diff --git a/src/main/java/neatlogic/framework/common/config/Config.java b/src/main/java/neatlogic/framework/common/config/Config.java
index 03aa5e93b247678102d8618748a67297741c7666..72d5d21232d37cde685a79531a777a60151f617a 100644
--- a/src/main/java/neatlogic/framework/common/config/Config.java
+++ b/src/main/java/neatlogic/framework/common/config/Config.java
@@ -136,6 +136,8 @@ public class Config {
 
     private static String CHANGELOG_JDBC_SOCKETTIME;//changelog jdbc 读取数据时间耗时限制
 
+    private static String HEADER_RULE_PREFIX; //请求头规则，目前用于角色和执行器组规则
+
     static {
         NEATLOGIC_HOME = System.getenv("NEATLOGIC_HOME");
         if (StringUtils.isBlank(NEATLOGIC_HOME)) {
@@ -476,6 +478,10 @@ public class Config {
         return CHANGELOG_JDBC_SOCKETTIME;
     }
 
+    public static String HEADER_RULE_PREFIX() {
+        return HEADER_RULE_PREFIX;
+    }
+
     public static Properties properties = new Properties();
 
     private void initConfigFile() {
@@ -656,6 +662,7 @@ public class Config {
             LICENSE_WILL_EXPIRED_NOTIFY_DAY = Integer.parseInt(prop.getProperty("license.will.expired.notify.day", "30"));
 
             JWT_SECRET = prop.getProperty("jwt.secret");
+            HEADER_RULE_PREFIX = prop.getProperty("header.rule.prefix", "neatlogic-rule-");
             if (StringUtils.isBlank(JWT_SECRET)) {
                 System.out.println(I18nUtils.getStaticMessage("nfcc.config.loadnacosproperties.jwtsecret"));
                 logger.error(I18nUtils.getStaticMessage("nfcc.config.loadnacosproperties.jwtsecret"));
diff --git a/src/main/java/neatlogic/framework/dao/mapper/runner/RunnerMapper.java b/src/main/java/neatlogic/framework/dao/mapper/runner/RunnerMapper.java
index d4a9fdbfe049f78b554c776bc848c11a334c4953..865707f03330b84382c701f285983f57a1d2775e 100644
--- a/src/main/java/neatlogic/framework/dao/mapper/runner/RunnerMapper.java
+++ b/src/main/java/neatlogic/framework/dao/mapper/runner/RunnerMapper.java
@@ -64,6 +64,8 @@ public interface RunnerMapper {
 
     List<RunnerGroupVo> getRunnerGroupByIdList(List<Long> idlist);
 
+    List<RunnerGroupVo> getAllRunnerGroupList();
+
     RunnerGroupVo getRunnerGroupByName(String string);
 
     List<RunnerGroupVo> getRunnerGroupByTagIdOrNameList(List<String> tagList);
diff --git a/src/main/java/neatlogic/framework/dao/mapper/runner/RunnerMapper.xml b/src/main/java/neatlogic/framework/dao/mapper/runner/RunnerMapper.xml
index b1cf7f26c2b3206152ee894e51b475b3cf21c782..2351c57ceda8ba32e6bebcd3ef99432241c37a4f 100644
--- a/src/main/java/neatlogic/framework/dao/mapper/runner/RunnerMapper.xml
+++ b/src/main/java/neatlogic/framework/dao/mapper/runner/RunnerMapper.xml
@@ -40,6 +40,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.-->
         <id column="id" property="id"/>
         <result column="name" property="name"/>
         <result column="description" property="description"/>
+        <result column="rule" property="rule"/>
         <collection property="groupNetworkList" ofType="neatlogic.framework.dto.runner.GroupNetworkVo">
             <id column="networkId" property="id"/>
             <result column="groupId" property="groupId"/>
@@ -57,6 +58,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.-->
     <resultMap id="runnerMapGroupMap" type="neatlogic.framework.dto.runner.RunnerGroupVo">
         <id column="id" property="id"/>
         <result column="name" property="name"/>
+        <result column="rule" property="rule"/>
         <collection property="networkList" ofType="neatlogic.framework.dto.runner.GroupNetworkVo">
             <id column="networkId" property="id"/>
             <result column="groupId" property="groupId"/>
@@ -116,6 +118,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.-->
     <select id="getRunnerMapGroupById" resultMap="runnerMapGroupMap" useCache="false">
         SELECT a.id              id,
                a.name            name,
+               a.rule            rule,
                c.id           AS runnerId,
                d.`id`         AS runnerMapId,
                c.`auth_type`  AS authType,
@@ -207,6 +210,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.-->
         g.`id` as id,
         g.`name` as name,
         g.`description`,
+        g.`rule`,
         nk.`id` as networkId,
         nk.`group_id` as groupId,
         nk.`network_ip` as networkIp,
@@ -217,6 +221,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.-->
         (SELECT DISTINCT
         rg.`id`,
         rg.`name`,
+        rg.`rule`,
         rg.`description`
         FROM
         runnergroup rg
@@ -271,6 +276,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.-->
         </foreach>
     </select>
 
+    <select id="getAllRunnerGroupList" resultType="neatlogic.framework.dto.runner.RunnerGroupVo" useCache="false">
+        SELECT
+        rg.`id`,
+        rg.`name`,
+        rg.`rule`,
+        rg.`description`
+        FROM
+        runnergroup rg
+    </select>
+
     <select id="checkRunnerGroupIdIsExist" resultType="int" useCache="false">
         select count(`id`)
         from runnergroup
@@ -563,15 +578,17 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.-->
     <update id="updateRunnerGroup" parameterType="neatlogic.framework.dto.runner.RunnerGroupVo">
         update runnergroup
         set `name`=#{name},
+            `rule` = #{rule},
             `description` =#{description}
         where `id` = #{id}
     </update>
 
     <insert id="insertRunnerGroup" parameterType="neatlogic.framework.dto.runner.RunnerGroupVo">
-        insert runnergroup(`id`, `name`, `description`)
+        insert runnergroup(`id`, `name`, `description`, `rule`)
         VALUES (#{id},
                 #{name},
-                #{description})
+                #{description},
+                #{rule})
     </insert>
 
     <delete id="deleteGroupNetWork">
diff --git a/src/main/java/neatlogic/framework/dto/runner/RunnerGroupVo.java b/src/main/java/neatlogic/framework/dto/runner/RunnerGroupVo.java
index 6f47785f16b1ed577d761f9ac63f717ce2aca058..c01d78f515bccff03501a20d59717eab9c8d06f5 100644
--- a/src/main/java/neatlogic/framework/dto/runner/RunnerGroupVo.java
+++ b/src/main/java/neatlogic/framework/dto/runner/RunnerGroupVo.java
@@ -32,6 +32,8 @@ public class RunnerGroupVo extends BasePageVo {
     private Long id;
     @EntityField(name = "runner 分组名", type = ApiParamType.STRING)
     private String name;
+    @EntityField(name = "runner 规则", type = ApiParamType.STRING)
+    private String rule;
     @EntityField(name = "描述", type = ApiParamType.STRING)
     private String description;
     @EntityField(name = "授权类型", type = ApiParamType.STRING)
@@ -156,4 +158,12 @@ public class RunnerGroupVo extends BasePageVo {
     public void setTagList(List<String> tagList) {
         this.tagList = tagList;
     }
+
+    public String getRule() {
+        return rule;
+    }
+
+    public void setRule(String rule) {
+        this.rule = rule;
+    }
 }
diff --git a/src/main/java/neatlogic/framework/exception/runner/RunnerGroupNotFoundException.java b/src/main/java/neatlogic/framework/exception/runner/RunnerGroupNotFoundException.java
index b815cc6f2351191118e12826eec48e0eb3b45767..1379ab71cad5a2dd264de9ac6d4a3465106f3d9b 100644
--- a/src/main/java/neatlogic/framework/exception/runner/RunnerGroupNotFoundException.java
+++ b/src/main/java/neatlogic/framework/exception/runner/RunnerGroupNotFoundException.java
@@ -22,6 +22,10 @@ public class RunnerGroupNotFoundException extends ApiRuntimeException {
     private static final long serialVersionUID = -2208449808982631219L;
 
     public RunnerGroupNotFoundException(String name) {
-        super("runnerGroup: {0} 不存在", name);
+        super("nfer.runnergroupnotfoundexception.runnergroupnotfoundexceptionname", name);
+    }
+
+    public RunnerGroupNotFoundException() {
+        super("nfer.runnergroupnotfoundexception.runnergroupnotfoundexception");
     }
 }
diff --git a/src/main/java/neatlogic/framework/service/AuthenticationInfoServiceImpl.java b/src/main/java/neatlogic/framework/service/AuthenticationInfoServiceImpl.java
index 3a682964a93d52b496fc765dc2dc537b1bc3afb7..75cd40ea21820469e0bdf2964df7bf589c88a807 100644
--- a/src/main/java/neatlogic/framework/service/AuthenticationInfoServiceImpl.java
+++ b/src/main/java/neatlogic/framework/service/AuthenticationInfoServiceImpl.java
@@ -19,13 +19,13 @@ import com.alibaba.fastjson.JSONObject;
 import neatlogic.framework.asynchronization.threadlocal.RequestContext;
 import neatlogic.framework.asynchronization.threadlocal.UserContext;
 import neatlogic.framework.common.RootComponent;
+import neatlogic.framework.common.config.Config;
 import neatlogic.framework.dao.mapper.RoleMapper;
 import neatlogic.framework.dao.mapper.TeamMapper;
 import neatlogic.framework.dto.AuthenticationInfoVo;
 import neatlogic.framework.dto.RoleVo;
 import neatlogic.framework.dto.TeamVo;
 import neatlogic.framework.util.AviatorEvaluatorUtil;
-import neatlogic.framework.util.FreemarkerUtil;
 import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.collections4.MapUtils;
 import org.apache.commons.lang3.StringUtils;
@@ -34,8 +34,7 @@ import org.slf4j.LoggerFactory;
 
 import javax.annotation.Resource;
 import java.util.*;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
+import java.util.stream.Collectors;
 
 /**
  * @author linbq
@@ -46,7 +45,6 @@ public class AuthenticationInfoServiceImpl implements AuthenticationInfoService
     private TeamMapper teamMapper;
     private RoleMapper roleMapper;
     static Logger logger = LoggerFactory.getLogger(AuthenticationInfoServiceImpl.class);
-    Pattern pattern = Pattern.compile("\\$\\{DATA\\.(.*?)}");
 
     @Resource
     public void setTeamMapper(TeamMapper _teamMapper) {
@@ -177,18 +175,17 @@ public class AuthenticationInfoServiceImpl implements AuthenticationInfoService
         if (MapUtils.isEmpty(originHeader)) {
             originHeader = getHeaders();
         }
+        //只保留符合指定前缀的header
+        if (MapUtils.isNotEmpty(originHeader)) {
+            headerSet.addAll(originHeader.keySet().stream().filter(o -> o.startsWith(Config.HEADER_RULE_PREFIX())).collect(Collectors.toSet()));
+        }
         List<String> validRoleUuidList = new ArrayList<>();
         List<RoleVo> roleVos = roleMapper.getRoleByUuidList(roleUuidList);
         for (RoleVo ro : roleVos) {
             String rule = ro.getRule();
             if (StringUtils.isNotBlank(rule)) {
-                Matcher matcher = pattern.matcher(rule);
-                while (matcher.find()) {
-                    headerSet.add(matcher.group(1));
-                }
                 try {
-                    rule = FreemarkerUtil.transform(originHeader, rule);
-                    if (AviatorEvaluatorUtil.evaluateBoolean(rule)) {
+                    if (AviatorEvaluatorUtil.evaluateBoolean(rule, originHeader)) {
                         validRoleUuidList.add(ro.getUuid());
                     }
                 } catch (Exception e) {
diff --git a/src/main/java/neatlogic/framework/util/AviatorEvaluatorUtil.java b/src/main/java/neatlogic/framework/util/AviatorEvaluatorUtil.java
index c8d009253b997d31c7e34714374f34a35a19f4fa..c7e0e68d190a55cda36b9641a915c6ebc06d01c3 100644
--- a/src/main/java/neatlogic/framework/util/AviatorEvaluatorUtil.java
+++ b/src/main/java/neatlogic/framework/util/AviatorEvaluatorUtil.java
@@ -17,98 +17,120 @@
 
 package neatlogic.framework.util;
 
+import com.google.common.cache.CacheBuilder;
+import com.google.common.cache.CacheLoader;
+import com.google.common.cache.LoadingCache;
 import com.googlecode.aviator.AviatorEvaluator;
 import com.googlecode.aviator.Expression;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
+import java.util.HashMap;
+import java.util.concurrent.TimeUnit;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 public class AviatorEvaluatorUtil {
+
     private static final Logger logger = LoggerFactory.getLogger(AviatorEvaluatorUtil.class);
-    // 缓存编译后的表达式
-    private static final ConcurrentHashMap<String, Expression> expressionCache = new ConcurrentHashMap<>();
 
-    // 匹配 ${...} 的变量表达式
     private static final Pattern VAR_PATTERN = Pattern.compile("\\$\\{([^}]+)}");
 
+    // Guava 缓存表达式：最多缓存 1000 条，1 小时内未访问会被清理
+    private static final LoadingCache<String, Expression> expressionCache =
+            CacheBuilder.newBuilder()
+                    .maximumSize(1000)
+                    .expireAfterAccess(1, TimeUnit.HOURS)
+                    .build(new CacheLoader<String, Expression>() {
+                        @Override
+                        public Expression load(String key) throws Exception {
+                            return AviatorEvaluator.compile(key, true);
+                        }
+                    });
+
     /**
-     * 处理表达式变量（将 ${DATA.env} 替换成 DATA.env）
+     * 将 ${env-var} 转换为 env_var
      */
     private static String normalizeExpression(String expr) {
         Matcher matcher = VAR_PATTERN.matcher(expr);
         StringBuffer sb = new StringBuffer();
         while (matcher.find()) {
-            matcher.appendReplacement(sb, matcher.group(1));
+            String replacement = matcher.group(1).replace("-", "_");
+            matcher.appendReplacement(sb, Matcher.quoteReplacement(replacement));
         }
         matcher.appendTail(sb);
         return sb.toString();
     }
 
     /**
-     * 执行 Aviator 表达式
-     *
-     * @param rawExpression 表达式，支持 ${var} 格式
-     * @param variables     变量上下文 Map（支持嵌套）
-     * @return 结果（Boolean、String、Number 等）
+     * 替换变量中的非法 key，避免 Aviator 不识别
+     */
+    private static Map<String, Object> getFinalVariables(Map<String, Object> variables) {
+        Map<String, Object> finalVariables = new HashMap<>();
+        for (Map.Entry<String, Object> entry : variables.entrySet()) {
+            String safeKey = entry.getKey().replace("-", "_");
+            if (finalVariables.containsKey(safeKey)) {
+                logger.warn("Variable name conflict: multiple keys map to {}", safeKey);
+            }
+            finalVariables.put(safeKey, entry.getValue());
+        }
+        return finalVariables;
+    }
+
+    /**
+     * 通用表达式执行（含变量）
      */
     public static Object evaluate(String rawExpression, Map<String, Object> variables) {
         try {
-            String finalExpression = normalizeExpression(rawExpression);
-            Expression compiled = expressionCache.computeIfAbsent(finalExpression, AviatorEvaluator::compile);
-            return compiled.execute(variables);
+            String normalizedExpr = normalizeExpression(rawExpression);
+            Expression expression = expressionCache.get(normalizedExpr);
+            return expression.execute(getFinalVariables(variables));
         } catch (Exception e) {
-            // 可替换为日志系统
-            logger.error("Aviator expression failed: " + rawExpression + ",errMsg:" + e.getMessage(), e);
-            e.printStackTrace();
+            logger.error("Aviator expression failed: {}, error: {}", rawExpression, e.getMessage(), e);
             return null;
         }
     }
 
     /**
-     * 执行 Aviator 表达式
-     *
-     * @param finalExpression 最终表达式
-     * @return 结果（Boolean、String、Number 等）
+     * 执行表达式（无变量）
      */
-    public static Object evaluate(String finalExpression) {
+    public static Object evaluate(String rawExpression) {
         try {
-            Expression compiled = expressionCache.computeIfAbsent(finalExpression, AviatorEvaluator::compile);
-            return compiled.execute();
+            Expression expression = expressionCache.get(rawExpression);
+            return expression.execute();
         } catch (Exception e) {
-            // 可替换为日志系统
-            logger.error("Aviator expression failed: " + finalExpression + ",errMsg:" + e.getMessage(), e);
-            e.printStackTrace();
+            logger.error("Aviator expression failed: {}, error: {}", rawExpression, e.getMessage(), e);
             return null;
         }
     }
 
     /**
-     * 执行布尔类型表达式，返回 true/false
+     * 执行布尔表达式（含变量）
      */
     public static boolean evaluateBoolean(String rawExpression, Map<String, Object> variables) {
         Object result = evaluate(rawExpression, variables);
-        if (result instanceof Boolean) {
-            return (Boolean) result;
-        }
-        if (result == null) return false;
-        return Boolean.parseBoolean(result.toString());
+        return toBoolean(result, rawExpression);
     }
 
-
     /**
-     * 执行布尔类型表达式，返回 true/false
+     * 执行布尔表达式（无变量）
      */
-    public static boolean evaluateBoolean(String finalExpression) {
-        Object result = evaluate(finalExpression);
+    public static boolean evaluateBoolean(String rawExpression) {
+        Object result = evaluate(rawExpression);
+        return toBoolean(result, rawExpression);
+    }
+
+    private static boolean toBoolean(Object result, String context) {
         if (result instanceof Boolean) {
             return (Boolean) result;
         }
-        if (result == null) return false;
-        return Boolean.parseBoolean(result.toString());
+        if (result == null) {
+            logger.warn("Boolean evaluation returned null: {}", context);
+            return false;
+        }
+        boolean parsed = Boolean.parseBoolean(result.toString());
+        logger.debug("Parsed boolean [{}] from expression: {}", parsed, context);
+        return parsed;
     }
-
 }