diff --git a/server/internal/dao/engine.go b/server/internal/dao/engine.go
index a032aa1..6c1660d 100644
--- a/server/internal/dao/engine.go
+++ b/server/internal/dao/engine.go
@@ -37,7 +37,6 @@ func Init() error {
 		new(model.AppConfig),
 		new(model.AppConfigHistory),
 		new(model.User),
-		new(model.UserPermission),
 		new(model.ClientInstance),
 	); err != nil {
 		return err
diff --git a/server/internal/handler/app.go b/server/internal/handler/app.go
index e7c08e4..9850172 100644
--- a/server/internal/handler/app.go
+++ b/server/internal/handler/app.go
@@ -45,10 +45,10 @@ func (h *AppHandler) List(c *gin.Context) {
 
 		if userInfo.IsGroupAdmin() && userInfo.GroupId != nil {
 			// 组管理员：本组应用 + 自己是负责人的应用
-			query = query.And("(group_id = ? OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0 OR id IN (SELECT app_id FROM user_permission WHERE user_id = ?))", *userInfo.GroupId, userId)
+			query = query.And("(group_id = ? OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0)", *userInfo.GroupId)
 		} else {
-			// 普通用户：自己是负责人的应用 + 被授权的应用
-			query = query.And("(FIND_IN_SET('" + userIdStr + "', owner_ids) > 0 OR id IN (SELECT app_id FROM user_permission WHERE user_id = ?))", userId)
+			// 普通用户：自己是负责人的应用
+			query = query.And("FIND_IN_SET('" + userIdStr + "', owner_ids) > 0")
 		}
 	}
 
@@ -60,10 +60,10 @@ func (h *AppHandler) List(c *gin.Context) {
 		
 		if userInfo.IsGroupAdmin() && userInfo.GroupId != nil {
 			// 组管理员：本组应用 + 自己是负责人的应用
-			whereClause += " AND (group_id = " + strconv.Itoa(*userInfo.GroupId) + " OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0 OR id IN (SELECT app_id FROM user_permission WHERE user_id = " + strconv.Itoa(userId) + "))"
+			whereClause += " AND (group_id = " + strconv.Itoa(*userInfo.GroupId) + " OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0)"
 		} else {
-			// 普通用户：自己是负责人的应用 + 被授权的应用
-			whereClause += " AND (FIND_IN_SET('" + userIdStr + "', owner_ids) > 0 OR id IN (SELECT app_id FROM user_permission WHERE user_id = " + strconv.Itoa(userId) + "))"
+			// 普通用户：自己是负责人的应用
+			whereClause += " AND (FIND_IN_SET('" + userIdStr + "', owner_ids) > 0)"
 		}
 	}
 	if req.AppType != "" {
diff --git a/server/internal/model/user.go b/server/internal/model/user.go
index 8386b2e..0dbb9c1 100644
--- a/server/internal/model/user.go
+++ b/server/internal/model/user.go
@@ -22,18 +22,6 @@ func (User) TableName() string {
 	return "user"
 }
 
-type UserPermission struct {
-	Id      int    `xorm:"int autoincr pk" json:"id"`
-	UserId  int    `xorm:"int" json:"userId"`
-	Env     string `xorm:"varchar(16)" json:"env"`
-	AppId   int    `xorm:"int" json:"appId"`
-	Operate string `xorm:"varchar(8) default 'RW'" json:"operate"` // RO, RW
-}
-
-func (UserPermission) TableName() string {
-	return "user_permission"
-}
-
 type LoginUserInfo struct {
 	Id              string   `json:"id"`
 	Name            string   `json:"name"`
diff --git a/server/internal/service/auth.go b/server/internal/service/auth.go
index 009b8c5..3d9973d 100644
--- a/server/internal/service/auth.go
+++ b/server/internal/service/auth.go
@@ -148,34 +148,6 @@ func (s *AuthService) loadPermissions(userInfo *model.LoginUserInfo, userId int)
 		userInfo.GrantAppIds = append(userInfo.GrantAppIds, app.Id)
 		userInfo.GrantPermissons = append(userInfo.GrantPermissons, buildPermissionCode(app.Id, "RW"))
 	}
-
-	// load granted permissions
-	var perms []model.UserPermission
-	dao.Engine.Where("user_id = ?", userId).Find(&perms)
-	for _, p := range perms {
-		permCode := buildPermissionCode(p.AppId, p.Operate)
-		// avoid duplicate
-		found := false
-		for _, existing := range userInfo.GrantPermissons {
-			if existing == permCode {
-				found = true
-				break
-			}
-		}
-		if !found {
-			userInfo.GrantPermissons = append(userInfo.GrantPermissons, permCode)
-		}
-		appIdFound := false
-		for _, id := range userInfo.GrantAppIds {
-			if id == p.AppId {
-				appIdFound = true
-				break
-			}
-		}
-		if !appIdFound {
-			userInfo.GrantAppIds = append(userInfo.GrantAppIds, p.AppId)
-		}
-	}
 }
 
 func buildPermissionCode(appId int, operate string) string {
diff --git a/sql/drop_user_permission.sql b/sql/drop_user_permission.sql
new file mode 100644
index 0000000..5780135
--- /dev/null
+++ b/sql/drop_user_permission.sql
@@ -0,0 +1,5 @@
+-- 删除已废弃的用户应用授权表。
+-- 权限现由 application.owner_ids（应用负责人）和业务组角色管理。
+-- 已有环境升级时手动执行：mysql -u<user> -p <database> < sql/drop_user_permission.sql
+
+DROP TABLE IF EXISTS `user_permission`;
diff --git a/sql/kenaito_conf.sql b/sql/kenaito_conf.sql
index a9016de..28dcb98 100644
--- a/sql/kenaito_conf.sql
+++ b/sql/kenaito_conf.sql
@@ -4,15 +4,6 @@
 
 SET FOREIGN_KEY_CHECKS = 0;
 
-CREATE TABLE `user_permission` (
-  `id` int NOT NULL AUTO_INCREMENT,
-  `user_id` int DEFAULT NULL,
-  `env` varchar(16) DEFAULT NULL,
-  `app_id` int DEFAULT NULL,
-  `operate` varchar(8) DEFAULT 'RW',
-  PRIMARY KEY (`id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3;
-
 CREATE TABLE `profile_extr_attr` (
   `profile` varchar(32) NOT NULL,
   `attr_name` varchar(50) NOT NULL,