diff --git a/pkg/apis/cloudid/cloudpolicy.go b/pkg/apis/cloudid/cloudpolicy.go
index c4121b6cb9..ca5f917f20 100644
--- a/pkg/apis/cloudid/cloudpolicy.go
+++ b/pkg/apis/cloudid/cloudpolicy.go
@@ -54,6 +54,9 @@ type CloudpolicyListInput struct {
 	// | system  |  过滤系统权限		|
 	// | custom  |  过滤自定义权限      |
 	PolicyType string `json:"policy_type"`
+
+	// 是否显示Locked的权限
+	Locked *bool `json:"locked"`
 }
 
 type CloudpolicyDetails struct {
diff --git a/pkg/cloudid/models/cloudpolicy.go b/pkg/cloudid/models/cloudpolicy.go
index 09d30dfe65..e4c32f1cd1 100644
--- a/pkg/cloudid/models/cloudpolicy.go
+++ b/pkg/cloudid/models/cloudpolicy.go
@@ -147,6 +147,10 @@ func (manager *SCloudpolicyManager) ListItemFilter(ctx context.Context, q *sqlch
 		q = q.In("id", sq.SubQuery())
 	}
 
+	if query.Locked == nil || !*query.Locked {
+		q = q.IsFalse("locked")
+	}
+
 	return q, nil
 }
 
diff --git a/pkg/mcclient/modules/mod_cloudpolicy.go b/pkg/mcclient/modules/mod_cloudpolicy.go
index f75bf4300f..338d23d82c 100644
--- a/pkg/mcclient/modules/mod_cloudpolicy.go
+++ b/pkg/mcclient/modules/mod_cloudpolicy.go
@@ -22,7 +22,7 @@ var (
 
 func init() {
 	Cloudpolicies = NewCloudIdManager("cloudpolicy", "cloudpolicies",
-		[]string{},
+		[]string{"id", "name", "description", "domain_id", "domain", "public_scope", "policy_type", "status", "locked"},
 		[]string{})
 
 	register(&Cloudpolicies)