diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go
index 51f7f839a4..3762d6e707 100644
--- a/pkg/cloudcommon/db/rbac.go
+++ b/pkg/cloudcommon/db/rbac.go
@@ -51,6 +51,8 @@ func isObjectRbacAllowed(model IModel, userCred mcclient.TokenCredential, action
 	case rbacutils.ScopeUser:
 		if ownerId != nil && objOwnerId != nil && (ownerId.GetUserId() == objOwnerId.GetUserId() || objOwnerId.GetUserId() == "" || (model.IsSharable(ownerId) && action == policy.PolicyActionGet)) {
 			requireScope = rbacutils.ScopeUser
+		} else if ownerId != nil && objOwnerId != nil && ownerId.GetProjectDomainId() == objOwnerId.GetProjectDomainId() {
+			requireScope = rbacutils.ScopeDomain
 		} else {
 			requireScope = rbacutils.ScopeSystem
 		}
@@ -103,6 +105,8 @@ func isClassRbacAllowed(manager IModelManager, userCred mcclient.TokenCredential
 	case rbacutils.ScopeUser:
 		if ownerId != nil && ownerId.GetUserId() == objOwnerId.GetUserId() {
 			requireScope = rbacutils.ScopeUser
+		} else if ownerId != nil && ownerId.GetProjectDomainId() == objOwnerId.GetProjectDomainId() {
+			requireScope = rbacutils.ScopeDomain
 		} else {
 			requireScope = rbacutils.ScopeSystem
 		}
diff --git a/pkg/notify/models/receiver.go b/pkg/notify/models/receiver.go
index ad5dd169ab..821b65f64f 100644
--- a/pkg/notify/models/receiver.go
+++ b/pkg/notify/models/receiver.go
@@ -533,6 +533,8 @@ func (rm *SReceiverManager) FetchOwnerId(ctx context.Context, data jsonutils.JSO
 			return nil, errors.Wrap(err, "UserCacheManager.FetchUserByIdOrName")
 		}
 		ownerId := db.SOwnerId{
+			DomainId:     u.DomainId,
+			Domain:       u.Domain,
 			UserDomain:   u.Domain,
 			UserDomainId: u.DomainId,
 			UserId:       u.Id,