diff --git a/src/modules/overseas-warehouse/permissions.test.mjs b/src/modules/overseas-warehouse/permissions.test.mjs
new file mode 100644
index 0000000..3514fff
--- /dev/null
+++ b/src/modules/overseas-warehouse/permissions.test.mjs
@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import test from 'node:test'
+
+const routes = readFileSync(new URL('./routes.ts', import.meta.url), 'utf8')
+const services = readFileSync(new URL('./views/WarehouseServiceView.vue', import.meta.url), 'utf8')
+const returns = readFileSync(new URL('./views/ReturnOrdersView.vue', import.meta.url), 'utf8')
+const contracts = readFileSync(new URL('../tenant-management/contracts.ts', import.meta.url), 'utf8')
+
+test('protects every overseas warehouse page with its independent list permission', () => {
+  for (const permission of [
+    'merchant:overseas-warehouse:relabel:list',
+    'merchant:overseas-warehouse:transfer:list',
+    'merchant:overseas-warehouse:discard:list',
+    'merchant:overseas-warehouse:return-order:list',
+    'merchant:overseas-warehouse:return-inventory:list',
+  ]) assert.match(routes, new RegExp(`permission: '${permission}'`))
+  assert.doesNotMatch(routes, /permission: 'dashboard:view'/)
+})
+
+test('keeps overseas warehouse writes behind operation-specific button permissions', () => {
+  for (const permission of [
+    'merchant:overseas-warehouse:relabel:create',
+    'merchant:overseas-warehouse:relabel:files',
+    'merchant:overseas-warehouse:relabel:confirm',
+    'merchant:overseas-warehouse:transfer:create',
+    'merchant:overseas-warehouse:transfer:confirm',
+    'merchant:overseas-warehouse:discard:create',
+    'merchant:overseas-warehouse:discard:cancel',
+  ]) assert.match(services, new RegExp(permission))
+  assert.match(services, /v-if="canCreate" type="primary" @click="openCreate"/)
+  assert.match(services, /canManageRelabelFiles && props\.service === 'labeling'/)
+  assert.match(services, /canConfirmTransfer && props\.service === 'transfer'/)
+  assert.match(services, /canCancelDiscard && props\.service === 'disposal'/)
+
+  assert.match(returns, /merchant:overseas-warehouse:return-order:create/)
+  assert.match(returns, /v-if="canCreate" type="primary" @click="openCreate"/)
+})
+
+test('publishes all overseas operation permissions in the enterprise role editor', () => {
+  for (const permission of [
+    'merchant:overseas-warehouse:last-mile-order:list',
+    'merchant:overseas-warehouse:relabel:list',
+    'merchant:overseas-warehouse:relabel:create',
+    'merchant:overseas-warehouse:relabel:files',
+    'merchant:overseas-warehouse:relabel:confirm',
+    'merchant:overseas-warehouse:transfer:list',
+    'merchant:overseas-warehouse:transfer:create',
+    'merchant:overseas-warehouse:transfer:confirm',
+    'merchant:overseas-warehouse:discard:list',
+    'merchant:overseas-warehouse:discard:create',
+    'merchant:overseas-warehouse:discard:cancel',
+    'merchant:overseas-warehouse:return-order:list',
+    'merchant:overseas-warehouse:return-order:create',
+    'merchant:overseas-warehouse:return-order:relabel',
+    'merchant:overseas-warehouse:return-inventory:list',
+  ]) assert.match(contracts, new RegExp(`code: '${permission}'`))
+})