diff --git a/frontend/src/components/doc-content.vue b/frontend/src/components/doc-content.vue
index 6ea7bb2a..b8d8f991 100644
--- a/frontend/src/components/doc-content.vue
+++ b/frontend/src/components/doc-content.vue
@@ -13,9 +13,21 @@ import { MessagePlugin, DialogPlugin } from "tdesign-vue-next";
 import { sanitizeHTML, safeMarkdownToHTML, createSafeImage, isValidImageURL, hydrateProtectedFileImages, isValidURL } from '@/utils/security';
 import { openMermaidFullscreen } from '@/utils/mermaidViewer';
 import { useI18n } from 'vue-i18n';
+import { useAuthStore } from '@/stores/auth';
 import DocumentPreview from '@/components/document-preview.vue';
 
 const { t } = useI18n();
+const authStore = useAuthStore();
+
+// canDeleteGeneratedQuestion 对应后端 DELETE /chunks/by-id/:id/questions
+// 的 OwnedChunkKBOrAdminFromChunkID 守卫——KB 创建者或租户 Admin+
+// 才允许删除。父组件 KnowledgeBase.vue 通过 :canEditKB 把 KB 级权限
+// 传下来（包含 KB creator / Admin / 组织分享 editor 三种来源），未
+// 传时按更严格的 Admin 兜底，避免 Viewer 看到一个会 403 的入口。
+const canDeleteGeneratedQuestion = computed(() => {
+  if (props.canEditKB === true) return true;
+  return authStore.hasRole('admin');
+});
 
 // Mermaid 初始化计数器，用于生成唯一ID
 let mermaidRenderCount = 0;
@@ -48,7 +60,7 @@ mermaid.initialize({
     topPadding: 50
   }
 });
-const props = defineProps(["visible", "details", "knowledgeType", "sourceInfo"]);
+const props = defineProps(["visible", "details", "knowledgeType", "sourceInfo", "canEditKB"]);
 const emit = defineEmits(["closeDoc", "getDoc", "questionDeleted"]);
 
 marked.use({
@@ -955,9 +967,10 @@ const handleDetailsScroll = () => {
                 >
                   <t-icon name="help-circle" size="14px" class="question-icon" />
                   <span class="question-text">{{ question.question }}</span>
-                  <t-button 
-                    theme="default" 
-                    variant="text" 
+                  <t-button
+                    v-if="canDeleteGeneratedQuestion"
+                    theme="default"
+                    variant="text"
                     size="small"
                     class="delete-question-btn"
                     :loading="isDeleting(index, question.id)"
diff --git a/frontend/src/views/agent/AgentEditorModal.vue b/frontend/src/views/agent/AgentEditorModal.vue
index 171ad17a..36be2fe1 100644
--- a/frontend/src/views/agent/AgentEditorModal.vue
+++ b/frontend/src/views/agent/AgentEditorModal.vue
@@ -1398,8 +1398,8 @@
 
               <!-- 底部操作栏 -->
               <div class="settings-footer">
-                <t-button variant="outline" @click="handleClose">{{ $t('common.cancel') }}</t-button>
-                <t-button theme="primary" :loading="saving" @click="handleSave">{{ $t('common.confirm') }}</t-button>
+                <t-button variant="outline" @click="handleClose">{{ props.readOnly ? $t('common.close') : $t('common.cancel') }}</t-button>
+                <t-button v-if="!props.readOnly" theme="primary" :loading="saving" @click="handleSave">{{ $t('common.confirm') }}</t-button>
               </div>
             </div>
           </div>
@@ -1458,6 +1458,12 @@ const props = defineProps<{
   mode: 'create' | 'edit';
   agent?: CustomAgent | null;
   initialSection?: string;
+  // readOnly hides the save button so a Viewer who clicks an agent
+  // card to inspect its config doesn't see a "确定" that 403s on the
+  // backend update endpoint. Field-level disable is intentionally NOT
+  // wired here yet (the modal has 3000+ lines of form inputs); instead
+  // we just remove the only mutation surface — the footer button.
+  readOnly?: boolean;
 }>();
 
 const emit = defineEmits<{
diff --git a/frontend/src/views/agent/AgentList.vue b/frontend/src/views/agent/AgentList.vue
index 435642d7..f29c8a49 100644
--- a/frontend/src/views/agent/AgentList.vue
+++ b/frontend/src/views/agent/AgentList.vue
@@ -89,7 +89,7 @@
             <span class="card-title" :title="agent.name">{{ agent.name }}</span>
           </div>
           <t-popup
-            v-if="agent.isMine"
+            v-if="agent.isMine && (canManageAgent(agent) || authStore.hasRole('contributor') || (!agent.is_builtin && authStore.hasRole('admin')))"
             :visible="openMoreAgentId === agent.id"
             trigger="hover"
             overlayClassName="card-more-popup"
@@ -105,7 +105,7 @@
               <div class="popup-menu">
                 <div v-if="canManageAgent(agent)" class="popup-menu-item" @click="handleEdit(agent)"><t-icon class="menu-icon" name="edit" /><span>{{ $t('common.edit') }}</span></div>
                 <div v-if="authStore.hasRole('contributor')" class="popup-menu-item" @click="handleCopy(agent)"><t-icon class="menu-icon" name="file-copy" /><span>{{ $t('common.copy') }}</span></div>
-                <div v-if="!agent.is_builtin" class="popup-menu-item" @click="handleToggleDisabled(agent)">
+                <div v-if="!agent.is_builtin && authStore.hasRole('admin')" class="popup-menu-item" @click="handleToggleDisabled(agent)">
                   <t-icon class="menu-icon" name="poweroff" />
                   <span>{{ agent.disabled_by_me ? $t('agent.enable') : $t('agent.disable') }}</span>
                 </div>
@@ -114,7 +114,7 @@
             </template>
           </t-popup>
           <t-popup
-            v-else
+            v-else-if="!agent.isMine && authStore.hasRole('admin')"
             :visible="openMoreAgentId === 'shared-' + agent.share_id"
             trigger="hover"
             overlayClassName="card-more-popup"
@@ -226,6 +226,7 @@
             <span class="card-title" :title="agent.name">{{ agent.name }}</span>
           </div>
           <t-popup
+            v-if="canManageAgent(agent) || authStore.hasRole('contributor') || (!agent.is_builtin && authStore.hasRole('admin'))"
             :visible="openMoreAgentId === agent.id"
             trigger="hover"
             overlayClassName="card-more-popup"
@@ -251,7 +252,7 @@
                   <t-icon class="menu-icon" name="file-copy" />
                   <span>{{ $t('common.copy') }}</span>
                 </div>
-                <div v-if="!agent.is_builtin" class="popup-menu-item" @click="handleToggleDisabled(agent)">
+                <div v-if="!agent.is_builtin && authStore.hasRole('admin')" class="popup-menu-item" @click="handleToggleDisabled(agent)">
                   <t-icon class="menu-icon" name="poweroff" />
                   <span>{{ agent.disabled_by_me ? $t('agent.enable') : $t('agent.disable') }}</span>
                 </div>
@@ -536,11 +537,12 @@
     </Transition>
 
     <!-- 智能体编辑器弹窗 -->
-    <AgentEditorModal 
+    <AgentEditorModal
       :visible="editorVisible"
       :mode="editorMode"
       :agent="editingAgent"
       :initialSection="editorInitialSection"
+      :readOnly="editorMode === 'edit' && editingAgent != null && !canManageAgent(editingAgent as AgentWithUI)"
       @update:visible="editorVisible = $event"
       @success="handleEditorSuccess"
     />
diff --git a/frontend/src/views/knowledge/KnowledgeBase.vue b/frontend/src/views/knowledge/KnowledgeBase.vue
index 923f37e5..b305c0b6 100644
--- a/frontend/src/views/knowledge/KnowledgeBase.vue
+++ b/frontend/src/views/knowledge/KnowledgeBase.vue
@@ -2711,7 +2711,7 @@ async function createNewSession(value: string): Promise<void> {
       </template>
 
       <!-- DocContent drawer (shared by documents tab and wiki source refs) -->
-      <DocContent :visible="isCardDetails" :details="details" @closeDoc="closeDoc" @getDoc="getDoc"></DocContent>
+      <DocContent :visible="isCardDetails" :details="details" :canEditKB="canEdit" @closeDoc="closeDoc" @getDoc="getDoc"></DocContent>
     </div>
   </template>
   <template v-else>
diff --git a/frontend/src/views/knowledge/KnowledgeBaseList.vue b/frontend/src/views/knowledge/KnowledgeBaseList.vue
index 63ee044b..981d8b6f 100644
--- a/frontend/src/views/knowledge/KnowledgeBaseList.vue
+++ b/frontend/src/views/knowledge/KnowledgeBaseList.vue
@@ -136,6 +136,7 @@
           <div class="card-header">
             <span class="card-title" :title="kb.name">{{ kb.name }}</span>
             <t-popup
+              v-if="canManageKBCard(kb)"
               overlayClassName="card-more-popup"
               trigger="click"
               destroy-on-close
@@ -313,6 +314,7 @@
         <div class="card-header">
           <span class="card-title" :title="kb.name">{{ kb.name }}</span>
           <t-popup
+            v-if="canManageKBCard(kb)"
             v-model="kb.showMore"
             overlayClassName="card-more-popup"
             :on-visible-change="onVisibleChange"
@@ -334,11 +336,11 @@
                     <t-icon class="menu-icon" :name="kb.is_pinned ? 'pin-filled' : 'pin'" />
                     <span>{{ kb.is_pinned ? $t('knowledgeList.pin.unpin') : $t('knowledgeList.pin.pin') }}</span>
                   </div>
-                  <div v-if="canManageKBCard(kb)" class="popup-menu-item" @click.stop="handleSettings(kb)">
+                  <div class="popup-menu-item" @click.stop="handleSettings(kb)">
                     <t-icon class="menu-icon" name="setting" />
                     <span>{{ $t('knowledgeBase.settings') }}</span>
                   </div>
-                  <div v-if="canManageKBCard(kb)" class="popup-menu-item delete" @click.stop="handleDelete(kb)">
+                  <div class="popup-menu-item delete" @click.stop="handleDelete(kb)">
                     <t-icon class="menu-icon" name="delete" />
                     <span>{{ $t('common.delete') }}</span>
                   </div>