diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go
index e2d89703f5..c5790ed620 100644
--- a/pkg/cloudcommon/db/rbac.go
+++ b/pkg/cloudcommon/db/rbac.go
@@ -134,6 +134,14 @@ func IsAdminAllowList(userCred mcclient.TokenCredential, manager IResource) bool
 	return IsAllowList(rbacutils.ScopeSystem, userCred, manager)
 }
 
+func IsDomainAllowList(userCred mcclient.TokenCredential, manager IResource) bool {
+	return IsAllowList(rbacutils.ScopeDomain, userCred, manager)
+}
+
+func IsProjectAllowList(userCred mcclient.TokenCredential, manager IResource) bool {
+	return IsAllowList(rbacutils.ScopeProject, userCred, manager)
+}
+
 func IsAllowCreate(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, manager IResource) bool {
 	if userCred == nil {
 		return false
@@ -145,6 +153,14 @@ func IsAdminAllowCreate(userCred mcclient.TokenCredential, manager IResource) bo
 	return IsAllowCreate(rbacutils.ScopeSystem, userCred, manager)
 }
 
+func IsDomainAllowCreate(userCred mcclient.TokenCredential, manager IResource) bool {
+	return IsAllowCreate(rbacutils.ScopeDomain, userCred, manager)
+}
+
+func IsProjectAllowCreate(userCred mcclient.TokenCredential, manager IResource) bool {
+	return IsAllowCreate(rbacutils.ScopeProject, userCred, manager)
+}
+
 func IsAllowClassPerform(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, manager IResource, action string) bool {
 	if userCred == nil {
 		return false
@@ -156,6 +172,14 @@ func IsAdminAllowClassPerform(userCred mcclient.TokenCredential, manager IResour
 	return IsAllowClassPerform(rbacutils.ScopeSystem, userCred, manager, action)
 }
 
+func IsDomainAllowClassPerform(userCred mcclient.TokenCredential, manager IResource, action string) bool {
+	return IsAllowClassPerform(rbacutils.ScopeDomain, userCred, manager, action)
+}
+
+func IsProjectAllowClassPerform(userCred mcclient.TokenCredential, manager IResource, action string) bool {
+	return IsAllowClassPerform(rbacutils.ScopeProject, userCred, manager, action)
+}
+
 func IsAllowGet(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource) bool {
 	if userCred == nil {
 		return false
@@ -167,6 +191,14 @@ func IsAdminAllowGet(userCred mcclient.TokenCredential, obj IResource) bool {
 	return IsAllowGet(rbacutils.ScopeSystem, userCred, obj)
 }
 
+func IsDomainAllowGet(userCred mcclient.TokenCredential, obj IResource) bool {
+	return IsAllowGet(rbacutils.ScopeDomain, userCred, obj)
+}
+
+func IsProjectAllowGet(userCred mcclient.TokenCredential, obj IResource) bool {
+	return IsAllowGet(rbacutils.ScopeProject, userCred, obj)
+}
+
 func IsAllowGetSpec(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource, spec string) bool {
 	if userCred == nil {
 		return false
@@ -178,6 +210,14 @@ func IsAdminAllowGetSpec(userCred mcclient.TokenCredential, obj IResource, spec
 	return IsAllowGetSpec(rbacutils.ScopeSystem, userCred, obj, spec)
 }
 
+func IsDomainAllowGetSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
+	return IsAllowGetSpec(rbacutils.ScopeDomain, userCred, obj, spec)
+}
+
+func IsProjectAllowGetSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
+	return IsAllowGetSpec(rbacutils.ScopeProject, userCred, obj, spec)
+}
+
 func IsAllowPerform(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource, action string) bool {
 	if userCred == nil {
 		return false
@@ -189,6 +229,14 @@ func IsAdminAllowPerform(userCred mcclient.TokenCredential, obj IResource, actio
 	return IsAllowPerform(rbacutils.ScopeSystem, userCred, obj, action)
 }
 
+func IsDomainAllowPerform(userCred mcclient.TokenCredential, obj IResource, action string) bool {
+	return IsAllowPerform(rbacutils.ScopeDomain, userCred, obj, action)
+}
+
+func IsProjectAllowPerform(userCred mcclient.TokenCredential, obj IResource, action string) bool {
+	return IsAllowPerform(rbacutils.ScopeProject, userCred, obj, action)
+}
+
 func IsAllowUpdate(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource) bool {
 	if userCred == nil {
 		return false
@@ -200,6 +248,14 @@ func IsAdminAllowUpdate(userCred mcclient.TokenCredential, obj IResource) bool {
 	return IsAllowUpdate(rbacutils.ScopeSystem, userCred, obj)
 }
 
+func IsDomainAllowUpdate(userCred mcclient.TokenCredential, obj IResource) bool {
+	return IsAllowUpdate(rbacutils.ScopeDomain, userCred, obj)
+}
+
+func IsProjectAllowUpdate(userCred mcclient.TokenCredential, obj IResource) bool {
+	return IsAllowUpdate(rbacutils.ScopeProject, userCred, obj)
+}
+
 func IsAllowUpdateSpec(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource, spec string) bool {
 	if userCred == nil {
 		return false
@@ -211,6 +267,14 @@ func IsAdminAllowUpdateSpec(userCred mcclient.TokenCredential, obj IResource, sp
 	return IsAllowUpdateSpec(rbacutils.ScopeSystem, userCred, obj, spec)
 }
 
+func IsDomainAllowUpdateSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
+	return IsAllowUpdateSpec(rbacutils.ScopeDomain, userCred, obj, spec)
+}
+
+func IsProjectAllowUpdateSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
+	return IsAllowUpdateSpec(rbacutils.ScopeProject, userCred, obj, spec)
+}
+
 func IsAllowDelete(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource) bool {
 	if userCred == nil {
 		return false
@@ -222,6 +286,14 @@ func IsAdminAllowDelete(userCred mcclient.TokenCredential, obj IResource) bool {
 	return IsAllowDelete(rbacutils.ScopeSystem, userCred, obj)
 }
 
+func IsDomainAllowDelete(userCred mcclient.TokenCredential, obj IResource) bool {
+	return IsAllowDelete(rbacutils.ScopeDomain, userCred, obj)
+}
+
+func IsProjectAllowDelete(userCred mcclient.TokenCredential, obj IResource) bool {
+	return IsAllowDelete(rbacutils.ScopeProject, userCred, obj)
+}
+
 func IsAllowDeleteSpec(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource, spec string) bool {
 	if userCred == nil {
 		return false
@@ -232,3 +304,11 @@ func IsAllowDeleteSpec(scope rbacutils.TRbacScope, userCred mcclient.TokenCreden
 func IsAdminAllowDeleteSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
 	return IsAllowDeleteSpec(rbacutils.ScopeSystem, userCred, obj, spec)
 }
+
+func IsDomainAllowDeleteSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
+	return IsAllowDeleteSpec(rbacutils.ScopeDomain, userCred, obj, spec)
+}
+
+func IsProjectAllowDeleteSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
+	return IsAllowDeleteSpec(rbacutils.ScopeProject, userCred, obj, spec)
+}
diff --git a/pkg/compute/models/networks.go b/pkg/compute/models/networks.go
index e70e67d6a6..b72508d9fb 100644
--- a/pkg/compute/models/networks.go
+++ b/pkg/compute/models/networks.go
@@ -831,7 +831,10 @@ func parseNetworkInfo(userCred mcclient.TokenCredential, info *api.NetworkConfig
 			}
 		}
 		net := netObj.(*SNetwork)
-		if net.IsOwner(userCred) || net.IsPublic || db.IsAdminAllowGet(userCred, net) ||
+		if net.IsPublic ||
+			net.ProjectId == userCred.GetProjectId() ||
+			(db.IsDomainAllowGet(userCred, net) && net.DomainId == userCred.GetProjectDomainId()) ||
+			db.IsAdminAllowGet(userCred, net) ||
 			utils.IsInStringArray(userCred.GetProjectId(), net.GetSharedProjects()) {
 			info.Network = netObj.GetId()
 		} else {