diff --git a/manifests/charts/base/templates/rbac-router.yaml b/manifests/charts/base/templates/rbac-router.yaml
index 4f3ecc06..71458433 100644
--- a/manifests/charts/base/templates/rbac-router.yaml
+++ b/manifests/charts/base/templates/rbac-router.yaml
@@ -27,3 +27,30 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: {{ .Values.router.serviceAccountName | default "agentcube-router" }}
+{{- if .Values.workloadmanager.auth.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.router.serviceAccountName | default "agentcube-router" }}-workloadmanager
+rules:
+  - apiGroups: ["agents.x-k8s.io"]
+    resources: ["sandboxes"]
+    verbs: ["create", "delete"]
+  - apiGroups: ["extensions.agents.x-k8s.io"]
+    resources: ["sandboxclaims"]
+    verbs: ["create", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.router.serviceAccountName | default "agentcube-router" }}-workloadmanager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.Name }}-{{ .Values.router.serviceAccountName | default "agentcube-router" }}-workloadmanager
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.router.serviceAccountName | default "agentcube-router" }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/manifests/charts/base/templates/workloadmanager.yaml b/manifests/charts/base/templates/workloadmanager.yaml
index 0cf9264b..1d797808 100644
--- a/manifests/charts/base/templates/workloadmanager.yaml
+++ b/manifests/charts/base/templates/workloadmanager.yaml
@@ -79,6 +79,9 @@ spec:
           args:
             - --port={{ .Values.workloadmanager.service.port }}
             - --runtime-class-name=
+            {{- if .Values.workloadmanager.auth.enabled }}
+            - --enable-auth
+            {{- end }}
             {{- if .Values.spire.enabled }}
             - --tls-cert={{ .Values.spire.spiffeHelper.certDir }}/{{ .Values.spire.spiffeHelper.certFileName }}
             - --tls-key={{ .Values.spire.spiffeHelper.certDir }}/{{ .Values.spire.spiffeHelper.keyFileName }}
diff --git a/manifests/charts/base/values.yaml b/manifests/charts/base/values.yaml
index 1a454e9b..e186b89d 100644
--- a/manifests/charts/base/values.yaml
+++ b/manifests/charts/base/values.yaml
@@ -49,6 +49,8 @@ router:
 # AgentCube Workload Manager
 workloadmanager:
   replicas: 1
+  auth:
+    enabled: true
   image:
     repository: ghcr.io/volcano-sh/workloadmanager
     pullPolicy: IfNotPresent