diff --git a/backend/src/middleware/auth.ts b/backend/src/middleware/auth.ts
index 2f7d62b..f5caa32 100644
--- a/backend/src/middleware/auth.ts
+++ b/backend/src/middleware/auth.ts
@@ -17,6 +17,10 @@ export function authMiddleware(req: AuthRequest, res: Response, next: NextFuncti
     return res.status(401).json({ success: false, error: { code: 'TOKEN_INVALID', message: '令牌无效或已过期' } })
   }
   req.user = payload
+  // 非 SUPER_ADMIN 用户必须有 orgId，否则企业端 API 会因 orgId=null 报错
+  if (payload.role !== 'SUPER_ADMIN' && !payload.orgId) {
+    return res.status(403).json({ success: false, error: { code: 'NO_ORG', message: '该账号未绑定企业' } })
+  }
   next()
 }
 
diff --git a/backend/src/services/auth.service.ts b/backend/src/services/auth.service.ts
index 7f9503f..378b363 100644
--- a/backend/src/services/auth.service.ts
+++ b/backend/src/services/auth.service.ts
@@ -94,6 +94,10 @@ export async function login(phone: string, password: string) {
     throw { code: 'ACCOUNT_DISABLED', message: '该账号已被禁用，请联系管理员' }
   }
 
+  if (user.role === 'SUPER_ADMIN') {
+    throw { code: 'FORBIDDEN', message: '平台管理员请使用平台管理入口登录' }
+  }
+
   await prisma.user.update({
     where: { id: user.id },
     data: { lastLoginAt: new Date() },