diff --git a/set_role_perm.py b/set_role_perm.py
index 71531b8..a62652e 100644
--- a/set_role_perm.py
+++ b/set_role_perm.py
@@ -32,6 +32,23 @@ async def main(role, path):
 
     # pipeline RBAC schema: permission (id, path) + rolepermission (roleid, permid)
     async with DBPools().sqlorContext('pipeline') as sor:
+        # role 解析：特殊角色(any/anonymous/logined)用字面 id（rbac userperm 硬编码）；
+        # 其余按 [orgtypeid.]name 查 role 表取真实 id（缺省 orgtypeid='*'）。
+        # 直接把 'admin' 当 roleid 写库是错的——roleid 必须是 role.id（2026-09-09）。
+        SPECIAL_ROLES = ('any', 'anonymous', 'logined')
+        if role in SPECIAL_ROLES:
+            role_id = role
+        else:
+            if '.' in role:
+                orgtypeid, role_name = role.split('.', 1)
+            else:
+                orgtypeid, role_name = '*', role
+            role_recs = await sor.R('role', {'orgtypeid': orgtypeid, 'name': role_name})
+            if not role_recs:
+                print(f'ERROR: role not found: {orgtypeid}.{role_name}')
+                sys.exit(1)
+            role_id = role_recs[0].id
+
         recs = await sor.R('permission', {'path': path})
         if not recs:
             permid = getID()
@@ -39,13 +56,13 @@ async def main(role, path):
         else:
             permid = recs[0].id
 
-        rp = await sor.R('rolepermission', {'roleid': role, 'permid': permid})
+        rp = await sor.R('rolepermission', {'roleid': role_id, 'permid': permid})
         if rp:
             print(f'Permission exists: {role} {path}')
             return
 
-        await sor.C('rolepermission', {'id': getID(), 'roleid': role, 'permid': permid})
-        print(f'Registered: {role} -> {path}')
+        await sor.C('rolepermission', {'id': getID(), 'roleid': role_id, 'permid': permid})
+        print(f'Registered: {role}({role_id}) -> {path}')
 
 
 if __name__ == '__main__':