diff --git a/build/support-files/templates/#etc#bkiam_config.yaml b/build/support-files/templates/#etc#bkiam_config.yaml
index bf671f3c..97d18bbe 100644
--- a/build/support-files/templates/#etc#bkiam_config.yaml
+++ b/build/support-files/templates/#etc#bkiam_config.yaml
@@ -71,6 +71,28 @@ customQuotas:
         max_actions_limit: 1500
         max_resource_types_limit: 500
         max_instance_selections_limit: 500
+  - id: bk_paas3
+    quota:
+      web:
+        subject_max_groups_limit: 1000
+  - id: bk_bcs_app
+    quota:
+      web:
+        subject_max_groups_limit: 500
+  - id: bk_ci_rbac
+    quota:
+      web:
+        subject_max_groups_limit: 30000
+      model:
+        max_actions_limit: 200
+  - id: bk_monitorv3
+    quota:
+      web:
+        subject_max_groups_limit: 2000
+  - id: bk_log_search
+    quota:
+      web:
+        subject_max_groups_limit: 1000
 
 logger:
   system:
diff --git a/pkg/database/dao/subject_template_group.go b/pkg/database/dao/subject_template_group.go
index b1d2fdbc..f9ff41c9 100644
--- a/pkg/database/dao/subject_template_group.go
+++ b/pkg/database/dao/subject_template_group.go
@@ -118,7 +118,7 @@ func (m *subjectTemplateGroupManager) GetMaxExpiredAtBySubjectGroup(
 	subjectPK, groupPK int64,
 	excludeTemplateID int64,
 ) (int64, error) {
-	var expiredAt int64
+	var expiredAt sql.NullInt64
 	query := `SELECT
 		 MAX(expired_at)
 		 FROM subject_template_group
@@ -126,7 +126,16 @@ func (m *subjectTemplateGroupManager) GetMaxExpiredAtBySubjectGroup(
 		 AND group_pk = ?
 		 AND template_id != ?`
 	err := database.SqlxGet(m.DB, &expiredAt, query, subjectPK, groupPK, excludeTemplateID)
-	return expiredAt, err
+	if err != nil {
+		return 0, err
+	}
+
+	if expiredAt.Valid {
+		return expiredAt.Int64, nil
+	}
+
+	// Handle NULL case, for example, by returning a default value
+	return 0, nil
 }
 
 func (m *subjectTemplateGroupManager) ListPagingTemplateGroupMember(
diff --git a/pkg/service/group.go b/pkg/service/group.go
index e8afbb8d..617d7745 100644
--- a/pkg/service/group.go
+++ b/pkg/service/group.go
@@ -646,18 +646,22 @@ func (l *groupService) BulkUpdateSubjectSystemGroupBySubjectTemplateGroupWithTx(
 		}
 
 		for _, systemID := range systemIDs {
-			for _, r := range relations {
-				err := l.addOrUpdateSubjectSystemGroup(tx, r.SubjectPK, systemID, relation.GroupPK, r.ExpiredAt)
-				if err != nil {
-					return errorWrapf(
-						err,
-						"addOrUpdateSubjectSystemGroup systemID=`%s`, subjectPK=`%d`, groupPK=`%d`, expiredAt=`%d`, fail",
-						systemID,
-						r.SubjectPK,
-						relation.GroupPK,
-						r.ExpiredAt,
-					)
-				}
+			err := l.addOrUpdateSubjectSystemGroup(
+				tx,
+				relation.SubjectPK,
+				systemID,
+				relation.GroupPK,
+				relation.ExpiredAt,
+			)
+			if err != nil {
+				return errorWrapf(
+					err,
+					"addOrUpdateSubjectSystemGroup systemID=`%s`, subjectPK=`%d`, groupPK=`%d`, expiredAt=`%d`, fail",
+					systemID,
+					relation.SubjectPK,
+					relation.GroupPK,
+					relation.ExpiredAt,
+				)
 			}
 		}
 	}
@@ -751,17 +755,15 @@ func (l *groupService) BulkDeleteSubjectTemplateGroupWithTx(
 		}
 
 		for _, systemID := range systemIDs {
-			for _, r := range relations {
-				err = l.removeSubjectSystemGroup(tx, r.SubjectPK, systemID, relation.GroupPK)
-				if err != nil {
-					return errorWrapf(
-						err,
-						"removeSubjectSystemGroup systemID=`%s`, subjectPK=`%d`, groupPK=`%d`, fail",
-						systemID,
-						r.SubjectPK,
-						relation.GroupPK,
-					)
-				}
+			err = l.removeSubjectSystemGroup(tx, relation.SubjectPK, systemID, relation.GroupPK)
+			if err != nil {
+				return errorWrapf(
+					err,
+					"removeSubjectSystemGroup systemID=`%s`, subjectPK=`%d`, groupPK=`%d`, fail",
+					systemID,
+					relation.SubjectPK,
+					relation.GroupPK,
+				)
 			}
 		}
 	}