(),
+    )?;
+
+    let mut roles_by_user: BTreeMap<String, Vec<String>> = BTreeMap::new();
+    for binding in &role_bindings {
+        roles_by_user.entry(binding.username.clone()).or_default().push(binding.role.clone());
+    }
+    for user in &mut users {
+        if let Some(roles) = roles_by_user.get_mut(&user.username) {
+            roles.sort();
+            roles.dedup();
+            user.roles = roles.clone();
+        }
+    }
+
+    let mut summaries: BTreeMap<String, NacosRoleSummary> = BTreeMap::new();
+    for binding in &role_bindings {
+        let summary = summaries.entry(binding.role.clone()).or_insert_with(|| role_summary(&binding.role));
+        summary.member_count += 1;
+    }
+    for permission in &permissions {
+        let summary = summaries.entry(permission.role.clone()).or_insert_with(|| role_summary(&permission.role));
+        summary.permission_count += 1;
+    }
+    for summary in summaries.values_mut() {
+        summary.complete = summary.administrator || (summary.member_count > 0 && summary.permission_count > 0);
+    }
+
+    Ok(NacosAccessControlSnapshot {
+        users,
+        role_bindings,
+        permissions,
+        roles: summaries.into_values().collect(),
+        namespaces,
+        current_username: admin.current_username(),
+    })
+}
+
+fn role_summary(role: &str) -> NacosRoleSummary {
+    NacosRoleSummary {
+        role: role.to_string(),
+        member_count: 0,
+        permission_count: 0,
+        complete: false,
+        administrator: role == ADMIN_ROLE,
+    }
+}
+
+async fn list_all_users(admin: Arc<dyn NacosAdmin>) -> Result<Vec<NacosUserInfo>, String> {
+    let mut items = Vec::new();
+    let mut page_no = 1;
+    loop {
+        let page = admin
+            .list_users(NacosUserQuery { username: None, page_no: Some(page_no), page_size: Some(PAGE_SIZE) })
+            .await?;
+        let count = page.items.len();
+        items.extend(page.items);
+        if count < PAGE_SIZE as usize || items.len() as u64 >= page.total_count {
+            break;
+        }
+        page_no += 1;
+    }
+    items.sort_by(|left, right| left.username.cmp(&right.username));
+    items.dedup_by(|left, right| left.username == right.username);
+    Ok(items)
+}
+
+async fn list_all_role_bindings(admin: Arc<dyn NacosAdmin>) -> Result<Vec<NacosRoleBinding>, String> {
+    let mut items = Vec::new();
+    let mut page_no = 1;
+    loop {
+        let page = admin
+            .list_role_bindings(NacosRoleQuery {
+                username: None,
+                role: None,
+                page_no: Some(page_no),
+                page_size: Some(PAGE_SIZE),
+            })
+            .await?;
+        let count = page.items.len();
+        items.extend(page.items);
+        if count < PAGE_SIZE as usize || items.len() as u64 >= page.total_count {
+            break;
+        }
+        page_no += 1;
+    }
+    items.sort_by(|left, right| (&left.role, &left.username).cmp(&(&right.role, &right.username)));
+    items.dedup_by(|left, right| left.role == right.role && left.username == right.username);
+    Ok(items)
+}
+
+async fn list_all_permissions(admin: Arc<dyn NacosAdmin>) -> Result<Vec<NacosPermissionInfo>, String> {
+    let mut items = Vec::new();
+    let mut page_no = 1;
+    loop {
+        let page = admin
+            .list_permissions(NacosPermissionQuery {
+                role: None,
+                resource: None,
+                page_no: Some(page_no),
+                page_size: Some(PAGE_SIZE),
+            })
+            .await?;
+        let count = page.items.len();
+        items.extend(page.items);
+        if count < PAGE_SIZE as usize || items.len() as u64 >= page.total_count {
+            break;
+        }
+        page_no += 1;
+    }
+    items.sort_by(|left, right| {
+        (&left.role, &left.resource_raw, &left.action_raw).cmp(&(&right.role, &right.resource_raw, &right.action_raw))
+    });
+    items.dedup();
+    Ok(items)
+}
+
+pub fn effective_permissions(snapshot: &NacosAccessControlSnapshot, username: &str) -> Vec<NacosEffectivePermission> {
+    let roles: BTreeSet<&str> = snapshot
+        .role_bindings
+        .iter()
+        .filter(|binding| binding.username == username)
+        .map(|binding| binding.role.as_str())
+        .collect();
+    if roles.contains(ADMIN_ROLE) {
+        return vec![NacosEffectivePermission {
+            resource_raw: "*:*:*".to_string(),
+            action: "rw".to_string(),
+            parsed_scope: Some(NacosPermissionScope { kind: NacosPermissionScopeKind::Global, namespace_id: None }),
+            source_roles: vec![ADMIN_ROLE.to_string()],
+        }];
+    }
+
+    let mut grouped: BTreeMap<String, NacosEffectivePermission> = BTreeMap::new();
+    for permission in snapshot.permissions.iter().filter(|permission| roles.contains(permission.role.as_str())) {
+        let entry = grouped.entry(effective_permission_key(permission)).or_insert_with(|| NacosEffectivePermission {
+            resource_raw: permission.resource_raw.clone(),
+            action: permission.action_raw.clone(),
+            parsed_scope: permission.parsed_scope.clone(),
+            source_roles: Vec::new(),
+        });
+        if entry.resource_raw == ":*:*" && permission.resource_raw == "public:*:*" {
+            entry.resource_raw = permission.resource_raw.clone();
+        }
+        entry.action = merge_actions(&entry.action, &permission.action_raw);
+        entry.source_roles.push(permission.role.clone());
+    }
+    for permission in grouped.values_mut() {
+        permission.source_roles.sort();
+        permission.source_roles.dedup();
+    }
+    grouped.into_values().collect()
+}
+
+fn effective_permission_key(permission: &NacosPermissionInfo) -> String {
+    match permission.parsed_scope.as_ref() {
+        Some(scope) if scope.kind == NacosPermissionScopeKind::Namespace => {
+            format!("namespace:{}", scope.namespace_id.as_deref().unwrap_or_default())
+        }
+        _ if matches!(permission.resource_raw.as_str(), ":*:*" | "public:*:*") => "namespace:public".to_string(),
+        _ => format!("raw:{}", permission.resource_raw),
+    }
+}
+
+fn merge_actions(left: &str, right: &str) -> String {
+    if left == right {
+        return left.to_string();
+    }
+    let reads = matches!(left, "r" | "rw") || matches!(right, "r" | "rw");
+    let writes = matches!(left, "w" | "rw") || matches!(right, "w" | "rw");
+    match (reads, writes) {
+        (true, true) => "rw".to_string(),
+        (true, false) => "r".to_string(),
+        (false, true) => "w".to_string(),
+        _ => right.to_string(),
+    }
+}
+
+pub async fn start_operation(
+    connection_id: &str,
+    connection_fingerprint: String,
+    admin: Arc<dyn NacosAdmin>,
+    request: NacosAccessOperationRequest,
+) -> Result<(NacosAccessOperationResult, bool), String> {
+    let operation_lock = connection_operation_lock(connection_id);
+    let _operation_guard = operation_lock.lock().await;
+    let snapshot = load_snapshot(admin.clone()).await?;
+    let execution_strategy = execution_strategy_for_request(&request);
+    let (commands, credentials, undoable) = plan_operation(&snapshot, request)?;
+    let capabilities = admin.refresh_access_control_capabilities().await;
+    ensure_commands_supported(&capabilities, &commands)?;
+    let operation_id = uuid::Uuid::new_v4().to_string();
+    let stored = execute_commands(
+        connection_id,
+        connection_fingerprint,
+        &operation_id,
+        admin,
+        commands,
+        &credentials,
+        undoable,
+        execution_strategy,
+    )
+    .await;
+    let state_changed = stored.result.steps.iter().any(|step| step.status == NacosAccessOperationStepStatus::Succeeded);
+    let result = stored.result.clone();
+    let mut registry = operations().lock().unwrap_or_else(|error| error.into_inner());
+    cleanup_operations(&mut registry);
+    registry.insert(operation_id, stored);
+    Ok((result, state_changed))
+}
+
+fn execution_strategy_for_request(request: &NacosAccessOperationRequest) -> ExecutionStrategy {
+    match request {
+        // Compound workflows are deliberately ordered. Once a prerequisite
+        // fails, later commands must remain retryable instead of executing
+        // against a partially updated role or user.
+        NacosAccessOperationRequest::CreateUser { .. }
+        | NacosAccessOperationRequest::CreateRole { .. }
+        | NacosAccessOperationRequest::UpdateUserRoles { .. }
+        | NacosAccessOperationRequest::UpdateRole { .. }
+        | NacosAccessOperationRequest::DeleteUser { .. }
+        | NacosAccessOperationRequest::DeleteRole { .. } => ExecutionStrategy::StopAfterFailure,
+        _ => ExecutionStrategy::ContinueAfterFailure,
+    }
+}
+
+pub fn get_operation(
+    connection_id: &str,
+    connection_fingerprint: &str,
+    operation_id: &str,
+) -> Result<NacosAccessOperationResult, String> {
+    let mut registry = operations().lock().unwrap_or_else(|error| error.into_inner());
+    cleanup_operations(&mut registry);
+    let operation =
+        registry.get(operation_id).ok_or_else(|| "Nacos access operation was not found or expired".to_string())?;
+    if operation.connection_id != connection_id || operation.connection_fingerprint != connection_fingerprint {
+        return Err("Nacos access operation was not found or expired".to_string());
+    }
+    Ok(operation.result.clone())
+}
+
+pub async fn retry_operation(
+    connection_id: &str,
+    connection_fingerprint: String,
+    admin: Arc<dyn NacosAdmin>,
+    retry: NacosAccessOperationRetry,
+) -> Result<(NacosAccessOperationResult, bool), String> {
+    let operation_lock = connection_operation_lock(connection_id);
+    let _operation_guard = operation_lock.lock().await;
+    let stored = {
+        let mut registry = operations().lock().unwrap_or_else(|error| error.into_inner());
+        cleanup_operations(&mut registry);
+        registry
+            .get(&retry.operation_id)
+            .filter(|operation| {
+                operation.connection_id == connection_id && operation.connection_fingerprint == connection_fingerprint
+            })
+            .cloned()
+            .ok_or_else(|| "Nacos access operation was not found or expired".to_string())?
+    };
+    if stored.failed.is_empty() {
+        return Ok((stored.result, false));
+    }
+    let snapshot = load_snapshot(admin.clone()).await?;
+    let credentials: HashMap<String, String> = retry
+        .credentials
+        .into_iter()
+        .map(|credential| (credential.username.trim().to_string(), credential.password))
+        .collect();
+    let commands: Vec<StepCommand> = stored.failed.iter().map(|(_, command)| command.clone()).collect();
+    let capabilities = admin.refresh_access_control_capabilities().await;
+    ensure_commands_supported(&capabilities, &commands)?;
+    validate_replayed_commands(&snapshot, &commands)?;
+    let retried = execute_commands(
+        connection_id,
+        connection_fingerprint,
+        &retry.operation_id,
+        admin,
+        commands,
+        &credentials,
+        stored.undoable,
+        stored.execution_strategy,
+    )
+    .await;
+    let state_changed =
+        retried.result.steps.iter().any(|step| step.status == NacosAccessOperationStepStatus::Succeeded);
+    let mut next = stored.clone();
+    let original_failures = stored.failed;
+    for ((original_index, _), retry_step) in original_failures.iter().zip(&retried.result.steps) {
+        let mut step = retry_step.clone();
+        step.id = next.result.steps[*original_index].id.clone();
+        next.result.steps[*original_index] = step;
+    }
+    next.failed =
+        retried.failed.into_iter().map(|(retry_index, command)| (original_failures[retry_index].0, command)).collect();
+    next.undo.extend(retried.undo);
+    let succeeded =
+        next.result.steps.iter().filter(|step| step.status == NacosAccessOperationStepStatus::Succeeded).count();
+    next.result.status = if next.failed.is_empty() {
+        NacosAccessOperationStatus::Succeeded
+    } else if succeeded == 0 {
+        NacosAccessOperationStatus::Failed
+    } else {
+        NacosAccessOperationStatus::Partial
+    };
+    next.result.can_retry = !next.failed.is_empty();
+    next.result.can_undo = !next.undo.is_empty();
+    next.expires_at = Instant::now() + OPERATION_TTL;
+    let result = next.result.clone();
+    operations().lock().unwrap_or_else(|error| error.into_inner()).insert(retry.operation_id, next);
+    Ok((result, state_changed))
+}
+
+pub async fn undo_operation(
+    connection_id: &str,
+    connection_fingerprint: String,
+    admin: Arc<dyn NacosAdmin>,
+    operation_id: &str,
+) -> Result<(NacosAccessOperationResult, bool), String> {
+    let operation_lock = connection_operation_lock(connection_id);
+    let _operation_guard = operation_lock.lock().await;
+    let stored = {
+        let mut registry = operations().lock().unwrap_or_else(|error| error.into_inner());
+        cleanup_operations(&mut registry);
+        registry
+            .get(operation_id)
+            .filter(|operation| {
+                operation.connection_id == connection_id && operation.connection_fingerprint == connection_fingerprint
+            })
+            .cloned()
+            .ok_or_else(|| "Nacos access operation was not found or expired".to_string())?
+    };
+    if !stored.result.can_undo {
+        return Err("This Nacos access operation cannot be undone".to_string());
+    }
+    let commands: Vec<_> = stored.undo.into_iter().rev().collect();
+    let snapshot = load_snapshot(admin.clone()).await?;
+    let capabilities = admin.refresh_access_control_capabilities().await;
+    ensure_commands_supported(&capabilities, &commands)?;
+    validate_replayed_commands(&snapshot, &commands)?;
+    let mut undone = execute_commands(
+        connection_id,
+        connection_fingerprint,
+        operation_id,
+        admin,
+        commands,
+        &HashMap::new(),
+        false,
+        ExecutionStrategy::StopAfterFailure,
+    )
+    .await;
+    let state_changed = undone.result.steps.iter().any(|step| step.status == NacosAccessOperationStepStatus::Succeeded);
+    for step in &mut undone.result.steps {
+        if step.status == NacosAccessOperationStepStatus::Succeeded {
+            step.status = NacosAccessOperationStepStatus::Compensated;
+        }
+    }
+    undone.result.status =
+        if undone.failed.is_empty() { NacosAccessOperationStatus::Undone } else { NacosAccessOperationStatus::Partial };
+    let result = undone.result.clone();
+    operations().lock().unwrap_or_else(|error| error.into_inner()).insert(operation_id.to_string(), undone);
+    Ok((result, state_changed))
+}
+
+fn validate_replayed_commands(snapshot: &NacosAccessControlSnapshot, commands: &[StepCommand]) -> Result<(), String> {
+    let mut bindings: BTreeSet<(String, String)> =
+        snapshot.role_bindings.iter().map(|binding| (binding.username.clone(), binding.role.clone())).collect();
+    let mut permissions: BTreeSet<NacosPermissionInfo> = snapshot.permissions.iter().cloned().collect();
+    for command in commands {
+        match command {
+            StepCommand::RevokePermission(permission) => {
+                // A role has no independent Nacos entity. Once its permissions are gone,
+                // removing its final binding completes a role deletion rather than leaving
+                // a memberless role behind.
+                permissions.remove(permission);
+            }
+            StepCommand::RemoveRole { username, role, mode } => {
+                if !bindings.contains(&(username.clone(), role.clone())) {
+                    continue;
+                }
+                if *mode == RoleRemovalMode::PreserveRole
+                    && snapshot.current_username.as_deref() == Some(username.as_str())
+                {
+                    return Err(
+                        "Retrying or undoing a current-account role removal requires a new confirmation".to_string()
+                    );
+                }
+                let member_count = bindings.iter().filter(|(_, bound_role)| bound_role == role).count();
+                validate_role_removal_count(role, member_count, *mode)?;
+                bindings.remove(&(username.clone(), role.clone()));
+            }
+            StepCommand::DeleteUser { username } | StepCommand::DeleteCreatedUser { username } => {
+                let user_exists = snapshot.users.iter().any(|user| user.username == *username);
+                if matches!(command, StepCommand::DeleteCreatedUser { .. }) && !user_exists {
+                    continue;
+                }
+                if !user_exists {
+                    return Err(format!("Nacos user {username} no longer exists"));
+                }
+                if snapshot.current_username.as_deref() == Some(username.as_str()) {
+                    return Err("Retrying deletion of the current account requires a new confirmation".to_string());
+                }
+                let roles: Vec<_> = bindings
+                    .iter()
+                    .filter(|(bound_username, _)| bound_username == username)
+                    .map(|(_, role)| role.clone())
+                    .collect();
+                for role in roles {
+                    let member_count = bindings.iter().filter(|(_, bound_role)| bound_role == &role).count();
+                    if role == ADMIN_ROLE && member_count <= 1 {
+                        return Err("At least one ROLE_ADMIN member must remain".to_string());
+                    }
+                    if role != ADMIN_ROLE && member_count <= 1 {
+                        return Err(format!("Add another member to {role} before deleting its last member"));
+                    }
+                }
+                bindings.retain(|(bound_username, _)| bound_username != username);
+            }
+            _ => {}
+        }
+    }
+    Ok(())
+}
+
+fn plan_operation(
+    snapshot: &NacosAccessControlSnapshot,
+    request: NacosAccessOperationRequest,
+) -> Result<OperationPlan, String> {
+    match request {
+        NacosAccessOperationRequest::CreateUser { username, password, roles, confirmation } => {
+            let username = required(&username, "Nacos username")?;
+            if password.is_empty() {
+                return Err("Nacos password is required".to_string());
+            }
+            if snapshot.users.iter().any(|user| user.username == username) {
+                return Err(format!("Nacos user {username} already exists"));
+            }
+            let roles = unique_strings(roles);
+            validate_assignable_roles(snapshot, &roles)?;
+            if roles.iter().any(|role| role == ADMIN_ROLE) && confirmation.as_deref() != Some(username.as_str()) {
+                return Err("Assigning ROLE_ADMIN requires typing the target username".to_string());
+            }
+            let mut commands = vec![StepCommand::CreateUser { username: username.clone() }];
+            commands.extend(roles.into_iter().map(|role| StepCommand::AssignRole {
+                username: username.clone(),
+                role,
+                undo_removal: RoleRemovalMode::PreserveRole,
+            }));
+            Ok((commands, HashMap::from([(username, password)]), true))
+        }
+        NacosAccessOperationRequest::CreateRole { role, members, new_users, permissions, confirmation } => {
+            let role = required(&role, "Nacos role")?;
+            if role == ADMIN_ROLE {
+                return Err("ROLE_ADMIN is reserved and cannot be created".to_string());
+            }
+            if snapshot.roles.iter().any(|item| item.role == role) {
+                return Err(format!("Nacos role {role} already exists"));
+            }
+            let (members, credentials, mut commands) = validate_members(snapshot, members, new_users)?;
+            let permissions = expand_permissions(&role, permissions)?;
+            if members.is_empty() || permissions.is_empty() {
+                return Err("A role requires at least one member and one namespace permission".to_string());
+            }
+            let anchor = members[0].clone();
+            commands.push(StepCommand::AssignRole {
+                username: anchor.clone(),
+                role: role.clone(),
+                undo_removal: RoleRemovalMode::DeleteRole,
+            });
+            commands.extend(permissions.into_iter().map(StepCommand::GrantPermission));
+            commands.extend(members.into_iter().skip(1).map(|username| StepCommand::AssignRole {
+                username,
+                role: role.clone(),
+                undo_removal: RoleRemovalMode::DeleteRole,
+            }));
+            let _ = confirmation;
+            Ok((commands, credentials, true))
+        }
+        NacosAccessOperationRequest::UpdateUserRoles { username, roles, confirmation } => {
+            let username = required(&username, "Nacos username")?;
+            let user = snapshot
+                .users
+                .iter()
+                .find(|user| user.username == username)
+                .ok_or_else(|| format!("Nacos user {username} does not exist"))?;
+            validate_assignable_roles(snapshot, &roles)?;
+            let desired: BTreeSet<_> = unique_strings(roles).into_iter().collect();
+            let current: BTreeSet<_> = user.roles.iter().cloned().collect();
+            validate_role_removals(snapshot, &username, &current, &desired, confirmation.as_deref())?;
+            if desired.contains(ADMIN_ROLE)
+                && !current.contains(ADMIN_ROLE)
+                && confirmation.as_deref() != Some(username.as_str())
+            {
+                return Err("Assigning ROLE_ADMIN requires typing the target username".to_string());
+            }
+            let mut commands: Vec<_> = desired
+                .difference(&current)
+                .map(|role| StepCommand::AssignRole {
+                    username: username.clone(),
+                    role: role.clone(),
+                    undo_removal: RoleRemovalMode::PreserveRole,
+                })
+                .collect();
+            commands.extend(current.difference(&desired).map(|role| StepCommand::RemoveRole {
+                username: username.clone(),
+                role: role.clone(),
+                mode: RoleRemovalMode::PreserveRole,
+            }));
+            Ok((commands, HashMap::new(), false))
+        }
+        NacosAccessOperationRequest::UpdateRole { role, members, new_users, permissions, confirmation } => {
+            let role = required(&role, "Nacos role")?;
+            if !snapshot.roles.iter().any(|item| item.role == role) {
+                return Err(format!("Nacos role {role} does not exist"));
+            }
+            let (members, credentials, mut commands) = validate_members(snapshot, members, new_users)?;
+            let current_members: BTreeSet<_> = snapshot
+                .role_bindings
+                .iter()
+                .filter(|binding| binding.role == role)
+                .map(|binding| binding.username.clone())
+                .collect();
+            let desired_members: BTreeSet<_> = members.into_iter().collect();
+            if role == ADMIN_ROLE {
+                if desired_members.is_empty() {
+                    return Err("At least one ROLE_ADMIN member must remain".to_string());
+                }
+                validate_admin_member_change(snapshot, &current_members, &desired_members, confirmation.as_deref())?;
+            } else if desired_members.is_empty() {
+                return Err("A role requires at least one member".to_string());
+            }
+            let desired_permissions: BTreeSet<_> = if role == ADMIN_ROLE {
+                BTreeSet::new()
+            } else {
+                let expanded = expand_permissions(&role, permissions)?;
+                if expanded.is_empty() {
+                    return Err("A role requires at least one namespace permission".to_string());
+                }
+                expanded.into_iter().collect()
+            };
+            let current_managed: BTreeSet<_> = snapshot
+                .permissions
+                .iter()
+                .filter(|permission| permission.role == role)
+                .filter(|permission| {
+                    permission
+                        .parsed_scope
+                        .as_ref()
+                        .is_some_and(|scope| scope.kind == NacosPermissionScopeKind::Namespace)
+                })
+                .cloned()
+                .collect();
+            commands.extend(desired_members.difference(&current_members).map(|username| StepCommand::AssignRole {
+                username: username.clone(),
+                role: role.clone(),
+                undo_removal: RoleRemovalMode::PreserveRole,
+            }));
+            commands
+                .extend(desired_permissions.difference(&current_managed).cloned().map(StepCommand::GrantPermission));
+            commands
+                .extend(current_managed.difference(&desired_permissions).cloned().map(StepCommand::RevokePermission));
+            commands.extend(current_members.difference(&desired_members).map(|username| StepCommand::RemoveRole {
+                username: username.clone(),
+                role: role.clone(),
+                mode: RoleRemovalMode::PreserveRole,
+            }));
+            Ok((commands, credentials, false))
+        }
+        NacosAccessOperationRequest::DeleteUser { username, confirmation } => {
+            let username = required(&username, "Nacos username")?;
+            if !snapshot.users.iter().any(|user| user.username == username) {
+                return Err(format!("Nacos user {username} does not exist"));
+            }
+            if snapshot.current_username.as_deref() == Some(username.as_str())
+                && confirmation.as_deref() != Some(username.as_str())
+            {
+                return Err("Deleting the current account requires typing the current username".to_string());
+            }
+            let current: BTreeSet<_> = snapshot
+                .role_bindings
+                .iter()
+                .filter(|binding| binding.username == username)
+                .map(|binding| binding.role.clone())
+                .collect();
+            validate_role_removals(snapshot, &username, &current, &BTreeSet::new(), confirmation.as_deref())?;
+            let mut commands: Vec<_> = current
+                .into_iter()
+                .map(|role| StepCommand::RemoveRole {
+                    username: username.clone(),
+                    role,
+                    mode: RoleRemovalMode::PreserveRole,
+                })
+                .collect();
+            commands.push(StepCommand::DeleteUser { username });
+            Ok((commands, HashMap::new(), false))
+        }
+        NacosAccessOperationRequest::DeleteRole { role, confirmation } => {
+            let role = required(&role, "Nacos role")?;
+            if role == ADMIN_ROLE {
+                return Err("ROLE_ADMIN cannot be deleted".to_string());
+            }
+            if confirmation.as_deref() != Some(role.as_str()) {
+                return Err("Deleting a role requires typing its role name".to_string());
+            }
+            if !snapshot.roles.iter().any(|item| item.role == role) {
+                return Err(format!("Nacos role {role} does not exist"));
+            }
+            let mut commands: Vec<_> = snapshot
+                .permissions
+                .iter()
+                .filter(|permission| permission.role == role)
+                .cloned()
+                .map(StepCommand::RevokePermission)
+                .collect();
+            commands.extend(snapshot.role_bindings.iter().filter(|binding| binding.role == role).map(|binding| {
+                StepCommand::RemoveRole {
+                    username: binding.username.clone(),
+                    role: role.clone(),
+                    mode: RoleRemovalMode::DeleteRole,
+                }
+            }));
+            Ok((commands, HashMap::new(), false))
+        }
+        NacosAccessOperationRequest::RevokePermission { permission, confirmation } => {
+            if !snapshot.permissions.contains(&permission) {
+                return Err("The Nacos permission no longer exists".to_string());
+            }
+            if permission.role == ADMIN_ROLE {
+                return Err("ROLE_ADMIN permissions are built into Nacos and cannot be revoked".to_string());
+            }
+            if confirmation.as_deref() != Some(permission.role.as_str()) {
+                return Err("Revoking a raw permission requires typing its role name".to_string());
+            }
+            Ok((vec![StepCommand::RevokePermission(permission)], HashMap::new(), false))
+        }
+    }
+}
+
+fn validate_members(
+    snapshot: &NacosAccessControlSnapshot,
+    members: Vec<String>,
+    new_users: Vec<NacosNewUserDraft>,
+) -> Result<ValidatedMembers, String> {
+    let existing_users: BTreeSet<_> = snapshot.users.iter().map(|user| user.username.as_str()).collect();
+    let mut normalized = unique_strings(members);
+    for member in &normalized {
+        if !existing_users.contains(member.as_str()) {
+            return Err(format!("Nacos user {member} does not exist"));
+        }
+    }
+    let mut credentials = HashMap::new();
+    let mut commands = Vec::new();
+    for user in new_users {
+        let username = required(&user.username, "Nacos username")?;
+        if user.password.is_empty() {
+            return Err(format!("Password is required for new user {username}"));
+        }
+        if existing_users.contains(username.as_str())
+            || normalized.contains(&username)
+            || credentials.contains_key(&username)
+        {
+            return Err(format!("Nacos user {username} is duplicated or already exists"));
+        }
+        credentials.insert(username.clone(), user.password);
+        commands.push(StepCommand::CreateUser { username: username.clone() });
+        normalized.push(username);
+    }
+    Ok((normalized, credentials, commands))
+}
+
+fn validate_assignable_roles(snapshot: &NacosAccessControlSnapshot, roles: &[String]) -> Result<(), String> {
+    for role in unique_strings(roles.to_vec()) {
+        let summary = snapshot
+            .roles
+            .iter()
+            .find(|item| item.role == role)
+            .ok_or_else(|| format!("Nacos role {role} does not exist"))?;
+        if !summary.complete && summary.permission_count == 0 {
+            return Err(format!("Nacos role {role} has no permissions and must be repaired before assignment"));
+        }
+    }
+    Ok(())
+}
+
+fn validate_role_removals(
+    snapshot: &NacosAccessControlSnapshot,
+    username: &str,
+    current: &BTreeSet<String>,
+    desired: &BTreeSet<String>,
+    confirmation: Option<&str>,
+) -> Result<(), String> {
+    for role in current.difference(desired) {
+        let count = snapshot.role_bindings.iter().filter(|binding| binding.role == *role).count();
+        if count <= 1 {
+            return Err(format!("Add another member to {role} before removing its last member"));
+        }
+        if role == ADMIN_ROLE
+            && snapshot.current_username.as_deref() == Some(username)
+            && confirmation != Some(username)
+        {
+            return Err("Changing the current administrator requires typing the current username".to_string());
+        }
+    }
+    if snapshot.current_username.as_deref() == Some(username) && current != desired && confirmation != Some(username) {
+        return Err("Changing the current account requires typing the current username".to_string());
+    }
+    Ok(())
+}
+
+fn validate_role_removal_count(role: &str, member_count: usize, mode: RoleRemovalMode) -> Result<(), String> {
+    if role == ADMIN_ROLE && (mode == RoleRemovalMode::DeleteRole || member_count <= 1) {
+        return Err("At least one ROLE_ADMIN member must remain".to_string());
+    }
+    if role != ADMIN_ROLE && mode == RoleRemovalMode::PreserveRole && member_count <= 1 {
+        return Err(format!("Add another member to {role} before removing its last member"));
+    }
+    Ok(())
+}
+
+fn validate_admin_member_change(
+    snapshot: &NacosAccessControlSnapshot,
+    current: &BTreeSet<String>,
+    desired: &BTreeSet<String>,
+    confirmation: Option<&str>,
+) -> Result<(), String> {
+    let adds_administrator = desired.difference(current).next().is_some();
+    if let Some(current_username) = snapshot.current_username.as_deref() {
+        if current.contains(current_username)
+            && !desired.contains(current_username)
+            && confirmation != Some(current_username)
+        {
+            return Err("Removing the current administrator requires typing the current username".to_string());
+        }
+        if adds_administrator && confirmation != Some(ADMIN_ROLE) && confirmation != Some(current_username) {
+            return Err("Assigning ROLE_ADMIN requires typing ROLE_ADMIN".to_string());
+        }
+    } else if adds_administrator && confirmation != Some(ADMIN_ROLE) {
+        return Err("Assigning ROLE_ADMIN requires typing ROLE_ADMIN".to_string());
+    }
+    Ok(())
+}
+
+fn expand_permissions(role: &str, drafts: Vec<NacosPermissionDraft>) -> Result<Vec<NacosPermissionInfo>, String> {
+    let mut namespaces = BTreeSet::new();
+    let mut permissions = Vec::new();
+    for draft in drafts {
+        let action = draft.action.trim().to_ascii_lowercase();
+        if !matches!(action.as_str(), "r" | "w" | "rw") {
+            return Err("Permission action must be r, w, or rw".to_string());
+        }
+        for namespace_id in draft.namespace_ids {
+            let namespace_id = namespace_id.trim();
+            let normalized = if namespace_id.is_empty() || namespace_id == "public" { "public" } else { namespace_id };
+            if !namespaces.insert(normalized.to_string()) {
+                return Err(format!("Namespace {normalized} is selected more than once"));
+            }
+            // Nacos Console persists the default namespace explicitly as
+            // `public:*:*`. Keep DBX-generated rules in that canonical form
+            // so they remain identical when viewed in the official console.
+            let resource_raw = format!("{normalized}:*:*");
+            permissions.push(NacosPermissionInfo {
+                role: role.to_string(),
+                resource_raw,
+                action_raw: action.clone(),
+                parsed_scope: Some(NacosPermissionScope {
+                    kind: NacosPermissionScopeKind::Namespace,
+                    namespace_id: Some(normalized.to_string()),
+                }),
+            });
+        }
+    }
+    Ok(permissions)
+}
+
+async fn execute_commands(
+    connection_id: &str,
+    connection_fingerprint: String,
+    operation_id: &str,
+    admin: Arc<dyn NacosAdmin>,
+    commands: Vec<StepCommand>,
+    credentials: &HashMap<String, String>,
+    undoable: bool,
+    execution_strategy: ExecutionStrategy,
+) -> StoredOperation {
+    let mut result = NacosAccessOperationResult {
+        operation_id: operation_id.to_string(),
+        status: NacosAccessOperationStatus::Running,
+        steps: commands.iter().enumerate().map(|(index, command)| step_for_command(index, command)).collect(),
+        can_retry: false,
+        can_undo: false,
+    };
+    let mut failed = Vec::new();
+    let mut undo = Vec::new();
+    let mut blocked = false;
+    for (index, command) in commands.into_iter().enumerate() {
+        if blocked {
+            result.steps[index].status = NacosAccessOperationStepStatus::Skipped;
+            result.steps[index].message = Some("Skipped because an earlier required step failed".to_string());
+            result.steps[index].needs_password = matches!(command, StepCommand::CreateUser { .. });
+            failed.push((index, command));
+            continue;
+        }
+        result.steps[index].status = NacosAccessOperationStepStatus::Running;
+        let execution = match validate_command_before_execution(admin.clone(), &command).await {
+            Ok(()) => execute_command_reconciled(admin.clone(), &command, credentials).await,
+            Err(error) => Err(error),
+        };
+        match execution {
+            Ok(()) => {
+                result.steps[index].status = NacosAccessOperationStepStatus::Succeeded;
+                if undoable {
+                    if let Some(inverse) = inverse_command(&command) {
+                        undo.push(inverse);
+                    }
+                }
+            }
+            Err(message) => {
+                result.steps[index].status = NacosAccessOperationStepStatus::Failed;
+                result.steps[index].message = Some(message);
+                result.steps[index].needs_password = matches!(command, StepCommand::CreateUser { .. });
+                failed.push((index, command));
+                blocked = matches!(execution_strategy, ExecutionStrategy::StopAfterFailure);
+            }
+        }
+    }
+    let succeeded = result.steps.iter().filter(|step| step.status == NacosAccessOperationStepStatus::Succeeded).count();
+    result.status = if failed.is_empty() {
+        NacosAccessOperationStatus::Succeeded
+    } else if succeeded == 0 {
+        NacosAccessOperationStatus::Failed
+    } else {
+        NacosAccessOperationStatus::Partial
+    };
+    result.can_retry = !failed.is_empty();
+    result.can_undo = undoable && !undo.is_empty();
+    StoredOperation {
+        connection_id: connection_id.to_string(),
+        connection_fingerprint,
+        result,
+        failed,
+        undo,
+        undoable,
+        execution_strategy,
+        expires_at: Instant::now() + OPERATION_TTL,
+    }
+}
+
+/// Connection teardown and configuration replacement must make old retry and
+/// undo records unusable before a new adapter can target another server.
+pub fn invalidate_operations(connection_id: &str) {
+    let mut registry = operations().lock().unwrap_or_else(|error| error.into_inner());
+    registry.retain(|_, operation| operation.connection_id != connection_id);
+}
+
+async fn validate_command_before_execution(admin: Arc<dyn NacosAdmin>, command: &StepCommand) -> Result<(), String> {
+    match command {
+        StepCommand::RemoveRole { username, role, mode } => {
+            let bindings = list_all_role_bindings(admin).await?;
+            if !bindings.iter().any(|binding| binding.username == *username && binding.role == *role) {
+                return Ok(());
+            }
+            let member_count = bindings.iter().filter(|binding| binding.role == *role).count();
+            validate_role_removal_count(role, member_count, *mode)
+        }
+        StepCommand::DeleteUser { username } | StepCommand::DeleteCreatedUser { username } => {
+            let bindings = list_all_role_bindings(admin).await?;
+            if bindings.iter().any(|binding| binding.username == *username) {
+                return Err(format!("Remove every role binding from {username} before deleting the user"));
+            }
+            Ok(())
+        }
+        _ => Ok(()),
+    }
+}
+
+async fn execute_command(
+    admin: &dyn NacosAdmin,
+    command: &StepCommand,
+    credentials: &HashMap<String, String>,
+) -> Result<(), String> {
+    match command {
+        StepCommand::CreateUser { username } => {
+            let password = credentials
+                .get(username)
+                .filter(|password| !password.is_empty())
+                .ok_or_else(|| format!("Password must be entered again for {username}"))?;
+            admin
+                .create_user(NacosUserCreate {
+                    username: username.clone(),
+                    password: password.clone(),
+                    nickname: None,
+                    enabled: None,
+                    roles: Vec::new(),
+                    namespace_privilege: None,
+                })
+                .await
+        }
+        StepCommand::DeleteUser { username } => admin.delete_user(username.clone()).await,
+        StepCommand::DeleteCreatedUser { username } => {
+            let bindings = admin
+                .list_role_bindings(NacosRoleQuery {
+                    username: Some(username.clone()),
+                    role: None,
+                    page_no: Some(1),
+                    page_size: Some(PAGE_SIZE),
+                })
+                .await?;
+            if bindings.items.iter().any(|binding| binding.username == *username) {
+                return Err(format!("User {username} has role bindings that were not created by this operation"));
+            }
+            admin.delete_user(username.clone()).await
+        }
+        StepCommand::AssignRole { username, role, .. } => {
+            admin.assign_role(NacosRoleBinding { username: username.clone(), role: role.clone() }).await
+        }
+        StepCommand::RemoveRole { username, role, .. } => {
+            admin.remove_role(NacosRoleBinding { username: username.clone(), role: role.clone() }).await
+        }
+        StepCommand::GrantPermission(permission) => admin.grant_permission(permission.clone()).await,
+        StepCommand::RevokePermission(permission) => admin.revoke_permission(permission.clone()).await,
+    }
+}
+
+async fn execute_command_reconciled(
+    admin: Arc<dyn NacosAdmin>,
+    command: &StepCommand,
+    credentials: &HashMap<String, String>,
+) -> Result<(), String> {
+    match execute_command(admin.as_ref(), command, credentials).await {
+        Ok(()) => Ok(()),
+        Err(error) if is_timeout_error(&error) => {
+            if command_is_satisfied(admin, command).await.unwrap_or(false) {
+                Ok(())
+            } else {
+                Err(error)
+            }
+        }
+        Err(error) => Err(error),
+    }
+}
+
+fn is_timeout_error(error: &str) -> bool {
+    let error = error.to_ascii_lowercase();
+    error.contains("timeout") || error.contains("timed out")
+}
+
+async fn command_is_satisfied(admin: Arc<dyn NacosAdmin>, command: &StepCommand) -> Result<bool, String> {
+    match command {
+        StepCommand::CreateUser { username } => {
+            let users = list_all_users(admin).await?;
+            Ok(users.iter().any(|user| user.username == *username))
+        }
+        StepCommand::DeleteUser { username } | StepCommand::DeleteCreatedUser { username } => {
+            let users = list_all_users(admin).await?;
+            Ok(users.iter().all(|user| user.username != *username))
+        }
+        StepCommand::AssignRole { username, role, .. } | StepCommand::RemoveRole { username, role, .. } => {
+            let present = list_all_role_bindings(admin)
+                .await?
+                .iter()
+                .any(|binding| binding.username == *username && binding.role == *role);
+            Ok(if matches!(command, StepCommand::AssignRole { .. }) { present } else { !present })
+        }
+        StepCommand::GrantPermission(permission) | StepCommand::RevokePermission(permission) => {
+            let present = list_all_permissions(admin).await?.contains(permission);
+            Ok(if matches!(command, StepCommand::GrantPermission(_)) { present } else { !present })
+        }
+    }
+}
+
+fn inverse_command(command: &StepCommand) -> Option<StepCommand> {
+    match command {
+        StepCommand::CreateUser { username } => Some(StepCommand::DeleteCreatedUser { username: username.clone() }),
+        StepCommand::AssignRole { username, role, undo_removal } => {
+            Some(StepCommand::RemoveRole { username: username.clone(), role: role.clone(), mode: *undo_removal })
+        }
+        StepCommand::GrantPermission(permission) => Some(StepCommand::RevokePermission(permission.clone())),
+        _ => None,
+    }
+}
+
+fn step_for_command(index: usize, command: &StepCommand) -> NacosAccessOperationStep {
+    let (action, target) = match command {
+        StepCommand::CreateUser { username } => ("createUser", username.clone()),
+        StepCommand::DeleteUser { username } | StepCommand::DeleteCreatedUser { username } => {
+            ("deleteUser", username.clone())
+        }
+        StepCommand::AssignRole { username, role, .. } => ("assignRole", format!("{username} · {role}")),
+        StepCommand::RemoveRole { username, role, .. } => ("removeRole", format!("{username} · {role}")),
+        StepCommand::GrantPermission(permission) => (
+            "grantPermission",
+            format!("{} · {} · {}", permission.role, permission.resource_raw, permission.action_raw),
+        ),
+        StepCommand::RevokePermission(permission) => (
+            "revokePermission",
+            format!("{} · {} · {}", permission.role, permission.resource_raw, permission.action_raw),
+        ),
+    };
+    NacosAccessOperationStep {
+        id: format!("step-{}", index + 1),
+        action: action.to_string(),
+        target,
+        status: NacosAccessOperationStepStatus::Pending,
+        retryable: true,
+        needs_password: false,
+        message: None,
+    }
+}
+
+fn required(value: &str, label: &str) -> Result<String, String> {
+    let value = value.trim();
+    if value.is_empty() {
+        Err(format!("{label} is required"))
+    } else {
+        Ok(value.to_string())
+    }
+}
+
+fn unique_strings(values: Vec<String>) -> Vec<String> {
+    let mut seen = BTreeSet::new();
+    values
+        .into_iter()
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty() && seen.insert(value.clone()))
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn command_capabilities_are_checked_per_mutation() {
+        let mut capabilities = NacosAccessControlCapabilities::unavailable(NacosCapabilityReason::PermissionDenied);
+        capabilities.grant_permission = NacosOperationCapability::supported();
+        let permission = NacosPermissionInfo {
+            role: "ops".to_string(),
+            resource_raw: "team-a:*:*".to_string(),
+            action_raw: "r".to_string(),
+            parsed_scope: None,
+        };
+
+        assert!(ensure_commands_supported(&capabilities, &[StepCommand::GrantPermission(permission)]).is_ok());
+        let error =
+            ensure_commands_supported(&capabilities, &[StepCommand::CreateUser { username: "alice".to_string() }])
+                .unwrap_err();
+        assert!(error.contains("CreateUser"));
+        assert!(error.contains("PermissionDenied"));
+    }
+
+    #[test]
+    fn combines_read_and_write_from_multiple_roles() {
+        let snapshot = NacosAccessControlSnapshot {
+            users: Vec::new(),
+            role_bindings: vec![
+                NacosRoleBinding { username: "alice".to_string(), role: "reader".to_string() },
+                NacosRoleBinding { username: "alice".to_string(), role: "writer".to_string() },
+            ],
+            permissions: vec![permission("reader", "team:*:*", "r"), permission("writer", "team:*:*", "w")],
+            roles: Vec::new(),
+            namespaces: Vec::new(),
+            current_username: None,
+        };
+        let effective = effective_permissions(&snapshot, "alice");
+        assert_eq!(effective.len(), 1);
+        assert_eq!(effective[0].action, "rw");
+        assert_eq!(effective[0].source_roles, vec!["reader", "writer"]);
+    }
+
+    #[test]
+    fn combines_legacy_and_canonical_public_namespace_permissions() {
+        let snapshot = NacosAccessControlSnapshot {
+            users: Vec::new(),
+            role_bindings: vec![
+                NacosRoleBinding { username: "alice".to_string(), role: "reader".to_string() },
+                NacosRoleBinding { username: "alice".to_string(), role: "writer".to_string() },
+            ],
+            permissions: vec![
+                NacosPermissionInfo {
+                    role: "reader".to_string(),
+                    resource_raw: ":*:*".to_string(),
+                    action_raw: "r".to_string(),
+                    parsed_scope: Some(NacosPermissionScope {
+                        kind: NacosPermissionScopeKind::Namespace,
+                        namespace_id: Some("public".to_string()),
+                    }),
+                },
+                permission("writer", "public:*:*", "w"),
+            ],
+            roles: Vec::new(),
+            namespaces: Vec::new(),
+            current_username: None,
+        };
+        let effective = effective_permissions(&snapshot, "alice");
+        assert_eq!(effective.len(), 1);
+        assert_eq!(effective[0].resource_raw, "public:*:*");
+        assert_eq!(effective[0].action, "rw");
+    }
+
+    #[test]
+    fn permission_drafts_reject_duplicate_namespaces() {
+        let error = expand_permissions(
+            "ops",
+            vec![
+                NacosPermissionDraft { namespace_ids: vec!["public".to_string()], action: "r".to_string() },
+                NacosPermissionDraft { namespace_ids: vec!["public".to_string()], action: "w".to_string() },
+            ],
+        )
+        .unwrap_err();
+        assert!(error.contains("selected more than once"));
+    }
+
+    #[test]
+    fn deleting_current_account_requires_typed_confirmation_even_without_roles() {
+        let snapshot = snapshot_with_user("nacos");
+        let error = plan_operation(
+            &snapshot,
+            NacosAccessOperationRequest::DeleteUser { username: "nacos".to_string(), confirmation: None },
+        )
+        .unwrap_err();
+        assert!(error.contains("current account"));
+    }
+
+    #[test]
+    fn removing_the_last_regular_role_member_is_rejected() {
+        let mut snapshot = snapshot_with_user("alice");
+        snapshot.role_bindings.push(NacosRoleBinding { username: "alice".to_string(), role: "ops".to_string() });
+        snapshot.users[0].roles.push("ops".to_string());
+        snapshot.roles.push(NacosRoleSummary {
+            role: "ops".to_string(),
+            member_count: 1,
+            permission_count: 1,
+            complete: true,
+            administrator: false,
+        });
+        let error = plan_operation(
+            &snapshot,
+            NacosAccessOperationRequest::UpdateUserRoles {
+                username: "alice".to_string(),
+                roles: Vec::new(),
+                confirmation: None,
+            },
+        )
+        .unwrap_err();
+        assert!(error.contains("last member"));
+    }
+
+    #[test]
+    fn role_creation_binds_an_anchor_before_granting_permissions() {
+        let snapshot = snapshot_with_user("alice");
+        let (commands, _, undoable) = plan_operation(
+            &snapshot,
+            NacosAccessOperationRequest::CreateRole {
+                role: "ops".to_string(),
+                members: vec!["alice".to_string()],
+                new_users: Vec::new(),
+                permissions: vec![NacosPermissionDraft {
+                    namespace_ids: vec!["public".to_string()],
+                    action: "rw".to_string(),
+                }],
+                confirmation: None,
+            },
+        )
+        .unwrap();
+        assert!(undoable);
+        assert!(
+            matches!(&commands[0], StepCommand::AssignRole { username, role, .. } if username == "alice" && role == "ops")
+        );
+        assert!(
+            matches!(&commands[1], StepCommand::GrantPermission(permission) if permission.resource_raw == "public:*:*")
+        );
+    }
+
+    #[test]
+    fn creating_an_administrator_with_whitespace_still_requires_confirmation() {
+        let mut snapshot = snapshot_with_user("alice");
+        snapshot.roles.push(NacosRoleSummary {
+            role: ADMIN_ROLE.to_string(),
+            member_count: 1,
+            permission_count: 0,
+            complete: true,
+            administrator: true,
+        });
+        let error = plan_operation(
+            &snapshot,
+            NacosAccessOperationRequest::CreateUser {
+                username: "bob".to_string(),
+                password: "secret".to_string(),
+                roles: vec![" ROLE_ADMIN ".to_string()],
+                confirmation: None,
+            },
+        )
+        .unwrap_err();
+        assert!(error.contains("Assigning ROLE_ADMIN"));
+    }
+
+    #[test]
+    fn compound_operations_stop_after_a_prerequisite_failure() {
+        let requests = [
+            NacosAccessOperationRequest::CreateUser {
+                username: "alice".to_string(),
+                password: "secret".to_string(),
+                roles: vec!["ops".to_string()],
+                confirmation: None,
+            },
+            NacosAccessOperationRequest::CreateRole {
+                role: "ops".to_string(),
+                members: vec!["alice".to_string()],
+                new_users: Vec::new(),
+                permissions: Vec::new(),
+                confirmation: None,
+            },
+            NacosAccessOperationRequest::UpdateUserRoles {
+                username: "alice".to_string(),
+                roles: Vec::new(),
+                confirmation: None,
+            },
+            NacosAccessOperationRequest::UpdateRole {
+                role: "ops".to_string(),
+                members: Vec::new(),
+                new_users: Vec::new(),
+                permissions: Vec::new(),
+                confirmation: None,
+            },
+            NacosAccessOperationRequest::DeleteUser { username: "alice".to_string(), confirmation: None },
+            NacosAccessOperationRequest::DeleteRole { role: "ops".to_string(), confirmation: None },
+        ];
+        for request in requests {
+            assert!(matches!(execution_strategy_for_request(&request), ExecutionStrategy::StopAfterFailure));
+        }
+    }
+
+    #[test]
+    fn role_removal_modes_distinguish_edits_from_role_deletion() {
+        let preserve_error = validate_role_removal_count("ops", 1, RoleRemovalMode::PreserveRole).unwrap_err();
+        assert!(preserve_error.contains("last member"));
+        assert!(validate_role_removal_count("ops", 1, RoleRemovalMode::DeleteRole).is_ok());
+
+        let admin_error = validate_role_removal_count(ADMIN_ROLE, 2, RoleRemovalMode::DeleteRole).unwrap_err();
+        assert!(admin_error.contains("ROLE_ADMIN"));
+        assert!(validate_role_removal_count(ADMIN_ROLE, 2, RoleRemovalMode::PreserveRole).is_ok());
+        assert!(validate_role_removal_count(ADMIN_ROLE, 1, RoleRemovalMode::PreserveRole).is_err());
+    }
+
+    #[test]
+    fn operation_locks_are_shared_only_within_a_connection() {
+        let first = connection_operation_lock("connection-a");
+        let same = connection_operation_lock("connection-a");
+        let other = connection_operation_lock("connection-b");
+
+        assert!(Arc::ptr_eq(&first, &same));
+        assert!(!Arc::ptr_eq(&first, &other));
+    }
+
+    #[test]
+    fn operations_cannot_be_reused_after_the_connection_identity_changes() {
+        let operation_id = "fingerprint-check".to_string();
+        let mut registry = operations().lock().unwrap_or_else(|error| error.into_inner());
+        registry.insert(
+            operation_id.clone(),
+            StoredOperation {
+                connection_id: "nacos".to_string(),
+                connection_fingerprint: "server-a".to_string(),
+                result: NacosAccessOperationResult {
+                    operation_id: operation_id.clone(),
+                    status: NacosAccessOperationStatus::Succeeded,
+                    steps: Vec::new(),
+                    can_retry: false,
+                    can_undo: false,
+                },
+                failed: Vec::new(),
+                undo: Vec::new(),
+                undoable: false,
+                execution_strategy: ExecutionStrategy::StopAfterFailure,
+                expires_at: Instant::now() + OPERATION_TTL,
+            },
+        );
+        drop(registry);
+
+        assert!(get_operation("nacos", "server-a", &operation_id).is_ok());
+        assert!(get_operation("nacos", "server-b", &operation_id).is_err());
+
+        invalidate_operations("nacos");
+        assert!(get_operation("nacos", "server-a", &operation_id).is_err());
+    }
+
+    #[test]
+    fn retrying_user_deletion_rechecks_new_role_bindings() {
+        let mut snapshot = snapshot_with_user("alice");
+        snapshot.current_username = None;
+        snapshot.role_bindings.push(NacosRoleBinding { username: "alice".to_string(), role: ADMIN_ROLE.to_string() });
+        let error = validate_replayed_commands(&snapshot, &[StepCommand::DeleteUser { username: "alice".to_string() }])
+            .unwrap_err();
+        assert!(error.contains("ROLE_ADMIN"));
+    }
+
+    #[test]
+    fn retrying_current_user_deletion_requires_a_new_confirmation() {
+        let snapshot = snapshot_with_user("alice");
+        let error = validate_replayed_commands(&snapshot, &[StepCommand::DeleteUser { username: "alice".to_string() }])
+            .unwrap_err();
+        assert!(error.contains("current account"));
+    }
+
+    #[test]
+    fn undoing_user_creation_rejects_external_role_bindings() {
+        let mut snapshot = snapshot_with_user("alice");
+        snapshot.current_username = None;
+        snapshot
+            .role_bindings
+            .push(NacosRoleBinding { username: "alice".to_string(), role: "external-role".to_string() });
+
+        let error =
+            validate_replayed_commands(&snapshot, &[StepCommand::DeleteCreatedUser { username: "alice".to_string() }])
+                .unwrap_err();
+        assert!(error.contains("external-role"));
+    }
+
+    #[test]
+    fn undoing_user_creation_is_idempotent_when_the_user_is_already_absent() {
+        let mut snapshot = snapshot_with_user("alice");
+        snapshot.users.clear();
+        snapshot.current_username = None;
+
+        assert!(validate_replayed_commands(
+            &snapshot,
+            &[StepCommand::DeleteCreatedUser { username: "alice".to_string() }],
+        )
+        .is_ok());
+    }
+
+    fn snapshot_with_user(username: &str) -> NacosAccessControlSnapshot {
+        NacosAccessControlSnapshot {
+            users: vec![NacosUserInfo {
+                username: username.to_string(),
+                nickname: None,
+                enabled: None,
+                roles: Vec::new(),
+                namespace_privilege: None,
+                source: None,
+            }],
+            role_bindings: Vec::new(),
+            permissions: Vec::new(),
+            roles: Vec::new(),
+            namespaces: Vec::new(),
+            current_username: Some(username.to_string()),
+        }
+    }
+
+    fn permission(role: &str, resource: &str, action: &str) -> NacosPermissionInfo {
+        NacosPermissionInfo {
+            role: role.to_string(),
+            resource_raw: resource.to_string(),
+            action_raw: action.to_string(),
+            parsed_scope: None,
+        }
+    }
+}
diff --git a/crates/dbx-core/src/nacos/config.rs b/crates/dbx-core/src/nacos/config.rs
index c126c6bb77..e1ab95e176 100644
--- a/crates/dbx-core/src/nacos/config.rs
+++ b/crates/dbx-core/src/nacos/config.rs
@@ -1,4 +1,5 @@
 use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
 
 use crate::models::connection::ConnectionConfig;
 
@@ -66,6 +67,12 @@ pub struct NacosAdminConfig {
     pub namespace: String,
     #[serde(default)]
     pub context_path: String,
+    /// Namespace IDs supplied for an official Nacos ordinary user that cannot
+    /// call the namespace or authorization management APIs. They define the
+    /// discoverable scope; Nacos still authorizes every configuration and
+    /// naming request.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub managed_namespaces: Vec<String>,
     /// Optional r-nacos authenticated-console address. This is separate from
     /// the OpenAPI server address because r-nacos exposes console-only APIs
     /// (including config history plus config type and description metadata) on
@@ -104,6 +111,13 @@ pub fn default_page_size() -> u32 {
 }
 
 impl NacosAdminConfig {
+    /// Binds short-lived, destructive workflows to the exact Nacos target and
+    /// credentials that created them. The digest is never exposed or persisted.
+    pub fn operation_fingerprint(&self) -> String {
+        let encoded = serde_json::to_vec(self).expect("NacosAdminConfig serialization must succeed");
+        format!("{:x}", Sha256::digest(encoded))
+    }
+
     pub fn from_connection(cfg: &ConnectionConfig) -> Result<Self, String> {
         let parsed = if let Some(raw) = cfg.external_config.as_ref() {
             serde_json::from_value::<NacosAdminConfig>(raw.clone())
@@ -117,6 +131,7 @@ impl NacosAdminConfig {
                 display_server_addr: String::new(),
                 namespace: cfg.database.clone().unwrap_or_default(),
                 context_path: String::new(),
+                managed_namespaces: Vec::new(),
                 rnacos_console_addr: String::new(),
                 rnacos_history_enabled: None,
                 rnacos_console_auth: NacosRNacosConsoleAuth::Inherit,
@@ -157,6 +172,14 @@ impl NacosAdminConfig {
         {
             self.context_path = "/nacos".to_string();
         }
+        let mut managed_namespaces = Vec::new();
+        for namespace in std::mem::take(&mut self.managed_namespaces) {
+            let namespace = namespace.trim().to_string();
+            if !namespace.is_empty() && !managed_namespaces.contains(&namespace) {
+                managed_namespaces.push(namespace);
+            }
+        }
+        self.managed_namespaces = managed_namespaces;
         self.rnacos_console_addr = if self.rnacos_console_addr.trim().is_empty() {
             String::new()
         } else {
@@ -369,6 +392,19 @@ mod tests {
         assert_eq!(parsed.rnacos_console_addr, "http://127.0.0.1:10848");
     }
 
+    #[test]
+    fn normalizes_managed_namespaces() {
+        let cfg = connection_with_external(serde_json::json!({
+            "implementation": "nacos",
+            "versionMode": "v3",
+            "serverAddr": "http://127.0.0.1:8818",
+            "managedNamespaces": [" public ", "team-a", "team-a", ""],
+        }));
+
+        let parsed = NacosAdminConfig::from_connection(&cfg).unwrap();
+        assert_eq!(parsed.managed_namespaces, vec!["public", "team-a"]);
+    }
+
     #[test]
     fn accepts_optional_profile_fields_and_rejects_endpoint_userinfo() {
         let parsed = NacosAdminConfig::from_connection(&connection_with_external(serde_json::json!({
diff --git a/crates/dbx-core/src/nacos/http.rs b/crates/dbx-core/src/nacos/http.rs
index f962a74fda..e38a66771d 100644
--- a/crates/dbx-core/src/nacos/http.rs
+++ b/crates/dbx-core/src/nacos/http.rs
@@ -1,6 +1,6 @@
 use std::collections::{HashMap, HashSet};
 use std::sync::atomic::{AtomicBool, AtomicU8, Ordering};
-use std::sync::Arc;
+use std::sync::{Arc, RwLock as StdRwLock};
 use std::time::{Duration, Instant};
 
 use aes::cipher::{block_padding::Pkcs7, BlockEncryptMut, KeyIvInit};
@@ -12,7 +12,7 @@ use serde_json::Value;
 use tokio::sync::Mutex;
 
 use crate::nacos::config::{NacosAdminConfig, NacosAuthConfig, NacosImplementation, NacosVersionMode};
-use crate::nacos::port::NacosAdmin;
+use crate::nacos::port::{NacosAdmin, NacosNamespaceAuthorizationSnapshot};
 use crate::nacos::types::*;
 
 const REQUEST_TIMEOUT_SECS: u64 = 30;
@@ -22,6 +22,108 @@ const REQUEST_TIMEOUT_SECS: u64 = 30;
 pub(crate) const RNACOS_CONSOLE_SESSION_CACHE_SECS: u64 = 86_400;
 const MAX_RAW_RESPONSE_BYTES: usize = 10 * 1024 * 1024;
 const NACOS_ERROR_PREFIX: &str = "NACOS_ERROR";
+const ACCESS_CONTROL_CAPABILITY_CACHE_TTL: Duration = Duration::from_secs(60);
+const ACCESS_CONTROL_PROBE_PAGE_SIZE: u32 = 500;
+const ADMIN_ROLE: &str = "ROLE_ADMIN";
+const CONSOLE_USERS_RESOURCE: &str = "console/users";
+const CONSOLE_ROLES_RESOURCE: &str = "console/roles";
+const CONSOLE_PERMISSIONS_RESOURCE: &str = "console/permissions";
+
+#[derive(Clone)]
+struct CachedAccessControlCapabilities {
+    capabilities: NacosAccessControlCapabilities,
+    authorization: Option<CachedOfficialAuthorization>,
+    expires_at: Instant,
+}
+
+#[derive(Clone)]
+struct CachedOfficialAuthorization {
+    username: String,
+    role_bindings: Result<NacosRoleList, String>,
+    permissions: Result<NacosPermissionList, String>,
+}
+
+fn access_control_probe_reason(error: &str) -> NacosCapabilityReason {
+    let lower = error.to_ascii_lowercase();
+    if lower.contains("403")
+        || lower.contains("401")
+        || lower.contains("forbidden")
+        || lower.contains("unauthorized")
+        || lower.contains("access denied")
+    {
+        NacosCapabilityReason::PermissionDenied
+    } else if lower.contains("404")
+        || lower.contains("405")
+        || lower.contains("not found")
+        || lower.contains("no static resource")
+    {
+        NacosCapabilityReason::EndpointUnavailable
+    } else {
+        NacosCapabilityReason::NotVerified
+    }
+}
+
+fn read_capability<T>(result: &Result<T, String>) -> NacosOperationCapability {
+    match result {
+        Ok(_) => NacosOperationCapability::supported(),
+        Err(error) => NacosOperationCapability::unsupported(access_control_probe_reason(error)),
+    }
+}
+
+fn write_capability(
+    read: &NacosOperationCapability,
+    authorization_complete: bool,
+    granted: bool,
+) -> NacosOperationCapability {
+    if !read.supported {
+        return read.clone();
+    }
+    if !authorization_complete {
+        return NacosOperationCapability::unsupported(NacosCapabilityReason::NotVerified);
+    }
+    if granted {
+        NacosOperationCapability::supported()
+    } else {
+        NacosOperationCapability::unsupported(NacosCapabilityReason::PermissionDenied)
+    }
+}
+
+fn official_unverified_access_control() -> NacosAccessControlCapabilities {
+    let unavailable = NacosOperationCapability::unsupported(NacosCapabilityReason::NotVerified);
+    NacosAccessControlCapabilities {
+        mode: NacosAccessControlMode::RoleBindings,
+        list_users: unavailable.clone(),
+        create_user: unavailable.clone(),
+        update_user: unavailable.clone(),
+        delete_user: unavailable.clone(),
+        list_role_bindings: unavailable.clone(),
+        assign_role: unavailable.clone(),
+        remove_role: unavailable.clone(),
+        list_permissions: unavailable.clone(),
+        grant_permission: unavailable.clone(),
+        revoke_permission: unavailable,
+        enhanced_workspace: false,
+        supports_namespace_privileges: false,
+    }
+}
+
+fn official_full_access_control() -> NacosAccessControlCapabilities {
+    NacosAccessControlCapabilities {
+        mode: NacosAccessControlMode::RoleBindings,
+        list_users: NacosOperationCapability::supported(),
+        create_user: NacosOperationCapability::supported(),
+        update_user: NacosOperationCapability::supported(),
+        delete_user: NacosOperationCapability::supported(),
+        list_role_bindings: NacosOperationCapability::supported(),
+        assign_role: NacosOperationCapability::supported(),
+        remove_role: NacosOperationCapability::supported(),
+        list_permissions: NacosOperationCapability::supported(),
+        grant_permission: NacosOperationCapability::supported(),
+        revoke_permission: NacosOperationCapability::supported(),
+        enhanced_workspace: true,
+        supports_namespace_privileges: false,
+    }
+}
 
 #[derive(Debug, Clone)]
 struct AccessToken {
@@ -69,6 +171,9 @@ pub struct NacosOpenApiAdmin {
     rnacos_console_session: RNacosConsoleSessionHandle,
     detected_rnacos: AtomicBool,
     detected_major_version: AtomicU8,
+    managed_namespace_fallback_used: AtomicBool,
+    global_admin: AtomicU8,
+    access_control_capabilities: StdRwLock<Option<CachedAccessControlCapabilities>>,
 }
 
 impl NacosOpenApiAdmin {
@@ -93,7 +198,17 @@ impl NacosOpenApiAdmin {
             // API generations: they follow the established v2 Naming API.
             Some(NacosVersionMode::V2) | Some(NacosVersionMode::Auto) | None => 2,
         });
-        Ok(Self { cfg, http, token: Mutex::new(None), rnacos_console_session, detected_rnacos, detected_major_version })
+        Ok(Self {
+            cfg,
+            http,
+            token: Mutex::new(None),
+            rnacos_console_session,
+            detected_rnacos,
+            detected_major_version,
+            managed_namespace_fallback_used: AtomicBool::new(false),
+            global_admin: AtomicU8::new(0),
+            access_control_capabilities: StdRwLock::new(None),
+        })
     }
 
     fn endpoint_with_context(&self, path: &str, context_path: &str) -> Result<String, String> {
@@ -240,6 +355,11 @@ impl NacosOpenApiAdmin {
             .or_else(|| token_source.get("expireSeconds"))
             .and_then(Value::as_u64)
             .unwrap_or(18_000);
+        if let Some(global_admin) =
+            token_source.get("globalAdmin").or_else(|| token_source.get("global_admin")).and_then(Value::as_bool)
+        {
+            self.global_admin.store(if global_admin { 2 } else { 1 }, Ordering::Relaxed);
+        }
         *self.token.lock().await = Some(AccessToken {
             token: token.clone(),
             expires_at: Instant::now() + Duration::from_secs(ttl.saturating_sub(30).max(60)),
@@ -264,7 +384,9 @@ impl NacosOpenApiAdmin {
     async fn get_json(&self, path: &str, query: Vec<(String, String)>) -> Result<Value, String> {
         let resp = self.request(reqwest::Method::GET, path, query, None, None).await?;
         let resp = error_for_status(resp, path).await?;
-        response_json_or_text(resp).await
+        let value = response_json_or_text(resp).await?;
+        validate_nacos_json_authorization(&value, path)?;
+        Ok(value)
     }
 
     async fn get_json_without_auth(&self, path: &str, query: Vec<(String, String)>) -> Result<Value, String> {
@@ -423,6 +545,32 @@ impl NacosOpenApiAdmin {
         }
     }
 
+    async fn post_rnacos_console_json(&self, path: &str, body: Value) -> Result<Value, String> {
+        let mut retried_after_expired_session = false;
+        loop {
+            let token = self.rnacos_console_token().await?;
+            let response = self
+                .http
+                .post(self.rnacos_console_endpoint(path)?)
+                .header("Token", token.clone())
+                .json(&body)
+                .send()
+                .await
+                .map_err(|e| format!("r-nacos console request to {path} failed: {e}"))?;
+            let response = error_for_status(response, path).await?;
+            let value = response_json_or_text(response).await?;
+            if value.get("success").and_then(Value::as_bool) == Some(true) {
+                return Ok(value);
+            }
+            if !retried_after_expired_session && rnacos_console_session_expired(&value) {
+                self.clear_rnacos_console_token_if_matches(&token).await;
+                retried_after_expired_session = true;
+                continue;
+            }
+            return Err(format!("r-nacos console {path} failed: {}", rnacos_console_error_detail(&value)));
+        }
+    }
+
     async fn get_rnacos_console_json_without_login(
         &self,
         path: &str,
@@ -1109,11 +1257,11 @@ impl NacosOpenApiAdmin {
         ))
     }
 
-    async fn verify_v3_naming_admin_api(&self) -> Result<(), String> {
+    async fn verify_v3_naming_admin_api(&self, namespace: &str) -> Result<(), String> {
         self.get_json(
             "/v3/admin/ns/service/list",
             vec![
-                ("namespaceId".to_string(), self.namespace(None)),
+                ("namespaceId".to_string(), namespace.to_string()),
                 ("pageNo".to_string(), "1".to_string()),
                 ("pageSize".to_string(), "1".to_string()),
             ],
@@ -1122,11 +1270,11 @@ impl NacosOpenApiAdmin {
         Ok(())
     }
 
-    async fn verify_v3_admin_config_api(&self) -> Result<(), String> {
+    async fn verify_v3_admin_config_api(&self, namespace: &str) -> Result<(), String> {
         self.get_json(
             "/v3/admin/cs/config/list",
             vec![
-                ("namespaceId".to_string(), self.namespace(None)),
+                ("namespaceId".to_string(), namespace.to_string()),
                 ("dataId".to_string(), String::new()),
                 ("groupName".to_string(), String::new()),
                 ("configDetail".to_string(), String::new()),
@@ -1139,6 +1287,316 @@ impl NacosOpenApiAdmin {
         Ok(())
     }
 
+    async fn verify_v3_workspace_api(&self, namespaces: &[NacosNamespaceInfo]) -> Result<(), String> {
+        let configured_namespace = self.namespace(None);
+        let namespace = if configured_namespace.is_empty() {
+            namespaces.first().map(|namespace| namespace.namespace.clone()).unwrap_or_default()
+        } else {
+            configured_namespace
+        };
+        let mut errors = Vec::new();
+        if let Err(error) = self.verify_v3_naming_admin_api(&namespace).await {
+            errors.push(format!("namespace {namespace:?} naming: {error}"));
+        }
+        if let Err(error) = self.verify_v3_admin_config_api(&namespace).await {
+            errors.push(format!("namespace {namespace:?} config: {error}"));
+        }
+        if errors.is_empty() {
+            return Ok(());
+        }
+        Err(classified_error(
+            "authFailed",
+            &format!(
+                "The current Nacos user cannot read configurations and services in any namespace: {}",
+                errors.join("; ")
+            ),
+        ))
+    }
+
+    async fn verify_v3_managed_namespaces(&self, namespaces: &[NacosNamespaceInfo]) -> Result<(), String> {
+        let mut errors = Vec::new();
+        for namespace in namespaces {
+            let namespace_id = &namespace.namespace;
+            let naming_result = self.verify_v3_naming_admin_api(namespace_id).await;
+            let config_result = self.verify_v3_admin_config_api(namespace_id).await;
+            if let Err(error) = naming_result {
+                errors.push(format!("namespace {namespace_id:?} naming: {error}"));
+            }
+            if let Err(error) = config_result {
+                errors.push(format!("namespace {namespace_id:?} config: {error}"));
+            }
+        }
+        if errors.is_empty() {
+            Ok(())
+        } else {
+            Err(classified_error(
+                "managedNamespaceAccessDenied",
+                &format!("One or more configured namespace IDs are not readable: {}", errors.join("; ")),
+            ))
+        }
+    }
+
+    async fn verify_v2_managed_namespaces(&self, namespaces: &[NacosNamespaceInfo]) -> Result<(), String> {
+        let mut errors = Vec::new();
+        for namespace in namespaces {
+            let namespace_id = &namespace.namespace;
+            if let Err(error) = self.get_config_list_value(namespace_id, "", "", "", 1, 1).await {
+                errors.push(format!("namespace {namespace_id:?} config: {error}"));
+            }
+            let params = vec![
+                ("namespaceId".to_string(), namespace_id.clone()),
+                ("pageNo".to_string(), "1".to_string()),
+                ("pageSize".to_string(), "1".to_string()),
+            ];
+            if let Err(error) = self
+                .get_service_json_from_candidates(
+                    "validate Nacos v2 namespace service access",
+                    vec![("/v1/ns/catalog/services", params.clone()), ("/v2/ns/service/list", params)],
+                )
+                .await
+            {
+                errors.push(format!("namespace {namespace_id:?} naming: {error}"));
+            }
+        }
+        if errors.is_empty() {
+            Ok(())
+        } else {
+            Err(classified_error(
+                "managedNamespaceAccessDenied",
+                &format!("One or more configured namespace IDs are not readable: {}", errors.join("; ")),
+            ))
+        }
+    }
+
+    fn map_v3_verification_error(error: String) -> String {
+        if error.contains("[contextPathMismatch]") || error.contains("[apiVersionMismatch]") {
+            format!(
+                "NACOS_ERROR[v3AdminEndpointMismatch]: {error}. Nacos 3 服务管理使用 Server / Admin API，通常为 http://主机:8848/nacos；不要使用 8080 Console 端口，并确认上下文路径为 /nacos。"
+            )
+        } else {
+            error
+        }
+    }
+
+    fn baseline_access_control_capabilities(&self) -> NacosAccessControlCapabilities {
+        if self.is_rnacos_compatible() {
+            if self.cfg.rnacos_console_addr.trim().is_empty() || !self.cfg.has_effective_rnacos_console_credentials() {
+                return NacosAccessControlCapabilities::unavailable(NacosCapabilityReason::EndpointUnavailable);
+            }
+            return NacosAccessControlCapabilities {
+                mode: NacosAccessControlMode::EmbeddedRoles,
+                list_users: NacosOperationCapability::supported(),
+                create_user: NacosOperationCapability::supported(),
+                update_user: NacosOperationCapability::supported(),
+                delete_user: NacosOperationCapability::supported(),
+                list_role_bindings: NacosOperationCapability::unsupported(NacosCapabilityReason::VersionUnsupported),
+                assign_role: NacosOperationCapability::unsupported(NacosCapabilityReason::VersionUnsupported),
+                remove_role: NacosOperationCapability::unsupported(NacosCapabilityReason::VersionUnsupported),
+                list_permissions: NacosOperationCapability::unsupported(NacosCapabilityReason::VersionUnsupported),
+                grant_permission: NacosOperationCapability::unsupported(NacosCapabilityReason::VersionUnsupported),
+                revoke_permission: NacosOperationCapability::unsupported(NacosCapabilityReason::VersionUnsupported),
+                enhanced_workspace: false,
+                supports_namespace_privileges: true,
+            };
+        }
+        if matches!(self.cfg.auth, NacosAuthConfig::None) {
+            official_full_access_control()
+        } else {
+            official_unverified_access_control()
+        }
+    }
+
+    fn cached_access_control_capabilities(&self) -> Option<NacosAccessControlCapabilities> {
+        self.access_control_capabilities
+            .read()
+            .unwrap_or_else(|error| error.into_inner())
+            .as_ref()
+            .filter(|cached| cached.expires_at > Instant::now())
+            .map(|cached| cached.capabilities.clone())
+    }
+
+    fn store_access_control_capabilities(
+        &self,
+        capabilities: NacosAccessControlCapabilities,
+        authorization: Option<CachedOfficialAuthorization>,
+    ) {
+        *self.access_control_capabilities.write().unwrap_or_else(|error| error.into_inner()) =
+            Some(CachedAccessControlCapabilities {
+                capabilities,
+                authorization,
+                expires_at: Instant::now() + ACCESS_CONTROL_CAPABILITY_CACHE_TTL,
+            });
+    }
+
+    fn cached_official_authorization(&self, username: &str) -> Option<CachedOfficialAuthorization> {
+        self.access_control_capabilities
+            .read()
+            .unwrap_or_else(|error| error.into_inner())
+            .as_ref()
+            .filter(|cached| cached.expires_at > Instant::now())
+            .and_then(|cached| cached.authorization.as_ref())
+            .filter(|authorization| authorization.username == username)
+            .cloned()
+    }
+
+    fn console_write_granted(permissions: &[NacosPermissionInfo], roles: &HashSet<String>, resource: &str) -> bool {
+        permissions.iter().any(|permission| {
+            roles.contains(&permission.role)
+                && permission.resource_raw.trim().eq_ignore_ascii_case(resource)
+                && matches!(permission.action_raw.trim().to_ascii_lowercase().as_str(), "w" | "rw" | "wr" | "*")
+        })
+    }
+
+    async fn probe_access_control_capabilities(&self) -> NacosAccessControlCapabilities {
+        if let Some(capabilities) = self.cached_access_control_capabilities() {
+            return capabilities;
+        }
+        if self.explicitly_scoped_namespace_ids().is_some() {
+            let capabilities = NacosAccessControlCapabilities::unavailable(NacosCapabilityReason::PermissionDenied);
+            self.store_access_control_capabilities(capabilities.clone(), None);
+            return capabilities;
+        }
+        let baseline = self.baseline_access_control_capabilities();
+        if self.is_rnacos_compatible() || matches!(self.cfg.auth, NacosAuthConfig::None) {
+            self.store_access_control_capabilities(baseline.clone(), None);
+            return baseline;
+        }
+        let Some(username) = self.current_username() else {
+            self.store_access_control_capabilities(baseline.clone(), None);
+            return baseline;
+        };
+
+        let users = self
+            .list_users(NacosUserQuery { username: Some(username.clone()), page_no: Some(1), page_size: Some(1) })
+            .await;
+        let role_bindings = self
+            .list_role_bindings(NacosRoleQuery {
+                username: Some(username.clone()),
+                role: None,
+                page_no: Some(1),
+                page_size: Some(ACCESS_CONTROL_PROBE_PAGE_SIZE),
+            })
+            .await;
+        let permissions = self
+            .list_permissions(NacosPermissionQuery {
+                role: None,
+                resource: None,
+                page_no: Some(1),
+                page_size: Some(ACCESS_CONTROL_PROBE_PAGE_SIZE),
+            })
+            .await;
+
+        let list_users = read_capability(&users);
+        let list_role_bindings = read_capability(&role_bindings);
+        let list_permissions = read_capability(&permissions);
+        let roles = role_bindings
+            .as_ref()
+            .map(|page| {
+                page.items
+                    .iter()
+                    .filter(|binding| binding.username == username)
+                    .map(|binding| binding.role.clone())
+                    .collect::<HashSet<_>>()
+            })
+            .unwrap_or_default();
+        let global_admin = self.global_admin.load(Ordering::Relaxed) == 2 || roles.contains(ADMIN_ROLE);
+        let authorization_complete = global_admin
+            || role_bindings.as_ref().is_ok_and(|page| page.total_count <= page.items.len() as u64)
+                && permissions.as_ref().is_ok_and(|page| page.total_count <= page.items.len() as u64);
+        let permission_items = permissions.as_ref().map(|page| page.items.as_slice()).unwrap_or_default();
+        let users_write = global_admin || Self::console_write_granted(permission_items, &roles, CONSOLE_USERS_RESOURCE);
+        let roles_write = global_admin || Self::console_write_granted(permission_items, &roles, CONSOLE_ROLES_RESOURCE);
+        let permissions_write =
+            global_admin || Self::console_write_granted(permission_items, &roles, CONSOLE_PERMISSIONS_RESOURCE);
+        let create_user = write_capability(&list_users, authorization_complete, users_write);
+        let update_user = create_user.clone();
+        let delete_user = create_user.clone();
+        let assign_role = write_capability(&list_role_bindings, authorization_complete, roles_write);
+        let remove_role = assign_role.clone();
+        let grant_permission = write_capability(&list_permissions, authorization_complete, permissions_write);
+        let revoke_permission = grant_permission.clone();
+        // The directory-detail workspace is a read surface. Individual
+        // mutations are guarded separately so a read-only or partially
+        // privileged administrator can still inspect the data it may read.
+        let enhanced_workspace =
+            [&list_users, &list_role_bindings, &list_permissions].into_iter().all(|capability| capability.supported);
+        let capabilities = NacosAccessControlCapabilities {
+            mode: NacosAccessControlMode::RoleBindings,
+            list_users,
+            create_user,
+            update_user,
+            delete_user,
+            list_role_bindings,
+            assign_role,
+            remove_role,
+            list_permissions,
+            grant_permission,
+            revoke_permission,
+            enhanced_workspace,
+            supports_namespace_privileges: false,
+        };
+        self.store_access_control_capabilities(
+            capabilities.clone(),
+            Some(CachedOfficialAuthorization { username, role_bindings, permissions }),
+        );
+        capabilities
+    }
+
+    async fn complete_role_bindings_page(
+        &self,
+        username: &str,
+        first_page: NacosRoleList,
+    ) -> Result<Vec<NacosRoleBinding>, String> {
+        let mut items = first_page.items;
+        let total_count = first_page.total_count;
+        let page_size = first_page.page_size.max(1);
+        let mut page_no = first_page.page_no.max(1);
+        while (items.len() as u64) < total_count {
+            page_no += 1;
+            let page = self
+                .list_role_bindings(NacosRoleQuery {
+                    username: Some(username.to_string()),
+                    role: None,
+                    page_no: Some(page_no),
+                    page_size: Some(page_size),
+                })
+                .await?;
+            let count = page.items.len();
+            items.extend(page.items);
+            if count < page_size as usize {
+                break;
+            }
+        }
+        Ok(items)
+    }
+
+    async fn complete_permissions_page(
+        &self,
+        first_page: NacosPermissionList,
+    ) -> Result<Vec<NacosPermissionInfo>, String> {
+        let mut items = first_page.items;
+        let total_count = first_page.total_count;
+        let page_size = first_page.page_size.max(1);
+        let mut page_no = first_page.page_no.max(1);
+        while (items.len() as u64) < total_count {
+            page_no += 1;
+            let page = self
+                .list_permissions(NacosPermissionQuery {
+                    role: None,
+                    resource: None,
+                    page_no: Some(page_no),
+                    page_size: Some(page_size),
+                })
+                .await?;
+            let count = page.items.len();
+            items.extend(page.items);
+            if count < page_size as usize {
+                break;
+            }
+        }
+        Ok(items)
+    }
+
     async fn update_v3_admin_instance(&self, req: NacosInstanceUpdateRequest) -> Result<(), String> {
         let namespace = self.namespace(req.target.namespace.as_deref());
         // Nacos v3 exposes a dedicated partial-update endpoint. Send only the
@@ -1223,6 +1681,31 @@ impl NacosAdmin for NacosOpenApiAdmin {
         capabilities
     }
 
+    fn access_control_capabilities(&self) -> NacosAccessControlCapabilities {
+        self.cached_access_control_capabilities().unwrap_or_else(|| self.baseline_access_control_capabilities())
+    }
+
+    fn invalidate_access_control_capabilities(&self) {
+        *self.access_control_capabilities.write().unwrap_or_else(|error| error.into_inner()) = None;
+    }
+
+    fn current_username(&self) -> Option<String> {
+        match &self.cfg.auth {
+            crate::nacos::config::NacosAuthConfig::UsernamePassword { username, .. } => {
+                let username = username.trim();
+                (!username.is_empty()).then(|| username.to_string())
+            }
+            crate::nacos::config::NacosAuthConfig::None => None,
+        }
+    }
+
+    fn explicitly_scoped_namespace_ids(&self) -> Option<Vec<String>> {
+        (!self.is_explicit_rnacos()
+            && matches!(self.cfg.auth, NacosAuthConfig::UsernamePassword { .. })
+            && !self.cfg.managed_namespaces.is_empty())
+        .then(|| self.cfg.managed_namespaces.clone())
+    }
+
     async fn test_connection(&self) -> Result<NacosConnectionInfo, String> {
         // Server-state endpoints are console APIs and r-nacos deliberately only
         // guarantees the client OpenAPI. Treat state/health as best-effort;
@@ -1236,7 +1719,7 @@ impl NacosAdmin for NacosOpenApiAdmin {
         let is_rnacos = self.is_explicit_rnacos() || state.as_ref().is_some_and(|state| state.is_rnacos_compatible);
         self.detected_rnacos.store(is_rnacos, Ordering::Relaxed);
         let _ = self.access_token().await?;
-        let _ = self.list_namespaces().await?;
+        let namespaces = self.list_namespaces().await?;
         let mut capabilities = NacosCapabilities::default();
         if is_rnacos {
             capabilities.service_management = self.service_capabilities();
@@ -1251,6 +1734,12 @@ impl NacosAdmin for NacosOpenApiAdmin {
                 capabilities.history_unavailable_reason = Some("consoleCredentialsMissing".to_string());
             }
         }
+        let access_control = if self.explicitly_scoped_namespace_ids().is_some() {
+            NacosAccessControlCapabilities::unavailable(NacosCapabilityReason::PermissionDenied)
+        } else {
+            self.access_control_capabilities()
+        };
+        capabilities.access_control = access_control;
         capabilities.supports_service_management = capabilities.service_management.list_services.supported;
         capabilities.supports_instance_update = capabilities.service_management.update_instance.supported;
         let server_version = if is_rnacos {
@@ -1260,16 +1749,20 @@ impl NacosAdmin for NacosOpenApiAdmin {
         };
         let is_v3 = matches!(self.cfg.version_mode, Some(NacosVersionMode::V3));
         if !is_rnacos && is_v3 {
-            self.verify_v3_naming_admin_api().await.map_err(|error| {
-                if error.contains("[contextPathMismatch]") || error.contains("[apiVersionMismatch]") {
-                    format!(
-                        "NACOS_ERROR[v3AdminEndpointMismatch]: {error}. Nacos 3 服务管理使用 Server / Admin API，通常为 http://主机:8848/nacos；不要使用 8080 Console 端口，并确认上下文路径为 /nacos。"
-                    )
-                } else {
-                    error
-                }
-            })?;
-            self.verify_v3_admin_config_api().await?;
+            let verification = if self.cfg.managed_namespaces.is_empty() {
+                self.verify_v3_workspace_api(&namespaces).await
+            } else {
+                let representative = NacosNamespaceInfo {
+                    namespace: self.cfg.managed_namespaces[0].clone(),
+                    namespace_show_name: self.cfg.managed_namespaces[0].clone(),
+                    namespace_desc: None,
+                    config_count: None,
+                    quota: None,
+                    namespace_type: None,
+                };
+                self.verify_v3_managed_namespaces(std::slice::from_ref(&representative)).await
+            };
+            verification.map_err(Self::map_v3_verification_error)?;
         }
         Ok(NacosConnectionInfo {
             server_addr: self.cfg.server_addr.clone(),
@@ -1285,6 +1778,95 @@ impl NacosAdmin for NacosOpenApiAdmin {
         })
     }
 
+    async fn test_connection_with_scope_validation(&self) -> Result<NacosConnectionInfo, String> {
+        let info = self.test_connection().await?;
+        if self.is_rnacos_compatible() || self.cfg.managed_namespaces.is_empty() {
+            return Ok(info);
+        }
+        if matches!(self.cfg.version_mode, Some(NacosVersionMode::V3)) {
+            // The bounded regular check already validated the first configured
+            // namespace. The explicit check completes the remainder without
+            // repeating that pair of requests.
+            let managed_namespaces = self
+                .cfg
+                .managed_namespaces
+                .iter()
+                .skip(1)
+                .map(|namespace| NacosNamespaceInfo {
+                    namespace: namespace.clone(),
+                    namespace_show_name: namespace.clone(),
+                    namespace_desc: None,
+                    config_count: None,
+                    quota: None,
+                    namespace_type: None,
+                })
+                .collect::<Vec<_>>();
+            if !managed_namespaces.is_empty() {
+                self.verify_v3_managed_namespaces(&managed_namespaces)
+                    .await
+                    .map_err(Self::map_v3_verification_error)?;
+            }
+        } else if matches!(self.cfg.version_mode, Some(NacosVersionMode::V2)) {
+            let managed_namespaces = self
+                .cfg
+                .managed_namespaces
+                .iter()
+                .map(|namespace| NacosNamespaceInfo {
+                    namespace: namespace.clone(),
+                    namespace_show_name: namespace.clone(),
+                    namespace_desc: None,
+                    config_count: None,
+                    quota: None,
+                    namespace_type: None,
+                })
+                .collect::<Vec<_>>();
+            self.verify_v2_managed_namespaces(&managed_namespaces).await?;
+        }
+        Ok(info)
+    }
+
+    async fn refresh_access_control_capabilities(&self) -> NacosAccessControlCapabilities {
+        self.probe_access_control_capabilities().await
+    }
+
+    async fn refresh_namespace_authorization(
+        &self,
+        username: &str,
+    ) -> Result<Option<NacosNamespaceAuthorizationSnapshot>, String> {
+        let access_control = self.probe_access_control_capabilities().await;
+        let Some(authorization) = self.cached_official_authorization(username) else {
+            return Ok(None);
+        };
+        let login_global_admin = self.global_admin.load(Ordering::Relaxed) == 2;
+        if login_global_admin {
+            return Ok(Some(NacosNamespaceAuthorizationSnapshot {
+                access_control,
+                roles: vec![ADMIN_ROLE.to_string()],
+                permissions: Vec::new(),
+                global_admin: true,
+            }));
+        }
+
+        let role_bindings = self.complete_role_bindings_page(username, authorization.role_bindings?).await?;
+        let mut roles = role_bindings
+            .into_iter()
+            .filter(|binding| binding.username == username)
+            .map(|binding| binding.role)
+            .collect::<Vec<_>>();
+        roles.sort();
+        roles.dedup();
+        let global_admin = roles.iter().any(|role| role == ADMIN_ROLE);
+        let permissions =
+            if global_admin { Vec::new() } else { self.complete_permissions_page(authorization.permissions?).await? };
+        Ok(Some(NacosNamespaceAuthorizationSnapshot { access_control, roles, permissions, global_admin }))
+    }
+
+    async fn inspect_connection(&self) -> Result<NacosConnectionInfo, String> {
+        let mut info = self.test_connection().await?;
+        info.capabilities.access_control = self.probe_access_control_capabilities().await;
+        Ok(info)
+    }
+
     async fn get_rnacos_console_captcha(&self) -> Result<NacosRNacosConsoleCaptcha, String> {
         self.fetch_rnacos_console_captcha().await
     }
@@ -1293,6 +1875,323 @@ impl NacosAdmin for NacosOpenApiAdmin {
         self.login_rnacos_console_with_captcha(captcha).await.map(|_| ())
     }
 
+    async fn list_users(&self, query: NacosUserQuery) -> Result<NacosUserList, String> {
+        let page_no = query.page_no.unwrap_or(1).max(1);
+        let page_size = query.page_size.unwrap_or(self.cfg.page_size).clamp(1, 500);
+        let username = query.username.unwrap_or_default().trim().to_string();
+        if self.is_rnacos_compatible() {
+            let value = self
+                .get_rnacos_console_json(
+                    "/rnacos/api/console/v2/user/list",
+                    vec![
+                        ("likeUsername".to_string(), username),
+                        ("pageNo".to_string(), page_no.to_string()),
+                        ("pageSize".to_string(), page_size.to_string()),
+                        ("isRev".to_string(), "false".to_string()),
+                    ],
+                )
+                .await?;
+            return Ok(parse_user_list(value, page_no, page_size));
+        }
+        let value = self
+            .get_json_from_candidates(
+                "list Nacos users",
+                vec![
+                    (
+                        "/v3/auth/user/list",
+                        vec![
+                            ("pageNo".to_string(), page_no.to_string()),
+                            ("pageSize".to_string(), page_size.to_string()),
+                            ("username".to_string(), username.clone()),
+                            ("search".to_string(), "blur".to_string()),
+                        ],
+                    ),
+                    (
+                        "/v1/auth/users",
+                        vec![
+                            ("pageNo".to_string(), page_no.to_string()),
+                            ("pageSize".to_string(), page_size.to_string()),
+                            ("username".to_string(), username),
+                            ("search".to_string(), "blur".to_string()),
+                        ],
+                    ),
+                ],
+            )
+            .await?;
+        Ok(parse_user_list(value, page_no, page_size))
+    }
+
+    async fn create_user(&self, req: NacosUserCreate) -> Result<(), String> {
+        let username = validated_nacos_username(&req.username)?;
+        if req.password.is_empty() {
+            return Err(classified_error("invalidUser", "Nacos user password is required"));
+        }
+        if self.is_rnacos_compatible() {
+            self.post_rnacos_console_json(
+                "/rnacos/api/console/v2/user/add",
+                rnacos_user_payload(
+                    &username,
+                    Some(&req.password),
+                    req.nickname.as_deref(),
+                    req.enabled,
+                    Some(&req.roles),
+                    req.namespace_privilege.as_ref(),
+                    true,
+                ),
+            )
+            .await?;
+            return Ok(());
+        }
+        self.submit_form_candidates(
+            "create Nacos user",
+            reqwest::Method::POST,
+            vec![
+                (
+                    "/v3/auth/user",
+                    vec![("username".to_string(), username.clone()), ("password".to_string(), req.password.clone())],
+                ),
+                ("/v1/auth/users", vec![("username".to_string(), username), ("password".to_string(), req.password)]),
+            ],
+        )
+        .await
+    }
+
+    async fn update_user(&self, req: NacosUserUpdate) -> Result<(), String> {
+        let username = validated_nacos_username(&req.username)?;
+        if self.is_rnacos_compatible() {
+            self.post_rnacos_console_json(
+                "/rnacos/api/console/v2/user/update",
+                rnacos_user_payload(
+                    &username,
+                    req.password.as_deref(),
+                    req.nickname.as_deref(),
+                    req.enabled,
+                    req.roles.as_deref(),
+                    req.namespace_privilege.as_ref(),
+                    false,
+                ),
+            )
+            .await?;
+            return Ok(());
+        }
+        let password = req
+            .password
+            .filter(|value| !value.is_empty())
+            .ok_or_else(|| classified_error("invalidUser", "A new password is required when updating a Nacos user"))?;
+        self.submit_form_candidates(
+            "update Nacos user password",
+            reqwest::Method::PUT,
+            vec![
+                (
+                    "/v3/auth/user",
+                    vec![("username".to_string(), username.clone()), ("newPassword".to_string(), password.clone())],
+                ),
+                ("/v1/auth/users", vec![("username".to_string(), username), ("newPassword".to_string(), password)]),
+            ],
+        )
+        .await
+    }
+
+    async fn delete_user(&self, username: String) -> Result<(), String> {
+        let username = validated_nacos_username(&username)?;
+        if self.is_rnacos_compatible() {
+            self.post_rnacos_console_json(
+                "/rnacos/api/console/v2/user/remove",
+                serde_json::json!({ "username": username }),
+            )
+            .await?;
+            return Ok(());
+        }
+        self.submit_query_candidates(
+            "delete Nacos user",
+            reqwest::Method::DELETE,
+            vec![
+                ("/v3/auth/user", vec![("username".to_string(), username.clone())]),
+                ("/v1/auth/users", vec![("username".to_string(), username)]),
+            ],
+        )
+        .await
+    }
+
+    async fn list_role_bindings(&self, query: NacosRoleQuery) -> Result<NacosRoleList, String> {
+        if self.is_rnacos_compatible() {
+            return Err(classified_error(
+                "unsupportedOperation",
+                "r-nacos stores fixed roles on each user instead of exposing role bindings",
+            ));
+        }
+        let page_no = query.page_no.unwrap_or(1).max(1);
+        let page_size = query.page_size.unwrap_or(self.cfg.page_size).clamp(1, 500);
+        let username = query.username.unwrap_or_default().trim().to_string();
+        let role = query.role.unwrap_or_default().trim().to_string();
+        let value = self
+            .get_json_from_candidates(
+                "list Nacos role bindings",
+                vec![
+                    (
+                        "/v3/auth/role/list",
+                        vec![
+                            ("pageNo".to_string(), page_no.to_string()),
+                            ("pageSize".to_string(), page_size.to_string()),
+                            ("username".to_string(), username.clone()),
+                            ("role".to_string(), role.clone()),
+                            ("search".to_string(), "blur".to_string()),
+                        ],
+                    ),
+                    (
+                        "/v1/auth/roles",
+                        vec![
+                            ("pageNo".to_string(), page_no.to_string()),
+                            ("pageSize".to_string(), page_size.to_string()),
+                            ("username".to_string(), username),
+                            ("role".to_string(), role),
+                            ("search".to_string(), "blur".to_string()),
+                        ],
+                    ),
+                ],
+            )
+            .await?;
+        Ok(parse_role_list(value, page_no, page_size))
+    }
+
+    async fn assign_role(&self, binding: NacosRoleBinding) -> Result<(), String> {
+        let username = validated_nacos_username(&binding.username)?;
+        let role = validated_nacos_role(&binding.role)?;
+        if self.is_rnacos_compatible() {
+            return Err(classified_error("unsupportedOperation", "r-nacos roles are updated with the user record"));
+        }
+        self.submit_form_candidates(
+            "assign Nacos role",
+            reqwest::Method::POST,
+            vec![
+                ("/v3/auth/role", vec![("username".to_string(), username.clone()), ("role".to_string(), role.clone())]),
+                ("/v1/auth/roles", vec![("username".to_string(), username), ("role".to_string(), role)]),
+            ],
+        )
+        .await
+    }
+
+    async fn remove_role(&self, binding: NacosRoleBinding) -> Result<(), String> {
+        let username = validated_nacos_username(&binding.username)?;
+        let role = validated_nacos_role(&binding.role)?;
+        if self.is_rnacos_compatible() {
+            return Err(classified_error("unsupportedOperation", "r-nacos roles are updated with the user record"));
+        }
+        // Both Nacos generations interpret an omitted username as "remove every
+        // binding for this role". Always send the pair represented by the UI row.
+        self.submit_query_candidates(
+            "remove Nacos role binding",
+            reqwest::Method::DELETE,
+            vec![
+                ("/v3/auth/role", vec![("username".to_string(), username.clone()), ("role".to_string(), role.clone())]),
+                ("/v1/auth/roles", vec![("username".to_string(), username), ("role".to_string(), role)]),
+            ],
+        )
+        .await
+    }
+
+    async fn list_permissions(&self, query: NacosPermissionQuery) -> Result<NacosPermissionList, String> {
+        if self.is_rnacos_compatible() {
+            return Err(classified_error("unsupportedOperation", "r-nacos does not expose Nacos role permissions"));
+        }
+        let page_no = query.page_no.unwrap_or(1).max(1);
+        let page_size = query.page_size.unwrap_or(self.cfg.page_size).clamp(1, 500);
+        let role = query.role.unwrap_or_default().trim().to_string();
+        let resource = query.resource.unwrap_or_default().trim().to_string();
+        let value = self
+            .get_json_from_candidates(
+                "list Nacos permissions",
+                vec![
+                    (
+                        "/v3/auth/permission/list",
+                        vec![
+                            ("pageNo".to_string(), page_no.to_string()),
+                            ("pageSize".to_string(), page_size.to_string()),
+                            ("role".to_string(), role.clone()),
+                            ("resource".to_string(), resource.clone()),
+                            ("search".to_string(), "blur".to_string()),
+                        ],
+                    ),
+                    (
+                        "/v1/auth/permissions",
+                        vec![
+                            ("pageNo".to_string(), page_no.to_string()),
+                            ("pageSize".to_string(), page_size.to_string()),
+                            ("role".to_string(), role),
+                            ("resource".to_string(), resource),
+                            ("search".to_string(), "blur".to_string()),
+                        ],
+                    ),
+                ],
+            )
+            .await?;
+        Ok(parse_permission_list(value, page_no, page_size))
+    }
+
+    async fn grant_permission(&self, permission: NacosPermissionInfo) -> Result<(), String> {
+        let role = validated_nacos_role(&permission.role)?;
+        let resource = permission.resource_raw.trim().to_string();
+        let action = validated_nacos_permission_action(&permission.action_raw)?;
+        if resource.is_empty() {
+            return Err(classified_error("invalidPermission", "Nacos permission resource is required"));
+        }
+        self.submit_form_candidates(
+            "grant Nacos permission",
+            reqwest::Method::POST,
+            vec![
+                (
+                    "/v3/auth/permission",
+                    vec![
+                        ("role".to_string(), role.clone()),
+                        ("resource".to_string(), resource.clone()),
+                        ("action".to_string(), action.clone()),
+                    ],
+                ),
+                (
+                    "/v1/auth/permissions",
+                    vec![
+                        ("role".to_string(), role),
+                        ("resource".to_string(), resource),
+                        ("action".to_string(), action),
+                    ],
+                ),
+            ],
+        )
+        .await
+    }
+
+    async fn revoke_permission(&self, permission: NacosPermissionInfo) -> Result<(), String> {
+        let role = validated_nacos_role(&permission.role)?;
+        let resource = permission.resource_raw.trim().to_string();
+        let action = permission.action_raw.trim().to_string();
+        if resource.is_empty() || action.is_empty() {
+            return Err(classified_error("invalidPermission", "Nacos permission resource and action are required"));
+        }
+        self.submit_query_candidates(
+            "revoke Nacos permission",
+            reqwest::Method::DELETE,
+            vec![
+                (
+                    "/v3/auth/permission",
+                    vec![
+                        ("role".to_string(), role.clone()),
+                        ("resource".to_string(), resource.clone()),
+                        ("action".to_string(), action.clone()),
+                    ],
+                ),
+                (
+                    "/v1/auth/permissions",
+                    vec![
+                        ("role".to_string(), role),
+                        ("resource".to_string(), resource),
+                        ("action".to_string(), action),
+                    ],
+                ),
+            ],
+        )
+        .await
+    }
+
     async fn list_namespaces(&self) -> Result<Vec<NacosNamespaceInfo>, String> {
         if self.is_rnacos_compatible() {
             // r-nacos v0.6.12 exposes the Nacos-compatible namespace API on
@@ -1311,13 +2210,41 @@ impl NacosAdmin for NacosOpenApiAdmin {
                 }
             }
         }
-        let value = self
+        match self
             .get_json_from_candidates(
                 "list Nacos namespaces",
                 vec![("/v3/admin/core/namespace/list", Vec::new()), ("/v1/console/namespaces", Vec::new())],
             )
-            .await?;
-        Ok(parse_namespaces(value))
+            .await
+        {
+            Ok(value) => {
+                self.managed_namespace_fallback_used.store(false, Ordering::Relaxed);
+                Ok(parse_namespaces(value))
+            }
+            Err(error) if classify_nacos_error(&error) == "authFailed" => {
+                if let Some(managed_namespaces) = self.explicitly_scoped_namespace_ids() {
+                    self.managed_namespace_fallback_used.store(true, Ordering::Relaxed);
+                    return Ok(managed_namespaces
+                        .into_iter()
+                        .map(|namespace| NacosNamespaceInfo {
+                            namespace: namespace.clone(),
+                            namespace_show_name: namespace,
+                            namespace_desc: None,
+                            config_count: None,
+                            quota: None,
+                            namespace_type: None,
+                        })
+                        .collect());
+                }
+                Err(classified_error(
+                    "managedNamespacesRequired",
+                    &format!(
+                        "{error}. This Nacos account cannot list namespaces. Enable the ordinary-user option and enter at least one namespace ID that the account is allowed to manage"
+                    ),
+                ))
+            }
+            Err(error) => Err(error),
+        }
     }
 
     async fn create_namespace(&self, req: NacosNamespaceCreate) -> Result<(), String> {
@@ -2294,7 +3221,7 @@ pub fn validate_raw_api_path(path: &str) -> Result<(), String> {
 
 fn parse_namespaces(value: Value) -> Vec<NacosNamespaceInfo> {
     let data = value.get("data").unwrap_or(&value);
-    let items = data
+    let items: Vec<Value> = data
         .as_array()
         .cloned()
         .or_else(|| data.get("namespaces").and_then(Value::as_array).cloned())
@@ -2343,6 +3270,207 @@ fn parse_namespaces(value: Value) -> Vec<NacosNamespaceInfo> {
     namespaces
 }
 
+fn validated_nacos_username(value: &str) -> Result<String, String> {
+    let value = value.trim();
+    if value.is_empty() {
+        return Err(classified_error("invalidUser", "Nacos username is required"));
+    }
+    Ok(value.to_string())
+}
+
+fn validated_nacos_role(value: &str) -> Result<String, String> {
+    let value = value.trim();
+    if value.is_empty() {
+        return Err(classified_error("invalidRole", "Nacos role is required"));
+    }
+    Ok(value.to_string())
+}
+
+fn validated_nacos_permission_action(value: &str) -> Result<String, String> {
+    let value = value.trim().to_ascii_lowercase();
+    if matches!(value.as_str(), "r" | "w" | "rw") {
+        Ok(value)
+    } else {
+        Err(classified_error("invalidPermission", "Nacos permission action must be r, w, or rw"))
+    }
+}
+
+fn parse_permission_scope(resource: &str) -> Option<NacosPermissionScope> {
+    let resource = resource.trim();
+    if resource.is_empty() {
+        return Some(NacosPermissionScope { kind: NacosPermissionScopeKind::Unknown, namespace_id: None });
+    }
+    if resource == "*:*:*" {
+        return Some(NacosPermissionScope { kind: NacosPermissionScopeKind::Global, namespace_id: None });
+    }
+    if let Some(namespace_id) = resource.strip_suffix(":*:*") {
+        if !namespace_id.contains(':') && namespace_id != "*" {
+            return Some(NacosPermissionScope {
+                kind: NacosPermissionScopeKind::Namespace,
+                namespace_id: Some(if namespace_id.is_empty() {
+                    "public".to_string()
+                } else {
+                    namespace_id.to_string()
+                }),
+            });
+        }
+        return Some(NacosPermissionScope { kind: NacosPermissionScopeKind::Custom, namespace_id: None });
+    }
+    Some(NacosPermissionScope { kind: NacosPermissionScopeKind::Custom, namespace_id: None })
+}
+
+fn rnacos_user_payload(
+    username: &str,
+    password: Option<&str>,
+    nickname: Option<&str>,
+    enabled: Option<bool>,
+    roles: Option<&[String]>,
+    namespace_privilege: Option<&NacosNamespacePrivilege>,
+    create: bool,
+) -> Value {
+    let mut payload = serde_json::Map::new();
+    payload.insert("username".to_string(), Value::String(username.to_string()));
+    if let Some(password) = password.filter(|value| !value.is_empty()) {
+        payload.insert("password".to_string(), Value::String(password.to_string()));
+    }
+    if let Some(nickname) = nickname.map(str::trim).filter(|value| !value.is_empty()) {
+        payload.insert("nickname".to_string(), Value::String(nickname.to_string()));
+    } else if create {
+        payload.insert("nickname".to_string(), Value::String(username.to_string()));
+    }
+    if let Some(enabled) = enabled {
+        payload.insert("enable".to_string(), Value::Bool(enabled));
+    }
+    if let Some(roles) = roles {
+        payload.insert(
+            "roles".to_string(),
+            Value::String(
+                roles.iter().map(|role| role.trim()).filter(|role| !role.is_empty()).collect::<Vec<_>>().join(","),
+            ),
+        );
+    }
+    if let Some(privilege) = namespace_privilege {
+        // r-nacos' UpdateUserInfoParam accepts only PrivilegeGroupOptionParam
+        // here. The response's `enabled` flag is derived server-side and is
+        // intentionally not a writable request field.
+        payload.insert(
+            "namespacePrivilegeParam".to_string(),
+            serde_json::json!({
+                "whitelistIsAll": privilege.whitelist_is_all,
+                "whitelist": privilege.whitelist,
+                "blacklistIsAll": privilege.blacklist_is_all,
+                "blacklist": privilege.blacklist,
+            }),
+        );
+    }
+    Value::Object(payload)
+}
+
+fn parse_user_list(value: Value, page_no: u32, page_size: u32) -> NacosUserList {
+    let data = value.get("data").unwrap_or(&value);
+    let total_count = optional_u64_field(data, &["totalCount", "count"])
+        .or_else(|| optional_u64_field(&value, &["totalCount", "count"]))
+        .unwrap_or_default();
+    let items: Vec<NacosUserInfo> = data
+        .get("pageItems")
+        .or_else(|| data.get("list"))
+        .or_else(|| data.get("items"))
+        .or_else(|| value.get("pageItems"))
+        .and_then(Value::as_array)
+        .cloned()
+        .unwrap_or_default()
+        .into_iter()
+        .filter_map(|item| {
+            let username = optional_string_field(&item, &["username", "userName"])?;
+            let roles = item
+                .get("roles")
+                .and_then(Value::as_array)
+                .map(|roles| roles.iter().filter_map(Value::as_str).map(str::to_string).collect::<Vec<_>>())
+                .unwrap_or_default();
+            let namespace_privilege = item.get("namespacePrivilege").map(|privilege| NacosNamespacePrivilege {
+                enabled: optional_bool_field(privilege, &["enabled"]).unwrap_or(true),
+                whitelist_is_all: optional_bool_field(privilege, &["whitelistIsAll"]).unwrap_or(true),
+                whitelist: privilege
+                    .get("whitelist")
+                    .and_then(Value::as_array)
+                    .map(|items| items.iter().filter_map(Value::as_str).map(str::to_string).collect())
+                    .unwrap_or_default(),
+                blacklist_is_all: optional_bool_field(privilege, &["blacklistIsAll"]).unwrap_or(false),
+                blacklist: privilege
+                    .get("blacklist")
+                    .and_then(Value::as_array)
+                    .map(|items| items.iter().filter_map(Value::as_str).map(str::to_string).collect())
+                    .unwrap_or_default(),
+            });
+            Some(NacosUserInfo {
+                username,
+                nickname: optional_string_field(&item, &["nickname"]),
+                enabled: optional_bool_field(&item, &["enable", "enabled"]),
+                roles,
+                namespace_privilege,
+                source: optional_string_field(&item, &["source"]),
+            })
+        })
+        .collect();
+    let total_count = if total_count == 0 { items.len() as u64 } else { total_count };
+    NacosUserList { page_no, page_size, total_count, items }
+}
+
+fn parse_role_list(value: Value, page_no: u32, page_size: u32) -> NacosRoleList {
+    let data = value.get("data").unwrap_or(&value);
+    let total_count = optional_u64_field(data, &["totalCount", "count"])
+        .or_else(|| optional_u64_field(&value, &["totalCount", "count"]))
+        .unwrap_or_default();
+    let items: Vec<NacosRoleBinding> = data
+        .get("pageItems")
+        .or_else(|| data.get("list"))
+        .or_else(|| data.get("items"))
+        .or_else(|| value.get("pageItems"))
+        .and_then(Value::as_array)
+        .cloned()
+        .unwrap_or_default()
+        .into_iter()
+        .filter_map(|item| {
+            Some(NacosRoleBinding {
+                username: optional_string_field(&item, &["username", "userName"])?,
+                role: optional_string_field(&item, &["role"])?,
+            })
+        })
+        .collect();
+    let total_count = if total_count == 0 { items.len() as u64 } else { total_count };
+    NacosRoleList { page_no, page_size, total_count, items }
+}
+
+fn parse_permission_list(value: Value, page_no: u32, page_size: u32) -> NacosPermissionList {
+    let data = value.get("data").unwrap_or(&value);
+    let total_count = optional_u64_field(data, &["totalCount", "count"])
+        .or_else(|| optional_u64_field(&value, &["totalCount", "count"]))
+        .unwrap_or_default();
+    let items: Vec<NacosPermissionInfo> = data
+        .get("pageItems")
+        .or_else(|| data.get("list"))
+        .or_else(|| data.get("items"))
+        .or_else(|| value.get("pageItems"))
+        .and_then(Value::as_array)
+        .cloned()
+        .unwrap_or_default()
+        .into_iter()
+        .filter_map(|item| {
+            let role = optional_string_field(&item, &["role"])?;
+            let resource_raw = optional_string_field(&item, &["resource"])?;
+            let action_raw = optional_string_field(&item, &["action"])?;
+            Some(NacosPermissionInfo {
+                role,
+                parsed_scope: parse_permission_scope(&resource_raw),
+                resource_raw,
+                action_raw,
+            })
+        })
+        .collect();
+    let total_count = if total_count == 0 { items.len() as u64 } else { total_count };
+    NacosPermissionList { page_no, page_size, total_count, items }
+}
+
 fn parse_dashboard_metrics(value: Value) -> NacosDashboardMetrics {
     let data = value.get("data").unwrap_or(&value);
     NacosDashboardMetrics {
@@ -2608,6 +3736,17 @@ fn classify_nacos_error(message: &str) -> &'static str {
     "requestFailed"
 }
 
+fn validate_nacos_json_authorization(value: &Value, path: &str) -> Result<(), String> {
+    let code = value.get("code").and_then(|value| value.as_i64().or_else(|| value.as_str()?.parse::<i64>().ok()));
+    if !matches!(code, Some(403 | 10001)) {
+        return Ok(());
+    }
+    let message = value.get("message").and_then(Value::as_str).unwrap_or("access denied");
+    let detail = value.get("data").and_then(Value::as_str).unwrap_or_default();
+    let detail = format!("Nacos {path} returned code {}: {message} {detail}", code.unwrap_or_default());
+    Err(classified_error("authFailed", detail.trim()))
+}
+
 fn extract_server_version(raw: &Value) -> Option<String> {
     raw.get("version")
         .or_else(|| raw.get("serverVersion"))
@@ -3261,6 +4400,13 @@ mod tests {
         socket.write_all(response.as_bytes()).await.unwrap();
     }
 
+    async fn accept_json_request(listener: &tokio::net::TcpListener, body: &str) -> String {
+        let (mut socket, _) = listener.accept().await.unwrap();
+        let target = read_request_target(&mut socket).await;
+        write_json_response(&mut socket, body).await;
+        target
+    }
+
     async fn write_text_response(socket: &mut tokio::net::TcpStream, body: &str) {
         let response = format!(
             "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
@@ -3314,6 +4460,7 @@ mod tests {
             display_server_addr: server_addr,
             namespace: String::new(),
             context_path: String::new(),
+            managed_namespaces: Vec::new(),
             rnacos_console_addr: String::new(),
             rnacos_history_enabled: None,
             rnacos_console_auth: Default::default(),
@@ -3326,6 +4473,159 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn v3_namespace_list_uses_managed_namespaces_after_admin_denial() {
+        let api_listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let api_address = api_listener.local_addr().unwrap();
+        let api_server = tokio::spawn(async move {
+            let (mut socket, _) = api_listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v3/auth/user/login");
+            write_json_response(&mut socket, r#"{"code":0,"data":{"accessToken":"ordinary-token","tokenTtl":18000}}"#)
+                .await;
+            let (mut socket, _) = api_listener.accept().await.unwrap();
+            let target = read_request_target(&mut socket).await;
+            assert!(target.starts_with("/nacos/v3/admin/core/namespace/list?"));
+            assert!(target.contains("accessToken=ordinary-token"));
+            write_json_response(
+                &mut socket,
+                r#"{"code":10001,"message":"access denied","data":"Code: 403, Message: authorization failed!."}"#,
+            )
+            .await;
+        });
+
+        let mut config = test_admin_config(format!("http://{api_address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V3);
+        config.context_path = "/nacos".to_string();
+        config.managed_namespaces = vec!["team-a".to_string(), "public".to_string()];
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        let admin = NacosOpenApiAdmin::new(config).unwrap();
+
+        let namespaces = admin.list_namespaces().await.unwrap();
+        assert!(namespaces.iter().any(|namespace| namespace.namespace == "team-a"));
+        assert!(namespaces.iter().any(|namespace| namespace.namespace == "public"));
+        api_server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v3_namespace_list_requires_managed_namespaces_after_admin_denial() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v3/auth/user/login");
+            write_json_response(&mut socket, r#"{"code":0,"data":{"accessToken":"ordinary-token","tokenTtl":18000}}"#)
+                .await;
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v3/admin/core/namespace/list?"));
+            write_json_response(
+                &mut socket,
+                r#"{"code":10001,"message":"access denied","data":"Code: 403, Message: authorization failed!."}"#,
+            )
+            .await;
+        });
+
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V3);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        let error = NacosOpenApiAdmin::new(config).unwrap().list_namespaces().await.unwrap_err();
+
+        assert!(error.contains("NACOS_ERROR[managedNamespacesRequired]"));
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v2_namespace_list_requires_managed_namespaces_after_admin_denial() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/auth/users/login");
+            write_json_response(&mut socket, r#"{"accessToken":"ordinary-token","tokenTtl":18000}"#).await;
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v1/console/namespaces?"));
+            write_json_response(&mut socket, r#"{"code":403,"message":"authorization failed","data":"access denied"}"#)
+                .await;
+        });
+
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V2);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        let error = NacosOpenApiAdmin::new(config).unwrap().list_namespaces().await.unwrap_err();
+
+        assert!(error.contains("NACOS_ERROR[managedNamespacesRequired]"));
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v2_namespace_list_uses_explicit_scope_after_admin_denial() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/auth/users/login");
+            write_json_response(&mut socket, r#"{"accessToken":"ordinary-token","tokenTtl":18000}"#).await;
+            let (mut socket, _) = listener.accept().await.unwrap();
+            let target = read_request_target(&mut socket).await;
+            assert!(target.starts_with("/nacos/v1/console/namespaces?"));
+            assert!(target.contains("accessToken=ordinary-token"));
+            write_json_response(&mut socket, r#"{"code":403,"message":"authorization failed","data":"access denied"}"#)
+                .await;
+        });
+
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V2);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        config.managed_namespaces = vec!["team-a".to_string(), "public".to_string()];
+
+        let namespaces = NacosOpenApiAdmin::new(config).unwrap().list_namespaces().await.unwrap();
+        assert_eq!(
+            namespaces.into_iter().map(|namespace| namespace.namespace).collect::<Vec<_>>(),
+            vec!["team-a".to_string(), "public".to_string()]
+        );
+        server.await.unwrap();
+    }
+
+    #[test]
+    fn official_nacos_v2_ordinary_users_can_define_an_explicit_namespace_scope() {
+        let mut config = test_admin_config("http://127.0.0.1:8848".to_string());
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V2);
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        config.managed_namespaces = vec!["team-a".to_string(), "public".to_string()];
+
+        assert_eq!(
+            NacosOpenApiAdmin::new(config).unwrap().explicitly_scoped_namespace_ids(),
+            Some(vec!["team-a".to_string(), "public".to_string()])
+        );
+    }
+
+    #[test]
+    fn recognizes_v3_authorization_errors_returned_inside_http_200_json() {
+        let error = validate_nacos_json_authorization(
+            &serde_json::json!({"code":10001,"message":"access denied","data":"Code: 403, Message: authorization failed!."}),
+            "/v3/admin/cs/config/list",
+        )
+        .unwrap_err();
+
+        assert!(error.contains("NACOS_ERROR[authFailed]"));
+        assert!(error.contains("authorization failed"));
+        assert!(
+            validate_nacos_json_authorization(&serde_json::json!({"code":0,"message":"success"}), "success").is_ok()
+        );
+    }
+
     #[tokio::test]
     async fn version_mode_v2_uses_only_v1_config_paths() {
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
@@ -4214,6 +5514,516 @@ mod tests {
         server.await.unwrap();
     }
 
+    #[tokio::test]
+    async fn v2_regular_connection_does_not_probe_access_control() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/ns/operator/servers");
+            write_json_response(&mut socket, "{}").await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/auth/users/login");
+            write_json_response(&mut socket, r#"{"accessToken":"ordinary-token","tokenTtl":18000}"#).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v1/console/namespaces?"));
+            write_json_response(&mut socket, r#"[{"namespace":"public","namespaceShowName":"public"}]"#).await;
+
+            assert!(tokio::time::timeout(Duration::from_millis(100), listener.accept()).await.is_err());
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V2);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+
+        let info = NacosOpenApiAdmin::new(config).unwrap().test_connection().await.unwrap();
+
+        assert!(!info.capabilities.access_control.enhanced_workspace);
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v3_regular_connection_does_not_probe_access_control() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v3/admin/core/state");
+            write_json_response(&mut socket, r#"{"version":"3.1.0"}"#).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v3/auth/user/login");
+            write_json_response(&mut socket, r#"{"code":0,"data":{"accessToken":"ordinary-token","tokenTtl":18000}}"#)
+                .await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v3/admin/core/namespace/list?"));
+            write_json_response(
+                &mut socket,
+                r#"{"code":0,"message":"success","data":[{"namespace":"public","namespaceShowName":"public"}]}"#,
+            )
+            .await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v3/admin/ns/service/list?"));
+            write_json_response(
+                &mut socket,
+                r#"{"code":0,"message":"success","data":{"totalCount":0,"pageItems":[]}}"#,
+            )
+            .await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v3/admin/cs/config/list?"));
+            write_json_response(
+                &mut socket,
+                r#"{"code":0,"message":"success","data":{"totalCount":0,"pageItems":[]}}"#,
+            )
+            .await;
+
+            assert!(tokio::time::timeout(Duration::from_millis(100), listener.accept()).await.is_err());
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V3);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+
+        let info = NacosOpenApiAdmin::new(config).unwrap().test_connection().await.unwrap();
+
+        assert!(!info.capabilities.access_control.enhanced_workspace);
+        assert_eq!(info.capabilities.access_control.list_permissions.reason, Some(NacosCapabilityReason::NotVerified));
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v2_connection_check_with_explicit_scope_skips_permission_probe() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/ns/operator/servers");
+            write_json_response(&mut socket, "{}").await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/auth/users/login");
+            write_json_response(&mut socket, r#"{"accessToken":"ordinary-token","tokenTtl":18000}"#).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v1/console/namespaces?"));
+            write_json_response(&mut socket, r#"[{"namespace":"public","namespaceShowName":"public"}]"#).await;
+
+            assert!(tokio::time::timeout(Duration::from_millis(100), listener.accept()).await.is_err());
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V2);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        config.managed_namespaces = vec!["team-a".to_string()];
+
+        let info = NacosOpenApiAdmin::new(config).unwrap().test_connection().await.unwrap();
+
+        assert!(!info.capabilities.access_control.enhanced_workspace);
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v2_explicit_connection_test_validates_every_managed_namespace() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/ns/operator/servers");
+            write_json_response(&mut socket, "{}").await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/auth/users/login");
+            write_json_response(&mut socket, r#"{"accessToken":"ordinary-token","tokenTtl":18000}"#).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v1/console/namespaces?"));
+            write_forbidden_response(&mut socket).await;
+
+            for namespace in ["team-a", "team-b"] {
+                let (mut socket, _) = listener.accept().await.unwrap();
+                let target = read_request_target(&mut socket).await;
+                assert!(target.starts_with("/nacos/v1/cs/configs?"));
+                assert!(target.contains(&format!("tenant={namespace}")));
+                write_json_response(&mut socket, r#"{"totalCount":0,"pageItems":[]}"#).await;
+
+                let (mut socket, _) = listener.accept().await.unwrap();
+                let target = read_request_target(&mut socket).await;
+                assert!(target.starts_with("/nacos/v1/ns/catalog/services?"));
+                assert!(target.contains(&format!("namespaceId={namespace}")));
+                write_json_response(&mut socket, r#"{"count":0,"serviceList":[]}"#).await;
+            }
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V2);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        config.managed_namespaces = vec!["team-a".to_string(), "team-b".to_string()];
+
+        NacosOpenApiAdmin::new(config).unwrap().test_connection_with_scope_validation().await.unwrap();
+
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v2_explicit_connection_test_rejects_an_unreadable_managed_namespace() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/ns/operator/servers");
+            write_json_response(&mut socket, "{}").await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v1/auth/users/login");
+            write_json_response(&mut socket, r#"{"accessToken":"ordinary-token","tokenTtl":18000}"#).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v1/console/namespaces?"));
+            write_forbidden_response(&mut socket).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v1/cs/configs?"));
+            write_forbidden_response(&mut socket).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v1/ns/catalog/services?"));
+            write_json_response(&mut socket, r#"{"count":0,"serviceList":[]}"#).await;
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V2);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        config.managed_namespaces = vec!["team-a".to_string()];
+
+        let error = NacosOpenApiAdmin::new(config).unwrap().test_connection_with_scope_validation().await.unwrap_err();
+
+        assert!(error.contains("NACOS_ERROR[managedNamespaceAccessDenied]"));
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v3_regular_connection_with_explicit_scope_validates_one_representative_namespace() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v3/admin/core/state");
+            write_json_response(&mut socket, r#"{"version":"3.1.0"}"#).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v3/auth/user/login");
+            write_json_response(&mut socket, r#"{"code":0,"data":{"accessToken":"ordinary-token","tokenTtl":18000}}"#)
+                .await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v3/admin/core/namespace/list?"));
+            write_json_response(
+                &mut socket,
+                r#"{"code":10001,"message":"access denied","data":"Code: 403, Message: authorization failed!."}"#,
+            )
+            .await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            let target = read_request_target(&mut socket).await;
+            assert!(target.starts_with("/nacos/v3/admin/ns/service/list?"));
+            assert!(target.contains("namespaceId=team-a"));
+            write_json_response(
+                &mut socket,
+                r#"{"code":0,"message":"success","data":{"totalCount":0,"pageItems":[]}}"#,
+            )
+            .await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            let target = read_request_target(&mut socket).await;
+            assert!(target.starts_with("/nacos/v3/admin/cs/config/list?"));
+            assert!(target.contains("namespaceId=team-a"));
+            write_json_response(
+                &mut socket,
+                r#"{"code":0,"message":"success","data":{"totalCount":0,"pageItems":[]}}"#,
+            )
+            .await;
+
+            assert!(tokio::time::timeout(Duration::from_millis(100), listener.accept()).await.is_err());
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V3);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        config.managed_namespaces = vec!["team-a".to_string()];
+
+        let info = NacosOpenApiAdmin::new(config).unwrap().test_connection().await.unwrap();
+
+        assert!(!info.capabilities.access_control.enhanced_workspace);
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v3_explicit_connection_test_validates_every_managed_namespace() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v3/admin/core/state");
+            write_json_response(&mut socket, r#"{"version":"3.1.0"}"#).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert_eq!(read_request_target(&mut socket).await, "/nacos/v3/auth/user/login");
+            write_json_response(&mut socket, r#"{"code":0,"data":{"accessToken":"ordinary-token","tokenTtl":18000}}"#)
+                .await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v3/admin/core/namespace/list?"));
+            write_json_response(
+                &mut socket,
+                r#"{"code":10001,"message":"access denied","data":"Code: 403, Message: authorization failed!."}"#,
+            )
+            .await;
+
+            for namespace in ["team-a", "team-b"] {
+                let (mut socket, _) = listener.accept().await.unwrap();
+                let target = read_request_target(&mut socket).await;
+                assert!(target.starts_with("/nacos/v3/admin/ns/service/list?"));
+                assert!(target.contains(&format!("namespaceId={namespace}")));
+                write_json_response(
+                    &mut socket,
+                    r#"{"code":0,"message":"success","data":{"totalCount":0,"pageItems":[]}}"#,
+                )
+                .await;
+
+                let (mut socket, _) = listener.accept().await.unwrap();
+                let target = read_request_target(&mut socket).await;
+                assert!(target.starts_with("/nacos/v3/admin/cs/config/list?"));
+                assert!(target.contains(&format!("namespaceId={namespace}")));
+                write_json_response(
+                    &mut socket,
+                    r#"{"code":0,"message":"success","data":{"totalCount":0,"pageItems":[]}}"#,
+                )
+                .await;
+            }
+
+            assert!(tokio::time::timeout(Duration::from_millis(100), listener.accept()).await.is_err());
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V3);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        config.managed_namespaces = vec!["team-a".to_string(), "team-b".to_string()];
+
+        NacosOpenApiAdmin::new(config).unwrap().test_connection_with_scope_validation().await.unwrap();
+
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v3_access_control_reads_are_probed_per_resource() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            assert_eq!(accept_json_request(&listener, r#"{"version":"3.1.0"}"#).await, "/nacos/v3/admin/core/state");
+            assert_eq!(
+                accept_json_request(
+                    &listener,
+                    r#"{"code":0,"data":{"accessToken":"ordinary-token","tokenTtl":18000,"globalAdmin":false}}"#,
+                )
+                .await,
+                "/nacos/v3/auth/user/login"
+            );
+            assert!(accept_json_request(
+                &listener,
+                r#"{"code":0,"data":[{"namespace":"public","namespaceShowName":"public"}]}"#,
+            )
+            .await
+            .starts_with("/nacos/v3/admin/core/namespace/list?"));
+            assert!(accept_json_request(&listener, r#"{"code":0,"data":{"totalCount":0,"pageItems":[]}}"#,)
+                .await
+                .starts_with("/nacos/v3/admin/ns/service/list?"));
+            assert!(accept_json_request(&listener, r#"{"code":0,"data":{"totalCount":0,"pageItems":[]}}"#,)
+                .await
+                .starts_with("/nacos/v3/admin/cs/config/list?"));
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v3/auth/user/list?"));
+            write_forbidden_response(&mut socket).await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            assert!(read_request_target(&mut socket).await.starts_with("/nacos/v3/auth/role/list?"));
+            write_forbidden_response(&mut socket).await;
+
+            assert!(accept_json_request(&listener, r#"{"code":0,"data":{"totalCount":0,"pageItems":[]}}"#,)
+                .await
+                .starts_with("/nacos/v3/auth/permission/list?"));
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V3);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+
+        let info = NacosOpenApiAdmin::new(config).unwrap().inspect_connection().await.unwrap();
+        let capabilities = info.capabilities.access_control;
+
+        assert!(!capabilities.list_users.supported);
+        assert_eq!(capabilities.list_users.reason, Some(NacosCapabilityReason::PermissionDenied));
+        assert!(!capabilities.list_role_bindings.supported);
+        assert_eq!(capabilities.list_role_bindings.reason, Some(NacosCapabilityReason::PermissionDenied));
+        assert!(capabilities.list_permissions.supported);
+        assert!(!capabilities.create_user.supported);
+        assert!(!capabilities.assign_role.supported);
+        assert!(!capabilities.grant_permission.supported);
+        assert!(!capabilities.enhanced_workspace);
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v3_namespace_authorization_reuses_capability_probe_rows() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            assert_eq!(
+                accept_json_request(
+                    &listener,
+                    r#"{"code":0,"data":{"accessToken":"ordinary-token","tokenTtl":18000,"globalAdmin":false}}"#,
+                )
+                .await,
+                "/nacos/v3/auth/user/login"
+            );
+            assert!(accept_json_request(
+                &listener,
+                r#"{"code":0,"data":[{"namespace":"team-a","namespaceShowName":"Team A"}]}"#,
+            )
+            .await
+            .starts_with("/nacos/v3/admin/core/namespace/list?"));
+            assert!(accept_json_request(
+                &listener,
+                r#"{"code":0,"data":{"totalCount":1,"pageItems":[{"username":"ordinary"}]}}"#,
+            )
+            .await
+            .starts_with("/nacos/v3/auth/user/list?"));
+            assert!(accept_json_request(
+                &listener,
+                r#"{"code":0,"data":{"totalCount":1,"pageItems":[{"username":"ordinary","role":"reader"}]}}"#,
+            )
+            .await
+            .starts_with("/nacos/v3/auth/role/list?"));
+            assert!(accept_json_request(
+                &listener,
+                r#"{"code":0,"data":{"totalCount":1,"pageItems":[{"role":"reader","resource":"team-a:*:*","action":"r"}]}}"#,
+            )
+            .await
+            .starts_with("/nacos/v3/auth/permission/list?"));
+            assert!(tokio::time::timeout(Duration::from_millis(100), listener.accept()).await.is_err());
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V3);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "ordinary".to_string(), password: "secret".to_string() };
+        let admin = NacosOpenApiAdmin::new(config).unwrap();
+
+        admin.list_namespaces().await.unwrap();
+        let authorization = admin.refresh_namespace_authorization("ordinary").await.unwrap().unwrap();
+
+        assert_eq!(authorization.roles, vec!["reader"]);
+        assert_eq!(authorization.permissions.len(), 1);
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn v3_read_only_admin_has_read_capabilities_but_no_write_capabilities() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            assert_eq!(accept_json_request(&listener, r#"{"version":"3.1.0"}"#).await, "/nacos/v3/admin/core/state");
+            assert_eq!(
+                accept_json_request(
+                    &listener,
+                    r#"{"code":0,"data":{"accessToken":"readonly-token","tokenTtl":18000,"globalAdmin":false}}"#,
+                )
+                .await,
+                "/nacos/v3/auth/user/login"
+            );
+            assert!(accept_json_request(
+                &listener,
+                r#"{"code":0,"data":[{"namespace":"public","namespaceShowName":"public"}]}"#,
+            )
+            .await
+            .starts_with("/nacos/v3/admin/core/namespace/list?"));
+            assert!(accept_json_request(&listener, r#"{"code":0,"data":{"totalCount":0,"pageItems":[]}}"#,)
+                .await
+                .starts_with("/nacos/v3/admin/ns/service/list?"));
+            assert!(accept_json_request(&listener, r#"{"code":0,"data":{"totalCount":0,"pageItems":[]}}"#,)
+                .await
+                .starts_with("/nacos/v3/admin/cs/config/list?"));
+            assert!(accept_json_request(
+                &listener,
+                r#"{"code":0,"data":{"totalCount":1,"pageItems":[{"username":"readonly"}]}}"#,
+            )
+            .await
+            .starts_with("/nacos/v3/auth/user/list?"));
+            assert!(accept_json_request(
+                &listener,
+                r#"{"code":0,"data":{"totalCount":1,"pageItems":[{"username":"readonly","role":"READ_ONLY"}]}}"#,
+            )
+            .await
+            .starts_with("/nacos/v3/auth/role/list?"));
+            assert!(accept_json_request(
+                &listener,
+                r#"{"code":0,"data":{"totalCount":3,"pageItems":[{"role":"READ_ONLY","resource":"console/users","action":"r"},{"role":"READ_ONLY","resource":"console/roles","action":"r"},{"role":"READ_ONLY","resource":"console/permissions","action":"r"}]}}"#,
+            )
+            .await
+            .starts_with("/nacos/v3/auth/permission/list?"));
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V3);
+        config.context_path = "/nacos".to_string();
+        config.auth =
+            NacosAuthConfig::UsernamePassword { username: "readonly".to_string(), password: "secret".to_string() };
+
+        let info = NacosOpenApiAdmin::new(config).unwrap().inspect_connection().await.unwrap();
+        let capabilities = info.capabilities.access_control;
+
+        assert!(capabilities.list_users.supported);
+        assert!(capabilities.list_role_bindings.supported);
+        assert!(capabilities.list_permissions.supported);
+        for operation in [
+            NacosAccessControlOperation::CreateUser,
+            NacosAccessControlOperation::UpdateUser,
+            NacosAccessControlOperation::DeleteUser,
+            NacosAccessControlOperation::AssignRole,
+            NacosAccessControlOperation::RemoveRole,
+            NacosAccessControlOperation::GrantPermission,
+            NacosAccessControlOperation::RevokePermission,
+        ] {
+            let capability = capabilities.operation(operation);
+            assert!(!capability.supported);
+            assert_eq!(capability.reason, Some(NacosCapabilityReason::PermissionDenied));
+        }
+        assert!(capabilities.enhanced_workspace);
+        server.await.unwrap();
+    }
+
     #[tokio::test]
     async fn v2_namespace_creation_uses_legacy_custom_namespace_id() {
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
@@ -6202,6 +8012,178 @@ mod tests {
         assert!(!explicit.should_try_next_candidate("NACOS_ERROR[apiVersionMismatch]: missing"));
     }
 
+    #[test]
+    fn permission_scope_preserves_public_namespace_and_raw_custom_resources() {
+        assert_eq!(
+            parse_permission_scope(":*:*").unwrap(),
+            NacosPermissionScope {
+                kind: NacosPermissionScopeKind::Namespace,
+                namespace_id: Some("public".to_string()),
+            }
+        );
+        assert_eq!(
+            parse_permission_scope("team-a:*:*").unwrap(),
+            NacosPermissionScope {
+                kind: NacosPermissionScopeKind::Namespace,
+                namespace_id: Some("team-a".to_string()),
+            }
+        );
+        assert_eq!(parse_permission_scope("*:*:*").unwrap().kind, NacosPermissionScopeKind::Global);
+        assert_eq!(parse_permission_scope("team-a:group:data").unwrap().kind, NacosPermissionScopeKind::Custom);
+        assert_eq!(parse_permission_scope("team-a:GROUP_A:*").unwrap().kind, NacosPermissionScopeKind::Custom);
+    }
+
+    #[test]
+    fn rnacos_user_payload_uses_only_writable_namespace_privilege_fields() {
+        let payload = rnacos_user_payload(
+            "alice",
+            None,
+            Some("Alice"),
+            Some(true),
+            Some(&["0".to_string(), "2".to_string()]),
+            Some(&NacosNamespacePrivilege {
+                enabled: false,
+                whitelist_is_all: false,
+                whitelist: vec!["team-a".to_string()],
+                blacklist_is_all: false,
+                blacklist: vec!["team-b".to_string()],
+            }),
+            false,
+        );
+
+        assert_eq!(payload["enable"], true);
+        assert_eq!(payload["roles"], "0,2");
+        assert_eq!(payload["namespacePrivilegeParam"]["whitelistIsAll"], false);
+        assert_eq!(payload["namespacePrivilegeParam"]["whitelist"], serde_json::json!(["team-a"]));
+        assert_eq!(payload["namespacePrivilegeParam"]["blacklistIsAll"], false);
+        assert_eq!(payload["namespacePrivilegeParam"]["blacklist"], serde_json::json!(["team-b"]));
+        assert!(payload["namespacePrivilegeParam"].get("enabled").is_none());
+    }
+
+    #[test]
+    fn rnacos_user_list_preserves_roles_and_derived_privilege_state() {
+        let users = parse_user_list(
+            serde_json::json!({
+                "data": {
+                    "totalCount": 1,
+                    "list": [{
+                        "username": "alice",
+                        "roles": ["0", "2"],
+                        "namespacePrivilege": {
+                            "enabled": false,
+                            "whitelistIsAll": true,
+                            "whitelist": [],
+                            "blacklistIsAll": false,
+                            "blacklist": ["team-b"]
+                        }
+                    }]
+                }
+            }),
+            1,
+            20,
+        );
+
+        assert_eq!(users.total_count, 1);
+        assert_eq!(users.items[0].roles, vec!["0", "2"]);
+        let privilege = users.items[0].namespace_privilege.as_ref().unwrap();
+        assert!(!privilege.enabled);
+        assert!(privilege.whitelist_is_all);
+        assert_eq!(privilege.blacklist, vec!["team-b"]);
+    }
+
+    #[test]
+    fn official_nacos_v2_and_v3_share_the_enhanced_access_workspace() {
+        let mut v2 = test_admin_config("http://127.0.0.1:8848".to_string());
+        v2.version_mode = Some(NacosVersionMode::V2);
+        let v2 = NacosOpenApiAdmin::new(v2).unwrap().access_control_capabilities();
+        assert!(v2.enhanced_workspace);
+        assert!(v2.list_permissions.supported);
+        assert!(v2.grant_permission.supported);
+        assert!(v2.revoke_permission.supported);
+
+        let mut v3 = test_admin_config("http://127.0.0.1:8848".to_string());
+        v3.version_mode = Some(NacosVersionMode::V3);
+        let v3 = NacosOpenApiAdmin::new(v3).unwrap().access_control_capabilities();
+        assert!(v3.enhanced_workspace);
+        assert!(v3.list_permissions.supported);
+        assert!(v3.grant_permission.supported);
+        assert!(v3.revoke_permission.supported);
+    }
+
+    #[test]
+    fn access_control_probe_classifies_authorization_failures() {
+        assert_eq!(
+            access_control_probe_reason("NACOS_ERROR[authFailed]: 403 Forbidden: access denied"),
+            NacosCapabilityReason::PermissionDenied
+        );
+        assert_eq!(
+            access_control_probe_reason("NACOS_ERROR[invalidResponse]: endpoint returned 404 Not Found"),
+            NacosCapabilityReason::EndpointUnavailable
+        );
+    }
+
+    #[test]
+    fn unverified_write_capability_fails_closed() {
+        let capability = write_capability(&NacosOperationCapability::supported(), false, true);
+        assert!(!capability.supported);
+        assert_eq!(capability.reason, Some(NacosCapabilityReason::NotVerified));
+    }
+
+    #[tokio::test]
+    async fn official_nacos_v2_uses_v1_permission_endpoints() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.unwrap();
+            let target = read_request_target(&mut socket).await;
+            assert!(target.starts_with("/nacos/v1/auth/permissions?"));
+            assert!(target.contains("pageNo=1"));
+            assert!(target.contains("pageSize=20"));
+            assert!(target.contains("role=app_developer"));
+            write_json_response(
+                &mut socket,
+                r#"{"totalCount":1,"pageItems":[{"role":"app_developer","resource":"team-a:*:*","action":"rw"}]}"#,
+            )
+            .await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            let request = read_http_request(&mut socket).await;
+            assert!(request.starts_with("POST /nacos/v1/auth/permissions HTTP/1.1"));
+            assert!(request.contains("role=app_developer"));
+            assert!(request.contains("action=rw"));
+            write_text_response(&mut socket, "ok").await;
+
+            let (mut socket, _) = listener.accept().await.unwrap();
+            let target = read_request_target(&mut socket).await;
+            assert!(target.starts_with("/nacos/v1/auth/permissions?"));
+            assert!(target.contains("role=app_developer"));
+            assert!(target.contains("action=rw"));
+            write_text_response(&mut socket, "ok").await;
+        });
+        let mut config = test_admin_config(format!("http://{address}"));
+        config.implementation = Some(NacosImplementation::Nacos);
+        config.version_mode = Some(NacosVersionMode::V2);
+        config.context_path = "/nacos".to_string();
+        let admin = NacosOpenApiAdmin::new(config).unwrap();
+
+        let listed = admin
+            .list_permissions(NacosPermissionQuery {
+                role: Some("app_developer".to_string()),
+                resource: None,
+                page_no: Some(1),
+                page_size: Some(20),
+            })
+            .await
+            .unwrap();
+        assert_eq!(listed.total_count, 1);
+        let permission = listed.items.into_iter().next().unwrap();
+        assert_eq!(permission.resource_raw, "team-a:*:*");
+
+        admin.grant_permission(permission.clone()).await.unwrap();
+        admin.revoke_permission(permission).await.unwrap();
+        server.await.unwrap();
+    }
+
     #[tokio::test]
     async fn service_creation_requires_an_explicit_group() {
         let mut config = test_admin_config("http://127.0.0.1:9".to_string());
diff --git a/crates/dbx-core/src/nacos/mod.rs b/crates/dbx-core/src/nacos/mod.rs
index 857ae758ee..bc7f5403ad 100644
--- a/crates/dbx-core/src/nacos/mod.rs
+++ b/crates/dbx-core/src/nacos/mod.rs
@@ -6,10 +6,12 @@
 //! still supports an older Rust toolchain. A future SDK adapter can implement
 //! the same port without changing commands, routes, or frontend contracts.
 
+pub mod access_control;
 pub mod archive;
 pub mod batch;
 pub mod config;
 pub mod http;
+pub mod namespace_access;
 pub mod port;
 mod prometheus;
 pub mod search;
@@ -116,6 +118,8 @@ impl NacosAdminRegistry {
     pub async fn drop_connection(&self, connection_id: &str) {
         self.instances.write().await.remove(connection_id);
         self.build_locks.write().await.remove(connection_id);
+        access_control::invalidate_operations(connection_id);
+        namespace_access::invalidate(connection_id);
     }
 
     async fn rnacos_console_session(&self, cfg: &NacosAdminConfig) -> RNacosConsoleSessionHandle {
@@ -176,6 +180,7 @@ mod tests {
             display_server_addr: "http://127.0.0.1:8848".to_string(),
             namespace: "public".to_string(),
             context_path: "/nacos".to_string(),
+            managed_namespaces: Vec::new(),
             rnacos_console_addr: "http://127.0.0.1:10848".to_string(),
             rnacos_history_enabled: Some(true),
             rnacos_console_auth: NacosRNacosConsoleAuth::UsernamePassword {
diff --git a/crates/dbx-core/src/nacos/namespace_access.rs b/crates/dbx-core/src/nacos/namespace_access.rs
new file mode 100644
index 0000000000..7b18b41eb5
--- /dev/null
+++ b/crates/dbx-core/src/nacos/namespace_access.rs
@@ -0,0 +1,835 @@
+use std::collections::{BTreeSet, HashMap};
+use std::sync::{Arc, Mutex, OnceLock};
+use std::time::{Duration, Instant};
+
+use sha2::{Digest, Sha256};
+
+use crate::nacos::port::{NacosAdmin, NacosNamespaceAuthorizationSnapshot};
+use crate::nacos::types::*;
+
+const AUTH_PAGE_SIZE: u32 = 500;
+const CACHE_TTL: Duration = Duration::from_secs(60);
+const CACHE_MAX_CONNECTIONS: usize = 64;
+const ADMIN_ROLE: &str = "ROLE_ADMIN";
+
+#[derive(Clone)]
+struct NamespaceAccessCacheEntry {
+    connection_fingerprint: String,
+    namespace_signature: [u8; 32],
+    readable_ids: BTreeSet<String>,
+    access_control: NacosAccessControlCapabilities,
+    expires_at: Instant,
+}
+
+struct ReadableNamespaces {
+    namespaces: Vec<NacosNamespaceInfo>,
+    access_control: NacosAccessControlCapabilities,
+}
+
+fn cache() -> &'static Mutex<HashMap<String, NamespaceAccessCacheEntry>> {
+    static CACHE: OnceLock<Mutex<HashMap<String, NamespaceAccessCacheEntry>>> = OnceLock::new();
+    CACHE.get_or_init(|| Mutex::new(HashMap::new()))
+}
+
+pub fn invalidate(connection_id: &str) {
+    cache().lock().unwrap_or_else(|error| error.into_inner()).remove(connection_id);
+}
+
+/// Access-control changes can affect a different DBX connection that targets
+/// the same server with the edited account, so invalidate every cached account.
+pub fn invalidate_all() {
+    cache().lock().unwrap_or_else(|error| error.into_inner()).clear();
+}
+
+pub async fn list_readable_namespaces(
+    connection_id: &str,
+    connection_fingerprint: String,
+    admin: Arc<dyn NacosAdmin>,
+) -> Result<Vec<NacosNamespaceInfo>, String> {
+    Ok(load_readable_namespaces(connection_id, connection_fingerprint, admin).await?.namespaces)
+}
+
+pub async fn sidebar_snapshot(
+    connection_id: &str,
+    connection_fingerprint: String,
+    admin: Arc<dyn NacosAdmin>,
+) -> Result<NacosNamespaceSidebarSnapshot, String> {
+    match load_readable_namespaces(connection_id, connection_fingerprint, admin.clone()).await {
+        Ok(result) => {
+            Ok(NacosNamespaceSidebarSnapshot { namespaces: result.namespaces, access_control: result.access_control })
+        }
+        Err(error) if is_namespace_authorization_error(&error) => {
+            let access_control = admin.access_control_capabilities();
+            let has_access_control_reads = access_control.list_users.supported
+                || access_control.list_role_bindings.supported
+                || access_control.list_permissions.supported;
+            if has_access_control_reads {
+                // Namespace visibility remains fail-closed, while an account
+                // that can inspect access control can still open that workspace.
+                Ok(NacosNamespaceSidebarSnapshot { namespaces: Vec::new(), access_control })
+            } else {
+                Err(error)
+            }
+        }
+        Err(error) => Err(error),
+    }
+}
+
+fn is_namespace_authorization_error(error: &str) -> bool {
+    error.contains("NACOS_ERROR[managedNamespacesRequired]")
+        || error.contains("NACOS_ERROR[namespaceAuthorizationUnavailable]")
+}
+
+async fn load_readable_namespaces(
+    connection_id: &str,
+    connection_fingerprint: String,
+    admin: Arc<dyn NacosAdmin>,
+) -> Result<ReadableNamespaces, String> {
+    let namespaces = admin.list_namespaces().await?;
+    let Some(username) =
+        admin.current_username().map(|value| value.trim().to_string()).filter(|value| !value.is_empty())
+    else {
+        return Ok(ReadableNamespaces { namespaces, access_control: admin.access_control_capabilities() });
+    };
+    if let Some(explicit_scope) = admin.explicitly_scoped_namespace_ids() {
+        let readable = explicit_scope.iter().map(|namespace| namespace_identity(namespace)).collect();
+        return Ok(ReadableNamespaces {
+            namespaces: filter_namespaces(namespaces, &readable),
+            access_control: NacosAccessControlCapabilities::unavailable(NacosCapabilityReason::PermissionDenied),
+        });
+    }
+    let signature = namespace_signature(&namespaces);
+    if let Some((readable, cached_access_control)) =
+        cached_readable_ids(connection_id, &connection_fingerprint, signature)
+    {
+        return Ok(ReadableNamespaces {
+            namespaces: filter_namespaces(namespaces, &readable),
+            access_control: cached_access_control,
+        });
+    }
+
+    let (access_control, readable) = match admin.refresh_namespace_authorization(&username).await {
+        Ok(Some(authorization)) => {
+            let access_control = authorization.access_control.clone();
+            let readable = readable_ids_from_authorization_snapshot(authorization, &namespaces)?;
+            (access_control, readable)
+        }
+        Ok(None) => {
+            let access_control = admin.access_control_capabilities();
+            let readable = readable_ids_from_authorization(admin, &username, &namespaces).await?;
+            (access_control, readable)
+        }
+        Err(error) => return Err(namespace_authorization_unavailable(&error)),
+    };
+    cache_readable_ids(connection_id, connection_fingerprint, signature, readable.clone(), access_control.clone());
+    Ok(ReadableNamespaces { namespaces: filter_namespaces(namespaces, &readable), access_control })
+}
+
+fn readable_ids_from_authorization_snapshot(
+    authorization: NacosNamespaceAuthorizationSnapshot,
+    namespaces: &[NacosNamespaceInfo],
+) -> Result<BTreeSet<String>, String> {
+    if authorization.global_admin {
+        return Ok(all_namespace_ids(namespaces));
+    }
+    let roles = authorization.roles.into_iter().collect::<BTreeSet<_>>();
+    if roles.is_empty() {
+        return Ok(BTreeSet::new());
+    }
+    readable_ids_from_permissions(&roles, &authorization.permissions, namespaces)
+        .ok_or_else(|| namespace_authorization_unavailable("the server returned an unsupported permission resource"))
+}
+
+async fn readable_ids_from_authorization(
+    admin: Arc<dyn NacosAdmin>,
+    username: &str,
+    namespaces: &[NacosNamespaceInfo],
+) -> Result<BTreeSet<String>, String> {
+    match admin.access_control_capabilities().mode {
+        NacosAccessControlMode::EmbeddedRoles => readable_ids_from_embedded_user(admin, username, namespaces).await,
+        NacosAccessControlMode::RoleBindings => readable_ids_from_role_bindings(admin, username, namespaces).await,
+        NacosAccessControlMode::Unavailable => {
+            Err(namespace_authorization_unavailable("this connection does not expose account authorization data"))
+        }
+    }
+}
+
+async fn readable_ids_from_embedded_user(
+    admin: Arc<dyn NacosAdmin>,
+    username: &str,
+    namespaces: &[NacosNamespaceInfo],
+) -> Result<BTreeSet<String>, String> {
+    let users = admin
+        .list_users(NacosUserQuery { username: Some(username.to_string()), page_no: Some(1), page_size: Some(2) })
+        .await
+        .map_err(|error| namespace_authorization_unavailable(&error))?;
+    let user = users.items.into_iter().find(|user| user.username == username).ok_or_else(|| {
+        namespace_authorization_unavailable("the current r-nacos account was absent from the authorization response")
+    })?;
+    Ok(readable_ids_from_namespace_privilege(user.enabled, user.namespace_privilege.as_ref(), namespaces))
+}
+
+async fn readable_ids_from_role_bindings(
+    admin: Arc<dyn NacosAdmin>,
+    username: &str,
+    namespaces: &[NacosNamespaceInfo],
+) -> Result<BTreeSet<String>, String> {
+    let roles = list_current_roles(admin.clone(), username)
+        .await
+        .map_err(|error| namespace_authorization_unavailable(&error))?;
+    if roles.contains(ADMIN_ROLE) {
+        return Ok(all_namespace_ids(namespaces));
+    }
+    if roles.is_empty() {
+        return Ok(BTreeSet::new());
+    }
+
+    let permissions = list_all_permissions(admin).await.map_err(|error| namespace_authorization_unavailable(&error))?;
+    readable_ids_from_permissions(&roles, &permissions, namespaces)
+        .ok_or_else(|| namespace_authorization_unavailable("the server returned an unsupported permission resource"))
+}
+
+fn namespace_authorization_unavailable(detail: &str) -> String {
+    let detail_lowercase = detail.to_ascii_lowercase();
+    let error_code = if detail_lowercase.contains("403")
+        || detail_lowercase.contains("forbidden")
+        || detail_lowercase.contains("access denied")
+        || detail_lowercase.contains("authorization failed")
+    {
+        "managedNamespacesRequired"
+    } else {
+        "namespaceAuthorizationUnavailable"
+    };
+    format!(
+        "NACOS_ERROR[{error_code}]: DBX cannot safely determine readable namespaces without per-namespace probes: {detail}"
+    )
+}
+
+async fn list_current_roles(admin: Arc<dyn NacosAdmin>, username: &str) -> Result<BTreeSet<String>, String> {
+    let mut roles = BTreeSet::new();
+    let mut page_no = 1;
+    loop {
+        let page = admin
+            .list_role_bindings(NacosRoleQuery {
+                username: Some(username.to_string()),
+                role: None,
+                page_no: Some(page_no),
+                page_size: Some(AUTH_PAGE_SIZE),
+            })
+            .await?;
+        let count = page.items.len();
+        roles.extend(page.items.into_iter().filter(|binding| binding.username == username).map(|binding| binding.role));
+        if count < AUTH_PAGE_SIZE as usize || roles.len() as u64 >= page.total_count {
+            break;
+        }
+        page_no += 1;
+    }
+    Ok(roles)
+}
+
+async fn list_all_permissions(admin: Arc<dyn NacosAdmin>) -> Result<Vec<NacosPermissionInfo>, String> {
+    let mut permissions = Vec::new();
+    let mut page_no = 1;
+    loop {
+        let page = admin
+            .list_permissions(NacosPermissionQuery {
+                role: None,
+                resource: None,
+                page_no: Some(page_no),
+                page_size: Some(AUTH_PAGE_SIZE),
+            })
+            .await?;
+        let count = page.items.len();
+        permissions.extend(page.items);
+        if count < AUTH_PAGE_SIZE as usize || permissions.len() as u64 >= page.total_count {
+            break;
+        }
+        page_no += 1;
+    }
+    Ok(permissions)
+}
+
+fn readable_ids_from_namespace_privilege(
+    enabled: Option<bool>,
+    privilege: Option<&NacosNamespacePrivilege>,
+    namespaces: &[NacosNamespaceInfo],
+) -> BTreeSet<String> {
+    let Some(privilege) = privilege.filter(|_| enabled != Some(false)) else {
+        return if enabled == Some(false) { BTreeSet::new() } else { all_namespace_ids(namespaces) };
+    };
+    if !privilege.enabled {
+        return all_namespace_ids(namespaces);
+    }
+    let mut readable = if privilege.whitelist_is_all {
+        all_namespace_ids(namespaces)
+    } else {
+        privilege.whitelist.iter().map(|namespace| namespace_identity(namespace)).collect()
+    };
+    if privilege.blacklist_is_all {
+        readable.clear();
+    } else {
+        for namespace in &privilege.blacklist {
+            readable.remove(&namespace_identity(namespace));
+        }
+    }
+    readable
+}
+
+fn readable_ids_from_permissions(
+    roles: &BTreeSet<String>,
+    permissions: &[NacosPermissionInfo],
+    namespaces: &[NacosNamespaceInfo],
+) -> Option<BTreeSet<String>> {
+    let mut readable = BTreeSet::new();
+    for permission in permissions.iter().filter(|permission| roles.contains(&permission.role)) {
+        if !matches!(permission.action_raw.trim().to_ascii_lowercase().as_str(), "r" | "rw") {
+            continue;
+        }
+        match permission.parsed_scope.as_ref().map(|scope| scope.kind) {
+            Some(NacosPermissionScopeKind::Global) => return Some(all_namespace_ids(namespaces)),
+            Some(NacosPermissionScopeKind::Namespace) => {
+                if let Some(namespace) =
+                    permission.parsed_scope.as_ref().and_then(|scope| scope.namespace_id.as_deref())
+                {
+                    readable.insert(namespace_identity(namespace));
+                }
+            }
+            // A custom resource can grant access to an individual group or
+            // data ID, but it cannot prove namespace-wide read access. Ignore
+            // it rather than widening the sidebar's visible namespace scope.
+            Some(NacosPermissionScopeKind::Custom | NacosPermissionScopeKind::Unknown) => {}
+            None => return None,
+        }
+    }
+    Some(readable)
+}
+
+fn namespace_identity(namespace: &str) -> String {
+    if namespace.is_empty() || namespace == "public" {
+        "public".to_string()
+    } else {
+        namespace.to_string()
+    }
+}
+
+fn all_namespace_ids(namespaces: &[NacosNamespaceInfo]) -> BTreeSet<String> {
+    namespaces.iter().map(|namespace| namespace_identity(&namespace.namespace)).collect()
+}
+
+fn filter_namespaces(namespaces: Vec<NacosNamespaceInfo>, readable: &BTreeSet<String>) -> Vec<NacosNamespaceInfo> {
+    namespaces.into_iter().filter(|namespace| readable.contains(&namespace_identity(&namespace.namespace))).collect()
+}
+
+fn namespace_signature(namespaces: &[NacosNamespaceInfo]) -> [u8; 32] {
+    let mut identities =
+        namespaces.iter().map(|namespace| namespace_identity(&namespace.namespace)).collect::<Vec<_>>();
+    identities.sort();
+    identities.dedup();
+    let mut hasher = Sha256::new();
+    for identity in identities {
+        hasher.update((identity.len() as u64).to_le_bytes());
+        hasher.update(identity.as_bytes());
+    }
+    hasher.finalize().into()
+}
+
+fn cached_readable_ids(
+    connection_id: &str,
+    connection_fingerprint: &str,
+    namespace_signature: [u8; 32],
+) -> Option<(BTreeSet<String>, NacosAccessControlCapabilities)> {
+    let mut entries = cache().lock().unwrap_or_else(|error| error.into_inner());
+    let now = Instant::now();
+    entries.retain(|_, entry| entry.expires_at > now);
+    entries.get(connection_id).and_then(|entry| {
+        (entry.connection_fingerprint == connection_fingerprint && entry.namespace_signature == namespace_signature)
+            .then(|| (entry.readable_ids.clone(), entry.access_control.clone()))
+    })
+}
+
+fn cache_readable_ids(
+    connection_id: &str,
+    connection_fingerprint: String,
+    namespace_signature: [u8; 32],
+    readable_ids: BTreeSet<String>,
+    access_control: NacosAccessControlCapabilities,
+) {
+    let mut entries = cache().lock().unwrap_or_else(|error| error.into_inner());
+    let now = Instant::now();
+    entries.retain(|_, entry| entry.expires_at > now);
+    if !entries.contains_key(connection_id) && entries.len() >= CACHE_MAX_CONNECTIONS {
+        if let Some(oldest) = entries.iter().min_by_key(|(_, entry)| entry.expires_at).map(|(id, _)| id.clone()) {
+            entries.remove(&oldest);
+        }
+    }
+    entries.insert(
+        connection_id.to_string(),
+        NamespaceAccessCacheEntry {
+            connection_fingerprint,
+            namespace_signature,
+            readable_ids,
+            access_control,
+            expires_at: now + CACHE_TTL,
+        },
+    );
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use async_trait::async_trait;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    fn namespace(id: &str) -> NacosNamespaceInfo {
+        NacosNamespaceInfo {
+            namespace: id.to_string(),
+            namespace_show_name: id.to_string(),
+            namespace_desc: None,
+            config_count: None,
+            quota: None,
+            namespace_type: None,
+        }
+    }
+
+    fn role_binding_capabilities() -> NacosAccessControlCapabilities {
+        NacosAccessControlCapabilities {
+            mode: NacosAccessControlMode::RoleBindings,
+            list_users: NacosOperationCapability::supported(),
+            create_user: NacosOperationCapability::supported(),
+            update_user: NacosOperationCapability::supported(),
+            delete_user: NacosOperationCapability::supported(),
+            list_role_bindings: NacosOperationCapability::supported(),
+            assign_role: NacosOperationCapability::supported(),
+            remove_role: NacosOperationCapability::supported(),
+            list_permissions: NacosOperationCapability::supported(),
+            grant_permission: NacosOperationCapability::supported(),
+            revoke_permission: NacosOperationCapability::supported(),
+            enhanced_workspace: true,
+            supports_namespace_privileges: false,
+        }
+    }
+
+    fn roles_only_capabilities() -> NacosAccessControlCapabilities {
+        let mut capabilities = NacosAccessControlCapabilities::unavailable(NacosCapabilityReason::PermissionDenied);
+        capabilities.mode = NacosAccessControlMode::RoleBindings;
+        capabilities.list_users = NacosOperationCapability::supported();
+        capabilities.list_role_bindings = NacosOperationCapability::supported();
+        capabilities
+    }
+
+    struct CountingAdmin {
+        namespaces: Vec<NacosNamespaceInfo>,
+        readable_ids: BTreeSet<String>,
+        permission_error: bool,
+        explicitly_scoped_ids: Option<Vec<String>>,
+        namespace_calls: AtomicUsize,
+        capability_calls: AtomicUsize,
+        role_calls: AtomicUsize,
+        permission_calls: AtomicUsize,
+        config_calls: AtomicUsize,
+    }
+
+    impl CountingAdmin {
+        fn restricted(namespace_count: usize) -> Self {
+            let namespaces = (0..namespace_count).map(|index| namespace(&format!("team-{index}"))).collect::<Vec<_>>();
+            let readable_ids = namespaces
+                .iter()
+                .enumerate()
+                .filter(|(index, _)| index % 2 == 0)
+                .map(|(_, namespace)| namespace.namespace.clone())
+                .collect();
+            Self {
+                namespaces,
+                readable_ids,
+                permission_error: false,
+                explicitly_scoped_ids: None,
+                namespace_calls: AtomicUsize::new(0),
+                capability_calls: AtomicUsize::new(0),
+                role_calls: AtomicUsize::new(0),
+                permission_calls: AtomicUsize::new(0),
+                config_calls: AtomicUsize::new(0),
+            }
+        }
+
+        fn total_authorization_calls(&self) -> usize {
+            self.namespace_calls.load(Ordering::SeqCst)
+                + self.capability_calls.load(Ordering::SeqCst)
+                + self.role_calls.load(Ordering::SeqCst)
+                + self.permission_calls.load(Ordering::SeqCst)
+                + self.config_calls.load(Ordering::SeqCst)
+        }
+    }
+
+    #[async_trait]
+    impl NacosAdmin for CountingAdmin {
+        fn access_control_capabilities(&self) -> NacosAccessControlCapabilities {
+            if self.permission_error {
+                roles_only_capabilities()
+            } else {
+                role_binding_capabilities()
+            }
+        }
+
+        fn current_username(&self) -> Option<String> {
+            Some("reader".to_string())
+        }
+
+        fn explicitly_scoped_namespace_ids(&self) -> Option<Vec<String>> {
+            self.explicitly_scoped_ids.clone()
+        }
+
+        async fn refresh_namespace_authorization(
+            &self,
+            username: &str,
+        ) -> Result<Option<NacosNamespaceAuthorizationSnapshot>, String> {
+            self.capability_calls.fetch_add(1, Ordering::SeqCst);
+            let role_bindings = self
+                .list_role_bindings(NacosRoleQuery {
+                    username: Some(username.to_string()),
+                    role: None,
+                    page_no: Some(1),
+                    page_size: Some(AUTH_PAGE_SIZE),
+                })
+                .await?;
+            let permissions = self
+                .list_permissions(NacosPermissionQuery {
+                    role: None,
+                    resource: None,
+                    page_no: Some(1),
+                    page_size: Some(AUTH_PAGE_SIZE),
+                })
+                .await?;
+            Ok(Some(NacosNamespaceAuthorizationSnapshot {
+                access_control: role_binding_capabilities(),
+                roles: role_bindings.items.into_iter().map(|binding| binding.role).collect(),
+                permissions: permissions.items,
+                global_admin: false,
+            }))
+        }
+
+        async fn test_connection(&self) -> Result<NacosConnectionInfo, String> {
+            Err("unused".to_string())
+        }
+
+        async fn list_namespaces(&self) -> Result<Vec<NacosNamespaceInfo>, String> {
+            self.namespace_calls.fetch_add(1, Ordering::SeqCst);
+            Ok(self.namespaces.clone())
+        }
+
+        async fn create_namespace(&self, _: NacosNamespaceCreate) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn update_namespace(&self, _: NacosNamespaceUpdate) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn list_configs(&self, _: NacosConfigQuery) -> Result<NacosConfigList, String> {
+            self.config_calls.fetch_add(1, Ordering::SeqCst);
+            Err("per-namespace probes are forbidden in the sidebar path".to_string())
+        }
+
+        async fn search_config_content_page(
+            &self,
+            _: &str,
+            _: &str,
+            _: u32,
+            _: u32,
+        ) -> Result<Option<NacosConfigList>, String> {
+            Err("unused".to_string())
+        }
+
+        async fn get_config(&self, _: NacosConfigKey) -> Result<NacosConfigItem, String> {
+            Err("unused".to_string())
+        }
+
+        async fn publish_config(&self, _: NacosConfigUpsert) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn delete_config(&self, _: NacosConfigKey) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn list_config_history(&self, _: NacosConfigHistoryQuery) -> Result<NacosConfigHistoryList, String> {
+            Err("unused".to_string())
+        }
+
+        async fn get_config_history(&self, _: NacosConfigHistoryKey) -> Result<NacosConfigItem, String> {
+            Err("unused".to_string())
+        }
+
+        async fn rollback_config(&self, _: NacosConfigRollbackRequest) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn get_rnacos_console_captcha(&self) -> Result<NacosRNacosConsoleCaptcha, String> {
+            Err("unused".to_string())
+        }
+
+        async fn login_rnacos_console(&self, _: Option<String>) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn list_role_bindings(&self, _: NacosRoleQuery) -> Result<NacosRoleList, String> {
+            self.role_calls.fetch_add(1, Ordering::SeqCst);
+            Ok(NacosRoleList {
+                page_no: 1,
+                page_size: AUTH_PAGE_SIZE,
+                total_count: 1,
+                items: vec![NacosRoleBinding { username: "reader".to_string(), role: "reader-role".to_string() }],
+            })
+        }
+
+        async fn list_permissions(&self, _: NacosPermissionQuery) -> Result<NacosPermissionList, String> {
+            self.permission_calls.fetch_add(1, Ordering::SeqCst);
+            if self.permission_error {
+                return Err("403 Forbidden".to_string());
+            }
+            let items = self
+                .readable_ids
+                .iter()
+                .map(|namespace| NacosPermissionInfo {
+                    role: "reader-role".to_string(),
+                    resource_raw: format!("{namespace}:*:*"),
+                    action_raw: "r".to_string(),
+                    parsed_scope: Some(NacosPermissionScope {
+                        kind: NacosPermissionScopeKind::Namespace,
+                        namespace_id: Some(namespace.clone()),
+                    }),
+                })
+                .collect::<Vec<_>>();
+            Ok(NacosPermissionList { page_no: 1, page_size: AUTH_PAGE_SIZE, total_count: items.len() as u64, items })
+        }
+
+        async fn list_services(&self, _: NacosServiceQuery) -> Result<NacosServiceList, String> {
+            Err("unused".to_string())
+        }
+
+        async fn get_service(&self, _: NacosServiceQuery) -> Result<NacosServiceDetail, String> {
+            Err("unused".to_string())
+        }
+
+        async fn create_service(&self, _: NacosServiceUpsert) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn update_service(&self, _: NacosServiceUpsert) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn delete_service(&self, _: NacosServiceQuery) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn list_instances(&self, _: NacosInstanceQuery) -> Result<Vec<NacosInstanceInfo>, String> {
+            Err("unused".to_string())
+        }
+
+        async fn update_instance(&self, _: NacosInstanceUpdateRequest) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn register_instance(&self, _: NacosInstanceRegistration) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn deregister_instance(&self, _: NacosInstanceRef) -> Result<(), String> {
+            Err("unused".to_string())
+        }
+
+        async fn get_dashboard(&self, _: NacosDashboardQuery) -> Result<NacosDashboardSnapshot, String> {
+            Err("unused".to_string())
+        }
+
+        async fn raw_request(&self, _: NacosRawRequest) -> Result<NacosRawResponse, String> {
+            Err("unused".to_string())
+        }
+    }
+
+    #[test]
+    fn role_permissions_keep_only_readable_namespaces() {
+        let namespaces = vec![namespace("public"), namespace("team-a"), namespace("team-b")];
+        let roles = BTreeSet::from(["reader".to_string()]);
+        let permissions = vec![
+            NacosPermissionInfo {
+                role: "reader".to_string(),
+                resource_raw: "team-a:*:*".to_string(),
+                action_raw: "r".to_string(),
+                parsed_scope: Some(NacosPermissionScope {
+                    kind: NacosPermissionScopeKind::Namespace,
+                    namespace_id: Some("team-a".to_string()),
+                }),
+            },
+            NacosPermissionInfo {
+                role: "reader".to_string(),
+                resource_raw: "team-b:*:*".to_string(),
+                action_raw: "w".to_string(),
+                parsed_scope: Some(NacosPermissionScope {
+                    kind: NacosPermissionScopeKind::Namespace,
+                    namespace_id: Some("team-b".to_string()),
+                }),
+            },
+        ];
+
+        assert_eq!(
+            readable_ids_from_permissions(&roles, &permissions, &namespaces),
+            Some(BTreeSet::from(["team-a".to_string()]))
+        );
+    }
+
+    #[test]
+    fn custom_permissions_do_not_grant_namespace_wide_visibility() {
+        let namespaces = vec![namespace("public"), namespace("team-a"), namespace("team-b")];
+        let roles = BTreeSet::from(["reader".to_string()]);
+        let permissions = vec![NacosPermissionInfo {
+            role: "reader".to_string(),
+            resource_raw: "team-a:GROUP_A:*".to_string(),
+            action_raw: "r".to_string(),
+            parsed_scope: Some(NacosPermissionScope {
+                kind: NacosPermissionScopeKind::Custom,
+                namespace_id: Some("team-a".to_string()),
+            }),
+        }];
+
+        assert_eq!(readable_ids_from_permissions(&roles, &permissions, &namespaces), Some(BTreeSet::new()));
+    }
+
+    #[test]
+    fn embedded_privileges_apply_whitelist_and_blacklist() {
+        let namespaces = vec![namespace("public"), namespace("team-a"), namespace("team-b")];
+        let privilege = NacosNamespacePrivilege {
+            enabled: true,
+            whitelist_is_all: false,
+            whitelist: vec!["team-a".to_string(), "team-b".to_string()],
+            blacklist_is_all: false,
+            blacklist: vec!["team-b".to_string()],
+        };
+
+        assert_eq!(
+            readable_ids_from_namespace_privilege(Some(true), Some(&privilege), &namespaces),
+            BTreeSet::from(["team-a".to_string()])
+        );
+    }
+
+    #[tokio::test]
+    async fn restricted_sidebar_filtering_has_constant_request_count() {
+        let mut request_counts = Vec::new();
+        for namespace_count in [1, 100] {
+            let connection_id = format!("constant-sidebar-requests-{namespace_count}");
+            invalidate(&connection_id);
+            let admin = Arc::new(CountingAdmin::restricted(namespace_count));
+
+            let snapshot = sidebar_snapshot(&connection_id, "server-a".to_string(), admin.clone()).await.unwrap();
+
+            assert_eq!(snapshot.namespaces.len(), namespace_count.div_ceil(2));
+            assert!(snapshot.namespaces.iter().all(|namespace| namespace
+                .namespace
+                .trim_start_matches("team-")
+                .parse::<usize>()
+                .unwrap()
+                % 2
+                == 0));
+            assert_eq!(admin.config_calls.load(Ordering::SeqCst), 0);
+            assert_eq!(admin.capability_calls.load(Ordering::SeqCst), 1);
+            assert_eq!(admin.role_calls.load(Ordering::SeqCst), 1);
+            assert_eq!(admin.permission_calls.load(Ordering::SeqCst), 1);
+            request_counts.push(admin.total_authorization_calls());
+        }
+
+        assert_eq!(request_counts, vec![4, 4]);
+    }
+
+    #[tokio::test]
+    async fn unavailable_authorization_fails_closed_without_namespace_probes() {
+        let connection_id = "unavailable-sidebar-authorization";
+        invalidate(connection_id);
+        let mut admin = CountingAdmin::restricted(100);
+        admin.permission_error = true;
+        let admin = Arc::new(admin);
+
+        let error = list_readable_namespaces(connection_id, "server-a".to_string(), admin.clone()).await.unwrap_err();
+
+        assert!(error.contains("NACOS_ERROR[managedNamespacesRequired]"));
+        assert_eq!(admin.config_calls.load(Ordering::SeqCst), 0);
+        assert_eq!(admin.total_authorization_calls(), 4);
+    }
+
+    #[tokio::test]
+    async fn roles_only_sidebar_keeps_access_control_entry_without_widening_namespaces() {
+        let connection_id = "roles-only-sidebar-authorization";
+        invalidate(connection_id);
+        let mut admin = CountingAdmin::restricted(100);
+        admin.permission_error = true;
+        let admin = Arc::new(admin);
+
+        let snapshot = sidebar_snapshot(connection_id, "server-a".to_string(), admin.clone()).await.unwrap();
+
+        assert!(snapshot.namespaces.is_empty());
+        assert!(snapshot.access_control.list_role_bindings.supported);
+        assert!(!snapshot.access_control.list_permissions.supported);
+        assert_eq!(admin.config_calls.load(Ordering::SeqCst), 0);
+        assert_eq!(admin.total_authorization_calls(), 4);
+    }
+
+    #[tokio::test]
+    async fn explicitly_scoped_namespace_list_skips_authorization_queries() {
+        let connection_id = "explicit-sidebar-scope";
+        invalidate(connection_id);
+        let mut admin = CountingAdmin::restricted(100);
+        admin.permission_error = true;
+        admin.explicitly_scoped_ids = Some(vec!["team-2".to_string(), "team-78".to_string()]);
+        let admin = Arc::new(admin);
+
+        let snapshot = sidebar_snapshot(connection_id, "server-a".to_string(), admin.clone()).await.unwrap();
+
+        assert_eq!(
+            snapshot.namespaces.iter().map(|namespace| namespace.namespace.as_str()).collect::<Vec<_>>(),
+            vec!["team-2", "team-78"]
+        );
+        assert_eq!(admin.total_authorization_calls(), 1);
+        assert!(!snapshot.access_control.list_users.supported);
+    }
+
+    #[test]
+    fn cache_is_bound_to_connection_fingerprint_and_namespace_set() {
+        let connection_id = "namespace-cache-test";
+        invalidate(connection_id);
+        let first_namespaces = vec![namespace("public"), namespace("team-a")];
+        let first_signature = namespace_signature(&first_namespaces);
+        cache_readable_ids(
+            connection_id,
+            "server-a".to_string(),
+            first_signature,
+            BTreeSet::from(["team-a".to_string()]),
+            role_binding_capabilities(),
+        );
+
+        assert_eq!(
+            cached_readable_ids(connection_id, "server-a", first_signature).map(|(ids, _)| ids),
+            Some(BTreeSet::from(["team-a".to_string()]))
+        );
+        assert_eq!(cached_readable_ids(connection_id, "server-b", first_signature), None);
+        assert_eq!(cached_readable_ids(connection_id, "server-a", namespace_signature(&[namespace("team-b")])), None);
+        invalidate(connection_id);
+        assert_eq!(cached_readable_ids(connection_id, "server-a", first_signature), None);
+
+        cache_readable_ids(
+            connection_id,
+            "server-a".to_string(),
+            first_signature,
+            BTreeSet::new(),
+            role_binding_capabilities(),
+        );
+        cache_readable_ids(
+            "other-connection",
+            "server-a".to_string(),
+            first_signature,
+            BTreeSet::new(),
+            role_binding_capabilities(),
+        );
+        invalidate_all();
+        assert_eq!(cached_readable_ids(connection_id, "server-a", first_signature), None);
+        assert_eq!(cached_readable_ids("other-connection", "server-a", first_signature), None);
+    }
+}
diff --git a/crates/dbx-core/src/nacos/port.rs b/crates/dbx-core/src/nacos/port.rs
index 6acfe7f482..5aa813f842 100644
--- a/crates/dbx-core/src/nacos/port.rs
+++ b/crates/dbx-core/src/nacos/port.rs
@@ -2,13 +2,65 @@ use async_trait::async_trait;
 
 use crate::nacos::types::*;
 
+#[derive(Clone, Debug)]
+pub struct NacosNamespaceAuthorizationSnapshot {
+    pub access_control: NacosAccessControlCapabilities,
+    pub roles: Vec<String>,
+    pub permissions: Vec<NacosPermissionInfo>,
+    pub global_admin: bool,
+}
+
 #[async_trait]
 pub trait NacosAdmin: Send + Sync {
     fn service_capabilities(&self) -> NacosServiceCapabilities {
         NacosServiceCapabilities::default()
     }
 
+    fn access_control_capabilities(&self) -> NacosAccessControlCapabilities {
+        NacosAccessControlCapabilities::default()
+    }
+
+    fn invalidate_access_control_capabilities(&self) {}
+
+    fn current_username(&self) -> Option<String> {
+        None
+    }
+
+    /// Returns the user-configured namespace scope for accounts that cannot
+    /// safely rely on server-wide namespace discovery.
+    fn explicitly_scoped_namespace_ids(&self) -> Option<Vec<String>> {
+        None
+    }
+
     async fn test_connection(&self) -> Result<NacosConnectionInfo, String>;
+    /// Runs the user-initiated connection check, including validation of every
+    /// explicitly configured namespace. Normal connection establishment must
+    /// remain bounded and should call `test_connection` instead.
+    async fn test_connection_with_scope_validation(&self) -> Result<NacosConnectionInfo, String> {
+        self.test_connection().await
+    }
+    /// Refreshes account capabilities from non-mutating authorization reads.
+    /// Implementations that cannot inspect permissions keep their conservative
+    /// configured capabilities.
+    async fn refresh_access_control_capabilities(&self) -> NacosAccessControlCapabilities {
+        self.access_control_capabilities()
+    }
+    /// Refreshes access-control capabilities and, when the adapter can do so
+    /// without another round trip, returns the authorization rows needed to
+    /// derive namespace visibility.
+    async fn refresh_namespace_authorization(
+        &self,
+        _username: &str,
+    ) -> Result<Option<NacosNamespaceAuthorizationSnapshot>, String> {
+        let _ = self.refresh_access_control_capabilities().await;
+        Ok(None)
+    }
+    /// Returns connection information for the Nacos management UI after
+    /// refreshing account capabilities, without re-running full namespace
+    /// scope validation on every tree or console refresh.
+    async fn inspect_connection(&self) -> Result<NacosConnectionInfo, String> {
+        self.test_connection().await
+    }
     async fn list_namespaces(&self) -> Result<Vec<NacosNamespaceInfo>, String>;
     async fn create_namespace(&self, req: NacosNamespaceCreate) -> Result<(), String>;
     async fn update_namespace(&self, req: NacosNamespaceUpdate) -> Result<(), String>;
@@ -32,6 +84,36 @@ pub trait NacosAdmin: Send + Sync {
     async fn rollback_config(&self, req: NacosConfigRollbackRequest) -> Result<(), String>;
     async fn get_rnacos_console_captcha(&self) -> Result<NacosRNacosConsoleCaptcha, String>;
     async fn login_rnacos_console(&self, captcha: Option<String>) -> Result<(), String>;
+    async fn list_users(&self, _: NacosUserQuery) -> Result<NacosUserList, String> {
+        Err("Nacos user management is unavailable for this connection".to_string())
+    }
+    async fn create_user(&self, _: NacosUserCreate) -> Result<(), String> {
+        Err("Nacos user management is unavailable for this connection".to_string())
+    }
+    async fn update_user(&self, _: NacosUserUpdate) -> Result<(), String> {
+        Err("Nacos user management is unavailable for this connection".to_string())
+    }
+    async fn delete_user(&self, _: String) -> Result<(), String> {
+        Err("Nacos user management is unavailable for this connection".to_string())
+    }
+    async fn list_role_bindings(&self, _: NacosRoleQuery) -> Result<NacosRoleList, String> {
+        Err("Nacos role management is unavailable for this connection".to_string())
+    }
+    async fn assign_role(&self, _: NacosRoleBinding) -> Result<(), String> {
+        Err("Nacos role management is unavailable for this connection".to_string())
+    }
+    async fn remove_role(&self, _: NacosRoleBinding) -> Result<(), String> {
+        Err("Nacos role management is unavailable for this connection".to_string())
+    }
+    async fn list_permissions(&self, _: NacosPermissionQuery) -> Result<NacosPermissionList, String> {
+        Err("Nacos permission management is unavailable for this connection".to_string())
+    }
+    async fn grant_permission(&self, _: NacosPermissionInfo) -> Result<(), String> {
+        Err("Nacos permission management is unavailable for this connection".to_string())
+    }
+    async fn revoke_permission(&self, _: NacosPermissionInfo) -> Result<(), String> {
+        Err("Nacos permission management is unavailable for this connection".to_string())
+    }
     async fn list_services(&self, query: NacosServiceQuery) -> Result<NacosServiceList, String>;
     async fn get_service(&self, query: NacosServiceQuery) -> Result<NacosServiceDetail, String>;
     async fn create_service(&self, req: NacosServiceUpsert) -> Result<(), String>;
diff --git a/crates/dbx-core/src/nacos/prometheus.rs b/crates/dbx-core/src/nacos/prometheus.rs
index ae9264d601..64d79d1073 100644
--- a/crates/dbx-core/src/nacos/prometheus.rs
+++ b/crates/dbx-core/src/nacos/prometheus.rs
@@ -806,6 +806,7 @@ app_memory_usage 1
             display_server_addr: server_addr.to_string(),
             namespace: String::new(),
             context_path: context_path.to_string(),
+            managed_namespaces: Vec::new(),
             rnacos_console_addr: String::new(),
             rnacos_history_enabled: None,
             rnacos_console_auth: Default::default(),
diff --git a/crates/dbx-core/src/nacos/service.rs b/crates/dbx-core/src/nacos/service.rs
index 22714f67cd..607edf25d3 100644
--- a/crates/dbx-core/src/nacos/service.rs
+++ b/crates/dbx-core/src/nacos/service.rs
@@ -4,6 +4,42 @@ use crate::connection::AppState;
 use crate::models::connection::DatabaseType;
 use crate::nacos::types::*;
 
+async fn refresh_access_control_after_mutation(admin: &std::sync::Arc<dyn crate::nacos::port::NacosAdmin>) {
+    admin.invalidate_access_control_capabilities();
+    let _ = admin.refresh_access_control_capabilities().await;
+}
+
+async fn current_access_control_capabilities(
+    admin: &std::sync::Arc<dyn crate::nacos::port::NacosAdmin>,
+) -> NacosAccessControlCapabilities {
+    // A synchronous read intentionally treats an expired entry as absent. All
+    // feature and safety gates therefore go through the refreshing path so a
+    // stale cache cannot disable the workspace or reopen legacy mutations.
+    admin.refresh_access_control_capabilities().await
+}
+
+fn ensure_access_control_operation(
+    capabilities: &NacosAccessControlCapabilities,
+    operation: NacosAccessControlOperation,
+) -> Result<(), String> {
+    let capability = capabilities.operation(operation);
+    if capability.supported {
+        return Ok(());
+    }
+    let reason = match capability.reason {
+        Some(NacosCapabilityReason::ImplementationReadOnly) => "implementationReadOnly",
+        Some(NacosCapabilityReason::VersionUnsupported) => "versionUnsupported",
+        Some(NacosCapabilityReason::EndpointUnavailable) => "endpointUnavailable",
+        Some(NacosCapabilityReason::NotVerified) => "notVerified",
+        Some(NacosCapabilityReason::ConnectionReadOnly) => "connectionReadOnly",
+        Some(NacosCapabilityReason::PermissionDenied) => "permissionDenied",
+        None => "notVerified",
+    };
+    Err(format!(
+        "NACOS_ERROR[unsupportedOperation]: Nacos access-control operation {operation:?} is unavailable ({reason})"
+    ))
+}
+
 pub async fn nacos_test_connection_core(state: &AppState, conn_id: &str) -> Result<NacosConnectionInfo, String> {
     let cfg = state.configs.read().await.get(conn_id).cloned().ok_or("Connection not found")?;
     if cfg.db_type != DatabaseType::Nacos {
@@ -13,12 +49,20 @@ pub async fn nacos_test_connection_core(state: &AppState, conn_id: &str) -> Resu
     // Keep this probe on the connection's shared adapter so an r-nacos console
     // session verified for configuration history can also expose its version.
     let admin = state.nacos_registry.get_or_build_config(conn_id, admin_config).await?;
-    admin.test_connection().await
+    admin.inspect_connection().await
 }
 
 pub async fn nacos_list_namespaces_core(state: &AppState, conn_id: &str) -> Result<Vec<NacosNamespaceInfo>, String> {
-    let admin = get_admin(state, conn_id).await?;
-    admin.list_namespaces().await
+    let (admin, fingerprint) = get_admin_with_operation_fingerprint(state, conn_id).await?;
+    crate::nacos::namespace_access::list_readable_namespaces(conn_id, fingerprint, admin).await
+}
+
+pub async fn nacos_sidebar_snapshot_core(
+    state: &AppState,
+    conn_id: &str,
+) -> Result<NacosNamespaceSidebarSnapshot, String> {
+    let (admin, fingerprint) = get_admin_with_operation_fingerprint(state, conn_id).await?;
+    crate::nacos::namespace_access::sidebar_snapshot(conn_id, fingerprint, admin).await
 }
 
 pub async fn nacos_create_namespace_core(
@@ -131,7 +175,181 @@ pub async fn nacos_login_rnacos_console_core(
     captcha: Option<String>,
 ) -> Result<(), String> {
     let admin = get_admin(state, conn_id).await?;
-    admin.login_rnacos_console(captcha).await
+    let result = admin.login_rnacos_console(captcha).await;
+    if result.is_ok() {
+        refresh_access_control_after_mutation(&admin).await;
+        crate::nacos::namespace_access::invalidate(conn_id);
+    }
+    result
+}
+
+pub async fn nacos_list_users_core(
+    state: &AppState,
+    conn_id: &str,
+    query: NacosUserQuery,
+) -> Result<NacosUserList, String> {
+    let admin = get_admin(state, conn_id).await?;
+    admin.list_users(query).await
+}
+
+pub async fn nacos_create_user_core(state: &AppState, conn_id: &str, req: NacosUserCreate) -> Result<(), String> {
+    ensure_connection_writable(state, conn_id, "Create Nacos user").await?;
+    let admin = get_admin(state, conn_id).await?;
+    let capabilities = current_access_control_capabilities(&admin).await;
+    ensure_access_control_operation(&capabilities, NacosAccessControlOperation::CreateUser)?;
+    let result = admin.create_user(req).await;
+    if result.is_ok() {
+        refresh_access_control_after_mutation(&admin).await;
+        crate::nacos::namespace_access::invalidate_all();
+    }
+    result
+}
+
+pub async fn nacos_update_user_core(state: &AppState, conn_id: &str, req: NacosUserUpdate) -> Result<(), String> {
+    ensure_connection_writable(state, conn_id, "Update Nacos user").await?;
+    let admin = get_admin(state, conn_id).await?;
+    let capabilities = current_access_control_capabilities(&admin).await;
+    ensure_access_control_operation(&capabilities, NacosAccessControlOperation::UpdateUser)?;
+    let result = admin.update_user(req).await;
+    if result.is_ok() {
+        refresh_access_control_after_mutation(&admin).await;
+        crate::nacos::namespace_access::invalidate_all();
+    }
+    result
+}
+
+pub async fn nacos_delete_user_core(state: &AppState, conn_id: &str, username: String) -> Result<(), String> {
+    ensure_connection_writable(state, conn_id, "Delete Nacos user").await?;
+    let admin = get_admin(state, conn_id).await?;
+    let capabilities = current_access_control_capabilities(&admin).await;
+    if capabilities.enhanced_workspace {
+        return Err(
+            "Nacos users in the enhanced workspace must be deleted through the access-control workflow".to_string()
+        );
+    }
+    ensure_access_control_operation(&capabilities, NacosAccessControlOperation::DeleteUser)?;
+    let result = admin.delete_user(username).await;
+    if result.is_ok() {
+        refresh_access_control_after_mutation(&admin).await;
+        crate::nacos::namespace_access::invalidate_all();
+    }
+    result
+}
+
+pub async fn nacos_list_role_bindings_core(
+    state: &AppState,
+    conn_id: &str,
+    query: NacosRoleQuery,
+) -> Result<NacosRoleList, String> {
+    let admin = get_admin(state, conn_id).await?;
+    admin.list_role_bindings(query).await
+}
+
+pub async fn nacos_assign_role_core(state: &AppState, conn_id: &str, binding: NacosRoleBinding) -> Result<(), String> {
+    ensure_connection_writable(state, conn_id, "Assign Nacos role").await?;
+    let admin = get_admin(state, conn_id).await?;
+    let capabilities = current_access_control_capabilities(&admin).await;
+    if capabilities.enhanced_workspace {
+        return Err(
+            "Nacos roles in the enhanced workspace must be changed through the access-control workflow".to_string()
+        );
+    }
+    ensure_access_control_operation(&capabilities, NacosAccessControlOperation::AssignRole)?;
+    let result = admin.assign_role(binding).await;
+    if result.is_ok() {
+        refresh_access_control_after_mutation(&admin).await;
+        crate::nacos::namespace_access::invalidate_all();
+    }
+    result
+}
+
+pub async fn nacos_remove_role_core(state: &AppState, conn_id: &str, binding: NacosRoleBinding) -> Result<(), String> {
+    ensure_connection_writable(state, conn_id, "Remove Nacos role").await?;
+    let admin = get_admin(state, conn_id).await?;
+    let capabilities = current_access_control_capabilities(&admin).await;
+    if capabilities.enhanced_workspace {
+        return Err(
+            "Nacos roles in the enhanced workspace must be changed through the access-control workflow".to_string()
+        );
+    }
+    ensure_access_control_operation(&capabilities, NacosAccessControlOperation::RemoveRole)?;
+    if binding.role == "ROLE_ADMIN" {
+        return Err("The Nacos administrator role cannot be removed through the legacy endpoint".to_string());
+    }
+    let result = admin.remove_role(binding).await;
+    if result.is_ok() {
+        refresh_access_control_after_mutation(&admin).await;
+        crate::nacos::namespace_access::invalidate_all();
+    }
+    result
+}
+
+pub async fn nacos_access_snapshot_core(state: &AppState, conn_id: &str) -> Result<NacosAccessControlSnapshot, String> {
+    let admin = get_admin(state, conn_id).await?;
+    if !current_access_control_capabilities(&admin).await.enhanced_workspace {
+        return Err("The enhanced access-control workspace is unavailable for this Nacos connection".to_string());
+    }
+    crate::nacos::access_control::load_snapshot(admin).await
+}
+
+pub async fn nacos_start_access_operation_core(
+    state: &AppState,
+    conn_id: &str,
+    req: NacosAccessOperationRequest,
+) -> Result<NacosAccessOperationResult, String> {
+    ensure_connection_writable(state, conn_id, "Manage Nacos access control").await?;
+    let (admin, fingerprint) = get_admin_with_operation_fingerprint(state, conn_id).await?;
+    if !current_access_control_capabilities(&admin).await.enhanced_workspace {
+        return Err("The enhanced access-control workspace is unavailable for this Nacos connection".to_string());
+    }
+    let (result, state_changed) =
+        crate::nacos::access_control::start_operation(conn_id, fingerprint, admin.clone(), req).await?;
+    if state_changed {
+        refresh_access_control_after_mutation(&admin).await;
+        crate::nacos::namespace_access::invalidate_all();
+    }
+    Ok(result)
+}
+
+pub async fn nacos_get_access_operation_core(
+    state: &AppState,
+    conn_id: &str,
+    operation_id: &str,
+) -> Result<NacosAccessOperationResult, String> {
+    let (_, fingerprint) = get_admin_with_operation_fingerprint(state, conn_id).await?;
+    crate::nacos::access_control::get_operation(conn_id, &fingerprint, operation_id)
+}
+
+pub async fn nacos_retry_access_operation_core(
+    state: &AppState,
+    conn_id: &str,
+    retry: NacosAccessOperationRetry,
+) -> Result<NacosAccessOperationResult, String> {
+    ensure_connection_writable(state, conn_id, "Retry Nacos access-control operation").await?;
+    let (admin, fingerprint) = get_admin_with_operation_fingerprint(state, conn_id).await?;
+    let (result, state_changed) =
+        crate::nacos::access_control::retry_operation(conn_id, fingerprint, admin.clone(), retry).await?;
+    if state_changed {
+        refresh_access_control_after_mutation(&admin).await;
+        crate::nacos::namespace_access::invalidate_all();
+    }
+    Ok(result)
+}
+
+pub async fn nacos_undo_access_operation_core(
+    state: &AppState,
+    conn_id: &str,
+    operation_id: &str,
+) -> Result<NacosAccessOperationResult, String> {
+    ensure_connection_writable(state, conn_id, "Undo Nacos access-control operation").await?;
+    let (admin, fingerprint) = get_admin_with_operation_fingerprint(state, conn_id).await?;
+    let (result, state_changed) =
+        crate::nacos::access_control::undo_operation(conn_id, fingerprint, admin.clone(), operation_id).await?;
+    if state_changed {
+        refresh_access_control_after_mutation(&admin).await;
+        crate::nacos::namespace_access::invalidate_all();
+    }
+    Ok(result)
 }
 
 pub async fn nacos_list_services_core(
@@ -278,6 +496,20 @@ pub(crate) async fn get_admin(
     state.nacos_registry.get_or_build_config(conn_id, admin_config).await
 }
 
+async fn get_admin_with_operation_fingerprint(
+    state: &AppState,
+    conn_id: &str,
+) -> Result<(std::sync::Arc<dyn crate::nacos::port::NacosAdmin>, String), String> {
+    let cfg = state.configs.read().await.get(conn_id).cloned().ok_or("Connection not found")?;
+    if cfg.db_type != DatabaseType::Nacos {
+        return Err("Connection is not a Nacos admin connection".to_string());
+    }
+    let admin_config = state.nacos_admin_config_for_connection(conn_id, &cfg).await?;
+    let fingerprint = admin_config.operation_fingerprint();
+    let admin = state.nacos_registry.get_or_build_config(conn_id, admin_config).await?;
+    Ok((admin, fingerprint))
+}
+
 pub(crate) async fn ensure_connection_writable(state: &AppState, conn_id: &str, action: &str) -> Result<(), String> {
     let cfg = state.configs.read().await.get(conn_id).cloned().ok_or("Connection not found")?;
     if cfg.read_only {
@@ -302,6 +534,7 @@ fn ensure_service_operation(
         Some(NacosCapabilityReason::EndpointUnavailable) => "endpointUnavailable",
         Some(NacosCapabilityReason::NotVerified) => "notVerified",
         Some(NacosCapabilityReason::ConnectionReadOnly) => "connectionReadOnly",
+        Some(NacosCapabilityReason::PermissionDenied) => "permissionDenied",
         None => "notVerified",
     };
     Err(format!("NACOS_ERROR[unsupportedOperation]: Nacos service operation {operation:?} is unavailable ({reason})"))
@@ -311,6 +544,18 @@ fn ensure_service_operation(
 mod tests {
     use super::*;
 
+    #[test]
+    fn access_control_operation_guard_uses_individual_capabilities() {
+        let mut capabilities = NacosAccessControlCapabilities::unavailable(NacosCapabilityReason::PermissionDenied);
+        capabilities.update_user = NacosOperationCapability::supported();
+
+        assert!(ensure_access_control_operation(&capabilities, NacosAccessControlOperation::UpdateUser).is_ok());
+        let error =
+            ensure_access_control_operation(&capabilities, NacosAccessControlOperation::CreateUser).unwrap_err();
+        assert!(error.contains("CreateUser"));
+        assert!(error.contains("permissionDenied"));
+    }
+
     #[test]
     fn core_service_operation_guard_allows_documented_rnacos_v1_writes() {
         use crate::nacos::config::{
@@ -327,6 +572,7 @@ mod tests {
             namespace: "public".to_string(),
             version_mode: Some(NacosVersionMode::Auto),
             context_path: "/nacos".to_string(),
+            managed_namespaces: Vec::new(),
             rnacos_console_addr: String::new(),
             rnacos_history_enabled: Some(false),
             rnacos_console_auth: NacosRNacosConsoleAuth::Inherit,
diff --git a/crates/dbx-core/src/nacos/types.rs b/crates/dbx-core/src/nacos/types.rs
index 445c83971a..23585a8a9f 100644
--- a/crates/dbx-core/src/nacos/types.rs
+++ b/crates/dbx-core/src/nacos/types.rs
@@ -12,6 +12,8 @@ pub struct NacosCapabilities {
     pub supports_raw_api: bool,
     #[serde(default)]
     pub service_management: NacosServiceCapabilities,
+    #[serde(default)]
+    pub access_control: NacosAccessControlCapabilities,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -46,6 +48,7 @@ pub enum NacosCapabilityReason {
     EndpointUnavailable,
     NotVerified,
     ConnectionReadOnly,
+    PermissionDenied,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -61,6 +64,93 @@ pub enum NacosServiceOperation {
     DeregisterInstance,
 }
 
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "camelCase")]
+pub enum NacosAccessControlMode {
+    #[default]
+    Unavailable,
+    RoleBindings,
+    EmbeddedRoles,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum NacosAccessControlOperation {
+    ListUsers,
+    CreateUser,
+    UpdateUser,
+    DeleteUser,
+    ListRoleBindings,
+    AssignRole,
+    RemoveRole,
+    ListPermissions,
+    GrantPermission,
+    RevokePermission,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosAccessControlCapabilities {
+    #[serde(default)]
+    pub mode: NacosAccessControlMode,
+    pub list_users: NacosOperationCapability,
+    pub create_user: NacosOperationCapability,
+    pub update_user: NacosOperationCapability,
+    pub delete_user: NacosOperationCapability,
+    pub list_role_bindings: NacosOperationCapability,
+    pub assign_role: NacosOperationCapability,
+    pub remove_role: NacosOperationCapability,
+    pub list_permissions: NacosOperationCapability,
+    pub grant_permission: NacosOperationCapability,
+    pub revoke_permission: NacosOperationCapability,
+    /// Whether all read endpoints required by the directory-detail workspace
+    /// are available. Write operations remain independently capability-gated.
+    #[serde(default)]
+    pub enhanced_workspace: bool,
+    #[serde(default)]
+    pub supports_namespace_privileges: bool,
+}
+
+impl NacosAccessControlCapabilities {
+    pub fn unavailable(reason: NacosCapabilityReason) -> Self {
+        Self {
+            mode: NacosAccessControlMode::Unavailable,
+            list_users: NacosOperationCapability::unsupported(reason),
+            create_user: NacosOperationCapability::unsupported(reason),
+            update_user: NacosOperationCapability::unsupported(reason),
+            delete_user: NacosOperationCapability::unsupported(reason),
+            list_role_bindings: NacosOperationCapability::unsupported(reason),
+            assign_role: NacosOperationCapability::unsupported(reason),
+            remove_role: NacosOperationCapability::unsupported(reason),
+            list_permissions: NacosOperationCapability::unsupported(reason),
+            grant_permission: NacosOperationCapability::unsupported(reason),
+            revoke_permission: NacosOperationCapability::unsupported(reason),
+            enhanced_workspace: false,
+            supports_namespace_privileges: false,
+        }
+    }
+
+    pub fn operation(&self, operation: NacosAccessControlOperation) -> &NacosOperationCapability {
+        match operation {
+            NacosAccessControlOperation::ListUsers => &self.list_users,
+            NacosAccessControlOperation::CreateUser => &self.create_user,
+            NacosAccessControlOperation::UpdateUser => &self.update_user,
+            NacosAccessControlOperation::DeleteUser => &self.delete_user,
+            NacosAccessControlOperation::ListRoleBindings => &self.list_role_bindings,
+            NacosAccessControlOperation::AssignRole => &self.assign_role,
+            NacosAccessControlOperation::RemoveRole => &self.remove_role,
+            NacosAccessControlOperation::ListPermissions => &self.list_permissions,
+            NacosAccessControlOperation::GrantPermission => &self.grant_permission,
+            NacosAccessControlOperation::RevokePermission => &self.revoke_permission,
+        }
+    }
+}
+
+impl Default for NacosAccessControlCapabilities {
+    fn default() -> Self {
+        Self::unavailable(NacosCapabilityReason::NotVerified)
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
 #[serde(rename_all = "camelCase")]
 pub struct NacosServiceCapabilities {
@@ -115,10 +205,341 @@ impl Default for NacosCapabilities {
             supports_instance_update: true,
             supports_raw_api: true,
             service_management: NacosServiceCapabilities::default(),
+            access_control: NacosAccessControlCapabilities::default(),
         }
     }
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosNamespacePrivilege {
+    #[serde(default = "default_true")]
+    pub enabled: bool,
+    #[serde(default = "default_true")]
+    pub whitelist_is_all: bool,
+    #[serde(default)]
+    pub whitelist: Vec<String>,
+    #[serde(default)]
+    pub blacklist_is_all: bool,
+    #[serde(default)]
+    pub blacklist: Vec<String>,
+}
+
+fn default_true() -> bool {
+    true
+}
+
+impl Default for NacosNamespacePrivilege {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            whitelist_is_all: true,
+            whitelist: Vec::new(),
+            blacklist_is_all: false,
+            blacklist: Vec::new(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosUserQuery {
+    #[serde(default)]
+    pub username: Option<String>,
+    #[serde(default)]
+    pub page_no: Option<u32>,
+    #[serde(default)]
+    pub page_size: Option<u32>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosUserInfo {
+    pub username: String,
+    #[serde(default)]
+    pub nickname: Option<String>,
+    #[serde(default)]
+    pub enabled: Option<bool>,
+    #[serde(default)]
+    pub roles: Vec<String>,
+    #[serde(default)]
+    pub namespace_privilege: Option<NacosNamespacePrivilege>,
+    #[serde(default)]
+    pub source: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosUserList {
+    pub page_no: u32,
+    pub page_size: u32,
+    pub total_count: u64,
+    pub items: Vec<NacosUserInfo>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosUserCreate {
+    pub username: String,
+    pub password: String,
+    #[serde(default)]
+    pub nickname: Option<String>,
+    #[serde(default)]
+    pub enabled: Option<bool>,
+    #[serde(default)]
+    pub roles: Vec<String>,
+    #[serde(default)]
+    pub namespace_privilege: Option<NacosNamespacePrivilege>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosUserUpdate {
+    pub username: String,
+    #[serde(default)]
+    pub password: Option<String>,
+    #[serde(default)]
+    pub nickname: Option<String>,
+    #[serde(default)]
+    pub enabled: Option<bool>,
+    #[serde(default)]
+    pub roles: Option<Vec<String>>,
+    #[serde(default)]
+    pub namespace_privilege: Option<NacosNamespacePrivilege>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosRoleQuery {
+    #[serde(default)]
+    pub username: Option<String>,
+    #[serde(default)]
+    pub role: Option<String>,
+    #[serde(default)]
+    pub page_no: Option<u32>,
+    #[serde(default)]
+    pub page_size: Option<u32>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosRoleBinding {
+    pub username: String,
+    pub role: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosRoleList {
+    pub page_no: u32,
+    pub page_size: u32,
+    pub total_count: u64,
+    pub items: Vec<NacosRoleBinding>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosPermissionQuery {
+    #[serde(default)]
+    pub role: Option<String>,
+    #[serde(default)]
+    pub resource: Option<String>,
+    #[serde(default)]
+    pub page_no: Option<u32>,
+    #[serde(default)]
+    pub page_size: Option<u32>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosPermissionInfo {
+    pub role: String,
+    pub resource_raw: String,
+    pub action_raw: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub parsed_scope: Option<NacosPermissionScope>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosPermissionScope {
+    pub kind: NacosPermissionScopeKind,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub namespace_id: Option<String>,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase")]
+pub enum NacosPermissionScopeKind {
+    Namespace,
+    Global,
+    Custom,
+    Unknown,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosPermissionList {
+    pub page_no: u32,
+    pub page_size: u32,
+    pub total_count: u64,
+    pub items: Vec<NacosPermissionInfo>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosRoleSummary {
+    pub role: String,
+    pub member_count: u64,
+    pub permission_count: u64,
+    pub complete: bool,
+    pub administrator: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosEffectivePermission {
+    pub resource_raw: String,
+    pub action: String,
+    pub parsed_scope: Option<NacosPermissionScope>,
+    pub source_roles: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosAccessControlSnapshot {
+    pub users: Vec<NacosUserInfo>,
+    pub role_bindings: Vec<NacosRoleBinding>,
+    pub permissions: Vec<NacosPermissionInfo>,
+    pub roles: Vec<NacosRoleSummary>,
+    pub namespaces: Vec<NacosNamespaceInfo>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub current_username: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosNewUserDraft {
+    pub username: String,
+    pub password: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosPermissionDraft {
+    pub namespace_ids: Vec<String>,
+    pub action: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "camelCase")]
+pub enum NacosAccessOperationRequest {
+    CreateUser {
+        username: String,
+        password: String,
+        #[serde(default)]
+        roles: Vec<String>,
+        #[serde(default)]
+        confirmation: Option<String>,
+    },
+    CreateRole {
+        role: String,
+        #[serde(default)]
+        members: Vec<String>,
+        #[serde(default, rename = "newUsers")]
+        new_users: Vec<NacosNewUserDraft>,
+        permissions: Vec<NacosPermissionDraft>,
+        #[serde(default)]
+        confirmation: Option<String>,
+    },
+    UpdateUserRoles {
+        username: String,
+        roles: Vec<String>,
+        #[serde(default)]
+        confirmation: Option<String>,
+    },
+    UpdateRole {
+        role: String,
+        members: Vec<String>,
+        #[serde(default, rename = "newUsers")]
+        new_users: Vec<NacosNewUserDraft>,
+        permissions: Vec<NacosPermissionDraft>,
+        #[serde(default)]
+        confirmation: Option<String>,
+    },
+    DeleteUser {
+        username: String,
+        #[serde(default)]
+        confirmation: Option<String>,
+    },
+    DeleteRole {
+        role: String,
+        #[serde(default)]
+        confirmation: Option<String>,
+    },
+    RevokePermission {
+        permission: NacosPermissionInfo,
+        #[serde(default)]
+        confirmation: Option<String>,
+    },
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub enum NacosAccessOperationStatus {
+    Running,
+    Partial,
+    Succeeded,
+    Failed,
+    Undoing,
+    Undone,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub enum NacosAccessOperationStepStatus {
+    Pending,
+    Running,
+    Succeeded,
+    Failed,
+    Skipped,
+    Compensated,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosAccessOperationStep {
+    pub id: String,
+    pub action: String,
+    pub target: String,
+    pub status: NacosAccessOperationStepStatus,
+    pub retryable: bool,
+    #[serde(default)]
+    pub needs_password: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosAccessOperationResult {
+    pub operation_id: String,
+    pub status: NacosAccessOperationStatus,
+    pub steps: Vec<NacosAccessOperationStep>,
+    #[serde(default)]
+    pub can_retry: bool,
+    #[serde(default)]
+    pub can_undo: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosAccessOperationRetry {
+    pub operation_id: String,
+    #[serde(default)]
+    pub credentials: Vec<NacosNewUserDraft>,
+}
+
 /// A short-lived challenge returned by the authenticated r-nacos console.
 /// The corresponding server-side CAPTCHA token stays in the adapter process;
 /// only the image is returned to the desktop client.
@@ -158,6 +579,13 @@ pub struct NacosNamespaceInfo {
     pub namespace_type: Option<u64>,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct NacosNamespaceSidebarSnapshot {
+    pub namespaces: Vec<NacosNamespaceInfo>,
+    pub access_control: NacosAccessControlCapabilities,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase")]
 pub struct NacosNamespaceCreate {
diff --git a/crates/dbx-web/src/main.rs b/crates/dbx-web/src/main.rs
index f24b13e1a5..e0bd5ecf92 100644
--- a/crates/dbx-web/src/main.rs
+++ b/crates/dbx-web/src/main.rs
@@ -723,6 +723,7 @@ async fn main() {
         // Nacos
         .route("/nacos/test-connection", post(routes::nacos::test_connection))
         .route("/nacos/namespaces/list", post(routes::nacos::list_namespaces))
+        .route("/nacos/sidebar/snapshot", post(routes::nacos::sidebar_snapshot))
         .route("/nacos/namespaces/create", post(routes::nacos::create_namespace))
         .route("/nacos/namespaces/update", post(routes::nacos::update_namespace))
         .route("/nacos/configs/list", post(routes::nacos::list_configs))
@@ -734,6 +735,18 @@ async fn main() {
         .route("/nacos/configs/history/rollback", post(routes::nacos::rollback_config))
         .route("/nacos/rnacos-console/captcha", post(routes::nacos::get_rnacos_console_captcha))
         .route("/nacos/rnacos-console/login", post(routes::nacos::login_rnacos_console))
+        .route("/nacos/users/list", post(routes::nacos::list_users))
+        .route("/nacos/users/create", post(routes::nacos::create_user))
+        .route("/nacos/users/update", post(routes::nacos::update_user))
+        .route("/nacos/users/delete", post(routes::nacos::delete_user))
+        .route("/nacos/roles/list", post(routes::nacos::list_role_bindings))
+        .route("/nacos/roles/assign", post(routes::nacos::assign_role))
+        .route("/nacos/roles/remove", post(routes::nacos::remove_role))
+        .route("/nacos/access/snapshot", post(routes::nacos::access_snapshot))
+        .route("/nacos/access/operations/start", post(routes::nacos::start_access_operation))
+        .route("/nacos/access/operations/get", post(routes::nacos::get_access_operation))
+        .route("/nacos/access/operations/retry", post(routes::nacos::retry_access_operation))
+        .route("/nacos/access/operations/undo", post(routes::nacos::undo_access_operation))
         .route("/nacos/services/list", post(routes::nacos::list_services))
         .route("/nacos/services/get", post(routes::nacos::get_service))
         .route("/nacos/services/create", post(routes::nacos::create_service))
diff --git a/crates/dbx-web/src/routes/connection.rs b/crates/dbx-web/src/routes/connection.rs
index ab18d3470d..eda7284fec 100644
--- a/crates/dbx-web/src/routes/connection.rs
+++ b/crates/dbx-web/src/routes/connection.rs
@@ -179,8 +179,18 @@ async fn run_temporary_connection_test(
     let temp_id = format!("{TEST_PROBE_ID_PREFIX}{}", uuid::Uuid::new_v4());
     app.configs.write().await.insert(temp_id.clone(), config.clone());
 
-    let pool_result = app.get_or_create_pool(&temp_id, config.database.as_deref()).await;
-    let database_info = if include_database_info {
+    let pool_result = if config.db_type == DatabaseType::Nacos {
+        match app.nacos_admin_config_for_connection(&temp_id, &config).await {
+            Ok(admin_config) => match app.nacos_registry.build_transient_config(admin_config).await {
+                Ok(adapter) => adapter.test_connection_with_scope_validation().await.map(|_| temp_id.clone()),
+                Err(error) => Err(error),
+            },
+            Err(error) => Err(error),
+        }
+    } else {
+        app.get_or_create_pool(&temp_id, config.database.as_deref()).await
+    };
+    let database_info = if include_database_info && config.db_type != DatabaseType::Nacos {
         match &pool_result {
             Ok(_) => match app.connection_database_info(&temp_id, config.database.as_deref()).await {
                 Ok(info) => info,
@@ -299,6 +309,7 @@ pub async fn connect_db(
     }
 
     app.remove_connection_pools_detached(&connection_id).await;
+    app.nacos_registry.drop_connection(&connection_id).await;
     app.reset_connection_transport_for_config(&connection_id, &runtime_config).await;
     app.configs.write().await.insert(connection_id.clone(), runtime_config);
 
diff --git a/crates/dbx-web/src/routes/nacos.rs b/crates/dbx-web/src/routes/nacos.rs
index 29c5921472..fffb53475b 100644
--- a/crates/dbx-web/src/routes/nacos.rs
+++ b/crates/dbx-web/src/routes/nacos.rs
@@ -88,6 +88,69 @@ pub(crate) struct RNacosConsoleLoginReq {
     captcha: Option<String>,
 }
 
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct UserListReq {
+    connection_id: String,
+    query: dbx_core::nacos::NacosUserQuery,
+}
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct UserCreateReq {
+    connection_id: String,
+    req: dbx_core::nacos::NacosUserCreate,
+}
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct UserUpdateReq {
+    connection_id: String,
+    req: dbx_core::nacos::NacosUserUpdate,
+}
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct UserDeleteReq {
+    connection_id: String,
+    username: String,
+}
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct RoleListReq {
+    connection_id: String,
+    query: dbx_core::nacos::NacosRoleQuery,
+}
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct RoleBindingReq {
+    connection_id: String,
+    binding: dbx_core::nacos::NacosRoleBinding,
+}
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct AccessOperationReq {
+    connection_id: String,
+    req: dbx_core::nacos::NacosAccessOperationRequest,
+}
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct AccessOperationIdReq {
+    connection_id: String,
+    operation_id: String,
+}
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct AccessOperationRetryReq {
+    connection_id: String,
+    retry: dbx_core::nacos::NacosAccessOperationRetry,
+}
+
 #[derive(serde::Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub(crate) struct ServiceListReq {
@@ -217,6 +280,16 @@ pub async fn list_namespaces(
     Ok(Json(result))
 }
 
+pub async fn sidebar_snapshot(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<ConnReq>,
+) -> Result<Json<dbx_core::nacos::NacosNamespaceSidebarSnapshot>, AppError> {
+    let result = dbx_core::nacos::service::nacos_sidebar_snapshot_core(&state.app, &req.connection_id)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(result))
+}
+
 pub async fn create_namespace(
     State(state): State<Arc<WebState>>,
     Json(req): Json<NamespaceCreateReq>,
@@ -327,6 +400,128 @@ pub async fn login_rnacos_console(
     Ok(Json(()))
 }
 
+pub async fn list_users(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<UserListReq>,
+) -> Result<Json<dbx_core::nacos::NacosUserList>, AppError> {
+    let result = dbx_core::nacos::service::nacos_list_users_core(&state.app, &req.connection_id, req.query)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(result))
+}
+
+pub async fn create_user(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<UserCreateReq>,
+) -> Result<Json<()>, AppError> {
+    dbx_core::nacos::service::nacos_create_user_core(&state.app, &req.connection_id, req.req)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(()))
+}
+
+pub async fn update_user(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<UserUpdateReq>,
+) -> Result<Json<()>, AppError> {
+    dbx_core::nacos::service::nacos_update_user_core(&state.app, &req.connection_id, req.req)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(()))
+}
+
+pub async fn delete_user(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<UserDeleteReq>,
+) -> Result<Json<()>, AppError> {
+    dbx_core::nacos::service::nacos_delete_user_core(&state.app, &req.connection_id, req.username)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(()))
+}
+
+pub async fn list_role_bindings(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<RoleListReq>,
+) -> Result<Json<dbx_core::nacos::NacosRoleList>, AppError> {
+    let result = dbx_core::nacos::service::nacos_list_role_bindings_core(&state.app, &req.connection_id, req.query)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(result))
+}
+
+pub async fn assign_role(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<RoleBindingReq>,
+) -> Result<Json<()>, AppError> {
+    dbx_core::nacos::service::nacos_assign_role_core(&state.app, &req.connection_id, req.binding)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(()))
+}
+
+pub async fn remove_role(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<RoleBindingReq>,
+) -> Result<Json<()>, AppError> {
+    dbx_core::nacos::service::nacos_remove_role_core(&state.app, &req.connection_id, req.binding)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(()))
+}
+
+pub async fn access_snapshot(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<ConnReq>,
+) -> Result<Json<dbx_core::nacos::NacosAccessControlSnapshot>, AppError> {
+    let result = dbx_core::nacos::service::nacos_access_snapshot_core(&state.app, &req.connection_id)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(result))
+}
+
+pub async fn start_access_operation(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<AccessOperationReq>,
+) -> Result<Json<dbx_core::nacos::NacosAccessOperationResult>, AppError> {
+    let result = dbx_core::nacos::service::nacos_start_access_operation_core(&state.app, &req.connection_id, req.req)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(result))
+}
+
+pub async fn get_access_operation(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<AccessOperationIdReq>,
+) -> Result<Json<dbx_core::nacos::NacosAccessOperationResult>, AppError> {
+    let result =
+        dbx_core::nacos::service::nacos_get_access_operation_core(&state.app, &req.connection_id, &req.operation_id)
+            .await
+            .map_err(AppError::from)?;
+    Ok(Json(result))
+}
+
+pub async fn retry_access_operation(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<AccessOperationRetryReq>,
+) -> Result<Json<dbx_core::nacos::NacosAccessOperationResult>, AppError> {
+    let result = dbx_core::nacos::service::nacos_retry_access_operation_core(&state.app, &req.connection_id, req.retry)
+        .await
+        .map_err(AppError::from)?;
+    Ok(Json(result))
+}
+
+pub async fn undo_access_operation(
+    State(state): State<Arc<WebState>>,
+    Json(req): Json<AccessOperationIdReq>,
+) -> Result<Json<dbx_core::nacos::NacosAccessOperationResult>, AppError> {
+    let result =
+        dbx_core::nacos::service::nacos_undo_access_operation_core(&state.app, &req.connection_id, &req.operation_id)
+            .await
+            .map_err(AppError::from)?;
+    Ok(Json(result))
+}
+
 pub async fn list_services(
     State(state): State<Arc<WebState>>,
     Json(req): Json<ServiceListReq>,
diff --git a/packages/app-tests/sidebarTreeAffordances.test.ts b/packages/app-tests/sidebarTreeAffordances.test.ts
index 9793b1c6bf..b9456282e0 100644
--- a/packages/app-tests/sidebarTreeAffordances.test.ts
+++ b/packages/app-tests/sidebarTreeAffordances.test.ts
@@ -78,7 +78,7 @@ test("tree filters retain a temporary expansion state", () => {
   assert.doesNotMatch(connectionTree, /children: matchingChildren,\s*isExpanded:\s*true/);
   assert.match(connectionTree, /function onSearchToggle\(node: TreeNode\) \{\s*if \(!isTreeSearchFiltering\.value \|\| !node\.children\) return;/);
   assert.match(connectionTree, /function onNodeToggled\(node: TreeNode, expanded: boolean\) \{\s*if \(isTreeSearchFiltering\.value\) return;\s*syncSidebarTreeNodeExpansion\(store\.treeNodes, node, expanded\)/);
-  assert.match(runtimeHost, /shouldRunTreeNodeRowAction\(action, clickDetail, isGroupLabel\(node\)\)/);
+  assert.match(runtimeHost, /shouldRunTreeNodeRowAction\(action, clickDetail, isGroupLabel\(node\) \|\| isRepeatableNavigationTreeNode\(node\.type\)\)/);
 });
 
 test("tree rebuilds keep a context menu only while its target row remains visible", () => {
diff --git a/src-tauri/src/commands/connection.rs b/src-tauri/src/commands/connection.rs
index 479cdce876..c01902a569 100644
--- a/src-tauri/src/commands/connection.rs
+++ b/src-tauri/src/commands/connection.rs
@@ -1259,7 +1259,7 @@ async fn test_connection_with_info_inner(
             DatabaseType::Nacos => {
                 let admin_config = state.nacos_admin_config_for_connection(connection_id, &config).await?;
                 let adapter = state.nacos_registry.build_transient_config(admin_config).await?;
-                adapter.test_connection().await?;
+                adapter.test_connection_with_scope_validation().await?;
                 Ok("Connection successful".to_string())
             }
             DatabaseType::Consul => {
@@ -1386,6 +1386,7 @@ pub async fn connect_db(
     let mut connected_db_config = db_config.clone();
 
     state.remove_connection_pools_detached(&id).await;
+    drop_nacos_adapters_for_connection_ids(state.inner(), std::slice::from_ref(&id)).await;
     state.reset_connection_transport_for_config(&id, &db_config).await;
 
     let (host, port) = state.connection_host_port(&id, &db_config).await?;
diff --git a/src-tauri/src/commands/nacos_cmd.rs b/src-tauri/src/commands/nacos_cmd.rs
index 4761e6eee2..a00d0782ae 100644
--- a/src-tauri/src/commands/nacos_cmd.rs
+++ b/src-tauri/src/commands/nacos_cmd.rs
@@ -22,6 +22,14 @@ pub async fn nacos_list_namespaces(
     dbx_core::nacos::service::nacos_list_namespaces_core(&state, &connection_id).await
 }
 
+#[tauri::command]
+pub async fn nacos_sidebar_snapshot(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+) -> Result<dbx_core::nacos::NacosNamespaceSidebarSnapshot, String> {
+    dbx_core::nacos::service::nacos_sidebar_snapshot_core(&state, &connection_id).await
+}
+
 #[tauri::command]
 pub async fn nacos_create_namespace(
     state: State<'_, Arc<AppState>>,
@@ -120,6 +128,113 @@ pub async fn nacos_login_rnacos_console(
     dbx_core::nacos::service::nacos_login_rnacos_console_core(&state, &connection_id, captcha).await
 }
 
+#[tauri::command]
+pub async fn nacos_list_users(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    query: dbx_core::nacos::NacosUserQuery,
+) -> Result<dbx_core::nacos::NacosUserList, String> {
+    dbx_core::nacos::service::nacos_list_users_core(&state, &connection_id, query).await
+}
+
+#[tauri::command]
+pub async fn nacos_create_user(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    req: dbx_core::nacos::NacosUserCreate,
+) -> Result<(), String> {
+    dbx_core::nacos::service::nacos_create_user_core(&state, &connection_id, req).await
+}
+
+#[tauri::command]
+pub async fn nacos_update_user(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    req: dbx_core::nacos::NacosUserUpdate,
+) -> Result<(), String> {
+    dbx_core::nacos::service::nacos_update_user_core(&state, &connection_id, req).await
+}
+
+#[tauri::command]
+pub async fn nacos_delete_user(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    username: String,
+) -> Result<(), String> {
+    dbx_core::nacos::service::nacos_delete_user_core(&state, &connection_id, username).await
+}
+
+#[tauri::command]
+pub async fn nacos_list_role_bindings(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    query: dbx_core::nacos::NacosRoleQuery,
+) -> Result<dbx_core::nacos::NacosRoleList, String> {
+    dbx_core::nacos::service::nacos_list_role_bindings_core(&state, &connection_id, query).await
+}
+
+#[tauri::command]
+pub async fn nacos_assign_role(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    binding: dbx_core::nacos::NacosRoleBinding,
+) -> Result<(), String> {
+    dbx_core::nacos::service::nacos_assign_role_core(&state, &connection_id, binding).await
+}
+
+#[tauri::command]
+pub async fn nacos_remove_role(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    binding: dbx_core::nacos::NacosRoleBinding,
+) -> Result<(), String> {
+    dbx_core::nacos::service::nacos_remove_role_core(&state, &connection_id, binding).await
+}
+
+#[tauri::command]
+pub async fn nacos_access_snapshot(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+) -> Result<dbx_core::nacos::NacosAccessControlSnapshot, String> {
+    dbx_core::nacos::service::nacos_access_snapshot_core(&state, &connection_id).await
+}
+
+#[tauri::command]
+pub async fn nacos_start_access_operation(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    req: dbx_core::nacos::NacosAccessOperationRequest,
+) -> Result<dbx_core::nacos::NacosAccessOperationResult, String> {
+    dbx_core::nacos::service::nacos_start_access_operation_core(&state, &connection_id, req).await
+}
+
+#[tauri::command]
+pub async fn nacos_get_access_operation(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    operation_id: String,
+) -> Result<dbx_core::nacos::NacosAccessOperationResult, String> {
+    dbx_core::nacos::service::nacos_get_access_operation_core(&state, &connection_id, &operation_id).await
+}
+
+#[tauri::command]
+pub async fn nacos_retry_access_operation(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    retry: dbx_core::nacos::NacosAccessOperationRetry,
+) -> Result<dbx_core::nacos::NacosAccessOperationResult, String> {
+    dbx_core::nacos::service::nacos_retry_access_operation_core(&state, &connection_id, retry).await
+}
+
+#[tauri::command]
+pub async fn nacos_undo_access_operation(
+    state: State<'_, Arc<AppState>>,
+    connection_id: String,
+    operation_id: String,
+) -> Result<dbx_core::nacos::NacosAccessOperationResult, String> {
+    dbx_core::nacos::service::nacos_undo_access_operation_core(&state, &connection_id, &operation_id).await
+}
+
 #[tauri::command]
 pub async fn nacos_list_services(
     state: State<'_, Arc<AppState>>,
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 61e0dd5205..7c6eafe3fb 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -1931,6 +1931,7 @@ pub fn run() {
             commands::consul_cmd::consul_mesh_exported_services_apply,
             commands::nacos_cmd::nacos_test_connection,
             commands::nacos_cmd::nacos_list_namespaces,
+            commands::nacos_cmd::nacos_sidebar_snapshot,
             commands::nacos_cmd::nacos_create_namespace,
             commands::nacos_cmd::nacos_update_namespace,
             commands::nacos_cmd::nacos_list_configs,
@@ -1942,6 +1943,18 @@ pub fn run() {
             commands::nacos_cmd::nacos_rollback_config,
             commands::nacos_cmd::nacos_get_rnacos_console_captcha,
             commands::nacos_cmd::nacos_login_rnacos_console,
+            commands::nacos_cmd::nacos_list_users,
+            commands::nacos_cmd::nacos_create_user,
+            commands::nacos_cmd::nacos_update_user,
+            commands::nacos_cmd::nacos_delete_user,
+            commands::nacos_cmd::nacos_list_role_bindings,
+            commands::nacos_cmd::nacos_assign_role,
+            commands::nacos_cmd::nacos_remove_role,
+            commands::nacos_cmd::nacos_access_snapshot,
+            commands::nacos_cmd::nacos_start_access_operation,
+            commands::nacos_cmd::nacos_get_access_operation,
+            commands::nacos_cmd::nacos_retry_access_operation,
+            commands::nacos_cmd::nacos_undo_access_operation,
             commands::nacos_cmd::nacos_list_services,
             commands::nacos_cmd::nacos_get_service,
             commands::nacos_cmd::nacos_create_service,