diff --git a/pkg/compute/models/access_group_caches.go b/pkg/compute/models/access_group_caches.go
index bd5dc5a61f..0c5860f1dd 100644
--- a/pkg/compute/models/access_group_caches.go
+++ b/pkg/compute/models/access_group_caches.go
@@ -70,6 +70,10 @@ type SAccessGroupCache struct {
 	NetworkType    string `width:"8" charset:"ascii" nullable:"false" index:"true" list:"user" default:"vpc"`
 }
 
+func (manager *SAccessGroupCacheManager) ResourceScope() rbacutils.TRbacScope {
+	return rbacutils.ScopeDomain
+}
+
 func (manager *SAccessGroupCacheManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
 	return false
 }
diff --git a/pkg/compute/policy/resources.go b/pkg/compute/policy/resources.go
index a7bc01e21d..92f8af2095 100644
--- a/pkg/compute/policy/resources.go
+++ b/pkg/compute/policy/resources.go
@@ -55,6 +55,9 @@ var (
 		"natgateways",
 		"natsentries",
 		"natdentries",
+		"file_systems",
+		"access_groups",
+		"access_group_caches",
 		"policy_assignments",
 		"proxysettings",
 		"project_mappings",