Users & Roles

Manage admin accounts, assign roles, and configure permissions.

Users

Fields

• name — display name
• email — unique, required
• password — required on create, optional on update
• avatar — uploaded file (stored via media library)
• is_active — disables login when false
• roles[] — one or more roles (multi-select)

Roles

Permission matrix

Permissions are stored as a JSON map on roles.permissions, with one boolean per ability:

{
  "users.view":          true,
  "users.create":        true,
  "users.update":        true,
  "users.delete":        false,

  "content.view":        true,
  "content.create":      true,
  "content.publish":     true,
  "content.delete":      false,

  "media.view":          true,
  "media.upload":        true,
  "media.delete":        false,

  "settings.manage":     false,
  "api-keys.manage":     false,
  "webhooks.manage":     false,
  "languages.manage":    false,
  "activity.view":       true
}

Checking permissions

// In controller
if (! auth()->user()->can('content.publish')) {
    abort(403);
}

// In Blade
@can('media.delete')
    <button class="text-red-600">Delete</button>
@endcan

Default roles

• Super Admin — all permissions; not deletable.
• Editor — content + media; no system settings.
• Author — create/update own entries; no publish, no delete.