diff --git a/wwwroot/api/cockpit_model_options.dspy b/wwwroot/api/cockpit_model_options.dspy
index 8bb29d5..fd6f18d 100644
--- a/wwwroot/api/cockpit_model_options.dspy
+++ b/wwwroot/api/cockpit_model_options.dspy
@@ -1,13 +1,18 @@
 # cockpit_model_options.dspy - Returns active models with capabilities for dropdown
 # Used by cockpit model selector
+# org_id 多租户隔离：非系统级机构只看到「本机构 + 系统级(org_id='0')」的模型
 
 dbname = get_module_dbname('pipeline-sdlc')
+org_id = (await get_userorgid()) or ''
 
 async with DBPools().sqlorContext(dbname) as sor:
-    recs = await sor.sqlExe(
-        "SELECT id, name, provider, model_id, capabilities FROM llm WHERE status='active' ORDER BY name",
-        {}
-    )
+    sql = "SELECT id, name, provider, model_id, capabilities FROM llm WHERE status='active'"
+    params = {}
+    if org_id and org_id != '0':
+        sql += " AND (org_id=${org}$ OR org_id='0')"
+        params['org'] = org_id
+    sql += " ORDER BY (org_id='0') ASC, name"
+    recs = await sor.sqlExe(sql, params)
 
 rows = []
 for r in recs: