diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java
index 2f865e18..05d7346e 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;
 
+import cn.dev33.satoken.annotation.SaCheckLogin;
 import cn.dev33.satoken.annotation.SaCheckRole;
 import cn.dev33.satoken.annotation.SaMode;
 import lombok.RequiredArgsConstructor;
@@ -26,6 +27,7 @@ import java.util.List;
 
 @RequiredArgsConstructor
 @RestController
+@SaCheckLogin
 public class AihrCandidateMaterialController {
 
     private static final String HR_OPERATOR_ROLE = "hr_operator";
diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java
index 84892cff..67ccef72 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;
 
+import cn.dev33.satoken.annotation.SaCheckLogin;
 import lombok.RequiredArgsConstructor;
 import org.dromara.common.core.domain.model.LoginUser;
 import org.dromara.common.core.enums.UserType;
@@ -32,6 +33,7 @@ import java.util.List;
 @RequiredArgsConstructor
 @RestController
 @RequestMapping("/api/knowledge/case")
+@SaCheckLogin
 public class AihrCaseController {
 
     private final AihrCaseService caseService;
diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java
index 5544099b..ae88abb0 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;
 
+import cn.dev33.satoken.annotation.SaCheckLogin;
 import lombok.RequiredArgsConstructor;
 import org.dromara.aihr.domain.AihrInterviewDto.AnswerRequest;
 import org.dromara.aihr.domain.AihrInterviewDto.AnswerResponse;
@@ -28,6 +29,7 @@ import java.util.List;
 @RequiredArgsConstructor
 @RestController
 @RequestMapping("/api/recruit/interview")
+@SaCheckLogin
 public class AihrInterviewController {
 
     private final AihrInterviewService interviewService;
diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java
index 8b202cec..9aebeaf4 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;
 
+import cn.dev33.satoken.annotation.SaCheckLogin;
 import cn.dev33.satoken.annotation.SaCheckRole;
 import cn.dev33.satoken.annotation.SaMode;
 import lombok.RequiredArgsConstructor;
@@ -73,6 +74,7 @@ public class AihrSopController {
         return R.ok(uploadQueueService.retry(id));
     }
 
+    @SaCheckLogin
     @PostMapping("/search")
     public R<SearchResponse> search(@RequestBody SearchRequest request) {
         return R.ok(sopSeedService.search(request));
@@ -84,6 +86,7 @@ public class AihrSopController {
         return R.ok(sopSeedService.positionSop(position, projectType));
     }
 
+    @SaCheckLogin
     @PostMapping("/answer-feedback")
     public R<AnswerFeedbackResponse> answerFeedback(@RequestBody AnswerFeedbackRequest request) {
         return R.ok(sopSeedService.answerFeedback(request));
@@ -110,6 +113,7 @@ public class AihrSopController {
         return response == null ? R.fail("SOP问答评审记录不存在") : R.ok(response);
     }
 
+    @SaCheckLogin
     @PostMapping("/summary-card")
     public R<SummaryCardResponse> summaryCard(@RequestBody SummaryCardRequest request) {
         return R.ok(sopSeedService.summaryCard(request));
diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSpeechController.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSpeechController.java
index dc01ade3..d518dee1 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSpeechController.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSpeechController.java
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;
 
+import cn.dev33.satoken.annotation.SaCheckLogin;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.dromara.aihr.domain.AihrSpeechDto.AsrResponse;
@@ -30,6 +31,7 @@ import java.util.Base64;
 @RequiredArgsConstructor
 @RestController
 @RequestMapping("/api/ai")
+@SaCheckLogin
 public class AihrSpeechController {
 
     private static final String NOT_CONFIGURED_HINT = "语音模型未配置：请在「模型管理」启用 asr/tts 类目模型（如硅基流动 SenseVoice/CosyVoice2）";
diff --git a/docs/BRD_IMPLEMENTATION_AUDIT.md b/docs/BRD_IMPLEMENTATION_AUDIT.md
index cdfe6395..905afa1d 100644
--- a/docs/BRD_IMPLEMENTATION_AUDIT.md
+++ b/docs/BRD_IMPLEMENTATION_AUDIT.md
@@ -80,3 +80,4 @@
 - 2026-07-14 线上只读复核：生产根站点与 `/h5/` 均返回 HTTP 200，线上 H5 入口仍加载 `index-Dh7w59t7.js`；`/prod-api/api/aihr/mobile/home/user` 返回业务 `code=200`。本次未发布、未修改生产数据；该结果只证明公开入口和员工首页 API 可用，不替代正式登录、主管身份和试点验收。
 - 本次线上核对发现 schema 漂移：生产库已存在 `aihr_practice_session.satisfaction_score`、`satisfaction_comment`，但尚未显式创建 `aihr_practice_audio`。当前代码仍有运行时懒建表兜底，满意度链路不受影响；正式音频留痕试点前必须执行并核验显式迁移，不能依赖首次请求触发；严格预检已增加该表存在性检查。
 - 2026-07-14 后续 BRD 审查：`组织与权限` 页已确认具备组织快照、dry-run、写入确认和 HR/管理员角色门禁；本轮修正写入模式按钮文案，并避免取消确认时误报“同步接口不可用”。岗位-SOP 页面继续明确显示“当前摘要不代表正式上岗资格”，在正式 `sop_applicability`、培训任务和资格规则未由 HR 确认前，不扩展为伪资格 gating。
+- 2026-07-14 权限审查：候选人面试、案例处理、ASR/TTS、SOP 搜索/反馈/总结卡、候选人资料接口均补控制器级登录门禁；匿名首页与 `position-sop` 导航摘要仍保持公开只读，写入、模型调用和候选人私有记录不再依赖业务层“失败返回”兜底。
diff --git a/scripts/demo-check.sh b/scripts/demo-check.sh
index 7aa4604d..33abd442 100755
--- a/scripts/demo-check.sh
+++ b/scripts/demo-check.sh
@@ -344,6 +344,10 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/control
 contains mobile-uni/src/services/candidate.ts "/api/recruit/interview/start"
 contains mobile-uni/src/services/candidate.ts "/api/aihr/mobile/candidate/materials"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java "候选人登录态无效"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java "@SaCheckLogin"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java "@SaCheckLogin"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSpeechController.java "@SaCheckLogin"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "@SaCheckLogin"
 contains mobile-uni/src/pages/candidate/interview/index.vue "startCandidateInterview"
 contains mobile-uni/src/pages/candidate/materials/index.vue "uploadCandidateMaterial"
 contains mobile-uni/src/pages/candidate/progress/index.vue "buildCandidateFlow"
@@ -431,6 +435,7 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/control
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "projectScopesForAppUser"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "/api/knowledge/case"
 contains frontend/src/api/aihr/sop.ts "/api/knowledge/search"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "@SaCheckLogin"
 contains frontend/src/api/aihr/sop.ts "/api/knowledge/doc/upload"
 contains frontend/src/api/aihr/sop.ts "/api/knowledge/reviews"
 contains frontend/src/api/aihr/sop.ts "/api/knowledge/answer-feedback"