diff --git a/inventory-backend/app/api/v1/auth.py b/inventory-backend/app/api/v1/auth.py
index df6cc29..075b7de 100644
--- a/inventory-backend/app/api/v1/auth.py
+++ b/inventory-backend/app/api/v1/auth.py
@@ -180,6 +180,7 @@ def create_user():
 # ==============================================================================
 @auth_bp.route('/user/batch', methods=['POST'])
 @jwt_required()
+@permission_required('system_user:operation')
 def batch_create_user():
     try:
         data_list = request.get_json()