diff --git a/wwwroot/api/task_control.dspy b/wwwroot/api/task_control.dspy
index f491452..e6201d6 100644
--- a/wwwroot/api/task_control.dspy
+++ b/wwwroot/api/task_control.dspy
@@ -8,6 +8,11 @@ if not task_id:
 if action not in ('pause', 'resume', 'cancel'):
     return json.dumps({"success": False, "message": "action必须是pause/resume/cancel"}, ensure_ascii=False)
 
+_uid = await get_user()
+_ok, _emsg = await check_task_owner(task_id, _uid)
+if not _ok:
+    return json.dumps({"success": False, "message": _emsg}, ensure_ascii=False)
+
 try:
     if action == 'pause':
         result = await pipeline_pause(tenant_id, task_id)
diff --git a/wwwroot/api/task_modify.dspy b/wwwroot/api/task_modify.dspy
index 73c4bb9..1cdfc7e 100644
--- a/wwwroot/api/task_modify.dspy
+++ b/wwwroot/api/task_modify.dspy
@@ -7,6 +7,11 @@ rerun_from = params_kw.get('rerun_from', 'node')
 if not task_id or not step_name:
     return json.dumps({"success": False, "message": "缺少task_id或step_name"}, ensure_ascii=False)
 
+_uid = await get_user()
+_ok, _emsg = await check_task_owner(task_id, _uid)
+if not _ok:
+    return json.dumps({"success": False, "message": _emsg}, ensure_ascii=False)
+
 # Parse content
 if isinstance(content_raw, str):
     try:
diff --git a/wwwroot/api/task_restart.dspy b/wwwroot/api/task_restart.dspy
index b5476a7..6fdbbea 100644
--- a/wwwroot/api/task_restart.dspy
+++ b/wwwroot/api/task_restart.dspy
@@ -4,6 +4,11 @@ task_id = params_kw.get('task_id', '')
 if not task_id:
     return json.dumps({"success": False, "message": "缺少task_id"}, ensure_ascii=False)
 
+_uid = await get_user()
+_ok, _emsg = await check_task_owner(task_id, _uid)
+if not _ok:
+    return json.dumps({"success": False, "message": _emsg}, ensure_ascii=False)
+
 try:
     result = await pipeline_restart(tenant_id, task_id)
     return result
diff --git a/wwwroot/api/task_submit.dspy b/wwwroot/api/task_submit.dspy
index 6cf8d81..8026c36 100644
--- a/wwwroot/api/task_submit.dspy
+++ b/wwwroot/api/task_submit.dspy
@@ -8,6 +8,10 @@ if not pipeline_id:
 if not title:
     return json.dumps({"success": False, "message": "缺少任务标题"}, ensure_ascii=False)
 
+_ok, _emsg = await check_tenant_owner(tenant_id, owner_id)
+if not _ok:
+    return json.dumps({"success": False, "message": _emsg}, ensure_ascii=False)
+
 # Collect optional params
 task_params = {}
 for key in ['input_audio', 'input_video', 'input_text', 'lyrics', 'mode', 'scene']: