diff --git a/deploy/migrations/m0028_pipeline_tool_policies.json b/deploy/migrations/m0028_pipeline_tool_policies.json
new file mode 100644
index 0000000..dd4ccf4
--- /dev/null
+++ b/deploy/migrations/m0028_pipeline_tool_policies.json
@@ -0,0 +1,17 @@
+{
+  "id": "m0028",
+  "title": "pipeline_tool_policies 工具作用域策略表——五级作用域(global/org/pipeline/role/project)的 allow/deny 微调；新表，配套 models/pipeline_tool_policies.json",
+  "backup_tables": [],
+  "up": [
+    {
+      "op": "sql",
+      "sql": "CREATE TABLE IF NOT EXISTS pipeline_tool_policies (id varchar(32) NOT NULL, scope varchar(32) NOT NULL DEFAULT 'org', scope_id varchar(128) NOT NULL DEFAULT '', tool_name varchar(64) NOT NULL, effect varchar(16) NOT NULL DEFAULT 'allow', reason varchar(500) DEFAULT NULL, status varchar(16) NOT NULL DEFAULT 'active', created_by varchar(32) DEFAULT NULL, created_at datetime NOT NULL DEFAULT current_timestamp(), updated_at datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(), PRIMARY KEY (id), UNIQUE KEY uk_scope_tool (scope, scope_id, tool_name), KEY idx_scope (scope, scope_id, status)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"
+    }
+  ],
+  "down": [
+    {
+      "op": "sql",
+      "sql": "DROP TABLE IF EXISTS pipeline_tool_policies"
+    }
+  ]
+}