diff --git a/apps/rbac/const.py b/apps/rbac/const.py
index fac97b5db..04bfb1617 100644
--- a/apps/rbac/const.py
+++ b/apps/rbac/const.py
@@ -79,7 +79,6 @@ exclude_permissions = (
     ('rbac', 'systemrolebinding', 'change', 'systemrolebinding'),
     ('rbac', 'orgrolebinding', 'change', 'orgrolebinding'),
     ('rbac', 'menupermission', '*', 'menupermission'),
-    ('rbac', 'role', '*', '*'),
     ('ops', 'adhocexecution', 'view,add,delete,change', '*'),
     ('ops', 'jobexecution', 'change,delete', 'jobexecution'),
     ('ops', 'historicaljob', '*', '*'),
@@ -132,7 +131,7 @@ only_system_permissions = (
     ('rbac', 'systemrole', '*', '*'),
     ('rbac', 'rolebinding', '*', '*'),
     ('rbac', 'systemrolebinding', '*', '*'),
-    ('rbac', 'orgrole', 'delete,add,change', '*'),
+    ('rbac', 'orgrole', 'delete,add,change', 'orgrole'),
     ('orgs', 'organization', '*', '*'),
     ('xpack', 'license', '*', '*'),
     ('settings', 'setting', '*', '*'),