diff --git a/apps/server/src/common/auth/permission.service.spec.ts b/apps/server/src/common/auth/permission.service.spec.ts
index 64135de..95d070c 100644
--- a/apps/server/src/common/auth/permission.service.spec.ts
+++ b/apps/server/src/common/auth/permission.service.spec.ts
@@ -56,6 +56,15 @@ describe('PermissionService', () => {
     })).resolves.toBe(true);
   });
 
+  it('allows a project member to write version-scoped work activity evidence', async () => {
+    versionFindUnique.mockResolvedValue({ id: 'version-1', projectId: 'project-1', members: [] });
+    projectMemberFindUnique.mockResolvedValue({ projectId: 'project-1', userId: 'dev-1', role: 'member' });
+
+    await expect(service.can(currentUser({ id: 'dev-1', roleId: 'role-dev' }), 'work-activity:manage', {
+      versionId: 'version-1',
+    })).resolves.toBe(true);
+  });
+
   it('denies users who have a global role permission but are outside the resource scope', async () => {
     versionFindUnique.mockResolvedValue({ id: 'version-1', projectId: 'project-1', members: [] });
     projectMemberFindUnique.mockResolvedValue(null);
diff --git a/apps/server/src/common/auth/permission.service.ts b/apps/server/src/common/auth/permission.service.ts
index c454b87..ee0376a 100644
--- a/apps/server/src/common/auth/permission.service.ts
+++ b/apps/server/src/common/auth/permission.service.ts
@@ -27,6 +27,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'overtime:view', 'member:view', 'role:view',
     'version.research:view', 'version.ui_plan:view', 'version.devtask:view',
     'version.testcase:view', 'version.bug:view',
+    'work-activity:manage',
   ],
   'role-dev': [
     ...VIEW_ONLY,
@@ -35,6 +36,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.research:view', 'version.product_plan:view', 'version.ui_plan:view', 'version.testcase:view',
     'xiaobao.warning:view',
     'overtime:view', 'overtime:create',
+    'work-activity:manage',
   ],
   'role-test': [
     ...VIEW_ONLY,
@@ -43,6 +45,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.research:view', 'version.product_plan:view', 'version.ui_plan:view', 'version.devtask:view',
     'xiaobao.warning:view',
     'overtime:view', 'overtime:create',
+    'work-activity:manage',
   ],
   'role-design': [
     ...VIEW_ONLY,
@@ -51,6 +54,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.testcase:view', 'version.bug:view',
     'xiaobao.warning:view',
     'overtime:view', 'overtime:create',
+    'work-activity:manage',
   ],
   'role-lead': [
     ...VIEW_ONLY,
@@ -60,6 +64,7 @@ const SYSTEM_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.bug:view', 'version.bug:create', 'version.bug:edit', 'version.bug:delete',
     'xiaobao.warning:view',
     'overtime:view', 'overtime:create', 'overtime:export',
+    'work-activity:manage',
   ],
 };
 
@@ -79,6 +84,7 @@ const PROJECT_ROLE_PERMISSIONS: Record<string, string[]> = {
     'version.bug:view', 'version.bug:create', 'version.bug:edit',
     'overtime:view', 'overtime:create',
     'xiaobao.warning:view',
+    'work-activity:manage',
   ],
   viewer: [
     'project:view',