Spatie maintains many Laravel packages. Three of them solve problems almost every business application meets: who may do what (laravel-permission), where files live (laravel-medialibrary) and who changed what (laravel-activitylog).

spatie/laravel-permission

php
// composer require spatie/laravel-permission
// php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"
// php artisan migrate

use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable
{
    use HasRoles;
}

$role = Role::create(['name' => 'editor']);
Permission::create(['name' => 'publish posts']);
$role->givePermissionTo('publish posts');

$user->assignRole('editor');
$user->hasRole('editor');           // true
$user->can('publish posts');        // true, through the role
$user->givePermissionTo('edit posts');  // direct permission
php
// bootstrap/app.php
->withMiddleware(function (Middleware $middleware) {
    $middleware->alias([
        'role' => \Spatie\Permission\Middleware\RoleMiddleware::class,
        'permission' => \Spatie\Permission\Middleware\PermissionMiddleware::class,
    ]);
})

Route::middleware('role:admin')->group(function () { /* ... */ });
Route::post('/posts/{post}/publish', PublishController::class)
    ->middleware('permission:publish posts');

// Blade
@can('publish posts')
    <button>Publish</button>
@endcan

// seeders: reset the cache first
app()[PermissionRegistrar::class]->forgetCachedPermissions();