diff --git a/src/components/assistant/AssistantComposer.vue b/src/components/assistant/AssistantComposer.vue
index b84b7ac..386de18 100644
--- a/src/components/assistant/AssistantComposer.vue
+++ b/src/components/assistant/AssistantComposer.vue
@@ -15,7 +15,12 @@ import { ref } from "vue";
 
 import { featureFlags } from "@/config/features";
 
-defineProps<{ modelValue: string; loading: boolean; canUpload: boolean }>();
+const props = defineProps<{
+  modelValue: string;
+  loading: boolean;
+  canUpload: boolean;
+  canReview: boolean;
+}>();
 
 const emit = defineEmits<{
   "update:modelValue": [value: string];
@@ -153,21 +158,22 @@ const functions: Array<{
     </form>
 
     <div class="function-grid">
-      <button
-        v-for="item in functions"
-        :key="item.title"
-        class="function-card"
-        type="button"
-        @click="emit('tool', item.tool)"
-      >
-        <span class="function-dot" :class="`function-dot--${item.tone}`"></span>
-        <component :is="item.icon" :size="13" />
-        <span v-if="item.isNew" class="function-new">新</span>
-        <span
-          ><strong>{{ item.title }}</strong
-          ><small>{{ item.description }}</small></span
+      <template v-for="item in functions" :key="item.title">
+        <button
+          v-if="item.tool !== 'review' || props.canReview"
+          class="function-card"
+          type="button"
+          @click="emit('tool', item.tool)"
         >
-      </button>
+          <span class="function-dot" :class="`function-dot--${item.tone}`"></span>
+          <component :is="item.icon" :size="13" />
+          <span v-if="item.isNew" class="function-new">新</span>
+          <span
+            ><strong>{{ item.title }}</strong
+            ><small>{{ item.description }}</small></span
+          >
+        </button>
+      </template>
     </div>
   </div>
 </template>
diff --git a/src/pages/RiskAssistantPage.vue b/src/pages/RiskAssistantPage.vue
index bdacaec..74f0c87 100644
--- a/src/pages/RiskAssistantPage.vue
+++ b/src/pages/RiskAssistantPage.vue
@@ -681,6 +681,7 @@ async function scrollToBottom(behavior: "smooth" | "auto" = "smooth") {
       v-model="prompt"
       :loading="loading"
       :can-upload="auth.hasPermission('risk_item.submit')"
+      :can-review="auth.hasPermission('risk_item.review')"
       @submit="submit"
       @select="usePrompt"
       @tool="openTool"
diff --git a/src/router/index.ts b/src/router/index.ts
index b456c47..de3cd28 100644
--- a/src/router/index.ts
+++ b/src/router/index.ts
@@ -24,6 +24,10 @@ router.beforeEach(async (to) => {
     return { name: "login", query: { redirect: to.fullPath } };
   }
   const permission = to.meta.permission;
+  // Refresh the permission snapshot before protected navigation. A role or
+  // permission changed directly in the database must take effect without
+  // requiring the user to clear the old browser session first.
+  if (typeof permission === "string" && auth.token) await auth.restore();
   if (typeof permission === "string" && !auth.hasPermission(permission))
     return { name: "assessment" };
   return true;