diff --git a/tools/grant_advisor_role.py b/tools/grant_advisor_role.py
index 190b3d8..219db95 100644
--- a/tools/grant_advisor_role.py
+++ b/tools/grant_advisor_role.py
@@ -92,6 +92,14 @@ ADVISOR_GRANTED_CODES: tuple[str, ...] = (
     "product-comparison:read:self",
     "product-recommendation:read:self",
     "product-recommendation:generate:self",
+    # 代客三项：对**名下客户**（而非自己）做推荐 / 资产配置 / 组合分析。
+    # 同样是服务层按 `customer_id == 自己` 动态拼出来的 `:customer` 变体，
+    # `data_scope=own_customers` —— 缺这三个码，投顾工作台一选客户就整片 403
+    # （`product_recommendation_service.py:71`、`asset_allocation_service.py:57`、
+    #  `portfolio_analysis_service.py:46`）。
+    "product-recommendation:generate:customer",
+    "asset-allocation:generate:customer",
+    "portfolio-analysis:read:customer",
     "product-recommendation:review",
     "product-recommendation:publish",
     # 平台通用：投顾同样要跑 Agent、查行情、检索知识、看所服务客户的画像
diff --git a/tools/seed_test_rbac.py b/tools/seed_test_rbac.py
index da49891..e3070a9 100644
--- a/tools/seed_test_rbac.py
+++ b/tools/seed_test_rbac.py
@@ -157,6 +157,23 @@ PERMISSIONS: tuple[tuple[int, str, str, str, str], ...] = (
     (9063, "trade:order:cancel", "trade", "order", "self"),
     (9064, "holding:read:self", "holding", "read", "self"),
     (9065, "trade:txn:read", "trade", "txn", "self"),
+
+    # ---- 9066-9068：投顾**代客**三项（`*:customer` 变体） ----
+    # 与 9057-9059 是**同一个坑的第二批**：这三个码同样是服务层按
+    # `customer_id == context.user_id` **动态拼**出来的，对账工具抓不到字面量，
+    # 于是库里从来没有它们，投顾一在投顾工作台对**客户**做操作就整片 403：
+    #   · `product_recommendation_service.py:71` `product-recommendation:generate:customer`
+    #   · `asset_allocation_service.py:57`       `asset-allocation:generate:customer`
+    #   · `portfolio_analysis_service.py:46`     `portfolio-analysis:read:customer`
+    # `data_scope` 必须是 `own_customers`：`AuthorizationService.require_customer_scope`
+    # 只放行 `all`，或 `own_customers` 且客户确在 `context.customer_ids`（= 归属客户）内。
+    # 这正是投顾该有的最小权限 —— 只对自己服务的客户出方案。
+    (9066, "product-recommendation:generate:customer", "product-recommendation",
+     "generate", "own_customers"),
+    (9067, "asset-allocation:generate:customer", "asset-allocation", "generate",
+     "own_customers"),
+    (9068, "portfolio-analysis:read:customer", "portfolio-analysis", "read",
+     "own_customers"),
 )
 
 # 客户：业务侧自助能力（自己的会话、反馈、转人工、自己的记忆画像）。