laravel-permission-development

Add the HasRoles trait to your User model, which includes HasPermissions. Then create roles and permissions with Role::create() or the idempotent findOrCreate() methods, and assign roles to users with assignRole().

Register the role, permission, and role_or_permission middleware aliases in bootstrap/app.php, then apply them to routes like middleware(['role:manager|writer']). The pipe character provides OR logic, and a guard can be specified after a comma.

Check permissions using $user->can() rather than roles, since apps should verify permissions while roles merely group them. This approach also supports Super Admin overrides via Gate::before, which role checks bypass.

Define a Gate::before callback in AppServiceProvider::boot() that returns true when the user has the Super Admin role. It must return null rather than false for other users so normal permission checks still run.

The package caches permissions, so stale cache causes new permissions to be unrecognized. Call app()[PermissionRegistrar::class]->forgetCachedPermissions() at the start of your seeder or after direct database inserts.

Yes, enable the teams option in config/permission.php before running migrations, then set the active team with setPermissionsTeamId() in middleware. When switching teams, unset the cached roles and permissions relations on the user.