diff --git a/apps/assets/api/account/account.py b/apps/assets/api/account/account.py
index 9e2697adb..8dad13b3c 100644
--- a/apps/assets/api/account/account.py
+++ b/apps/assets/api/account/account.py
@@ -76,8 +76,7 @@ class AccountHistoriesSecretAPI(RecordViewLogMixin, ListAPIView):
     model = Account.history.model
     serializer_class = serializers.AccountHistorySerializer
     http_method_names = ['get', 'options']
-    # Todo: 记得打开
-    # permission_classes = [RBACPermission, UserConfirmation.require(ConfirmType.MFA)]
+    permission_classes = [RBACPermission, UserConfirmation.require(ConfirmType.MFA)]
     rbac_perms = {
         'list': 'assets.view_accountsecret',
     }