diff --git a/pkg/keystone/models/policies.go b/pkg/keystone/models/policies.go index 829508cacc..9ce7228e69 100644 --- a/pkg/keystone/models/policies.go +++ b/pkg/keystone/models/policies.go @@ -687,12 +687,14 @@ func (policy *SPolicy) ValidateUpdateCondition(ctx context.Context) error { //if policy.IsSystem.IsTrue() { // return errors.Wrap(httperrors.ErrForbidden, "system policy") //} - rps, err := RolePolicyManager.fetchByPolicyId(policy.Id) - if err != nil { - return errors.Wrap(err, "fetchByPolicyId") - } - if len(rps) > 0 { - return errors.Wrap(httperrors.ErrForbidden, "policy in use") + if options.Options.ThreeAdminRoleSystem { + rps, err := RolePolicyManager.fetchByPolicyId(policy.Id) + if err != nil { + return errors.Wrap(err, "fetchByPolicyId") + } + if len(rps) > 0 { + return errors.Wrap(httperrors.ErrForbidden, "policy in use") + } } return nil }