diff --git a/apps/web/src/components/layout/header.tsx b/apps/web/src/components/layout/header.tsx
index 0915de06..fd0d37ee 100644
--- a/apps/web/src/components/layout/header.tsx
+++ b/apps/web/src/components/layout/header.tsx
@@ -7,7 +7,7 @@
  *   - brand-area: AwoooI Pills V2 logo + display name
  *   - page-title: Syne 26px 800
  *   - lang-btn: pill 樣式 (border-radius 20px)
- *   - avatar: 34px 圓形 #d97757
+ *   - operator marker: 34px 圓形 #d97757，僅顯示角色圖示，不顯示個人縮寫
  *
  * Phase 19: 使用 Z_INDEX.HEADER (30)
  * @see lib/constants/z-index.ts
@@ -17,6 +17,7 @@
 import { useCallback } from 'react'
 import { useTranslations } from 'next-intl'
 import { usePathname } from 'next/navigation'
+import { ShieldCheck } from 'lucide-react'
 import { Z_INDEX } from '@/lib/constants/z-index'
 
 // =============================================================================
@@ -194,8 +195,11 @@ export function Header({
           {t('en')}
         </button>
 
-        {/* Avatar — 34px 圓形 #d97757 */}
-        <div style={{
+        {/* Operator marker — 不顯示個人縮寫 */}
+        <div
+          aria-label="操作員"
+          title="操作員"
+          style={{
           display: compact ? 'none' : 'flex',
           width: 34,
           height: 34,
@@ -208,8 +212,9 @@ export function Header({
           fontWeight: 700,
           flexShrink: 0,
           fontFamily: 'var(--font-body), monospace',
-        }}>
-          OG
+        }}
+        >
+          <ShieldCheck size={16} aria-hidden="true" strokeWidth={2.2} />
         </div>
       </div>
     </header>
diff --git a/scripts/security/security-mirror-progress-guard.py b/scripts/security/security-mirror-progress-guard.py
index 04aecafa..e18fbfe5 100755
--- a/scripts/security/security-mirror-progress-guard.py
+++ b/scripts/security/security-mirror-progress-guard.py
@@ -276,6 +276,9 @@ def validate(root: Path) -> None:
     sidebar = (root / "apps" / "web" / "src" / "components" / "layout" / "sidebar.tsx").read_text(
         encoding="utf-8"
     )
+    layout_header = (root / "apps" / "web" / "src" / "components" / "layout" / "header.tsx").read_text(
+        encoding="utf-8"
+    )
     command_palette = (
         root / "apps" / "web" / "src" / "components" / "command-palette" / "CommandPalette.tsx"
     ).read_text(encoding="utf-8")
@@ -350,6 +353,7 @@ def validate(root: Path) -> None:
             governance_automation_inventory_tab,
             iwooos_bridge,
             public_security_redaction,
+            layout_header,
         ]
     )
     for forbidden in [
@@ -368,6 +372,8 @@ def validate(root: Path) -> None:
         "ws={route.websocket_route_count}",
     ]:
         assert_text_not_contains("frontend.tenants_visible_internal_implementation_text", awooop_tenants_page, forbidden)
+    assert_text_not_contains("frontend.layout_header.personal_initials", layout_header, ">OG<")
+    assert_text_contains("frontend.layout_header.operator_marker_icon", layout_header, "ShieldCheck")
 
     for label, text in [
         ("awooop_home_page", awooop_home_page),