diff --git a/scripts/iam-init.sql b/scripts/iam-init.sql
new file mode 100644
index 0000000..2cb30b5
--- /dev/null
+++ b/scripts/iam-init.sql
@@ -0,0 +1,58 @@
+-- IAM 服务表结构（P2 身份阶段）
+CREATE TABLE IF NOT EXISTS `iam_users` (
+  `id` CHAR(36) NOT NULL,
+  `email` VARCHAR(255) NOT NULL,
+  `password_hash` VARCHAR(255) NOT NULL,
+  `name` VARCHAR(100) NOT NULL,
+  `status` VARCHAR(20) NOT NULL DEFAULT 'active',
+  `created_at` TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `iam_users_email_unique` (`email`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `iam_roles` (
+  `id` CHAR(36) NOT NULL,
+  `name` VARCHAR(50) NOT NULL,
+  `description` VARCHAR(255) NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `iam_roles_name_unique` (`name`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `iam_user_roles` (
+  `user_id` CHAR(36) NOT NULL,
+  `role_id` CHAR(36) NOT NULL,
+  `created_at` TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (`user_id`, `role_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `iam_permissions` (
+  `id` CHAR(36) NOT NULL,
+  `name` VARCHAR(100) NOT NULL,
+  `resource` VARCHAR(50) NOT NULL,
+  `action` VARCHAR(50) NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `iam_permissions_name_unique` (`name`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `iam_role_permissions` (
+  `role_id` CHAR(36) NOT NULL,
+  `permission_id` CHAR(36) NOT NULL,
+  PRIMARY KEY (`role_id`, `permission_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `iam_refresh_tokens` (
+  `id` CHAR(36) NOT NULL,
+  `user_id` CHAR(36) NOT NULL,
+  `token_hash` VARCHAR(255) NOT NULL,
+  `expires_at` TIMESTAMP NOT NULL,
+  `revoked_at` TIMESTAMP NULL,
+  `created_at` TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  INDEX `idx_iam_refresh_tokens_user_id` (`user_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- 种子数据：默认 teacher 角色
+INSERT IGNORE INTO `iam_roles` (`id`, `name`, `description`) VALUES
+  ('00000000-0000-0000-0000-000000000001', 'teacher', '教师角色'),
+  ('00000000-0000-0000-0000-000000000002', 'admin', '管理员角色');