diff --git a/include/libs/nodes/querynodes.h b/include/libs/nodes/querynodes.h
index 480912a8cf..9569cfe055 100644
--- a/include/libs/nodes/querynodes.h
+++ b/include/libs/nodes/querynodes.h
@@ -379,6 +379,8 @@ typedef struct SVnodeModifyOpStmt {
   SName                 usingTableName;
   const char*           pBoundCols;
   struct STableMeta*    pTableMeta;
+  SNode*                pTagCond;
+  SArray*               pTableTag;
   SHashObj*             pVgroupsHashObj;
   SHashObj*             pTableBlockHashObj;  // SHashObj<tuid, STableDataCxt*>
   SHashObj*             pSubTableHashObj;
diff --git a/source/client/src/clientMain.c b/source/client/src/clientMain.c
index 54ae1ab4b3..2ebc8e7379 100644
--- a/source/client/src/clientMain.c
+++ b/source/client/src/clientMain.c
@@ -108,7 +108,7 @@ TAOS *taos_connect(const char *ip, const char *user, const char *pass, const cha
   if (pass == NULL) {
     pass = TSDB_DEFAULT_PASS;
   }
-  
+
   STscObj *pObj = taos_connect_internal(ip, user, pass, NULL, db, port, CONN_TYPE__QUERY);
   if (pObj) {
     int64_t *rid = taosMemoryCalloc(1, sizeof(int64_t));
@@ -359,11 +359,11 @@ int taos_print_row(char *str, TAOS_ROW row, TAOS_FIELD *fields, int num_fields)
       case TSDB_DATA_TYPE_NCHAR: {
         int32_t charLen = varDataLen((char *)row[i] - VARSTR_HEADER_SIZE);
         if (fields[i].type == TSDB_DATA_TYPE_BINARY) {
-          if(ASSERT(charLen <= fields[i].bytes && charLen >= 0)){
+          if (ASSERT(charLen <= fields[i].bytes && charLen >= 0)) {
             tscError("taos_print_row error binary. charLen:%d, fields[i].bytes:%d", charLen, fields[i].bytes);
           }
         } else {
-          if(ASSERT(charLen <= fields[i].bytes * TSDB_NCHAR_SIZE && charLen >= 0)){
+          if (ASSERT(charLen <= fields[i].bytes * TSDB_NCHAR_SIZE && charLen >= 0)) {
             tscError("taos_print_row error. charLen:%d, fields[i].bytes:%d", charLen, fields[i].bytes);
           }
         }
@@ -705,16 +705,16 @@ int taos_get_current_db(TAOS *taos, char *database, int len, int *required) {
 
   int code = TSDB_CODE_SUCCESS;
   taosThreadMutexLock(&pTscObj->mutex);
-  if(database == NULL || len <= 0){
-    if(required != NULL) *required = strlen(pTscObj->db) + 1;
+  if (database == NULL || len <= 0) {
+    if (required != NULL) *required = strlen(pTscObj->db) + 1;
     terrno = TSDB_CODE_INVALID_PARA;
     code = -1;
-  }else if(len < strlen(pTscObj->db) + 1){
+  } else if (len < strlen(pTscObj->db) + 1) {
     tstrncpy(database, pTscObj->db, len);
-    if(required) *required = strlen(pTscObj->db) + 1;
+    if (required) *required = strlen(pTscObj->db) + 1;
     terrno = TSDB_CODE_INVALID_PARA;
     code = -1;
-  }else{
+  } else {
     strcpy(database, pTscObj->db);
     code = 0;
   }
@@ -741,6 +741,7 @@ static void destoryCatalogReq(SCatalogReq *pCatalogReq) {
   taosArrayDestroy(pCatalogReq->pUser);
   taosArrayDestroy(pCatalogReq->pTableIndex);
   taosArrayDestroy(pCatalogReq->pTableCfg);
+  taosArrayDestroy(pCatalogReq->pTableTag);
   taosMemoryFree(pCatalogReq);
 }
 
@@ -976,7 +977,7 @@ void doAsyncQuery(SRequestObj *pRequest, bool updateMetaForce) {
   if (TSDB_CODE_SUCCESS == code) {
     pRequest->stmtType = pRequest->pQuery->pRoot->type;
     code = phaseAsyncQuery(pWrapper);
-  } 
+  }
 
   if (TSDB_CODE_SUCCESS != code) {
     tscError("0x%" PRIx64 " error happens, code:%d - %s, reqId:0x%" PRIx64, pRequest->self, code, tstrerror(code),
@@ -1044,11 +1045,11 @@ static void fetchCallback(void *pResult, void *param, int32_t code) {
 }
 
 void taos_fetch_rows_a(TAOS_RES *res, __taos_async_fn_t fp, void *param) {
-  if(ASSERT(res != NULL && fp != NULL)){
+  if (ASSERT(res != NULL && fp != NULL)) {
     tscError("taos_fetch_rows_a invalid paras");
     return;
   }
-  if(ASSERT(TD_RES_QUERY(res))){
+  if (ASSERT(TD_RES_QUERY(res))) {
     tscError("taos_fetch_rows_a res is NULL");
     return;
   }
@@ -1094,11 +1095,11 @@ void taos_fetch_rows_a(TAOS_RES *res, __taos_async_fn_t fp, void *param) {
 }
 
 void taos_fetch_raw_block_a(TAOS_RES *res, __taos_async_fn_t fp, void *param) {
-  if(ASSERT(res != NULL && fp != NULL)){
+  if (ASSERT(res != NULL && fp != NULL)) {
     tscError("taos_fetch_rows_a invalid paras");
     return;
   }
-  if(ASSERT(TD_RES_QUERY(res))){
+  if (ASSERT(TD_RES_QUERY(res))) {
     tscError("taos_fetch_rows_a res is NULL");
     return;
   }
@@ -1113,11 +1114,11 @@ void taos_fetch_raw_block_a(TAOS_RES *res, __taos_async_fn_t fp, void *param) {
 }
 
 const void *taos_get_raw_block(TAOS_RES *res) {
-  if(ASSERT(res != NULL)){
+  if (ASSERT(res != NULL)) {
     tscError("taos_fetch_rows_a invalid paras");
     return NULL;
   }
-  if(ASSERT(TD_RES_QUERY(res))){
+  if (ASSERT(TD_RES_QUERY(res))) {
     tscError("taos_fetch_rows_a res is NULL");
     return NULL;
   }
@@ -1275,7 +1276,6 @@ _return:
   return code;
 }
 
-
 int taos_load_table_info(TAOS *taos, const char *tableNameList) {
   if (NULL == taos) {
     terrno = TSDB_CODE_TSC_DISCONNECTED;
diff --git a/source/libs/catalog/src/ctgUtil.c b/source/libs/catalog/src/ctgUtil.c
index a42a189e75..9274c1ef92 100644
--- a/source/libs/catalog/src/ctgUtil.c
+++ b/source/libs/catalog/src/ctgUtil.c
@@ -170,6 +170,9 @@ void ctgFreeSMetaData(SMetaData* pData) {
   taosArrayDestroy(pData->pTableCfg);
   pData->pTableCfg = NULL;
 
+  taosArrayDestroy(pData->pTableTag);
+  pData->pTableTag = NULL;
+
   taosMemoryFreeClear(pData->pSvrVer);
 }
 
@@ -530,7 +533,7 @@ void ctgFreeTaskRes(CTG_TASK_TYPE type, void** pRes) {
     }
     case CTG_TASK_GET_USER: {
       if (*pRes) {
-        SUserAuthRes* pAuth = (SUserAuthRes *)*pRes;
+        SUserAuthRes* pAuth = (SUserAuthRes*)*pRes;
         nodesDestroyNode(pAuth->pCond);
         taosMemoryFreeClear(*pRes);
       }
@@ -711,6 +714,7 @@ void ctgFreeTaskCtx(SCtgTask* pTask) {
       SCtgTbTagCtx* taskCtx = (SCtgTbTagCtx*)pTask->taskCtx;
       taosMemoryFreeClear(taskCtx->pName);
       taosMemoryFreeClear(taskCtx->pVgInfo);
+      taosMemoryFreeClear(taskCtx);
       break;
     }
     case CTG_TASK_GET_DB_VGROUP:
diff --git a/source/libs/nodes/src/nodesUtilFuncs.c b/source/libs/nodes/src/nodesUtilFuncs.c
index 422a196c50..f71eef7969 100644
--- a/source/libs/nodes/src/nodesUtilFuncs.c
+++ b/source/libs/nodes/src/nodesUtilFuncs.c
@@ -827,6 +827,8 @@ void nodesDestroyNode(SNode* pNode) {
       SVnodeModifyOpStmt* pStmt = (SVnodeModifyOpStmt*)pNode;
       destroyVgDataBlockArray(pStmt->pDataBlocks);
       taosMemoryFreeClear(pStmt->pTableMeta);
+      nodesDestroyNode(pStmt->pTagCond);
+      taosArrayDestroy(pStmt->pTableTag);
       taosHashCleanup(pStmt->pVgroupsHashObj);
       taosHashCleanup(pStmt->pSubTableHashObj);
       taosHashCleanup(pStmt->pTableNameHashObj);
diff --git a/source/libs/parser/src/parAuthenticator.c b/source/libs/parser/src/parAuthenticator.c
index d182f5bd73..1586d8128b 100644
--- a/source/libs/parser/src/parAuthenticator.c
+++ b/source/libs/parser/src/parAuthenticator.c
@@ -91,17 +91,22 @@ static int32_t mergeStableTagCond(SNode** pWhere, SNode* pTagCond) {
 }
 
 static int32_t appendStableTagCond(SNode** pWhere, SNode* pTagCond) {
+  SNode* pTagCondCopy = nodesCloneNode(pTagCond);
+  if (NULL == pTagCondCopy) {
+    return TSDB_CODE_OUT_OF_MEMORY;
+  }
+
   if (NULL == *pWhere) {
-    *pWhere = pTagCond;
+    *pWhere = pTagCondCopy;
     return TSDB_CODE_SUCCESS;
   }
 
   if (QUERY_NODE_LOGIC_CONDITION == nodeType(*pWhere) &&
       LOGIC_COND_TYPE_AND == ((SLogicConditionNode*)*pWhere)->condType) {
-    return nodesListStrictAppend(((SLogicConditionNode*)*pWhere)->pParameterList, pTagCond);
+    return nodesListStrictAppend(((SLogicConditionNode*)*pWhere)->pParameterList, pTagCondCopy);
   }
 
-  return mergeStableTagCond(pWhere, pTagCond);
+  return mergeStableTagCond(pWhere, pTagCondCopy);
 }
 
 static EDealRes authSelectImpl(SNode* pNode, void* pContext) {
diff --git a/source/libs/parser/src/parInsertSql.c b/source/libs/parser/src/parInsertSql.c
index eb2efd573d..02de9f227d 100644
--- a/source/libs/parser/src/parInsertSql.c
+++ b/source/libs/parser/src/parInsertSql.c
@@ -53,6 +53,7 @@ typedef struct SInsertParseContext {
   bool           missCache;
   bool           usingDuplicateTable;
   bool           forceUpdate;
+  bool           needTableTagVal;
 } SInsertParseContext;
 
 typedef int32_t (*_row_append_fn_t)(SMsgBuf* pMsgBuf, const void* value, int32_t len, void* param);
@@ -577,28 +578,39 @@ static int32_t rewriteTagCondColumnImpl(STagVal* pVal, SNode** pNode) {
   if (NULL == pValue) {
     return TSDB_CODE_OUT_OF_MEMORY;
   }
-  pValue->node.resType.type = pVal->type;
+
+  pValue->node.resType = ((SColumnNode*)*pNode)->node.resType;
+  nodesDestroyNode(*pNode);
+  *pNode = (SNode*)pValue;
+
   switch (pVal->type) {
     case TSDB_DATA_TYPE_BOOL:
       pValue->datum.b = *(int8_t*)(&pVal->i64);
+      *(bool*)&pValue->typeData = pValue->datum.b;
       break;
     case TSDB_DATA_TYPE_TINYINT:
       pValue->datum.i = *(int8_t*)(&pVal->i64);
+      *(int8_t*)&pValue->typeData = pValue->datum.i;
       break;
     case TSDB_DATA_TYPE_SMALLINT:
       pValue->datum.i = *(int16_t*)(&pVal->i64);
+      *(int16_t*)&pValue->typeData = pValue->datum.i;
       break;
     case TSDB_DATA_TYPE_INT:
       pValue->datum.i = *(int32_t*)(&pVal->i64);
+      *(int32_t*)&pValue->typeData = pValue->datum.i;
       break;
     case TSDB_DATA_TYPE_BIGINT:
       pValue->datum.i = pVal->i64;
+      pValue->typeData = pValue->datum.i;
       break;
     case TSDB_DATA_TYPE_FLOAT:
       pValue->datum.d = *(float*)(&pVal->i64);
+      *(float*)&pValue->typeData = pValue->datum.d;
       break;
     case TSDB_DATA_TYPE_DOUBLE:
       pValue->datum.d = *(double*)(&pVal->i64);
+      *(double*)&pValue->typeData = pValue->datum.d;
       break;
     case TSDB_DATA_TYPE_VARCHAR:
     case TSDB_DATA_TYPE_NCHAR:
@@ -611,18 +623,23 @@ static int32_t rewriteTagCondColumnImpl(STagVal* pVal, SNode** pNode) {
       break;
     case TSDB_DATA_TYPE_TIMESTAMP:
       pValue->datum.i = pVal->i64;
+      pValue->typeData = pValue->datum.i;
       break;
     case TSDB_DATA_TYPE_UTINYINT:
       pValue->datum.i = *(uint8_t*)(&pVal->i64);
+      *(uint8_t*)&pValue->typeData = pValue->datum.i;
       break;
     case TSDB_DATA_TYPE_USMALLINT:
       pValue->datum.i = *(uint16_t*)(&pVal->i64);
+      *(uint16_t*)&pValue->typeData = pValue->datum.i;
       break;
     case TSDB_DATA_TYPE_UINT:
       pValue->datum.i = *(uint32_t*)(&pVal->i64);
+      *(uint32_t*)&pValue->typeData = pValue->datum.i;
       break;
     case TSDB_DATA_TYPE_UBIGINT:
       pValue->datum.i = *(uint64_t*)(&pVal->i64);
+      *(uint64_t*)&pValue->typeData = pValue->datum.i;
       break;
     case TSDB_DATA_TYPE_JSON:
     case TSDB_DATA_TYPE_VARBINARY:
@@ -667,16 +684,15 @@ static int32_t checkTagCondResult(SNode* pResult) {
                                                                                     : TSDB_CODE_PAR_PERMISSION_DENIED;
 }
 
-int32_t checkSubtablePrivilege(SArray* pTagVals, SArray* pTagName, SNode* pCond) {
-  int32_t code = setTagVal(pTagVals, pTagName, pCond);
-  SNode*  pNew = NULL;
+static int32_t checkSubtablePrivilege(SArray* pTagVals, SArray* pTagName, SNode** pCond) {
+  int32_t code = setTagVal(pTagVals, pTagName, *pCond);
   if (TSDB_CODE_SUCCESS == code) {
-    code = scalarCalculateConstants(pCond, &pNew);
+    code = scalarCalculateConstants(*pCond, pCond);
   }
   if (TSDB_CODE_SUCCESS == code) {
-    code = checkTagCondResult(pNew);
+    code = checkTagCondResult(*pCond);
   }
-  nodesDestroyNode(pNew);
+  NODES_DESTORY_NODE(*pCond);
   return code;
 }
 
@@ -716,6 +732,10 @@ static int32_t parseTagsClauseImpl(SInsertParseContext* pCxt, SVnodeModifyOpStmt
     }
   }
 
+  if (TSDB_CODE_SUCCESS == code && NULL != pStmt->pTagCond) {
+    code = checkSubtablePrivilege(pTagVals, pTagName, &pStmt->pTagCond);
+  }
+
   if (TSDB_CODE_SUCCESS == code && !isParseBindParam && !isJson) {
     code = tTagNew(pTagVals, 1, false, &pTag);
   }
@@ -843,7 +863,7 @@ static void setUserAuthInfo(SParseContext* pCxt, SName* pTbName, SUserAuthInfo*
   pInfo->type = AUTH_TYPE_WRITE;
 }
 
-static int32_t checkAuth(SParseContext* pCxt, SName* pTbName, bool* pMissCache) {
+static int32_t checkAuth(SParseContext* pCxt, SName* pTbName, bool* pMissCache, SNode** pTagCond) {
   int32_t       code = TSDB_CODE_SUCCESS;
   SUserAuthInfo authInfo = {0};
   setUserAuthInfo(pCxt, pTbName, &authInfo);
@@ -863,11 +883,28 @@ static int32_t checkAuth(SParseContext* pCxt, SName* pTbName, bool* pMissCache)
       *pMissCache = true;
     } else if (!authRes.pass) {
       code = TSDB_CODE_PAR_PERMISSION_DENIED;
+    } else if (NULL != authRes.pCond) {
+      *pTagCond = authRes.pCond;
     }
   }
   return code;
 }
 
+static int32_t checkAuthForTable(SParseContext* pCxt, SName* pTbName, bool* pMissCache, bool* pNeedTableTagVal) {
+  SNode*  pTagCond = NULL;
+  int32_t code = checkAuth(pCxt, pTbName, pMissCache, &pTagCond);
+  if (TSDB_CODE_SUCCESS == code) {
+    *pNeedTableTagVal = ((*pMissCache) || (NULL != pTagCond));
+    *pMissCache = (NULL != pTagCond);
+  }
+  nodesDestroyNode(pTagCond);
+  return code;
+}
+
+static int32_t checkAuthForStable(SParseContext* pCxt, SName* pTbName, bool* pMissCache, SNode** pTagCond) {
+  return checkAuth(pCxt, pTbName, pMissCache, pTagCond);
+}
+
 static int32_t getTableMeta(SInsertParseContext* pCxt, SName* pTbName, bool isStb, STableMeta** pTableMeta,
                             bool* pMissCache) {
   SParseContext* pComCxt = pCxt->pComCxt;
@@ -970,7 +1007,7 @@ static int32_t getTargetTableSchema(SInsertParseContext* pCxt, SVnodeModifyOpStm
     return TSDB_CODE_SUCCESS;
   }
 
-  int32_t code = checkAuth(pCxt->pComCxt, &pStmt->targetTableName, &pCxt->missCache);
+  int32_t code = checkAuthForTable(pCxt->pComCxt, &pStmt->targetTableName, &pCxt->missCache, &pCxt->needTableTagVal);
   if (TSDB_CODE_SUCCESS == code && !pCxt->missCache) {
     code = getTableMetaAndVgroup(pCxt, pStmt, &pCxt->missCache);
   }
@@ -993,7 +1030,7 @@ static int32_t getUsingTableSchema(SInsertParseContext* pCxt, SVnodeModifyOpStmt
     return TSDB_CODE_SUCCESS;
   }
 
-  int32_t code = checkAuth(pCxt->pComCxt, &pStmt->targetTableName, &pCxt->missCache);
+  int32_t code = checkAuthForStable(pCxt->pComCxt, &pStmt->usingTableName, &pCxt->missCache, &pStmt->pTagCond);
   if (TSDB_CODE_SUCCESS == code && !pCxt->missCache) {
     code = getTableMeta(pCxt, &pStmt->usingTableName, true, &pStmt->pTableMeta, &pCxt->missCache);
   }
@@ -1606,6 +1643,8 @@ static int32_t parseInsertTableClauseBottom(SInsertParseContext* pCxt, SVnodeMod
 static void resetEnvPreTable(SInsertParseContext* pCxt, SVnodeModifyOpStmt* pStmt) {
   insDestroyBoundColInfo(&pCxt->tags);
   taosMemoryFreeClear(pStmt->pTableMeta);
+  nodesDestroyNode(pStmt->pTagCond);
+  taosArrayDestroy(pStmt->pTableTag);
   tdDestroySVCreateTbReq(pStmt->pCreateTblReq);
   taosMemoryFreeClear(pStmt->pCreateTblReq);
   pCxt->missCache = false;
@@ -1780,14 +1819,18 @@ static int32_t createInsertQuery(SInsertParseContext* pCxt, SQuery** pOutput) {
   return code;
 }
 
-static int32_t checkAuthFromMetaData(const SArray* pUsers) {
+static int32_t checkAuthFromMetaData(const SArray* pUsers, SNode** pTagCond) {
   if (1 != taosArrayGetSize(pUsers)) {
     return TSDB_CODE_FAILED;
   }
 
   SMetaRes* pRes = taosArrayGet(pUsers, 0);
   if (TSDB_CODE_SUCCESS == pRes->code) {
-    return (*(bool*)pRes->pRes) ? TSDB_CODE_SUCCESS : TSDB_CODE_PAR_PERMISSION_DENIED;
+    SUserAuthRes* pAuth = pRes->pRes;
+    if (NULL != pAuth->pCond) {
+      *pTagCond = nodesCloneNode(pAuth->pCond);
+    }
+    return pAuth->pass ? TSDB_CODE_SUCCESS : TSDB_CODE_PAR_PERMISSION_DENIED;
   }
   return pRes->code;
 }
@@ -1826,9 +1869,40 @@ static int32_t getTableVgroupFromMetaData(const SArray* pTables, SVnodeModifyOpS
                      sizeof(SVgroupInfo));
 }
 
+static int32_t buildTagNameFromMeta(STableMeta* pMeta, SArray** pTagName) {
+  *pTagName = taosArrayInit(pMeta->tableInfo.numOfTags, TSDB_COL_NAME_LEN);
+  if (NULL == *pTagName) {
+    return TSDB_CODE_OUT_OF_MEMORY;
+  }
+  SSchema* pSchema = getTableTagSchema(pMeta);
+  for (int32_t i = 0; i < pMeta->tableInfo.numOfTags; ++i) {
+    taosArrayPush(*pTagName, pSchema[i].name);
+  }
+  return TSDB_CODE_SUCCESS;
+}
+
+static int32_t checkSubtablePrivilegeForTable(const SArray* pTables, SVnodeModifyOpStmt* pStmt) {
+  if (1 != taosArrayGetSize(pTables)) {
+    return TSDB_CODE_FAILED;
+  }
+
+  SMetaRes* pRes = taosArrayGet(pTables, 0);
+  if (TSDB_CODE_SUCCESS != pRes->code) {
+    return pRes->code;
+  }
+
+  SArray* pTagName = NULL;
+  int32_t code = buildTagNameFromMeta(pStmt->pTableMeta, &pTagName);
+  if (TSDB_CODE_SUCCESS == code) {
+    code = checkSubtablePrivilege((SArray*)pRes->pRes, pTagName, &pStmt->pTagCond);
+  }
+  taosArrayDestroy(pTagName);
+  return code;
+}
+
 static int32_t getTableSchemaFromMetaData(SInsertParseContext* pCxt, const SMetaData* pMetaData,
                                           SVnodeModifyOpStmt* pStmt, bool isStb) {
-  int32_t code = checkAuthFromMetaData(pMetaData->pUser);
+  int32_t code = checkAuthFromMetaData(pMetaData->pUser, &pStmt->pTagCond);
   if (TSDB_CODE_SUCCESS == code) {
     code = getTableMetaFromMetaData(pMetaData->pTableMeta, &pStmt->pTableMeta);
   }
@@ -1841,6 +1915,9 @@ static int32_t getTableSchemaFromMetaData(SInsertParseContext* pCxt, const SMeta
   if (TSDB_CODE_SUCCESS == code) {
     code = getTableVgroupFromMetaData(pMetaData->pTableHash, pStmt, isStb);
   }
+  if (TSDB_CODE_SUCCESS == code && !isStb && NULL != pStmt->pTagCond) {
+    code = checkSubtablePrivilegeForTable(pMetaData->pTableTag, pStmt);
+  }
   return code;
 }
 
@@ -1860,6 +1937,8 @@ static void clearCatalogReq(SCatalogReq* pCatalogReq) {
   pCatalogReq->pTableHash = NULL;
   taosArrayDestroy(pCatalogReq->pUser);
   pCatalogReq->pUser = NULL;
+  taosArrayDestroy(pCatalogReq->pTableTag);
+  pCatalogReq->pTableTag = NULL;
 }
 
 static int32_t setVnodeModifOpStmt(SInsertParseContext* pCxt, SCatalogReq* pCatalogReq, const SMetaData* pMetaData,
@@ -2033,8 +2112,15 @@ static int32_t buildInsertUserAuthReq(const char* pUser, SName* pName, SArray**
   return TSDB_CODE_SUCCESS;
 }
 
+static int32_t buildInsertTableTagReq(SName* pName, SArray** pTables) { return buildInsertTableReq(pName, pTables); }
+
 static int32_t buildInsertCatalogReq(SInsertParseContext* pCxt, SVnodeModifyOpStmt* pStmt, SCatalogReq* pCatalogReq) {
-  int32_t code = buildInsertUserAuthReq(pCxt->pComCxt->pUser, &pStmt->targetTableName, &pCatalogReq->pUser);
+  int32_t code = buildInsertUserAuthReq(
+      pCxt->pComCxt->pUser, (0 == pStmt->usingTableName.type ? &pStmt->targetTableName : &pStmt->usingTableName),
+      &pCatalogReq->pUser);
+  if (TSDB_CODE_SUCCESS == code && pCxt->needTableTagVal) {
+    code = buildInsertTableTagReq(&pStmt->targetTableName, &pCatalogReq->pTableTag);
+  }
   if (TSDB_CODE_SUCCESS == code) {
     if (0 == pStmt->usingTableName.type) {
       code = buildInsertDbReq(&pStmt->targetTableName, &pCatalogReq->pTableMeta);
diff --git a/source/libs/scalar/src/scalar.c b/source/libs/scalar/src/scalar.c
index 0521076d23..d9295656e8 100644
--- a/source/libs/scalar/src/scalar.c
+++ b/source/libs/scalar/src/scalar.c
@@ -53,6 +53,7 @@ int32_t sclCreateColumnInfoData(SDataType *pType, int32_t numOfRows, SScalarPara
   int32_t code = colInfoDataEnsureCapacity(pColumnData, numOfRows, true);
   if (code != TSDB_CODE_SUCCESS) {
     terrno = TSDB_CODE_OUT_OF_MEMORY;
+    colDataDestroy(pColumnData);
     taosMemoryFree(pColumnData);
     return terrno;
   }
@@ -1061,17 +1062,20 @@ int32_t sclConvertOpValueNodeTs(SOperatorNode *node, SScalarCtx *ctx) {
 
   if (node->pLeft && SCL_IS_VAR_VALUE_NODE(node->pLeft)) {
     if (node->pRight && (TSDB_DATA_TYPE_TIMESTAMP == ((SExprNode *)node->pRight)->resType.type)) {
-      SCL_ERR_JRET(sclConvertToTsValueNode(sclGetOpValueNodeTsPrecision(node->pLeft, node->pRight), (SValueNode*)node->pLeft));
+      SCL_ERR_JRET(
+          sclConvertToTsValueNode(sclGetOpValueNodeTsPrecision(node->pLeft, node->pRight), (SValueNode *)node->pLeft));
     }
   } else if (node->pRight && SCL_IS_NOTNULL_CONST_NODE(node->pRight)) {
     if (node->pLeft && (TSDB_DATA_TYPE_TIMESTAMP == ((SExprNode *)node->pLeft)->resType.type)) {
       if (SCL_IS_VAR_VALUE_NODE(node->pRight)) {
-        SCL_ERR_JRET(sclConvertToTsValueNode(sclGetOpValueNodeTsPrecision(node->pLeft, node->pRight), (SValueNode*)node->pRight));
+        SCL_ERR_JRET(sclConvertToTsValueNode(sclGetOpValueNodeTsPrecision(node->pLeft, node->pRight),
+                                             (SValueNode *)node->pRight));
       } else if (QUERY_NODE_NODE_LIST == node->pRight->type) {
-        SNode* pNode;
-        FOREACH(pNode, ((SNodeListNode*)node->pRight)->pNodeList) {
+        SNode *pNode;
+        FOREACH(pNode, ((SNodeListNode *)node->pRight)->pNodeList) {
           if (SCL_IS_VAR_VALUE_NODE(pNode)) {
-            SCL_ERR_JRET(sclConvertToTsValueNode(sclGetOpValueNodeTsPrecision(node->pLeft, pNode), (SValueNode*)pNode));
+            SCL_ERR_JRET(
+                sclConvertToTsValueNode(sclGetOpValueNodeTsPrecision(node->pLeft, pNode), (SValueNode *)pNode));
           }
         }
       }
@@ -1086,8 +1090,6 @@ _return:
   return DEAL_RES_ERROR;
 }
 
-
-
 int32_t sclConvertCaseWhenValueNodeTs(SCaseWhenNode *node, SScalarCtx *ctx) {
   int32_t code = 0;
 
@@ -1096,19 +1098,20 @@ int32_t sclConvertCaseWhenValueNodeTs(SCaseWhenNode *node, SScalarCtx *ctx) {
   }
 
   if (SCL_IS_VAR_VALUE_NODE(node->pCase)) {
-    SNode* pNode;
+    SNode *pNode;
     FOREACH(pNode, node->pWhenThenList) {
       SExprNode *pExpr = (SExprNode *)((SWhenThenNode *)pNode)->pWhen;
       if (TSDB_DATA_TYPE_TIMESTAMP == pExpr->resType.type) {
-        SCL_ERR_JRET(sclConvertToTsValueNode(pExpr->resType.precision, (SValueNode*)node->pCase));
+        SCL_ERR_JRET(sclConvertToTsValueNode(pExpr->resType.precision, (SValueNode *)node->pCase));
         break;
       }
     }
   } else if (TSDB_DATA_TYPE_TIMESTAMP == ((SExprNode *)node->pCase)->resType.type) {
-    SNode* pNode;
+    SNode *pNode;
     FOREACH(pNode, node->pWhenThenList) {
       if (SCL_IS_VAR_VALUE_NODE(((SWhenThenNode *)pNode)->pWhen)) {
-        SCL_ERR_JRET(sclConvertToTsValueNode(((SExprNode *)node->pCase)->resType.precision, (SValueNode*)((SWhenThenNode *)pNode)->pWhen));
+        SCL_ERR_JRET(sclConvertToTsValueNode(((SExprNode *)node->pCase)->resType.precision,
+                                             (SValueNode *)((SWhenThenNode *)pNode)->pWhen));
       }
     }
   }
@@ -1271,7 +1274,6 @@ EDealRes sclRewriteLogic(SNode **pNode, SScalarCtx *ctx) {
   return DEAL_RES_CONTINUE;
 }
 
-
 EDealRes sclRewriteOperator(SNode **pNode, SScalarCtx *ctx) {
   SOperatorNode *node = (SOperatorNode *)*pNode;
 
diff --git a/tests/parallel_test/cases.task b/tests/parallel_test/cases.task
index dda4ec3e84..8ea13e741c 100644
--- a/tests/parallel_test/cases.task
+++ b/tests/parallel_test/cases.task
@@ -722,6 +722,7 @@
 ,,y,script,./test.sh -f tsim/user/privilege_db.sim
 ,,y,script,./test.sh -f tsim/user/privilege_sysinfo.sim
 ,,y,script,./test.sh -f tsim/user/privilege_topic.sim
+,,y,script,./test.sh -f tsim/user/privilege_table.sim
 ,,y,script,./test.sh -f tsim/db/alter_option.sim
 ,,y,script,./test.sh -f tsim/db/alter_replica_31.sim
 ,,y,script,./test.sh -f tsim/db/basic1.sim
diff --git a/tests/script/tsim/user/privilege_table.sim b/tests/script/tsim/user/privilege_table.sim
index 5256cdd21d..05f91ff5b0 100644
--- a/tests/script/tsim/user/privilege_table.sim
+++ b/tests/script/tsim/user/privilege_table.sim
@@ -96,7 +96,9 @@ sql connect wxy
 sql reset query cache;
 sql_error select tbname, * from test.st1; 
 sql insert into test.st1s1 values(now, 10);
+sql insert into test.st1s3 using test.st1 tags(1, 'dachang') values(now, 100);
 sql_error insert into test.st1s2 values(now, 20);
+sql_error insert into test.st1s4 using test.st1 tags(3, 'dachang') values(now, 300);
 sql_error select * from test.st2; 
 sql_error insert into test.st2s1 values(now, 10) test.st2s2 values(now, 20);
 
@@ -112,7 +114,7 @@ sql connect wxy
 
 sql reset query cache;
 sql select * from test.st1;
-if $rows != 5 then 
+if $rows != 6 then 
   return -1
 endi
 sql_error insert into test.st1s1 values(now, 10) test.st1s2 values(now, 20);
@@ -133,7 +135,7 @@ sql connect wxy
 
 sql reset query cache;
 sql select * from test.st1; 
-if $rows != 2 then 
+if $rows != 6 then 
   return -1
 endi
 sql_error insert into test.st1s1 values(now, 10) test.st1s2 values(now, 20);
@@ -153,8 +155,9 @@ sql grant read on test.st1 with id = 1 to wxy;
 sql close
 sql connect wxy
 
+sql reset query cache;
 sql select * from test.st1; 
-if $rows != 1 then 
+if $rows != 4 then 
   return -1
 endi
 sql_error insert into test.st1s1 values(now, 10) test.st1s2 values(now, 20);
@@ -174,8 +177,9 @@ sql grant write on test.st1 to wxy;
 sql close
 sql connect wxy
 
+sql reset query cache;
 sql select * from test.st1;
-if $rows != 2 then 
+if $rows != 6 then 
   return -1
 endi
 sql insert into test.st1s1 values(now, 10) test.st1s2 values(now, 20);
@@ -195,10 +199,17 @@ sql grant write on test.st1 with id = 1 to wxy;
 sql close
 sql connect wxy
 
-sql select * from test.st1; 
+sql reset query cache;
+sql select * from test.st1;
+if $rows != 8 then 
+  return -1
+endi
 sql insert into test.st1s1 values(now, 10);
 sql_error insert into test.st1s2 values(now, 20);
-sql select * from test.st2; 
+sql select * from test.st2;
+if $rows != 2 then 
+  return -1
+endi
 sql_error insert into test.st2s1 values(now, 10) test.st2s2 values(now, 20);
 
 print =============== case 11: database write privilege and table unauthorized
@@ -212,6 +223,7 @@ sql grant write on test.* to wxy;
 sql close
 sql connect wxy
 
+sql reset query cache;
 sql_error select * from test.st1; 
 sql insert into test.st1s1 values(now, 10) test.st1s2 values(now, 20);
 sql_error select * from test.st2; 
@@ -226,7 +238,11 @@ sql grant read on test.st1 to wxy;
 sql close
 sql connect wxy
 
+sql reset query cache;
 sql select * from test.st1; 
+if $rows != 11 then 
+  return -1
+endi
 sql insert into test.st1s1 values(now, 10) test.st1s2 values(now, 20);
 sql_error select * from test.st2; 
 sql insert into test.st2s1 values(now, 10) test.st2s2 values(now, 20);
@@ -241,7 +257,11 @@ sql grant read on test.st1 with id = 1 to wxy;
 sql close
 sql connect wxy
 
+sql reset query cache;
 sql select * from test.st1; 
+if $rows != 8 then 
+  return -1
+endi
 sql insert into test.st1s1 values(now, 10) test.st1s2 values(now, 20);
 sql_error select * from test.st2; 
 sql insert into test.st2s1 values(now, 10) test.st2s2 values(now, 20);
@@ -256,6 +276,7 @@ sql grant write on test.st1 to wxy;
 sql close
 sql connect wxy
 
+sql reset query cache;
 sql_error select * from test.st1; 
 sql insert into test.st1s1 values(now, 10) test.st1s2 values(now, 20);
 sql_error select * from test.st2; 
@@ -271,6 +292,7 @@ sql grant write on test.st1 with id = 1 to wxy;
 sql close
 sql connect wxy
 
+sql reset query cache;
 sql_error select * from test.st1; 
 sql insert into test.st1s1 values(now, 10);
 sql_error insert into test.st1s2 values(now, 20);
diff --git a/tests/script/win-test-file b/tests/script/win-test-file
index 2d5a1b3108..3b358993fa 100644
--- a/tests/script/win-test-file
+++ b/tests/script/win-test-file
@@ -3,6 +3,7 @@
 ./test.sh -f tsim/user/privilege_db.sim
 ./test.sh -f tsim/user/privilege_sysinfo.sim
 ./test.sh -f tsim/user/privilege_topic.sim
+./test.sh -f tsim/user/privilege_table.sim
 ./test.sh -f tsim/db/alter_option.sim
 rem ./test.sh -f tsim/db/alter_replica_13.sim
 ./test.sh -f tsim/db/alter_replica_31.sim