diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go
index d2565e2bd2..76c2fd2152 100644
--- a/pkg/cloudcommon/db/rbac.go
+++ b/pkg/cloudcommon/db/rbac.go
@@ -1,8 +1,6 @@
 package db
 
 import (
-	"yunion.io/x/log"
-
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient"
@@ -14,9 +12,11 @@ func isListRbacAllowed(manager IModelManager, userCred mcclient.TokenCredential,
 }
 
 func isListRbacAllowedInternal(manager IModelManager, resource string, userCred mcclient.TokenCredential, isAdminMode bool) bool {
-	log.Debugf("%s %s", manager.KeywordPlural(), resource)
 	var requireAdmin bool
-	ownerId := manager.GetOwnerId(userCred)
+	var ownerId string
+	if userCred != nil {
+		ownerId = manager.GetOwnerId(userCred)
+	}
 	if len(ownerId) > 0 {
 		if isAdminMode {
 			requireAdmin = true
@@ -36,8 +36,6 @@ func isListRbacAllowedInternal(manager IModelManager, resource string, userCred
 		return true
 	case result == rbacutils.OwnerAllow && !requireAdmin:
 		return true
-	case result == rbacutils.AdminAllow && requireAdmin:
-		return true
 	}
 
 	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
@@ -52,7 +50,10 @@ func isJointListRbacAllowed(manager IJointModelManager, userCred mcclient.TokenC
 
 func isClassActionRbacAllowed(manager IModelManager, userCred mcclient.TokenCredential, ownerProjId string, action string, extra ...string) bool {
 	var requireAdmin bool
-	ownerId := manager.GetOwnerId(userCred)
+	var ownerId string
+	if userCred != nil {
+		ownerId = manager.GetOwnerId(userCred)
+	}
 	if len(ownerId) > 0 {
 		if ownerProjId == ownerId {
 			requireAdmin = false
@@ -72,8 +73,6 @@ func isClassActionRbacAllowed(manager IModelManager, userCred mcclient.TokenCred
 		return true
 	case result == rbacutils.OwnerAllow && !requireAdmin:
 		return true
-	case result == rbacutils.AdminAllow && requireAdmin:
-		return true
 	}
 
 	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
@@ -85,7 +84,11 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
 	var requireAdmin bool
 	var isOwner bool
 
-	ownerId := model.GetModelManager().GetOwnerId(userCred)
+	var ownerId string
+
+	if userCred != nil {
+		ownerId = model.GetModelManager().GetOwnerId(userCred)
+	}
 
 	if len(ownerId) > 0 {
 		objOwnerId := model.GetOwnerProjectId()
@@ -109,8 +112,6 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
 		return true
 	case result == rbacutils.OwnerAllow && isOwner && !requireAdmin:
 		return true
-	case result == rbacutils.AdminAllow && (requireAdmin || isOwner):
-		return true
 	}
 
 	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go
index ebbda04d79..d4ab475993 100644
--- a/pkg/cloudcommon/policy/policy.go
+++ b/pkg/cloudcommon/policy/policy.go
@@ -221,7 +221,7 @@ func (manager *SPolicyManager) Allow(isAdmin bool, userCred mcclient.TokenCreden
 			currentPriv = result
 		}
 	}
-	if manager.defaultPolicy != nil {
+	if !isAdmin && manager.defaultPolicy != nil {
 		result := manager.defaultPolicy.Allow(userCredJson, service, resource, action, extra...)
 		if currentPriv.StricterThan(result) {
 			currentPriv = result
@@ -230,6 +230,17 @@ func (manager *SPolicyManager) Allow(isAdmin bool, userCred mcclient.TokenCreden
 	if consts.IsRbacDebug() {
 		log.Debugf("[RBAC: %v] %s %s %s %#v permission %s", isAdmin, service, resource, action, extra, currentPriv)
 	}
+	if isAdmin {
+		switch currentPriv {
+		case rbacutils.OwnerAllow, rbacutils.UserAllow, rbacutils.GuestAllow:
+			currentPriv = rbacutils.AdminAllow
+		}
+	} else {
+		switch currentPriv {
+		case rbacutils.AdminAllow:
+			currentPriv = rbacutils.UserAllow
+		}
+	}
 	return currentPriv
 }