diff --git a/rag/init.py b/rag/init.py
index 63955c5..2345c9c 100644
--- a/rag/init.py
+++ b/rag/init.py
@@ -584,7 +584,10 @@ async def file_serve_handler(request, params_kw, *args, **kwargs):
             doc = recs[0]
             ok, kb, msg = await check_kb_perm(env, sor, doc.kb_id, 'search')
             if not ok:
-                return json.dumps({"error": "kb_perm_denied", "message": msg}, ensure_ascii=False)
+                # 维护者也需要下载文件（管理职责）
+                ok2, _, _ = await check_kb_perm(env, sor, doc.kb_id, 'maintain')
+                if not ok2:
+                    return json.dumps({"error": "kb_perm_denied", "message": msg}, ensure_ascii=False)
             fp = doc.file_path or ''
             if fp.startswith('/rags/'):
                 parts = [p for p in fp.split('/') if p]
diff --git a/wwwroot/knowledge_bases_list/file_list.dspy b/wwwroot/knowledge_bases_list/file_list.dspy
index e4c0aef..d1d4813 100644
--- a/wwwroot/knowledge_bases_list/file_list.dspy
+++ b/wwwroot/knowledge_bases_list/file_list.dspy
@@ -14,8 +14,11 @@ from rag.init import check_kb_perm
 env = request._run_ns
 async with db.sqlorContext(dbname) as sor:
     _ok, _kb, _msg = await check_kb_perm(env, sor, kb_id, 'search')
-if not _ok:
-    return {"widgettype": "Text", "options": {"text": "⛔ " + _msg, "cfontsize": 13, "color": "#f56c6c", "halign": "center", "marginTop": "40px"}}
+    if not _ok:
+        # 维护者也需要看到文件列表/下载文件（管理职责）
+        _ok2, _kb, _msg2 = await check_kb_perm(env, sor, kb_id, 'maintain')
+        if not _ok2:
+            return {"widgettype": "Text", "options": {"text": "⛔ " + _msg, "cfontsize": 13, "color": "#f56c6c", "halign": "center", "marginTop": "40px"}}
 
 rows = []
 try: