diff --git a/app/domain/rules.py b/app/domain/rules.py
index b401c25..adc7154 100644
--- a/app/domain/rules.py
+++ b/app/domain/rules.py
@@ -10,6 +10,12 @@ from __future__ import annotations
 SCOPE_ORDER = ("province", "city", "district")
 
 
+def is_platform_admin(user: dict) -> bool:
+    """平台管理方（平台端运营者）：拥有全权限，可执行全部平台管理操作。
+    与其它端口（投资人/OPC/政务/企业/服务商/载体）不关联。"""
+    return user.get("role") == "operator" or user.get("sub_role") in ("op_super_admin", "superadmin")
+
+
 def role_allowed(user: dict, *roles: str) -> bool:
     """当前用户业务角色是否 ∈ 允许角色集合。"""
     return user.get("role") in set(roles)
@@ -21,7 +27,9 @@ def sub_role_allowed(user: dict, *sub_roles: str) -> bool:
 
 
 def permission_granted(user: dict, perm: str) -> bool:
-    """当前用户是否拥有权限码 perm。"""
+    """当前用户是否拥有权限码 perm。平台管理方(operator/op_super_admin)恒授予全权限。"""
+    if is_platform_admin(user):
+        return True
     return perm in user.get("permissions", [])