diff --git a/docs/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md b/docs/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
index e936f9a0e..1782d23a3 100644
--- a/docs/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
+++ b/docs/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
@@ -203,8 +203,26 @@ auth:
   users:
     - username: "admin"
       password: "admin"
+      permission: "readwrite"
+    - username: "grafana"
+      password: "grafana_pwd"
+      permission: "readonly"
+    - username: "telegraf"
+      password: "telegraf_pwd"
+      permission: "writeonly"
 ```
 
+GreptimeDB supports three permission modes:
+
+| Mode | Shorthand | Allowed Operations | Typical Use Cases |
+|------|-----------|-------------------|-------------------|
+| `readwrite` | `rw` | Read + Write | Administrators, development environments |
+| `readonly` | `ro` | Read only | Dashboards, reporting systems, read replicas |
+| `writeonly` | `wo` | Write only | Data collectors, IoT devices, log aggregators |
+
+:::note
+Users without an explicit permission mode default to `readwrite`, maintaining backward compatibility.
+
 ### Logging Configuration
 
 The top-level variable `logging` is used to configure global logging levels, as shown below:
diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md b/i18n/zh/docusaurus-plugin-content-docs/current/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
index 662fb4027..a7706de31 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/current/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/current/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
@@ -203,8 +203,26 @@ auth:
   users:
     - username: "admin"
       password: "admin"
+      permission: "readwrite"
+    - username: "grafana"
+      password: "grafana_pwd"
+      permission: "readonly"
+    - username: "telegraf"
+      password: "telegraf_pwd"
+      permission: "writeonly"
 ```
 
+GreptimeDB 支持三种权限模式：
+
+| 模式 | 缩写 | 允许的操作 | 典型场景 |
+|------|------|-----------|---------|
+| `readwrite` | `rw` | 读取 + 写入 | 管理员、开发环境 |
+| `readonly` | `ro` | 仅读取 | 仪表盘、报表系统、只读副本 |
+| `writeonly` | `wo` | 仅写入 | 数据采集器、IoT 设备、日志收集 |
+
+:::note
+未指定权限模式的用户默认拥有 `readwrite` 权限，与此前版本行为一致。
+
 ### 日志配置
 
 顶层变量 `logging` 用于配置全局日志级别，如下所示：
diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-1.0/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md b/i18n/zh/docusaurus-plugin-content-docs/version-1.0/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
index 662fb4027..a7706de31 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/version-1.0/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/version-1.0/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
@@ -203,8 +203,26 @@ auth:
   users:
     - username: "admin"
       password: "admin"
+      permission: "readwrite"
+    - username: "grafana"
+      password: "grafana_pwd"
+      permission: "readonly"
+    - username: "telegraf"
+      password: "telegraf_pwd"
+      permission: "writeonly"
 ```
 
+GreptimeDB 支持三种权限模式：
+
+| 模式 | 缩写 | 允许的操作 | 典型场景 |
+|------|------|-----------|---------|
+| `readwrite` | `rw` | 读取 + 写入 | 管理员、开发环境 |
+| `readonly` | `ro` | 仅读取 | 仪表盘、报表系统、只读副本 |
+| `writeonly` | `wo` | 仅写入 | 数据采集器、IoT 设备、日志收集 |
+
+:::note
+未指定权限模式的用户默认拥有 `readwrite` 权限，与此前版本行为一致。
+
 ### 日志配置
 
 顶层变量 `logging` 用于配置全局日志级别，如下所示：
diff --git a/versioned_docs/version-1.0/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md b/versioned_docs/version-1.0/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
index e936f9a0e..1782d23a3 100644
--- a/versioned_docs/version-1.0/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
+++ b/versioned_docs/version-1.0/user-guide/deployments-administration/deploy-on-kubernetes/common-helm-chart-configurations.md
@@ -203,8 +203,26 @@ auth:
   users:
     - username: "admin"
       password: "admin"
+      permission: "readwrite"
+    - username: "grafana"
+      password: "grafana_pwd"
+      permission: "readonly"
+    - username: "telegraf"
+      password: "telegraf_pwd"
+      permission: "writeonly"
 ```
 
+GreptimeDB supports three permission modes:
+
+| Mode | Shorthand | Allowed Operations | Typical Use Cases |
+|------|-----------|-------------------|-------------------|
+| `readwrite` | `rw` | Read + Write | Administrators, development environments |
+| `readonly` | `ro` | Read only | Dashboards, reporting systems, read replicas |
+| `writeonly` | `wo` | Write only | Data collectors, IoT devices, log aggregators |
+
+:::note
+Users without an explicit permission mode default to `readwrite`, maintaining backward compatibility.
+
 ### Logging Configuration
 
 The top-level variable `logging` is used to configure global logging levels, as shown below: