diff --git a/src/main/java/com/xujie/modules/sys/controller/SpecialSecurityController.java b/src/main/java/com/xujie/modules/sys/controller/SpecialSecurityController.java
new file mode 100644
index 0000000..fcf665e
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/controller/SpecialSecurityController.java
@@ -0,0 +1,55 @@
+package com.xujie.modules.sys.controller;
+
+import com.xujie.common.utils.R;
+import com.xujie.modules.sys.dto.UserSpecialSecurityRowVO;
+import com.xujie.modules.sys.dto.UserSpecialSecurityUpdateRequest;
+import com.xujie.modules.sys.entity.SysSpecialPermissionDefEntity;
+import com.xujie.modules.sys.service.SysSpecialPermissionService;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * 用户特殊权限（定义表 + 用户覆盖表）
+ */
+@RestController
+@RequestMapping("/specialSecurity")
+public class SpecialSecurityController {
+
+    @Autowired
+    private SysSpecialPermissionService specialPermissionService;
+
+    @GetMapping("/getUserSpecialSecurity/{username}")
+    public R getUserSpecialSecurity(@PathVariable("username") String username) {
+        List<UserSpecialSecurityRowVO> list = specialPermissionService.listMergedForUser(username);
+        return R.ok().put("list", list);
+    }
+
+    /**
+     * 维护权限定义清单（不存在则新增，存在则更新）
+     */
+    @PostMapping("/saveUserSpecialSecurity")
+    public R saveUserSpecialSecurity(@RequestBody List<SysSpecialPermissionDefEntity> defs) {
+        specialPermissionService.saveOrUpdateDefinitions(defs);
+        return R.ok("保存成功");
+    }
+
+    @PostMapping("/updateUserSpecialSecurity")
+    public R updateUserSpecialSecurity(@RequestBody UserSpecialSecurityUpdateRequest request) {
+        specialPermissionService.updateUserPermissions(request);
+        return R.ok("保存成功");
+    }
+
+    /**
+     * 按用户名 + 权限号查询最终生效值：USER 为用户表，DEFAULT 为定义表默认，NONE 为无
+     */
+    @GetMapping("/getPermissionValue")
+    public R getPermissionValue(
+            @RequestParam("username") String username,
+            @RequestParam("permissionCode") String permissionCode) {
+        Map<String, Object> map = specialPermissionService.getPermissionValue(username, permissionCode);
+        return R.ok().put("value", map.get("value")).put("source", map.get("source"));
+    }
+}
diff --git a/src/main/java/com/xujie/modules/sys/dao/SysSpecialPermissionDefDao.java b/src/main/java/com/xujie/modules/sys/dao/SysSpecialPermissionDefDao.java
new file mode 100644
index 0000000..d9a790a
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/dao/SysSpecialPermissionDefDao.java
@@ -0,0 +1,9 @@
+package com.xujie.modules.sys.dao;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.xujie.modules.sys.entity.SysSpecialPermissionDefEntity;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SysSpecialPermissionDefDao extends BaseMapper<SysSpecialPermissionDefEntity> {
+}
diff --git a/src/main/java/com/xujie/modules/sys/dao/SysSpecialPermissionUserDao.java b/src/main/java/com/xujie/modules/sys/dao/SysSpecialPermissionUserDao.java
new file mode 100644
index 0000000..84efd11
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/dao/SysSpecialPermissionUserDao.java
@@ -0,0 +1,9 @@
+package com.xujie.modules.sys.dao;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.xujie.modules.sys.entity.SysSpecialPermissionUserEntity;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SysSpecialPermissionUserDao extends BaseMapper<SysSpecialPermissionUserEntity> {
+}
diff --git a/src/main/java/com/xujie/modules/sys/dto/UserSpecialSecurityItemDTO.java b/src/main/java/com/xujie/modules/sys/dto/UserSpecialSecurityItemDTO.java
new file mode 100644
index 0000000..c5538a9
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/dto/UserSpecialSecurityItemDTO.java
@@ -0,0 +1,12 @@
+package com.xujie.modules.sys.dto;
+
+import lombok.Data;
+
+@Data
+public class UserSpecialSecurityItemDTO {
+
+    private String permissionCode;
+
+    /** Y / N */
+    private String itemvalue;
+}
diff --git a/src/main/java/com/xujie/modules/sys/dto/UserSpecialSecurityRowVO.java b/src/main/java/com/xujie/modules/sys/dto/UserSpecialSecurityRowVO.java
new file mode 100644
index 0000000..b407109
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/dto/UserSpecialSecurityRowVO.java
@@ -0,0 +1,21 @@
+package com.xujie.modules.sys.dto;
+
+import lombok.Data;
+
+/**
+ * 用户特殊权限弹窗行（与 user.vue 表格字段对齐）
+ */
+@Data
+public class UserSpecialSecurityRowVO {
+
+    private String permissionCode;
+
+    /** 参数描述 */
+    private String securitydesc;
+
+    /** 模块 */
+    private String module;
+
+    /** 参数值（布尔，前端 checkbox） */
+    private Boolean itemvalue;
+}
diff --git a/src/main/java/com/xujie/modules/sys/dto/UserSpecialSecurityUpdateRequest.java b/src/main/java/com/xujie/modules/sys/dto/UserSpecialSecurityUpdateRequest.java
new file mode 100644
index 0000000..367748a
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/dto/UserSpecialSecurityUpdateRequest.java
@@ -0,0 +1,13 @@
+package com.xujie.modules.sys.dto;
+
+import lombok.Data;
+
+import java.util.List;
+
+@Data
+public class UserSpecialSecurityUpdateRequest {
+
+    private String username;
+
+    private List<UserSpecialSecurityItemDTO> items;
+}
diff --git a/src/main/java/com/xujie/modules/sys/entity/SysSpecialPermissionDefEntity.java b/src/main/java/com/xujie/modules/sys/entity/SysSpecialPermissionDefEntity.java
new file mode 100644
index 0000000..b81d093
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/entity/SysSpecialPermissionDefEntity.java
@@ -0,0 +1,35 @@
+package com.xujie.modules.sys.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+/**
+ * 特殊权限定义（默认清单）
+ */
+@Data
+@TableName("sys_special_permission_def")
+public class SysSpecialPermissionDefEntity {
+
+    @TableId(value = "permission_code", type = IdType.INPUT)
+    private String permissionCode;
+
+    private String permissionName;
+
+    private String moduleCode;
+
+    private String defaultValue;
+
+    /**
+     * 值类型（与库列 MS_Description 一致）：0=Y/N；1=字符串；2=整数；3=小数
+     */
+    private Integer valueType;
+
+    private Integer sortOrder;
+
+    /** 是否启用本权限定义：Y/N，默认 Y */
+    private String active;
+
+    private String remark;
+}
diff --git a/src/main/java/com/xujie/modules/sys/entity/SysSpecialPermissionUserEntity.java b/src/main/java/com/xujie/modules/sys/entity/SysSpecialPermissionUserEntity.java
new file mode 100644
index 0000000..a4d3b72
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/entity/SysSpecialPermissionUserEntity.java
@@ -0,0 +1,25 @@
+package com.xujie.modules.sys.entity;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+/**
+ * 用户特殊权限（覆盖默认值）
+ */
+@Data
+@TableName("sys_special_permission_user")
+public class SysSpecialPermissionUserEntity {
+
+    @TableId(type = IdType.AUTO)
+    private Long id;
+
+    private String username;
+
+    private String permissionCode;
+
+    @TableField("[value]")
+    private String value;
+}
diff --git a/src/main/java/com/xujie/modules/sys/service/SysSpecialPermissionService.java b/src/main/java/com/xujie/modules/sys/service/SysSpecialPermissionService.java
new file mode 100644
index 0000000..440fb0b
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/service/SysSpecialPermissionService.java
@@ -0,0 +1,19 @@
+package com.xujie.modules.sys.service;
+
+import com.xujie.modules.sys.dto.UserSpecialSecurityRowVO;
+import com.xujie.modules.sys.dto.UserSpecialSecurityUpdateRequest;
+import com.xujie.modules.sys.entity.SysSpecialPermissionDefEntity;
+
+import java.util.List;
+import java.util.Map;
+
+public interface SysSpecialPermissionService {
+
+    List<UserSpecialSecurityRowVO> listMergedForUser(String username);
+
+    void updateUserPermissions(UserSpecialSecurityUpdateRequest request);
+
+    void saveOrUpdateDefinitions(List<SysSpecialPermissionDefEntity> defs);
+
+    Map<String, Object> getPermissionValue(String username, String permissionCode);
+}
diff --git a/src/main/java/com/xujie/modules/sys/service/impl/SysSpecialPermissionServiceImpl.java b/src/main/java/com/xujie/modules/sys/service/impl/SysSpecialPermissionServiceImpl.java
new file mode 100644
index 0000000..0cab025
--- /dev/null
+++ b/src/main/java/com/xujie/modules/sys/service/impl/SysSpecialPermissionServiceImpl.java
@@ -0,0 +1,174 @@
+package com.xujie.modules.sys.service.impl;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.xujie.modules.sys.dao.SysSpecialPermissionDefDao;
+import com.xujie.modules.sys.dao.SysSpecialPermissionUserDao;
+import com.xujie.modules.sys.dto.UserSpecialSecurityItemDTO;
+import com.xujie.modules.sys.dto.UserSpecialSecurityRowVO;
+import com.xujie.modules.sys.dto.UserSpecialSecurityUpdateRequest;
+import com.xujie.modules.sys.entity.SysSpecialPermissionDefEntity;
+import com.xujie.modules.sys.entity.SysSpecialPermissionUserEntity;
+import com.xujie.modules.sys.service.SysSpecialPermissionService;
+import org.apache.commons.lang.StringUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+@Service
+public class SysSpecialPermissionServiceImpl implements SysSpecialPermissionService {
+
+    @Autowired
+    private SysSpecialPermissionDefDao defDao;
+
+    @Autowired
+    private SysSpecialPermissionUserDao userDao;
+
+    @Override
+    public List<UserSpecialSecurityRowVO> listMergedForUser(String username) {
+        List<SysSpecialPermissionDefEntity> defs = defDao.selectList(
+                new QueryWrapper<SysSpecialPermissionDefEntity>()
+                        .eq("active", "Y")
+                        .orderByAsc("sort_order")
+                        .orderByAsc("permission_code"));
+        if (defs.isEmpty()) {
+            return new ArrayList<>();
+        }
+        List<SysSpecialPermissionUserEntity> userRows = userDao.selectList(
+                new QueryWrapper<SysSpecialPermissionUserEntity>().eq("username", username));
+        Map<String, String> override = userRows.stream()
+                .collect(Collectors.toMap(
+                        SysSpecialPermissionUserEntity::getPermissionCode,
+                        SysSpecialPermissionUserEntity::getValue,
+                        (a, b) -> a));
+        List<UserSpecialSecurityRowVO> result = new ArrayList<>();
+        for (SysSpecialPermissionDefEntity d : defs) {
+            UserSpecialSecurityRowVO vo = new UserSpecialSecurityRowVO();
+            vo.setPermissionCode(d.getPermissionCode());
+            vo.setSecuritydesc(d.getPermissionName());
+            vo.setModule(d.getModuleCode());
+            String raw = override.get(d.getPermissionCode());
+            if (raw == null) {
+                raw = d.getDefaultValue();
+            }
+            vo.setItemvalue(isTruthy(raw));
+            result.add(vo);
+        }
+        return result;
+    }
+
+    private static boolean isTruthy(String v) {
+        if (v == null) {
+            return false;
+        }
+        String s = v.trim();
+        return "Y".equalsIgnoreCase(s) || "1".equals(s) || "true".equalsIgnoreCase(s);
+    }
+
+    /** 定义是否参与默认/列表：active 为 Y（忽略大小写） */
+    private static boolean isActiveY(String active) {
+        return active != null && "Y".equalsIgnoreCase(active.trim());
+    }
+
+    @Override
+    @Transactional(rollbackFor = Exception.class)
+    public void updateUserPermissions(UserSpecialSecurityUpdateRequest request) {
+        if (request == null || StringUtils.isBlank(request.getUsername())) {
+            throw new IllegalArgumentException("username 不能为空");
+        }
+        List<UserSpecialSecurityItemDTO> items = request.getItems();
+        if (items == null || items.isEmpty()) {
+            throw new IllegalArgumentException("权限项不能为空");
+        }
+        String username = request.getUsername().trim();
+        userDao.delete(new QueryWrapper<SysSpecialPermissionUserEntity>().eq("username", username));
+        for (UserSpecialSecurityItemDTO item : items) {
+            if (item == null || StringUtils.isBlank(item.getPermissionCode())) {
+                continue;
+            }
+            String val = normalizeItemValue(item.getItemvalue());
+            SysSpecialPermissionUserEntity row = new SysSpecialPermissionUserEntity();
+            row.setUsername(username);
+            row.setPermissionCode(item.getPermissionCode().trim());
+            row.setValue(val);
+            userDao.insert(row);
+        }
+    }
+
+    private static String normalizeItemValue(String itemvalue) {
+        if (itemvalue == null || itemvalue.trim().isEmpty()) {
+            return "N";
+        }
+        String v = itemvalue.trim();
+        if (isTruthy(v)) {
+            return "Y";
+        }
+        return "N";
+    }
+
+    @Override
+    @Transactional(rollbackFor = Exception.class)
+    public void saveOrUpdateDefinitions(List<SysSpecialPermissionDefEntity> defs) {
+        if (defs == null || defs.isEmpty()) {
+            return;
+        }
+        for (SysSpecialPermissionDefEntity def : defs) {
+            if (def == null || StringUtils.isBlank(def.getPermissionCode())) {
+                continue;
+            }
+            SysSpecialPermissionDefEntity existing = defDao.selectById(def.getPermissionCode());
+            if (existing == null) {
+                if (StringUtils.isBlank(def.getActive())) {
+                    def.setActive("Y");
+                } else {
+                    def.setActive("Y".equalsIgnoreCase(def.getActive().trim()) ? "Y" : "N");
+                }
+                if (def.getValueType() == null) {
+                    def.setValueType(0);
+                }
+                if (def.getSortOrder() == null) {
+                    def.setSortOrder(0);
+                }
+                if (StringUtils.isBlank(def.getDefaultValue())) {
+                    def.setDefaultValue("N");
+                }
+                defDao.insert(def);
+            } else {
+                defDao.updateById(def);
+            }
+        }
+    }
+
+    @Override
+    public Map<String, Object> getPermissionValue(String username, String permissionCode) {
+        Map<String, Object> m = new HashMap<>(4);
+        if (StringUtils.isBlank(username) || StringUtils.isBlank(permissionCode)) {
+            m.put("value", null);
+            m.put("source", "NONE");
+            return m;
+        }
+        SysSpecialPermissionUserEntity u = userDao.selectOne(
+                new QueryWrapper<SysSpecialPermissionUserEntity>()
+                        .eq("username", username.trim())
+                        .eq("permission_code", permissionCode.trim()));
+        if (u != null) {
+            m.put("value", u.getValue());
+            m.put("source", "USER");
+            return m;
+        }
+        SysSpecialPermissionDefEntity d = defDao.selectById(permissionCode.trim());
+        if (d != null && isActiveY(d.getActive())) {
+            m.put("value", d.getDefaultValue());
+            m.put("source", "DEFAULT");
+            return m;
+        }
+        m.put("value", null);
+        m.put("source", "NONE");
+        return m;
+    }
+}