diff --git a/widgets/app/app.go b/widgets/app/app.go
index bb1658cc..dfe93bcf 100644
--- a/widgets/app/app.go
+++ b/widgets/app/app.go
@@ -553,10 +553,17 @@ func (dsl *DSL) icons(cfg config.Config) {
 }
 
 // Permissions get the permission blacklist
-func Permissions(process *gou.Process) map[string]bool {
+// {"<widget>.<ID>":[<id...>]}
+func Permissions(process *gou.Process, widget string, id string) map[string]bool {
 	permissions := map[string]bool{}
 	sessionData, _ := session.Global().ID(process.Sid).Get("__permissions")
-	switch values := sessionData.(type) {
+	data, ok := sessionData.(map[string]interface{})
+	if !ok && sessionData != nil {
+		log.Error("[Permissions] session data should be a map, but got %#v", sessionData)
+		return permissions
+	}
+
+	switch values := data[fmt.Sprintf("%s.%s", widget, id)].(type) {
 	case []interface{}:
 		for _, value := range values {
 			permissions[fmt.Sprintf("%v", value)] = true
diff --git a/widgets/table/action.go b/widgets/table/action.go
index 7b47065e..ab5419dc 100644
--- a/widgets/table/action.go
+++ b/widgets/table/action.go
@@ -94,84 +94,96 @@ var processActionDefaults = map[string]*action.Process{
 	},
 }
 
+func (act *ActionDSL) getDefaults() map[string]*action.Process {
+	defaults := map[string]*action.Process{}
+	for key, action := range processActionDefaults {
+		new := *action
+		if act.Guard != "" {
+			new.Guard = act.Guard
+		}
+		defaults[key] = &new
+	}
+	return defaults
+}
+
 // SetDefaultProcess set the default value of action
 func (act *ActionDSL) SetDefaultProcess() {
-
+	defaults := act.getDefaults()
 	act.Setting = action.ProcessOf(act.Setting).
-		Merge(processActionDefaults["Setting"]).
+		Merge(defaults["Setting"]).
 		SetHandler(processHandler)
 
 	act.Component = action.ProcessOf(act.Component).
-		Merge(processActionDefaults["Component"]).
+		Merge(defaults["Component"]).
 		SetHandler(processHandler)
 
 	act.Upload = action.ProcessOf(act.Upload).
-		Merge(processActionDefaults["Upload"]).
+		Merge(defaults["Upload"]).
 		SetHandler(processHandler)
 
 	act.Download = action.ProcessOf(act.Download).
-		Merge(processActionDefaults["Download"]).
+		Merge(defaults["Download"]).
 		SetHandler(processHandler)
 
 	act.Search = action.ProcessOf(act.Search).
 		WithBefore(act.BeforeSearch).WithAfter(act.AfterSearch).
-		Merge(processActionDefaults["Search"]).
+		Merge(defaults["Search"]).
 		SetHandler(processHandler)
 
 	act.Get = action.ProcessOf(act.Get).
 		WithBefore(act.BeforeGet).WithAfter(act.AfterGet).
-		Merge(processActionDefaults["Get"]).
+		Merge(defaults["Get"]).
 		SetHandler(processHandler)
 
 	act.Find = action.ProcessOf(act.Find).
 		WithBefore(act.BeforeFind).
 		WithAfter(act.AfterFind).
-		Merge(processActionDefaults["Find"]).
+		Merge(defaults["Find"]).
 		SetHandler(processHandler)
 
 	act.Save = action.ProcessOf(act.Save).
 		WithBefore(act.BeforeSave).WithAfter(act.AfterSave).
-		Merge(processActionDefaults["Save"]).
+		Merge(defaults["Save"]).
 		SetHandler(processHandler)
 
 	act.Create = action.ProcessOf(act.Create).
 		WithBefore(act.BeforeCreate).WithAfter(act.AfterCreate).
-		Merge(processActionDefaults["Create"]).
+		Merge(defaults["Create"]).
 		SetHandler(processHandler)
 
 	act.Insert = action.ProcessOf(act.Insert).
 		WithBefore(act.BeforeInsert).WithAfter(act.AfterInsert).
-		Merge(processActionDefaults["Insert"]).
+		Merge(defaults["Insert"]).
 		SetHandler(processHandler)
 
 	act.Update = action.ProcessOf(act.Update).
 		WithBefore(act.BeforeUpdate).WithAfter(act.AfterUpdate).
-		Merge(processActionDefaults["Update"]).
+		Merge(defaults["Update"]).
 		SetHandler(processHandler)
 
 	act.UpdateWhere = action.ProcessOf(act.UpdateWhere).
 		WithBefore(act.BeforeUpdateWhere).WithAfter(act.AfterUpdateWhere).
-		Merge(processActionDefaults["UpdateWhere"]).
+		Merge(defaults["UpdateWhere"]).
 		SetHandler(processHandler)
 
 	act.UpdateIn = action.ProcessOf(act.UpdateIn).
 		WithBefore(act.BeforeUpdateIn).WithAfter(act.AfterUpdateIn).
-		Merge(processActionDefaults["UpdateIn"]).
+		Merge(defaults["UpdateIn"]).
 		SetHandler(processHandler)
 
 	act.Delete = action.ProcessOf(act.Delete).
 		WithBefore(act.BeforeDelete).WithAfter(act.AfterDelete).
-		Merge(processActionDefaults["Delete"]).
+		Merge(defaults["Delete"]).
 		SetHandler(processHandler)
 
 	act.DeleteWhere = action.ProcessOf(act.DeleteWhere).
 		WithBefore(act.BeforeDeleteWhere).WithAfter(act.AfterDeleteWhere).
-		Merge(processActionDefaults["DeleteWhere"]).
+		Merge(defaults["DeleteWhere"]).
 		SetHandler(processHandler)
 
 	act.DeleteIn = action.ProcessOf(act.DeleteIn).
 		WithBefore(act.BeforeDeleteIn).WithAfter(act.AfterDeleteIn).
-		Merge(processActionDefaults["DeleteIn"]).
+		Merge(defaults["DeleteIn"]).
 		SetHandler(processHandler)
 }
 
diff --git a/widgets/table/api_test.go b/widgets/table/api_test.go
index 364e66fe..19cbc86d 100644
--- a/widgets/table/api_test.go
+++ b/widgets/table/api_test.go
@@ -147,6 +147,40 @@ func TestAPICustomGuard(t *testing.T) {
 	assert.Equal(t, 200, res.Status())
 }
 
+func TestAPIGlobalCustomGuard(t *testing.T) {
+
+	port := start(t)
+	defer test.Stop(func() {})
+
+	req := test.NewRequest(port).Route("/api/__yao/table/guard/find/1")
+	res, err := req.Get()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, 403, res.Status())
+
+	req = test.NewRequest(port).Route("/api/__yao/table/guard/get")
+	res, err = req.Get()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, 403, res.Status())
+
+	req = test.NewRequest(port).Route("/api/__yao/table/guard/get").Token(token(t)).Header("Unit-Test", "yes")
+	res, err = req.Get()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, 418, res.Status())
+
+	req = test.NewRequest(port).Route("/api/__yao/table/guard/get").Token(token(t))
+	res, err = req.Get()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, 200, res.Status())
+}
+
 func start(t *testing.T) int {
 	port := network.FreePort()
 	load(t)
diff --git a/widgets/table/process.go b/widgets/table/process.go
index eafca9c2..bcba7db6 100644
--- a/widgets/table/process.go
+++ b/widgets/table/process.go
@@ -47,7 +47,7 @@ func processXgen(process *gou.Process) interface{} {
 
 	tab := MustGet(process)
 	data := process.ArgsMap(1, map[string]interface{}{})
-	excludes := app.Permissions(process)
+	excludes := app.Permissions(process, "tables", tab.ID)
 	setting, err := tab.Xgen(data, excludes)
 	if err != nil {
 		exception.New(err.Error(), 500).Throw()
diff --git a/widgets/table/process_test.go b/widgets/table/process_test.go
index f2feae20..4f2a0149 100644
--- a/widgets/table/process_test.go
+++ b/widgets/table/process_test.go
@@ -438,11 +438,13 @@ func TestProcessXgenWithPermissions(t *testing.T) {
 	clear(t)
 	testData(t)
 
-	session.Global().Set("__permissions", []string{
-		"8ca9bdf0fa2cbc8f1018f8566ed6ab5e", // fields.table.消费金额
-		"f03f1ae60c46dd6cdeda87b919a51d7e", // fields.filter.状态
-		"b1483ade34cd51261817558114e74e3f", // filter.actions[0] 添加宠物
-		"e6a67850312980e8372e550c5b361097", // operation.actions[0] 查看
+	session.Global().Set("__permissions", map[string]interface{}{
+		"tables.pet": []string{
+			"8ca9bdf0fa2cbc8f1018f8566ed6ab5e", // fields.table.消费金额
+			"f03f1ae60c46dd6cdeda87b919a51d7e", // fields.filter.状态
+			"b1483ade34cd51261817558114e74e3f", // filter.actions[0] 添加宠物
+			"e6a67850312980e8372e550c5b361097", // operation.actions[0] 查看
+		},
 	})
 
 	args := []interface{}{"pet"}
diff --git a/widgets/table/table_test.go b/widgets/table/table_test.go
index ed8108d8..b50a5f6f 100644
--- a/widgets/table/table_test.go
+++ b/widgets/table/table_test.go
@@ -25,7 +25,7 @@ func TestLoad(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	assert.Equal(t, 12, len(Tables))
+	assert.Equal(t, 13, len(Tables))
 }
 
 func TestLoadID(t *testing.T) {
diff --git a/widgets/table/types.go b/widgets/table/types.go
index e02eb9c8..db6626b0 100644
--- a/widgets/table/types.go
+++ b/widgets/table/types.go
@@ -25,6 +25,7 @@ type DSL struct {
 
 // ActionDSL the table action DSL
 type ActionDSL struct {
+	Guard             string          `json:"guard,omitempty"` // the default guard
 	Bind              *BindActionDSL  `json:"bind,omitempty"`
 	Setting           *action.Process `json:"setting,omitempty"`
 	Component         *action.Process `json:"component,omitempty"`