laravel-permission-development

Install spatie/laravel-permission, add the HasRoles trait to your User model, then create roles and permissions with Role::create() and Permission::create(). Assign roles to users with assignRole() and grant permissions to roles with givePermissionTo().

Register the role, permission, and role_or_permission middleware aliases in bootstrap/app.php, then apply them to routes like middleware(['permission:edit articles']). Use a pipe character for OR logic, such as role:manager|writer.

Check permissions, not roles, using $user->can('permission-name') for all authorization logic. Roles should group permissions, and permission checks support Super Admin overrides via Gate::before, while direct role checks bypass the Gate.

Add a Gate::before callback in AppServiceProvider::boot() that returns true when the user has the Super Admin role. It must return null for other users so normal permission checks still run.

The package caches permissions, so stale cache causes seeded changes to be ignored. Call forgetCachedPermissions() on the PermissionRegistrar before seeding and after any direct database inserts like Permission::insert().

Yes, enable the teams option in config/permission.php before running migrations, then set the active team with setPermissionsTeamId() in middleware. When switching teams, unset the cached roles and permissions relations on the user.