diff --git a/controller/service/iml.go b/controller/service/iml.go
index 70969bf7..0c6bcbb9 100644
--- a/controller/service/iml.go
+++ b/controller/service/iml.go
@@ -5,6 +5,9 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"time"
+
+	"github.com/eolinker/eosc/log"
 
 	application_authorization "github.com/APIParkLab/APIPark/module/application-authorization"
 	application_authorization_dto "github.com/APIParkLab/APIPark/module/application-authorization/dto"
@@ -234,7 +237,12 @@ func (i *imlServiceController) SearchMyServices(ctx *gin.Context, teamId string,
 //}
 
 func (i *imlServiceController) Get(ctx *gin.Context, id string) (*service_dto.Service, error) {
+	now := time.Now()
+	defer func() {
+		log.Infof("get service %s cost %d ms", id, time.Since(now).Milliseconds())
+	}()
 	return i.module.Get(ctx, id)
+
 }
 
 func (i *imlServiceController) Search(ctx *gin.Context, teamID string, keyword string) ([]*service_dto.ServiceItem, error) {
diff --git a/module/service/iml.go b/module/service/iml.go
index 79400ac8..64187a18 100644
--- a/module/service/iml.go
+++ b/module/service/iml.go
@@ -6,6 +6,9 @@ import (
 	"fmt"
 	"sort"
 	"strings"
+	"time"
+
+	"github.com/eolinker/eosc/log"
 
 	"github.com/APIParkLab/APIPark/resources/access"
 
@@ -231,6 +234,7 @@ func (i *imlServiceModule) SearchMyServices(ctx context.Context, teamId string,
 //}
 
 func (i *imlServiceModule) Get(ctx context.Context, id string) (*service_dto.Service, error) {
+	now := time.Now()
 	serviceInfo, err := i.serviceService.Get(ctx, id)
 	if err != nil {
 		return nil, err
@@ -244,6 +248,7 @@ func (i *imlServiceModule) Get(ctx context.Context, id string) (*service_dto.Ser
 	s.Tags = auto.List(utils.SliceToSlice(tags, func(p *service_tag.Tag) string {
 		return p.Tid
 	}))
+	log.Infof("get service cost %d ms", time.Since(now).Milliseconds())
 	return s, nil
 }
 
diff --git a/plugins/core/access.go b/plugins/core/access.go
deleted file mode 100644
index 9a8bc959..00000000
--- a/plugins/core/access.go
+++ /dev/null
@@ -1 +0,0 @@
-package core
diff --git a/plugins/core/subscribe.go b/plugins/core/subscribe.go
index 643a4142..a068ddbb 100644
--- a/plugins/core/subscribe.go
+++ b/plugins/core/subscribe.go
@@ -3,23 +3,25 @@ package core
 import (
 	"net/http"
 
+	"github.com/APIParkLab/APIPark/resources/access"
+
 	"github.com/eolinker/go-common/pm3"
 )
 
 func (p *plugin) subscribeApis() []pm3.Api {
 	return []pm3.Api{
-		pm3.CreateApiWidthDoc(http.MethodGet, "/api/v1/service/subscribers", []string{"context", "query:service", "query:keyword"}, []string{"subscribers"}, p.subscribeController.Search),
+		pm3.CreateApiWidthDoc(http.MethodGet, "/api/v1/service/subscribers", []string{"context", "query:service", "query:keyword"}, []string{"subscribers"}, p.subscribeController.Search, access.SystemWorkspaceServiceViewAll, access.TeamServiceSubscriptionView),
 
-		pm3.CreateApiWidthDoc(http.MethodPost, "/api/v1/service/subscriber", []string{"context", "query:service", "body"}, nil, p.subscribeController.AddSubscriber),
-		pm3.CreateApiWidthDoc(http.MethodDelete, "/api/v1/service/subscriber", []string{"context", "query:service", "query:service", "query:application"}, nil, p.subscribeController.DeleteSubscriber),
+		pm3.CreateApiWidthDoc(http.MethodPost, "/api/v1/service/subscriber", []string{"context", "query:service", "body"}, nil, p.subscribeController.AddSubscriber, access.SystemWorkspaceServiceManagerAll, access.TeamServiceSubscriptionManager),
+		pm3.CreateApiWidthDoc(http.MethodDelete, "/api/v1/service/subscriber", []string{"context", "query:service", "query:service", "query:application"}, nil, p.subscribeController.DeleteSubscriber, access.SystemWorkspaceServiceManagerAll, access.TeamServiceSubscriptionManager),
 
-		pm3.CreateApiWidthDoc(http.MethodGet, "/api/v1/application/subscriptions", []string{"context", "query:application", "query:keyword"}, []string{"subscriptions"}, p.subscribeController.SearchSubscriptions),
-		pm3.CreateApiWidthDoc(http.MethodPost, "/api/v1/application/subscription/cancel", []string{"context", "query:application", "query:subscription"}, nil, p.subscribeController.RevokeSubscription),
-		pm3.CreateApiWidthDoc(http.MethodPost, "/api/v1/application/subscription/cancel_apply", []string{"context", "query:application", "query:subscription"}, nil, p.subscribeController.RevokeApply),
+		pm3.CreateApiWidthDoc(http.MethodGet, "/api/v1/application/subscriptions", []string{"context", "query:application", "query:keyword"}, []string{"subscriptions"}, p.subscribeController.SearchSubscriptions, access.SystemWorkspaceApplicationViewAll, access.TeamConsumerSubscriptionViewSubscribed),
+		pm3.CreateApiWidthDoc(http.MethodPost, "/api/v1/application/subscription/cancel", []string{"context", "query:application", "query:subscription"}, nil, p.subscribeController.RevokeSubscription, access.SystemWorkspaceApplicationManagerAll, access.TeamConsumerSubscriptionSubscribe, access.TeamConsumerSubscriptionManagerSubscribed),
+		pm3.CreateApiWidthDoc(http.MethodPost, "/api/v1/application/subscription/cancel_apply", []string{"context", "query:application", "query:subscription"}, nil, p.subscribeController.RevokeApply, access.SystemWorkspaceApplicationManagerAll, access.TeamConsumerSubscriptionSubscribe, access.TeamConsumerSubscriptionManagerSubscribed),
 
 		// 审核相关
-		pm3.CreateApiWidthDoc(http.MethodGet, "/api/v1/service/approval/subscribes", []string{"context", "query:service", "query:status"}, []string{"approvals"}, p.subscribeApprovalController.GetApprovalList),
-		pm3.CreateApiWidthDoc(http.MethodGet, "/api/v1/service/approval/subscribe", []string{"context", "query:service", "query:apply"}, []string{"approval"}, p.subscribeApprovalController.GetApprovalDetail),
+		pm3.CreateApiWidthDoc(http.MethodGet, "/api/v1/service/approval/subscribes", []string{"context", "query:service", "query:status"}, []string{"approvals"}, p.subscribeApprovalController.GetApprovalList, access.SystemWorkspaceServiceViewAll, access.TeamServiceSubscriptionView),
+		pm3.CreateApiWidthDoc(http.MethodGet, "/api/v1/service/approval/subscribe", []string{"context", "query:service", "query:apply"}, []string{"approval"}, p.subscribeApprovalController.GetApprovalDetail, access.SystemWorkspaceServiceViewAll, access.TeamServiceSubscriptionView),
 		pm3.CreateApiWidthDoc(http.MethodPost, "/api/v1/service/approval/subscribe", []string{"context", "query:service", "query:apply", "body"}, nil, p.subscribeApprovalController.Approval),
 	}
 }
diff --git a/resources/access/role.yaml b/resources/access/role.yaml
index 19772f90..8dcd8e1a 100644
--- a/resources/access/role.yaml
+++ b/resources/access/role.yaml
@@ -62,7 +62,6 @@ team:
   - name: team admin
     value: team_admin
     permits:
-      - team.consumer.application.manager
       - team.consumer.authorization.manager
       - team.consumer.authorization.view
       - team.consumer.subscription.manager_subscribed_services
@@ -74,7 +73,6 @@ team:
       - team.service.api_doc.view
       - team.service.release.manager
       - team.service.release.view
-      - team.service.service.manager
       - team.service.service_intro.manager
       - team.service.service_intro.view
       - team.service.subscription.manager
@@ -99,7 +97,6 @@ team:
       - team.service.api_doc.view
       - team.service.release.manager
       - team.service.release.view
-      - team.service.service.manager
       - team.service.service_intro.manager
       - team.service.service_intro.view
       - team.service.subscription.manager
@@ -134,7 +131,6 @@ team:
   - name: consumer admin
     value: consumer_admin
     permits:
-      - team.consumer.application.manager
       - team.consumer.authorization.manager
       - team.consumer.authorization.view
       - team.consumer.subscription.manager_subscribed_services