diff --git a/pkg/cloudcommon/db/metadata.go b/pkg/cloudcommon/db/metadata.go
index bd95e3fadd..3bb3205a75 100644
--- a/pkg/cloudcommon/db/metadata.go
+++ b/pkg/cloudcommon/db/metadata.go
@@ -279,9 +279,6 @@ func (manager *SMetadataManager) SetValues(ctx context.Context, obj IModel, stor
 
 	changes := make([]sMetadataChange, 0)
 	for key, value := range store {
-		if strings.HasPrefix(key, SYS_TAG_PREFIX) && (userCred == nil || !IsAllowGetSpec(rbacutils.ScopeSystem, userCred, obj, "metadata")) {
-			return nil, httperrors.NewForbiddenError("Ordinary users can't set the tags that begin with an underscore")
-		}
 
 		valStr := stringutils.Interface2String(value)
 		valStrLower := strings.ToLower(valStr)
diff --git a/pkg/cloudcommon/db/standalone.go b/pkg/cloudcommon/db/standalone.go
index 4df2aa3201..bd0fbb94e0 100644
--- a/pkg/cloudcommon/db/standalone.go
+++ b/pkg/cloudcommon/db/standalone.go
@@ -17,6 +17,7 @@ package db
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
@@ -238,18 +239,10 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli
 }
 
 func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error {
-	if Metadata.IsSystemAdminKey(key) && !IsAllowPerform(rbacutils.ScopeSystem, userCred, model, "metadata") {
-		return httperrors.NewNotSufficientPrivilegeError("cannot set system key")
-	}
 	return Metadata.SetValue(ctx, model, key, value, userCred)
 }
 
 func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error {
-	for k := range dictstore {
-		if Metadata.IsSystemAdminKey(k) && !IsAllowPerform(rbacutils.ScopeSystem, userCred, model, "metadata") {
-			return httperrors.NewNotSufficientPrivilegeError("not allow to set system key %s", k)
-		}
-	}
 	return Metadata.SetValuesWithLog(ctx, model, dictstore, userCred)
 }
 
@@ -305,6 +298,10 @@ func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userC
 	}
 	dictStore := make(map[string]interface{})
 	for k, v := range dictMap {
+		// 已双下滑线开头的metadata是系统内置，普通用户不可添加，只能查看
+		if strings.HasPrefix(k, SYS_TAG_PREFIX) && (userCred == nil || !IsAllowPerform(rbacutils.ScopeSystem, userCred, model, "metadata")) {
+			return nil, httperrors.NewForbiddenError("not allow to set system key, please remove the underscore at the beginning")
+		}
 		dictStore[k], _ = v.GetString()
 	}
 	err = model.SetAllMetadata(ctx, dictStore, userCred)
@@ -326,7 +323,7 @@ func (model *SStandaloneResourceBase) PerformUserMetadata(ctx context.Context, u
 	}
 	dictStore := make(map[string]interface{})
 	for k, v := range dictMap {
-		dictStore["user:"+k], _ = v.GetString()
+		dictStore[USER_TAG_PREFIX+k], _ = v.GetString()
 	}
 	err = model.SetUserMetadataValues(ctx, dictStore, userCred)
 	return nil, err