diff --git a/server/home/home-web/src/main/java/io/holoinsight/server/home/web/security/custom/AlarmBlockFacadeImplChecker.java b/server/home/home-web/src/main/java/io/holoinsight/server/home/web/security/custom/AlarmBlockFacadeImplChecker.java
index b82895442..878c2b810 100644
--- a/server/home/home-web/src/main/java/io/holoinsight/server/home/web/security/custom/AlarmBlockFacadeImplChecker.java
+++ b/server/home/home-web/src/main/java/io/holoinsight/server/home/web/security/custom/AlarmBlockFacadeImplChecker.java
@@ -149,12 +149,12 @@ private LevelAuthorizationCheckResult checkAlarmBlockDTO(String methodName,
       return failCheckResult("invalid tags %s", alarmBlockDTO.getTags());
     }
     if (StringUtils.isNotEmpty(alarmBlockDTO.getTenant())
-        && StringUtils.equals(alarmBlockDTO.getTenant(), tenant)) {
+        && !StringUtils.equals(alarmBlockDTO.getTenant(), tenant)) {
       return failCheckResult("invalid tenant %s, real tenant %s", alarmBlockDTO.getTenant(),
           tenant);
     }
     if (StringUtils.isNotEmpty(alarmBlockDTO.getWorkspace())
-        && StringUtils.equals(alarmBlockDTO.getWorkspace(), workspace)) {
+        && !StringUtils.equals(alarmBlockDTO.getWorkspace(), workspace)) {
       return failCheckResult("invalid workspace %s, real workspace %s",
           alarmBlockDTO.getWorkspace(), workspace);
     }
diff --git a/test/server-e2e-test/src/main/java/io/holoinsight/server/test/it/AlertRuleIT.java b/test/server-e2e-test/src/main/java/io/holoinsight/server/test/it/AlertRuleIT.java
index 2670d5e38..bffc29f18 100644
--- a/test/server-e2e-test/src/main/java/io/holoinsight/server/test/it/AlertRuleIT.java
+++ b/test/server-e2e-test/src/main/java/io/holoinsight/server/test/it/AlertRuleIT.java
@@ -157,6 +157,7 @@ public void test_check_rule_name() {
         .body(new JSONObject(J.toMap(J.toJson(alarmRuleDTO)))) //
         .when() //
         .post("/webapi/alarmRule/create") //
+        .prettyPeek() //
         .then() //
         .body("success", IS_FALSE) //
         .body("message", startsWith("API_SECURITY"));
@@ -170,6 +171,7 @@ public void test_check_rule_name() {
         .body(new JSONObject(J.toMap(J.toJson(alarmRuleDTO)))) //
         .when() //
         .post("/webapi/alarmRule/update") //
+        .prettyPeek() //
         .then() //
         .body("success", IS_FALSE) //
         .body("message", startsWith("API_SECURITY"));
@@ -216,8 +218,7 @@ public void test_rule_delete() {
     System.out.println(response.body().print());
     response //
         .then() //
-        .body("success", IS_TRUE) //
-        .body("data", IS_NULL);
+        .body("success", IS_FALSE);
   }
 
   @Order(6)