diff --git a/yuthon_hr_employee/models/yuthon_hr_employee.py b/yuthon_hr_employee/models/yuthon_hr_employee.py
index 07cc3b5d8..4f6536fb4 100644
--- a/yuthon_hr_employee/models/yuthon_hr_employee.py
+++ b/yuthon_hr_employee/models/yuthon_hr_employee.py
@@ -393,7 +393,8 @@ class YuthonHrEmployee(models.Model):
                 groups_by_role_group.write({'users': [(4, employee.user_id.id)]})
 
     def write(self, vals):
-        """覆盖 write，user_role_id / user_role_ids 变更时反向同步到角色的 personnel_ids"""
+        """覆盖 write，user_role_id / user_role_ids 变更时反向同步到角色的 personnel_ids，
+        并正向同步到 res.groups 的用户明细行"""
         role_fields = {'user_role_id', 'user_role_ids'}
         if not role_fields.intersection(vals.keys()):
             return super().write(vals)
@@ -428,6 +429,61 @@ class YuthonHrEmployee(models.Model):
                     role = self.env['soong.user.role'].browse(rid)
                     if emp.id in role.personnel_ids.ids:
                         role.write({'personnel_ids': [(3, emp.id)]})
+
+            # --- 权限组同步 ---
+            if not emp.user_id:
+                continue
+
+            # 收集当前所有角色ID（主角色 + 辅助角色）
+            current_role_ids = set()
+            if emp.user_role_id:
+                current_role_ids.add(emp.user_role_id.id)
+            if emp.user_role_ids:
+                current_role_ids.update(emp.user_role_ids.ids)
+
+            # 收集被移除的角色ID
+            removed_role_ids = set()
+            if 'user_role_id' in vals:
+                old_rid = old_role_id_map.get(emp.id)
+                new_rid = emp.user_role_id.id if emp.user_role_id else False
+                if old_rid and old_rid != new_rid:
+                    removed_role_ids.add(old_rid)
+            if 'user_role_ids' in vals:
+                old_rids_set = old_role_ids_map.get(emp.id, set())
+                new_rids_set = set(emp.user_role_ids.ids)
+                removed_role_ids.update(old_rids_set - new_rids_set)
+
+            # 收集被添加的角色ID
+            added_role_ids = set()
+            if 'user_role_id' in vals:
+                old_rid = old_role_id_map.get(emp.id)
+                new_rid = emp.user_role_id.id if emp.user_role_id else False
+                if new_rid and new_rid != old_rid:
+                    added_role_ids.add(new_rid)
+            if 'user_role_ids' in vals:
+                old_rids_set = old_role_ids_map.get(emp.id, set())
+                new_rids_set = set(emp.user_role_ids.ids)
+                added_role_ids.update(new_rids_set - old_rids_set)
+
+            # 1. 新增角色对应的权限组：把员工的用户加进去
+            if added_role_ids:
+                groups_to_add = self.env['res.groups'].sudo().search([
+                    ('user_role_ids', 'in', list(added_role_ids))
+                ])
+                for group in groups_to_add:
+                    if emp.user_id.id not in group.users.ids:
+                        group.sudo().write({'users': [(4, emp.user_id.id)]})
+
+            # 2. 移除角色对应的权限组：若员工在该组不再有任何角色交集，则把用户移除
+            if removed_role_ids:
+                groups_to_check = self.env['res.groups'].sudo().search([
+                    ('user_role_ids', 'in', list(removed_role_ids))
+                ])
+                for group in groups_to_check:
+                    group_role_ids = set(group.user_role_ids.ids)
+                    if not (group_role_ids & current_role_ids):
+                        if emp.user_id.id in group.users.ids:
+                            group.sudo().write({'users': [(3, emp.user_id.id)]})
         return result
 
     def update_trade_union(self):