diff --git a/backend/src/main/java/com/xly/test4/module/usr/service/impl/UserServiceImpl.java b/backend/src/main/java/com/xly/test4/module/usr/service/impl/UserServiceImpl.java
index 5d0b83f..1f14586 100644
--- a/backend/src/main/java/com/xly/test4/module/usr/service/impl/UserServiceImpl.java
+++ b/backend/src/main/java/com/xly/test4/module/usr/service/impl/UserServiceImpl.java
@@ -10,9 +10,11 @@ import com.xly.test4.module.usr.dto.UserCreateDTO;
 import com.xly.test4.module.usr.entity.Employee;
 import com.xly.test4.module.usr.entity.Permission;
 import com.xly.test4.module.usr.entity.User;
+import com.xly.test4.module.usr.entity.UserPermission;
 import com.xly.test4.module.usr.mapper.EmployeeMapper;
 import com.xly.test4.module.usr.mapper.PermissionMapper;
 import com.xly.test4.module.usr.mapper.UserMapper;
+import com.xly.test4.module.usr.mapper.UserPermissionMapper;
 import com.xly.test4.module.usr.service.UserService;
 import com.xly.test4.module.usr.vo.UserCreateVO;
 import org.springframework.beans.factory.annotation.Value;
@@ -26,6 +28,7 @@ import java.util.List;
 public class UserServiceImpl implements UserService {
 
     private final UserMapper userMapper;
+    private final UserPermissionMapper userPermissionMapper;
     private final EmployeeMapper employeeMapper;
     private final PermissionMapper permissionMapper;
     private final UserConverter userConverter;
@@ -33,12 +36,14 @@ public class UserServiceImpl implements UserService {
     private final String defaultPassword;
 
     public UserServiceImpl(UserMapper userMapper,
+                           UserPermissionMapper userPermissionMapper,
                            EmployeeMapper employeeMapper,
                            PermissionMapper permissionMapper,
                            UserConverter userConverter,
                            PasswordEncoder passwordEncoder,
                            @Value("${app.security.default-password}") String defaultPassword) {
         this.userMapper = userMapper;
+        this.userPermissionMapper = userPermissionMapper;
         this.employeeMapper = employeeMapper;
         this.permissionMapper = permissionMapper;
         this.userConverter = userConverter;
@@ -90,6 +95,19 @@ public class UserServiceImpl implements UserService {
 
         userMapper.insert(user);
 
+        if (dto.getPermissionIds() != null && !dto.getPermissionIds().isEmpty()) {
+            for (Integer permissionId : dto.getPermissionIds()) {
+                UserPermission up = UserPermission.builder()
+                        .iUserId(user.getIIncrement())
+                        .iPermissionId(permissionId)
+                        .sGrantedBy(current.getUserName())
+                        .sBrandsId(current.getBrandsId())
+                        .sSubsidiaryId(current.getSubsidiaryId())
+                        .build();
+                userPermissionMapper.insert(up);
+            }
+        }
+
         return userConverter.toVO(user);
     }
 }
diff --git a/backend/src/test/java/com/xly/test4/module/usr/service/impl/UserServiceImplTest.java b/backend/src/test/java/com/xly/test4/module/usr/service/impl/UserServiceImplTest.java
index a1abef7..ea008f6 100644
--- a/backend/src/test/java/com/xly/test4/module/usr/service/impl/UserServiceImplTest.java
+++ b/backend/src/test/java/com/xly/test4/module/usr/service/impl/UserServiceImplTest.java
@@ -6,12 +6,13 @@ import com.xly.test4.common.security.CurrentUser;
 import com.xly.test4.common.security.CurrentUserContext;
 import com.xly.test4.module.usr.converter.UserConverter;
 import com.xly.test4.module.usr.dto.UserCreateDTO;
-import com.xly.test4.module.usr.entity.Employee;
 import com.xly.test4.module.usr.entity.Permission;
 import com.xly.test4.module.usr.entity.User;
+import com.xly.test4.module.usr.entity.UserPermission;
 import com.xly.test4.module.usr.mapper.EmployeeMapper;
 import com.xly.test4.module.usr.mapper.PermissionMapper;
 import com.xly.test4.module.usr.mapper.UserMapper;
+import com.xly.test4.module.usr.mapper.UserPermissionMapper;
 import com.xly.test4.module.usr.vo.UserCreateVO;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -35,6 +36,7 @@ import static org.mockito.Mockito.when;
 class UserServiceImplTest {
 
     private UserMapper userMapper;
+    private UserPermissionMapper userPermissionMapper;
     private EmployeeMapper employeeMapper;
     private PermissionMapper permissionMapper;
     private UserConverter userConverter;
@@ -53,11 +55,12 @@ class UserServiceImplTest {
     @BeforeEach
     void setUp() {
         userMapper = mock(UserMapper.class);
+        userPermissionMapper = mock(UserPermissionMapper.class);
         employeeMapper = mock(EmployeeMapper.class);
         permissionMapper = mock(PermissionMapper.class);
         userConverter = mock(UserConverter.class);
         passwordEncoder = new BCryptPasswordEncoder();
-        service = new UserServiceImpl(userMapper, employeeMapper, permissionMapper,
+        service = new UserServiceImpl(userMapper, userPermissionMapper, employeeMapper, permissionMapper,
                 userConverter, passwordEncoder, "666666");
         ctxMock = mockStatic(CurrentUserContext.class);
         ctxMock.when(CurrentUserContext::current).thenReturn(ADMIN_CONTEXT);
@@ -227,4 +230,41 @@ class UserServiceImplTest {
         service.createUser(dto2);
         verify(permissionMapper, never()).selectList(any(Wrapper.class));
     }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void createUser_withPermissionIds_insertsOneUserPermissionPerId() {
+        stubConverterReturnsEmptyUser();
+        when(permissionMapper.selectList(any(Wrapper.class)))
+                .thenReturn(List.of(new Permission(), new Permission(), new Permission()));
+
+        UserCreateDTO dto = baseDTO();
+        dto.setPermissionIds(List.of(10, 20, 30));
+
+        service.createUser(dto);
+
+        ArgumentCaptor<UserPermission> captor = ArgumentCaptor.forClass(UserPermission.class);
+        verify(userPermissionMapper, org.mockito.Mockito.times(3)).insert(captor.capture());
+
+        List<UserPermission> writes = captor.getAllValues();
+        assertThat(writes).extracting(UserPermission::getIPermissionId)
+                .containsExactly(10, 20, 30);
+        assertThat(writes).allSatisfy(up -> {
+            assertThat(up.getIUserId()).isEqualTo(42);
+            assertThat(up.getSGrantedBy()).isEqualTo("admin");
+            assertThat(up.getSBrandsId()).isEqualTo("BR-DEFAULT");
+            assertThat(up.getSSubsidiaryId()).isEqualTo("SUB-DEFAULT");
+        });
+    }
+
+    @Test
+    void createUser_emptyPermissionIds_doesNotCallUserPermissionInsert() {
+        stubConverterReturnsEmptyUser();
+        UserCreateDTO dto = baseDTO();
+        dto.setPermissionIds(List.of());
+
+        service.createUser(dto);
+
+        verify(userPermissionMapper, never()).insert(any(UserPermission.class));
+    }
 }