diff --git a/shortcuts/register.go b/shortcuts/register.go
index f2e9f85dd..439870787 100644
--- a/shortcuts/register.go
+++ b/shortcuts/register.go
@@ -9,6 +9,7 @@ import (
 	"github.com/larksuite/cli/shortcuts/okr"
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/internal/cmdmeta"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/shortcuts/base"
@@ -92,6 +93,18 @@ func RegisterShortcutsWithContext(ctx context.Context, program *cobra.Command, f
 			}
 			program.AddCommand(svc)
 		}
+		// Tag the service group with its domain so platform.ByDomain
+		// and Rule.Allow path-globs work without each leaf shortcut
+		// having to declare the domain itself: cmdmeta.Domain walks up
+		// the parent chain and stops at the first annotated ancestor
+		// (this command).
+		//
+		// Done OUTSIDE the create branch so the tag is still applied
+		// when the service command was pre-created by cmd/service
+		// (OpenAPI auto-registration adds im, drive, calendar, etc.
+		// before shortcuts run). Without this, only pure-shortcut
+		// services like `docs` would get tagged.
+		cmdmeta.SetDomain(svc, service)
 		if service == "docs" {
 			doc.ConfigureServiceHelp(svc)
 		}
diff --git a/shortcuts/register_test.go b/shortcuts/register_test.go
index ae49b64b3..2aecda09f 100644
--- a/shortcuts/register_test.go
+++ b/shortcuts/register_test.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/internal/cmdmeta"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
@@ -98,6 +99,37 @@ func TestRegisterShortcutsMountsBaseCommands(t *testing.T) {
 	}
 }
 
+// Service-level cobra commands created by RegisterShortcuts must carry
+// the cmdmeta.Domain annotation so plugin Selectors (platform.ByDomain)
+// and Rule.Allow path-globs can resolve a command's business domain.
+// The annotation is set on the parent; cmdmeta.Domain walks up the
+// parent chain so every leaf shortcut inherits without extra tagging.
+func TestRegisterShortcutsTagsServiceDomain(t *testing.T) {
+	program := &cobra.Command{Use: "root"}
+	RegisterShortcuts(program, newRegisterTestFactory(t))
+
+	for _, svc := range []string{"im", "docs", "drive", "calendar", "base"} {
+		group, _, err := program.Find([]string{svc})
+		if err != nil || group == nil {
+			t.Errorf("service %q not mounted", svc)
+			continue
+		}
+		if got := cmdmeta.Domain(group); got != svc {
+			t.Errorf("service %q domain = %q, want %q", svc, got, svc)
+		}
+	}
+
+	// Inheritance: a leaf shortcut under a service must also resolve
+	// to the parent's domain via cmdmeta.Domain's parent-chain walk.
+	leaf, _, err := program.Find([]string{"im", "+messages-send"})
+	if err != nil || leaf == nil {
+		t.Fatalf("expected im/+messages-send to be mounted")
+	}
+	if got := cmdmeta.Domain(leaf); got != "im" {
+		t.Errorf("leaf domain via parent inheritance = %q, want %q", got, "im")
+	}
+}
+
 func TestRegisterShortcutsMountsDocsMediaPreview(t *testing.T) {
 	program := &cobra.Command{Use: "root"}
 	RegisterShortcuts(program, newRegisterTestFactory(t))