diff --git a/packages/brick-kit/src/internal/menu.spec.ts b/packages/brick-kit/src/internal/menu.spec.ts
index 4d271beaf9..8d934c1d3c 100644
--- a/packages/brick-kit/src/internal/menu.spec.ts
+++ b/packages/brick-kit/src/internal/menu.spec.ts
@@ -366,7 +366,7 @@ const mockMenuList: any[] = [
     title: "Menu i",
     dynamicItems: true,
     itemsResolve: {
-      args: ["<% PATH.objectId %>"],
+      args: ["<% PATH.objectId %>", "<% PERMISSIONS.check('x:y') %>"],
       useProvider: "my.fake-provider",
     },
     items: [
@@ -472,6 +472,8 @@ describe("fetchMenuById", () => {
   it("menu should not cache cache", async () => {
     await fetchMenuById("menu-i", fakeKernel);
     expect(InstanceApi_postSearch).toHaveBeenCalledTimes(1);
+    expect(validatePermissions).toBeCalledTimes(1);
+    expect(validatePermissions).toBeCalledWith(["x:y"]);
     await fetchMenuById("menu-i", fakeKernel);
     expect(InstanceApi_postSearch).toHaveBeenCalledTimes(2);
   });
diff --git a/packages/brick-kit/src/internal/menu.ts b/packages/brick-kit/src/internal/menu.ts
index e56714685d..8fe7cd9a6c 100644
--- a/packages/brick-kit/src/internal/menu.ts
+++ b/packages/brick-kit/src/internal/menu.ts
@@ -302,6 +302,10 @@ async function loadDynamicMenuItems(
         };
       }
     }
+
+    const usedActions = scanPermissionActionsInAny(menu.itemsResolve);
+    await validatePermissions(usedActions);
+
     await _internalApiGetResolver().resolveOne(
       "reference",
       {