diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go
index 2f4b87c341..ca44780b1d 100644
--- a/pkg/compute/models/guest_actions.go
+++ b/pkg/compute/models/guest_actions.go
@@ -941,7 +941,7 @@ func (self *SGuest) PerformAddSecgroup(ctx context.Context, userCred mcclient.To
 	}
 
 	originSecgroups := self.GetSecgroups()
-	if len(originSecgroups)+len(secgrpJsonArray) >= maxCount {
+	if len(originSecgroups)+len(secgrpJsonArray) > maxCount {
 		return nil, httperrors.NewUnsupportOperationError("guest %s band to up to %d security groups", self.Name, maxCount)
 	}