diff --git a/scripts/init_rbac.py b/scripts/init_rbac.py
index 4ffa43a..ff02f56 100644
--- a/scripts/init_rbac.py
+++ b/scripts/init_rbac.py
@@ -1,84 +1,38 @@
-# -*- coding:utf-8 -*-
-"""RAG Server RBAC 权限初始化"""
-import sys, os
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), 'pkgs', 'rag-pipeline'))
+#!/usr/bin/env python3
+"""RAG Server RBAC 权限初始化 — 直接 SQL"""
+import sys, os, asyncio
+
+sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), '..'))
 
-from ahserver.serverenv import ServerEnv
-from appPublic.jsonConfig import getConfig
 from sqlor.dbpools import DBPools
-import asyncio
+from appPublic.jsonConfig import getConfig
 
 config = getConfig('.')
 DBPools(config.databases)
 
-from rbac.userperm import UserPerm
-
-PUBLIC_PATHS = [
-    '/api/status',
-    '/api/engines',
-    '/api/kb/list',
-    '/',
-    '/index.ui',
-]
-
-LOGINED_PATHS = [
-    '/api/search',
-    '/api/ingest',
-    '/knowledge_bases_list/',
-    '/documents_list/',
-    '/engine_configs_list/',
-    '/subscriptions_list/',
-]
+PUBLIC = ['/api/status', '/api/engines', '/api/kb/list', '/', '/index.ui']
+LOGINED = ['/api/search', '/api/ingest',
+           '/knowledge_bases_list/', '/documents_list/',
+           '/engine_configs_list/', '/subscriptions_list/']
 
 
-async def init_perms():
-    sor = await DBPools().get_sor_context('rag')
-    up = UserPerm()
-    await up.init(sor)
+async def main():
+    db = DBPools()
+    async with db.sqlorContext('rag') as sor:
+        for rid, rname in [('any', 'any'), ('logined', 'logined')]:
+            await sor.sqlExe(
+                f"INSERT IGNORE INTO role (id, orgtypeid, name) VALUES ('{rid}', '', '{rname}')", {})
 
-    # Create 'any' role for public access
-    recs = await sor.sqlExe("SELECT id FROM role WHERE id='any'", {})
-    if not recs:
-        await sor.sqlExe(
-            "INSERT INTO role (id, rolename, orgtypeid, roletype, del_flg) "
-            "VALUES ('any', 'any', '', 'any', '0')", {}
-        )
+        for paths, role in [(PUBLIC, 'any'), (LOGINED, 'logined')]:
+            for path in paths:
+                pid = f"perm_{path.replace('/', '_')}"
+                await sor.sqlExe(
+                    f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{pid}', '{path}', 'RAG')", {})
+                await sor.sqlExe(
+                    f"INSERT IGNORE INTO rolepermission (id, roleid, permid) VALUES ('rp_{pid}', '{role}', '{pid}')", {})
 
-    # Create 'logined' role
-    recs = await sor.sqlExe("SELECT id FROM role WHERE id='logined'", {})
-    if not recs:
-        await sor.sqlExe(
-            "INSERT INTO role (id, rolename, orgtypeid, roletype, del_flg) "
-            "VALUES ('logined', 'logined', '', 'logined', '0')", {}
-        )
-
-    # Register public paths
-    for path in PUBLIC_PATHS:
-        perm_id = f"perm_{path.replace('/', '_')}"
-        await sor.sqlExe(
-            f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{perm_id}', '{path}', 'RAG {path}')",
-            {}
-        )
-        await sor.sqlExe(
-            f"INSERT IGNORE INTO rolepermission (role_id, permission_id) VALUES ('any', '{perm_id}')",
-            {}
-        )
-
-    # Register logined paths
-    for path in LOGINED_PATHS:
-        perm_id = f"perm_{path.replace('/', '_')}"
-        await sor.sqlExe(
-            f"INSERT IGNORE INTO permission (id, path, name) VALUES ('{perm_id}', '{path}', 'RAG {path}')",
-            {}
-        )
-        await sor.sqlExe(
-            f"INSERT IGNORE INTO rolepermission (role_id, permission_id) VALUES ('logined', '{perm_id}')",
-            {}
-        )
-
-    print(f"RBAC initialized: {len(PUBLIC_PATHS)} public + {len(LOGINED_PATHS)} logined paths")
+    print(f"OK: {len(PUBLIC)} public + {len(LOGINED)} logined paths")
 
 
 if __name__ == '__main__':
-    asyncio.run(init_perms())
+    asyncio.run(main())