diff --git a/wwwroot/api/work_env.dspy b/wwwroot/api/work_env.dspy
index b5d5740..364e4fd 100644
--- a/wwwroot/api/work_env.dspy
+++ b/wwwroot/api/work_env.dspy
@@ -37,12 +37,24 @@ elif action == 'set':
     mode = (params_kw or {}).get('mode', 'local')
     account_name = (params_kw or {}).get('account_name', '') or account_name_for(username)
 
-    # owner_id：user 级用 user_id，org 级用 org_id
+    # owner_id 与权限校验
     owner_id = (params_kw or {}).get('owner_id', '')
     if owner_type == 'user':
-        owner_id = owner_id or user_id
+        # 用户级：强制只能设自己，不允许设别人
+        owner_id = user_id
     elif owner_type == 'org':
-        owner_id = owner_id or org_id
+        # 机构级：仅平台超管（owner.superuser）可设置，且只能设自己所在机构
+        owner_id = org_id
+        if not owner_id:
+            return json.dumps({'ok': False, 'error': '当前用户无机构'}, ensure_ascii=False)
+        async with get_sor_context(request._run_ns, 'pipeline') as _sor:
+            _adm = await _sor.sqlExe(
+                "SELECT 1 FROM userrole WHERE userid=${u}$ AND roleid='owner.superuser' LIMIT 1",
+                {'u': user_id})
+        if not _adm:
+            return json.dumps({'ok': False, 'error': '只有平台管理员能设置机构级工作环境'}, ensure_ascii=False)
+    else:
+        return json.dumps({'ok': False, 'error': 'owner_type 必须是 user 或 org'}, ensure_ascii=False)
 
     remote_config = {
         'remote_host': (params_kw or {}).get('remote_host', ''),