diff --git a/backend/app/services/authorization_policy.py b/backend/app/services/authorization_policy.py
index d3d4f5f..f158573 100644
--- a/backend/app/services/authorization_policy.py
+++ b/backend/app/services/authorization_policy.py
@@ -58,6 +58,8 @@ def permission_for(module, name, method, *, params=None, body=None):
     if module == "system.tplus":
         return "tplus:" + ("view" if method == "GET" else "retry" if name == "retry" else "collect")
     if module == "system.tplus_workbench":
+        if name == "business_sync_preview":
+            return "tplus:preview"
         if name.startswith("business_sync_"):
             return "tplus:view" if method == "GET" else "tplus:import"
         if name == "work_report":
diff --git a/backend/tests/unit/test_authorization_policy.py b/backend/tests/unit/test_authorization_policy.py
index 18cdb71..7c23ef0 100644
--- a/backend/tests/unit/test_authorization_policy.py
+++ b/backend/tests/unit/test_authorization_policy.py
@@ -30,5 +30,14 @@ def test_全部受保护接口都有权限映射():
     assert not missing, missing
 
 
+def test_业务接入预览只需要预览权限():
+    assert permission_for(
+        'system.tplus_workbench',
+        'business_sync_preview',
+        'POST',
+        body={},
+    ) == 'tplus:preview'
+
+
 def test_未知接口没有默认放行():
     assert permission_for('future_module','new_action','GET') is None