diff --git a/src/components/ListTable/index.vue b/src/components/ListTable/index.vue
index e79d69d10..68103e878 100644
--- a/src/components/ListTable/index.vue
+++ b/src/components/ListTable/index.vue
@@ -6,7 +6,7 @@
       :date-pick="handleDateChange"
       :selected-rows="selectedRows"
       :reload-table="reloadTable"
-      v-bind="headerActions"
+      v-bind="iHeaderActions"
     />
     <IBox class="table-content">
       <AutoDataTable
@@ -25,7 +25,9 @@ import AutoDataTable from '../AutoDataTable'
 import IBox from '../IBox'
 import TableAction from './TableAction'
 import Emitter from '@/mixins/emitter'
+import { getResourceFromApiUrl } from '@/utils/jms'
 import deepmerge from 'deepmerge'
+import { mapGetters } from 'vuex'
 
 export default {
   name: 'ListTable',
@@ -55,17 +57,64 @@ export default {
     }
   },
   computed: {
+    ...mapGetters(['currentOrgIsRoot']),
     dataTable() {
       return this.$refs.dataTable.$refs.dataTable
     },
+    iHeaderActions() {
+      const actions = {
+        canCreate: { action: 'add', checkRoot: true },
+        hasBulkDelete: { action: 'delete', checkRoot: false },
+        hasBulkUpdate: { action: 'change', checkRoot: true },
+        hasImport: { action: 'add', checkRoot: true },
+        hasExport: { action: 'view', checkRoot: false }
+      }
+      const defaults = {}
+      for (const [k, v] of Object.entries(actions)) {
+        defaults[k] = this.hasActionPerm(v.action)
+        if (v.checkRoot) {
+          defaults[k] = defaults[k] && !this.currentOrgIsRoot
+        }
+      }
+      return Object.assign(defaults, this.headerActions)
+    },
     iTableConfig() {
-      const config = deepmerge(this.tableConfig, { extraQuery: this.extraQuery })
+      const config = deepmerge(this.tableConfig, {
+        extraQuery: this.extraQuery
+      })
+      const formatterArgs = {
+        'columnsMeta.actions.formatterArgs.canUpdate': 'change',
+        'columnsMeta.actions.formatterArgs.canDelete': 'delete',
+        'columnsMeta.actions.formatterArgs.canClone': 'add',
+        'columnsMeta.name.formatterArgs.can': 'view'
+      }
+      for (const [arg, action] of Object.entries(formatterArgs)) {
+        const notSet = _.get(config, arg) === undefined
+        if (notSet) {
+          _.set(config, arg, this.hasActionPerm(action))
+        }
+      }
       this.$log.debug('Header actions', this.headerActions)
       this.$log.debug('ListTable: iTableConfig change', config)
       return config
     },
     tableUrl() {
-      return this.iTableConfig.url
+      return this.tableConfig.url
+    },
+    permissions() {
+      // 获取 permissions，获取不到通过 url 解析
+      const permissions = this.tableConfig.permissions || {}
+      const { app: apiApp, resource: apiResource } = getResourceFromApiUrl(this.tableUrl)
+      const app = permissions.app || apiApp
+      const resource = permissions.resource || apiResource
+      const actions = ['add', 'change', 'delete', 'view']
+      const defaultPermissions = actions.reduce((result, action) => {
+        result[action] = `${app}.${action}_${resource}`
+        return result
+      }, {})
+      const perms = Object.assign(defaultPermissions, permissions)
+      this.$log.debug('Permissions: ', perms)
+      return perms
     }
   },
   watch: {
@@ -97,6 +146,10 @@ export default {
       this.$emit('TagFilter', attrs)
       this.$refs.dataTable.$refs.dataTable.search(attrs, true)
     },
+    hasActionPerm(action) {
+      const permRequired = this.permissions[action]
+      return this.$hasPerm(permRequired)
+    },
     handleDateChange(attrs) {
       let dateFrom = ''
       let dateTo = ''
diff --git a/src/components/TableFormatters/ActionsFormatter.vue b/src/components/TableFormatters/ActionsFormatter.vue
index 81c2cf7fe..939d64ff8 100644
--- a/src/components/TableFormatters/ActionsFormatter.vue
+++ b/src/components/TableFormatters/ActionsFormatter.vue
@@ -84,19 +84,11 @@ export default {
       default: function() {
         return {
           hasUpdate: true, // can set function(row, value)
-          canUpdate: () => {
-            const notRootOrg = !this.$store.getters.currentOrgIsRoot
-            return notRootOrg && this.$hasCurrentResAction('change')
-          }, // can set function(row, value)
+          canUpdate: true, // can set function(row, value)
           hasDelete: true, // can set function(row, value)
-          canDelete: () => {
-            return this.$hasCurrentResAction('delete')
-          },
+          canDelete: true,
           hasClone: true,
-          canClone: () => {
-            const notRootOrg = !this.$store.getters.currentOrgIsRoot
-            return notRootOrg && this.$hasCurrentResAction('add')
-          },
+          canClone: true,
           updateRoute: this.$route.name.replace('List', 'Update'),
           cloneRoute: this.$route.name.replace('List', 'Create'),
           performDelete: defaultPerformDelete,
diff --git a/src/components/TableFormatters/DetailFormatter.vue b/src/components/TableFormatters/DetailFormatter.vue
index 5e84fa211..cd4f1c542 100644
--- a/src/components/TableFormatters/DetailFormatter.vue
+++ b/src/components/TableFormatters/DetailFormatter.vue
@@ -16,10 +16,7 @@ export default {
           route: this.$route.name.replace('List', 'Detail'),
           getRoute: null,
           routeQuery: null,
-          permissions: this.$getCurrentResActionPerms('view'),
-          can: (col) => {
-            return this.$hasPerm(this.formatterArgs.permissions)
-          },
+          can: true,
           getTitle({ col, row, cellValue }) {
             return cellValue
           }
@@ -42,7 +39,11 @@ export default {
       })
     },
     disabled() {
-      return !this.formatterArgs.can(this.col)
+      let can = this.formatterArgs.can
+      if (typeof can === 'function') {
+        can = can(this.col)
+      }
+      return !can
     }
   },
   methods: {
@@ -60,13 +61,14 @@ export default {
         console.error('No route found')
         return
       }
-      let detailRoute = {}
+      let detailRoute = { replace: true }
       if (typeof route === 'string') {
         detailRoute.name = route
         detailRoute.params = { id: this.row.id }
       } else {
         detailRoute = route
       }
+      console.log('Route: ', detailRoute)
 
       const routeQuery = this.formatterArgs.routeQuery
       if (routeQuery && typeof routeQuery === 'object') {
diff --git a/src/directive/permission/index.js b/src/directive/permission/index.js
index 745cb02f1..857fb2148 100644
--- a/src/directive/permission/index.js
+++ b/src/directive/permission/index.js
@@ -1,4 +1,4 @@
-import { hasPermission, getRouteRequiredPerms } from '@/utils/jms'
+import { hasPermission, getRouteRequiredPerms, getApiUrlRequirePerms } from '@/utils/jms'
 import permission from './permission'
 import Vue from 'vue'
 
@@ -9,6 +9,11 @@ const install = function(Vue) {
     return hasPermission(perms)
   }
 
+  Vue.prototype.$hasApiActionPerm = function(url, action) {
+    const permsRequired = getApiUrlRequirePerms(url, action)
+    return hasPermission(permsRequired)
+  }
+
   Vue.prototype.$getCurrentResActionPerms = function(action) {
     return getRouteRequiredPerms(this.$route, action)
   }
diff --git a/src/layout/components/GenericListTable/index.vue b/src/layout/components/GenericListTable/index.vue
index 276318e0e..56ecccf09 100644
--- a/src/layout/components/GenericListTable/index.vue
+++ b/src/layout/components/GenericListTable/index.vue
@@ -4,8 +4,6 @@
 
 <script>
 import ListTable from '@/components/ListTable/index'
-import { mapGetters } from 'vuex'
-import { getResourceFromRoute, hasPermission } from '@/utils/jms'
 
 export default {
   name: 'GenericListTable',
@@ -13,42 +11,10 @@ export default {
     ListTable
   },
   computed: {
-    ...mapGetters(['currentOrgIsRoot'])
   },
   created() {
-    this.setDefaultAction()
   },
   methods: {
-    getRequiredPerms(action) {
-      const { app, resource } = getResourceFromRoute(this.$route)
-      return [`${app}.${action}_${resource}`]
-    },
-    hasActionPerm(action) {
-      const permsRequired = this.getRequiredPerms(action)
-      const has = hasPermission(permsRequired)
-      this.$log.debug('Action perm required: ', permsRequired, has)
-      return has
-    },
-    isRootOrgOrNoPerm(action) {
-      const permsRequired = this.getRequiredPerms(action)
-      this.$log.debug('Is root perm required: ', permsRequired)
-      return this.currentOrgIsRoot || !hasPermission(permsRequired)
-    },
-    setDefaultAction() {
-      const headerActions = this.$attrs['header-actions'] || {}
-      if (headerActions.canCreate === undefined && this.isRootOrgOrNoPerm('add')) {
-        _.set(this.$attrs, 'header-actions.canCreate', false)
-      }
-      if (headerActions.hasImport === undefined && this.isRootOrgOrNoPerm('add')) {
-        _.set(this.$attrs, 'header-actions.hasImport', false)
-      }
-      if (headerActions.hasBulkDelete === undefined && !this.hasActionPerm('del')) {
-        _.set(this.$attrs, 'header-actions.hasBulkDelete', false)
-      }
-      if (headerActions.hasBulkUpdate === undefined && !this.hasActionPerm('change')) {
-        _.set(this.$attrs, 'header-actions.hasBulkUpdate', false)
-      }
-    }
   }
 }
 </script>
diff --git a/src/router/console/users.js b/src/router/console/users.js
index 77e03d147..f711987ea 100644
--- a/src/router/console/users.js
+++ b/src/router/console/users.js
@@ -14,7 +14,9 @@ export default [
         path: '',
         component: () => import('@/views/users/User/UserList.vue'), // Parent router-view
         name: 'UserList',
-        meta: { title: i18n.t('route.UserList') }
+        meta: {
+          title: i18n.t('route.UserList')
+        }
       },
       {
         path: 'create',
@@ -83,7 +85,7 @@ export default [
     ]
   },
   {
-    path: 'user-groups',
+    path: 'groups',
     component: empty,
     redirect: '',
     meta: {
@@ -94,7 +96,7 @@ export default [
         path: '',
         component: () => import('@/views/users/Group/UserGroupList.vue'), // Parent router-view
         name: 'UserGroupList',
-        meta: { title: i18n.t('route.UserGroupList') }
+        meta: { title: i18n.t('route.UserGroupList'), permissions: ['users.view_usergroup'] }
       },
       {
         path: 'create',
diff --git a/src/router/index.js b/src/router/index.js
index 0d293032c..4d13dc548 100644
--- a/src/router/index.js
+++ b/src/router/index.js
@@ -61,6 +61,12 @@ export const allRoutes = [
     name: 'Home',
     meta: {
       permissions: []
+    },
+    beforeEnter(to, from, next) {
+      if (from.path !== '/workspace/home') {
+        next('/workspace/')
+      }
+      next(false)
     }
   },
   consoleViewRoutes,
diff --git a/src/utils/org.js b/src/utils/org.js
index 93717ee08..69533341c 100644
--- a/src/utils/org.js
+++ b/src/utils/org.js
@@ -33,6 +33,7 @@ async function changeOrg(orgId) {
   } else {
     console.debug('Change to org: ', org)
   }
+  localStorage.setItem('PreView', '')
 
   store.dispatch('users/setCurrentOrg', org).then(() => {
     // console.log('Set current org to: ', org)
diff --git a/src/views/users/Group/UserGroupList.vue b/src/views/users/Group/UserGroupList.vue
index d7f9f6a79..c646d4f1b 100644
--- a/src/views/users/Group/UserGroupList.vue
+++ b/src/views/users/Group/UserGroupList.vue
@@ -13,7 +13,10 @@ export default {
     return {
       tableConfig: {
         url: '/api/v1/users/groups/',
-        columns: ['name', 'users_amount', 'date_created', 'created_by', 'org_name', 'comment', 'actions'],
+        columns: [
+          'name', 'users_amount', 'date_created', 'created_by',
+          'org_name', 'comment', 'actions'
+        ],
         columnsShow: {
           default: ['name', 'users_amount', 'comment', 'actions'],
           min: ['name', 'action']
@@ -24,7 +27,10 @@ export default {
             width: '120px'
           }
         },
-        detailRoute: 'UserGroupDetail'
+        permissions: {
+          app: 'users',
+          resource: 'usergroup'
+        }
       },
       headerActions: {
         createRoute: 'UserGroupCreate'