diff --git a/iam/src/main/java/com/baiyue/iam/service/MemberService.java b/iam/src/main/java/com/baiyue/iam/service/MemberService.java
index 46813a762..43f79000e 100644
--- a/iam/src/main/java/com/baiyue/iam/service/MemberService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/MemberService.java
@@ -170,6 +170,8 @@ public class MemberService {
             membership.setLeftAt("DISABLED".equals(request.status()) ? LocalDateTime.now() : null);
             user.setStatus(request.status()); repository.saveUser(user); repository.save(membership);
             securityEvents.userStatus(user.getAuthUserId(), tenantId, "MERCHANT", request.status());
+            securityEvents.permissionChanged(user.getAuthUserId(), tenantId, "MERCHANT",
+                    "MEMBER_STATUS_CHANGED");
         } catch (RuntimeException localFailure) {
             try {
                 authClient.status(internalToken, user.getAuthUserId(), new AuthAccountClient.StatusRequest(oldStatus));
diff --git a/iam/src/main/java/com/baiyue/iam/service/PlatformInternalUserService.java b/iam/src/main/java/com/baiyue/iam/service/PlatformInternalUserService.java
index 032898b2c..8f94a889d 100644
--- a/iam/src/main/java/com/baiyue/iam/service/PlatformInternalUserService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/PlatformInternalUserService.java
@@ -147,6 +147,8 @@ public class PlatformInternalUserService {
             repository.saveUser(user);
             repository.save(membership);
             securityEvents.userStatus(user.getAuthUserId(), PLATFORM_TENANT_ID, "PLATFORM", request.status());
+            securityEvents.permissionChanged(user.getAuthUserId(), PLATFORM_TENANT_ID, "PLATFORM",
+                    "PLATFORM_INTERNAL_USER_STATUS_CHANGED");
             return response(membership, user, authAccount.username(), roleIds);
         } catch (RuntimeException localFailure) {
             compensateStatus(user.getAuthUserId(), authAccount.status(), localFailure);
diff --git a/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java b/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java
index a277858ae..fa73ece19 100644
--- a/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java
@@ -203,6 +203,8 @@ public class PlatformUserManagementService {
             members.save(membership);
             securityEvents.userStatus(user.getAuthUserId(), membership.getTenantId(),
                     appCode(membership.getTenantId()), request.status());
+            securityEvents.permissionChanged(user.getAuthUserId(), membership.getTenantId(),
+                    appCode(membership.getTenantId()), "PLATFORM_USER_STATUS_CHANGED");
         } catch (RuntimeException localFailure) {
             call(() -> authClient.status(internalToken, user.getAuthUserId(),
                     new AuthAccountClient.StatusRequest(oldAccount.status())));
diff --git a/iam/src/test/java/com/baiyue/iam/service/MemberServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/MemberServiceTest.java
index 29f97b03f..b190038a9 100644
--- a/iam/src/test/java/com/baiyue/iam/service/MemberServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/MemberServiceTest.java
@@ -106,6 +106,8 @@ class MemberServiceTest {
         assertEquals("DISABLED", result.status());
         verify(repository).save(member);
         verify(repository).saveUser(user);
+        verify(securityEvents).userStatus(40L, 100L, "MERCHANT", "DISABLED");
+        verify(securityEvents).permissionChanged(40L, 100L, "MERCHANT", "MEMBER_STATUS_CHANGED");
     }
 
     @Test void shouldHandleCase05() {
diff --git a/iam/src/test/java/com/baiyue/iam/service/PlatformInternalUserServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/PlatformInternalUserServiceTest.java
index 6e8da47c5..ede6e98a7 100644
--- a/iam/src/test/java/com/baiyue/iam/service/PlatformInternalUserServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/PlatformInternalUserServiceTest.java
@@ -142,6 +142,19 @@ class PlatformInternalUserServiceTest {
         verify(auth, never()).status(anyString(), anyLong(), any());
     }
 
+    @Test
+    void statusChangePublishesMatchingAuthorizationSnapshot() {
+        when(auth.status(anyString(), eq(10L), any())).thenReturn(ApiResponse.success(null));
+
+        InternalUserResponse result = service.changeStatus(30L,
+                new ChangeInternalUserStatusRequest("DISABLED"), 99L);
+
+        assertEquals("DISABLED", result.status());
+        verify(securityEvents).userStatus(10L, 0L, "PLATFORM", "DISABLED");
+        verify(securityEvents).permissionChanged(10L, 0L, "PLATFORM",
+                "PLATFORM_INTERNAL_USER_STATUS_CHANGED");
+    }
+
     @Test
     void shouldHandleCase05() {
         when(auth.status(anyString(), eq(10L), any())).thenReturn(ApiResponse.success(null));
diff --git a/iam/src/test/java/com/baiyue/iam/service/PlatformUserManagementServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/PlatformUserManagementServiceTest.java
index 606955222..67b7cfc39 100644
--- a/iam/src/test/java/com/baiyue/iam/service/PlatformUserManagementServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/PlatformUserManagementServiceTest.java
@@ -224,6 +224,20 @@ class PlatformUserManagementServiceTest {
         verify(auth, never()).status(anyString(), anyLong(), any());
     }
 
+    @Test
+    void statusChangePublishesMatchingAuthorizationSnapshot() {
+        when(auth.status(anyString(), eq(10L), any())).thenReturn(ApiResponse.success(null));
+        when(auth.summary("internal-token", 10L)).thenReturn(ApiResponse.success(
+                new AuthAccountClient.AccountSummary(10L, "operator", "平台运营", "ACTIVE")));
+        when(members.findRoleIds(0L, 30L)).thenReturn(List.of(40001L));
+
+        UserResponse result = service.changeStatus(30L, new ChangeStatusRequest("ACTIVE"), 99L);
+
+        assertEquals("ACTIVE", result.status());
+        verify(securityEvents).userStatus(10L, 0L, "PLATFORM", "ACTIVE");
+        verify(securityEvents).permissionChanged(10L, 0L, "PLATFORM", "PLATFORM_USER_STATUS_CHANGED");
+    }
+
     @Test
     void builtInPlatformAdministratorCannotBeDisabled() {
         IamRole platformAdmin = new IamRole();