diff --git a/packages/address/src/Policies/AddressPolicy.php b/packages/address/src/Policies/AddressPolicy.php
new file mode 100644
index 0000000000..8efb660453
--- /dev/null
+++ b/packages/address/src/Policies/AddressPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Address\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Address\Models\Address;
+
+class AddressPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Address');
+    }
+
+    public function view(AuthUser $authUser, Address $address): bool
+    {
+        return $authUser->can('View:Address');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Address');
+    }
+
+    public function update(AuthUser $authUser, Address $address): bool
+    {
+        return $authUser->can('Update:Address');
+    }
+
+    public function delete(AuthUser $authUser, Address $address): bool
+    {
+        return $authUser->can('Delete:Address');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Address');
+    }
+
+    public function restore(AuthUser $authUser, Address $address): bool
+    {
+        return $authUser->can('Restore:Address');
+    }
+
+    public function forceDelete(AuthUser $authUser, Address $address): bool
+    {
+        return $authUser->can('ForceDelete:Address');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Address');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Address');
+    }
+
+    public function replicate(AuthUser $authUser, Address $address): bool
+    {
+        return $authUser->can('Replicate:Address');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Address');
+    }
+}
diff --git a/packages/audit/src/Policies/ActivityPolicy.php b/packages/audit/src/Policies/ActivityPolicy.php
new file mode 100644
index 0000000000..592bff7bb1
--- /dev/null
+++ b/packages/audit/src/Policies/ActivityPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Audit\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Audit\Models\Activity;
+
+class ActivityPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Activity');
+    }
+
+    public function view(AuthUser $authUser, Activity $activity): bool
+    {
+        return $authUser->can('View:Activity');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Activity');
+    }
+
+    public function update(AuthUser $authUser, Activity $activity): bool
+    {
+        return $authUser->can('Update:Activity');
+    }
+
+    public function delete(AuthUser $authUser, Activity $activity): bool
+    {
+        return $authUser->can('Delete:Activity');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Activity');
+    }
+
+    public function restore(AuthUser $authUser, Activity $activity): bool
+    {
+        return $authUser->can('Restore:Activity');
+    }
+
+    public function forceDelete(AuthUser $authUser, Activity $activity): bool
+    {
+        return $authUser->can('ForceDelete:Activity');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Activity');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Activity');
+    }
+
+    public function replicate(AuthUser $authUser, Activity $activity): bool
+    {
+        return $authUser->can('Replicate:Activity');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Activity');
+    }
+}
diff --git a/packages/builder/src/Policies/FieldGroupPolicy.php b/packages/builder/src/Policies/FieldGroupPolicy.php
new file mode 100644
index 0000000000..47d772be77
--- /dev/null
+++ b/packages/builder/src/Policies/FieldGroupPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Builder\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Builder\Models\FieldGroup;
+
+class FieldGroupPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:FieldGroup');
+    }
+
+    public function view(AuthUser $authUser, FieldGroup $fieldGroup): bool
+    {
+        return $authUser->can('View:FieldGroup');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:FieldGroup');
+    }
+
+    public function update(AuthUser $authUser, FieldGroup $fieldGroup): bool
+    {
+        return $authUser->can('Update:FieldGroup');
+    }
+
+    public function delete(AuthUser $authUser, FieldGroup $fieldGroup): bool
+    {
+        return $authUser->can('Delete:FieldGroup');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:FieldGroup');
+    }
+
+    public function restore(AuthUser $authUser, FieldGroup $fieldGroup): bool
+    {
+        return $authUser->can('Restore:FieldGroup');
+    }
+
+    public function forceDelete(AuthUser $authUser, FieldGroup $fieldGroup): bool
+    {
+        return $authUser->can('ForceDelete:FieldGroup');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:FieldGroup');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:FieldGroup');
+    }
+
+    public function replicate(AuthUser $authUser, FieldGroup $fieldGroup): bool
+    {
+        return $authUser->can('Replicate:FieldGroup');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:FieldGroup');
+    }
+}
diff --git a/packages/category/src/Policies/CategoryPolicy.php b/packages/category/src/Policies/CategoryPolicy.php
new file mode 100644
index 0000000000..6b730916a9
--- /dev/null
+++ b/packages/category/src/Policies/CategoryPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Category\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Category\Models\Category;
+
+class CategoryPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Category');
+    }
+
+    public function view(AuthUser $authUser, Category $category): bool
+    {
+        return $authUser->can('View:Category');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Category');
+    }
+
+    public function update(AuthUser $authUser, Category $category): bool
+    {
+        return $authUser->can('Update:Category');
+    }
+
+    public function delete(AuthUser $authUser, Category $category): bool
+    {
+        return $authUser->can('Delete:Category');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Category');
+    }
+
+    public function restore(AuthUser $authUser, Category $category): bool
+    {
+        return $authUser->can('Restore:Category');
+    }
+
+    public function forceDelete(AuthUser $authUser, Category $category): bool
+    {
+        return $authUser->can('ForceDelete:Category');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Category');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Category');
+    }
+
+    public function replicate(AuthUser $authUser, Category $category): bool
+    {
+        return $authUser->can('Replicate:Category');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Category');
+    }
+}
diff --git a/packages/company/src/Policies/CompanyPolicy.php b/packages/company/src/Policies/CompanyPolicy.php
new file mode 100644
index 0000000000..903d6ed620
--- /dev/null
+++ b/packages/company/src/Policies/CompanyPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Company\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Company\Models\Company;
+
+class CompanyPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Company');
+    }
+
+    public function view(AuthUser $authUser, Company $company): bool
+    {
+        return $authUser->can('View:Company');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Company');
+    }
+
+    public function update(AuthUser $authUser, Company $company): bool
+    {
+        return $authUser->can('Update:Company');
+    }
+
+    public function delete(AuthUser $authUser, Company $company): bool
+    {
+        return $authUser->can('Delete:Company');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Company');
+    }
+
+    public function restore(AuthUser $authUser, Company $company): bool
+    {
+        return $authUser->can('Restore:Company');
+    }
+
+    public function forceDelete(AuthUser $authUser, Company $company): bool
+    {
+        return $authUser->can('ForceDelete:Company');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Company');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Company');
+    }
+
+    public function replicate(AuthUser $authUser, Company $company): bool
+    {
+        return $authUser->can('Replicate:Company');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Company');
+    }
+}
diff --git a/packages/connect/src/Policies/ApiConnectionPolicy.php b/packages/connect/src/Policies/ApiConnectionPolicy.php
new file mode 100644
index 0000000000..ea2e841717
--- /dev/null
+++ b/packages/connect/src/Policies/ApiConnectionPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Connect\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Connect\Models\ApiConnection;
+
+class ApiConnectionPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:ApiConnection');
+    }
+
+    public function view(AuthUser $authUser, ApiConnection $apiConnection): bool
+    {
+        return $authUser->can('View:ApiConnection');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:ApiConnection');
+    }
+
+    public function update(AuthUser $authUser, ApiConnection $apiConnection): bool
+    {
+        return $authUser->can('Update:ApiConnection');
+    }
+
+    public function delete(AuthUser $authUser, ApiConnection $apiConnection): bool
+    {
+        return $authUser->can('Delete:ApiConnection');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:ApiConnection');
+    }
+
+    public function restore(AuthUser $authUser, ApiConnection $apiConnection): bool
+    {
+        return $authUser->can('Restore:ApiConnection');
+    }
+
+    public function forceDelete(AuthUser $authUser, ApiConnection $apiConnection): bool
+    {
+        return $authUser->can('ForceDelete:ApiConnection');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:ApiConnection');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:ApiConnection');
+    }
+
+    public function replicate(AuthUser $authUser, ApiConnection $apiConnection): bool
+    {
+        return $authUser->can('Replicate:ApiConnection');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:ApiConnection');
+    }
+}
diff --git a/packages/connect/src/Policies/ApiEndpointPolicy.php b/packages/connect/src/Policies/ApiEndpointPolicy.php
new file mode 100644
index 0000000000..ce1c47da90
--- /dev/null
+++ b/packages/connect/src/Policies/ApiEndpointPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Connect\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Connect\Models\ApiEndpoint;
+
+class ApiEndpointPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:ApiEndpoint');
+    }
+
+    public function view(AuthUser $authUser, ApiEndpoint $apiEndpoint): bool
+    {
+        return $authUser->can('View:ApiEndpoint');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:ApiEndpoint');
+    }
+
+    public function update(AuthUser $authUser, ApiEndpoint $apiEndpoint): bool
+    {
+        return $authUser->can('Update:ApiEndpoint');
+    }
+
+    public function delete(AuthUser $authUser, ApiEndpoint $apiEndpoint): bool
+    {
+        return $authUser->can('Delete:ApiEndpoint');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:ApiEndpoint');
+    }
+
+    public function restore(AuthUser $authUser, ApiEndpoint $apiEndpoint): bool
+    {
+        return $authUser->can('Restore:ApiEndpoint');
+    }
+
+    public function forceDelete(AuthUser $authUser, ApiEndpoint $apiEndpoint): bool
+    {
+        return $authUser->can('ForceDelete:ApiEndpoint');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:ApiEndpoint');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:ApiEndpoint');
+    }
+
+    public function replicate(AuthUser $authUser, ApiEndpoint $apiEndpoint): bool
+    {
+        return $authUser->can('Replicate:ApiEndpoint');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:ApiEndpoint');
+    }
+}
diff --git a/packages/connect/src/Policies/ApiLogPolicy.php b/packages/connect/src/Policies/ApiLogPolicy.php
new file mode 100644
index 0000000000..e079c189d0
--- /dev/null
+++ b/packages/connect/src/Policies/ApiLogPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Connect\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Connect\Models\ApiLog;
+
+class ApiLogPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:ApiLog');
+    }
+
+    public function view(AuthUser $authUser, ApiLog $apiLog): bool
+    {
+        return $authUser->can('View:ApiLog');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:ApiLog');
+    }
+
+    public function update(AuthUser $authUser, ApiLog $apiLog): bool
+    {
+        return $authUser->can('Update:ApiLog');
+    }
+
+    public function delete(AuthUser $authUser, ApiLog $apiLog): bool
+    {
+        return $authUser->can('Delete:ApiLog');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:ApiLog');
+    }
+
+    public function restore(AuthUser $authUser, ApiLog $apiLog): bool
+    {
+        return $authUser->can('Restore:ApiLog');
+    }
+
+    public function forceDelete(AuthUser $authUser, ApiLog $apiLog): bool
+    {
+        return $authUser->can('ForceDelete:ApiLog');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:ApiLog');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:ApiLog');
+    }
+
+    public function replicate(AuthUser $authUser, ApiLog $apiLog): bool
+    {
+        return $authUser->can('Replicate:ApiLog');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:ApiLog');
+    }
+}
diff --git a/packages/contact/src/Policies/ContactPolicy.php b/packages/contact/src/Policies/ContactPolicy.php
new file mode 100644
index 0000000000..92d2236542
--- /dev/null
+++ b/packages/contact/src/Policies/ContactPolicy.php
@@ -0,0 +1,71 @@
+<?php
+
+namespace Moox\Contact\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+
+class ContactPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Contact');
+    }
+
+    public function view(AuthUser $authUser): bool
+    {
+        return $authUser->can('View:Contact');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Contact');
+    }
+
+    public function update(AuthUser $authUser): bool
+    {
+        return $authUser->can('Update:Contact');
+    }
+
+    public function delete(AuthUser $authUser): bool
+    {
+        return $authUser->can('Delete:Contact');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Contact');
+    }
+
+    public function restore(AuthUser $authUser): bool
+    {
+        return $authUser->can('Restore:Contact');
+    }
+
+    public function forceDelete(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDelete:Contact');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Contact');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Contact');
+    }
+
+    public function replicate(AuthUser $authUser): bool
+    {
+        return $authUser->can('Replicate:Contact');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Contact');
+    }
+}
diff --git a/packages/customer/src/Policies/CustomerPolicy.php b/packages/customer/src/Policies/CustomerPolicy.php
new file mode 100644
index 0000000000..1a6b0a30cb
--- /dev/null
+++ b/packages/customer/src/Policies/CustomerPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Customer\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Customer\Models\Customer;
+
+class CustomerPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Customer');
+    }
+
+    public function view(AuthUser $authUser, Customer $customer): bool
+    {
+        return $authUser->can('View:Customer');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Customer');
+    }
+
+    public function update(AuthUser $authUser, Customer $customer): bool
+    {
+        return $authUser->can('Update:Customer');
+    }
+
+    public function delete(AuthUser $authUser, Customer $customer): bool
+    {
+        return $authUser->can('Delete:Customer');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Customer');
+    }
+
+    public function restore(AuthUser $authUser, Customer $customer): bool
+    {
+        return $authUser->can('Restore:Customer');
+    }
+
+    public function forceDelete(AuthUser $authUser, Customer $customer): bool
+    {
+        return $authUser->can('ForceDelete:Customer');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Customer');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Customer');
+    }
+
+    public function replicate(AuthUser $authUser, Customer $customer): bool
+    {
+        return $authUser->can('Replicate:Customer');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Customer');
+    }
+}
diff --git a/packages/data/src/Policies/StaticAllowanceReasonPolicy.php b/packages/data/src/Policies/StaticAllowanceReasonPolicy.php
new file mode 100644
index 0000000000..a562d0f9a1
--- /dev/null
+++ b/packages/data/src/Policies/StaticAllowanceReasonPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticAllowanceReason;
+
+class StaticAllowanceReasonPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticAllowanceReason');
+    }
+
+    public function view(AuthUser $authUser, StaticAllowanceReason $staticAllowanceReason): bool
+    {
+        return $authUser->can('View:StaticAllowanceReason');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticAllowanceReason');
+    }
+
+    public function update(AuthUser $authUser, StaticAllowanceReason $staticAllowanceReason): bool
+    {
+        return $authUser->can('Update:StaticAllowanceReason');
+    }
+
+    public function delete(AuthUser $authUser, StaticAllowanceReason $staticAllowanceReason): bool
+    {
+        return $authUser->can('Delete:StaticAllowanceReason');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticAllowanceReason');
+    }
+
+    public function restore(AuthUser $authUser, StaticAllowanceReason $staticAllowanceReason): bool
+    {
+        return $authUser->can('Restore:StaticAllowanceReason');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticAllowanceReason $staticAllowanceReason): bool
+    {
+        return $authUser->can('ForceDelete:StaticAllowanceReason');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticAllowanceReason');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticAllowanceReason');
+    }
+
+    public function replicate(AuthUser $authUser, StaticAllowanceReason $staticAllowanceReason): bool
+    {
+        return $authUser->can('Replicate:StaticAllowanceReason');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticAllowanceReason');
+    }
+}
diff --git a/packages/data/src/Policies/StaticCertificateKindPolicy.php b/packages/data/src/Policies/StaticCertificateKindPolicy.php
new file mode 100644
index 0000000000..b2bd7a82d1
--- /dev/null
+++ b/packages/data/src/Policies/StaticCertificateKindPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticCertificateKind;
+
+class StaticCertificateKindPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticCertificateKind');
+    }
+
+    public function view(AuthUser $authUser, StaticCertificateKind $staticCertificateKind): bool
+    {
+        return $authUser->can('View:StaticCertificateKind');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticCertificateKind');
+    }
+
+    public function update(AuthUser $authUser, StaticCertificateKind $staticCertificateKind): bool
+    {
+        return $authUser->can('Update:StaticCertificateKind');
+    }
+
+    public function delete(AuthUser $authUser, StaticCertificateKind $staticCertificateKind): bool
+    {
+        return $authUser->can('Delete:StaticCertificateKind');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticCertificateKind');
+    }
+
+    public function restore(AuthUser $authUser, StaticCertificateKind $staticCertificateKind): bool
+    {
+        return $authUser->can('Restore:StaticCertificateKind');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticCertificateKind $staticCertificateKind): bool
+    {
+        return $authUser->can('ForceDelete:StaticCertificateKind');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticCertificateKind');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticCertificateKind');
+    }
+
+    public function replicate(AuthUser $authUser, StaticCertificateKind $staticCertificateKind): bool
+    {
+        return $authUser->can('Replicate:StaticCertificateKind');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticCertificateKind');
+    }
+}
diff --git a/packages/data/src/Policies/StaticChargeReasonPolicy.php b/packages/data/src/Policies/StaticChargeReasonPolicy.php
new file mode 100644
index 0000000000..87d355eb39
--- /dev/null
+++ b/packages/data/src/Policies/StaticChargeReasonPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticChargeReason;
+
+class StaticChargeReasonPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticChargeReason');
+    }
+
+    public function view(AuthUser $authUser, StaticChargeReason $staticChargeReason): bool
+    {
+        return $authUser->can('View:StaticChargeReason');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticChargeReason');
+    }
+
+    public function update(AuthUser $authUser, StaticChargeReason $staticChargeReason): bool
+    {
+        return $authUser->can('Update:StaticChargeReason');
+    }
+
+    public function delete(AuthUser $authUser, StaticChargeReason $staticChargeReason): bool
+    {
+        return $authUser->can('Delete:StaticChargeReason');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticChargeReason');
+    }
+
+    public function restore(AuthUser $authUser, StaticChargeReason $staticChargeReason): bool
+    {
+        return $authUser->can('Restore:StaticChargeReason');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticChargeReason $staticChargeReason): bool
+    {
+        return $authUser->can('ForceDelete:StaticChargeReason');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticChargeReason');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticChargeReason');
+    }
+
+    public function replicate(AuthUser $authUser, StaticChargeReason $staticChargeReason): bool
+    {
+        return $authUser->can('Replicate:StaticChargeReason');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticChargeReason');
+    }
+}
diff --git a/packages/data/src/Policies/StaticCountryPolicy.php b/packages/data/src/Policies/StaticCountryPolicy.php
new file mode 100644
index 0000000000..b65d4f8ff7
--- /dev/null
+++ b/packages/data/src/Policies/StaticCountryPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticCountry;
+
+class StaticCountryPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticCountry');
+    }
+
+    public function view(AuthUser $authUser, StaticCountry $staticCountry): bool
+    {
+        return $authUser->can('View:StaticCountry');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticCountry');
+    }
+
+    public function update(AuthUser $authUser, StaticCountry $staticCountry): bool
+    {
+        return $authUser->can('Update:StaticCountry');
+    }
+
+    public function delete(AuthUser $authUser, StaticCountry $staticCountry): bool
+    {
+        return $authUser->can('Delete:StaticCountry');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticCountry');
+    }
+
+    public function restore(AuthUser $authUser, StaticCountry $staticCountry): bool
+    {
+        return $authUser->can('Restore:StaticCountry');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticCountry $staticCountry): bool
+    {
+        return $authUser->can('ForceDelete:StaticCountry');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticCountry');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticCountry');
+    }
+
+    public function replicate(AuthUser $authUser, StaticCountry $staticCountry): bool
+    {
+        return $authUser->can('Replicate:StaticCountry');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticCountry');
+    }
+}
diff --git a/packages/data/src/Policies/StaticCurrencyPolicy.php b/packages/data/src/Policies/StaticCurrencyPolicy.php
new file mode 100644
index 0000000000..1b8bbde573
--- /dev/null
+++ b/packages/data/src/Policies/StaticCurrencyPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticCurrency;
+
+class StaticCurrencyPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticCurrency');
+    }
+
+    public function view(AuthUser $authUser, StaticCurrency $staticCurrency): bool
+    {
+        return $authUser->can('View:StaticCurrency');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticCurrency');
+    }
+
+    public function update(AuthUser $authUser, StaticCurrency $staticCurrency): bool
+    {
+        return $authUser->can('Update:StaticCurrency');
+    }
+
+    public function delete(AuthUser $authUser, StaticCurrency $staticCurrency): bool
+    {
+        return $authUser->can('Delete:StaticCurrency');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticCurrency');
+    }
+
+    public function restore(AuthUser $authUser, StaticCurrency $staticCurrency): bool
+    {
+        return $authUser->can('Restore:StaticCurrency');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticCurrency $staticCurrency): bool
+    {
+        return $authUser->can('ForceDelete:StaticCurrency');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticCurrency');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticCurrency');
+    }
+
+    public function replicate(AuthUser $authUser, StaticCurrency $staticCurrency): bool
+    {
+        return $authUser->can('Replicate:StaticCurrency');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticCurrency');
+    }
+}
diff --git a/packages/data/src/Policies/StaticDocumentTypePolicy.php b/packages/data/src/Policies/StaticDocumentTypePolicy.php
new file mode 100644
index 0000000000..9a4592eec2
--- /dev/null
+++ b/packages/data/src/Policies/StaticDocumentTypePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticDocumentType;
+
+class StaticDocumentTypePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticDocumentType');
+    }
+
+    public function view(AuthUser $authUser, StaticDocumentType $staticDocumentType): bool
+    {
+        return $authUser->can('View:StaticDocumentType');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticDocumentType');
+    }
+
+    public function update(AuthUser $authUser, StaticDocumentType $staticDocumentType): bool
+    {
+        return $authUser->can('Update:StaticDocumentType');
+    }
+
+    public function delete(AuthUser $authUser, StaticDocumentType $staticDocumentType): bool
+    {
+        return $authUser->can('Delete:StaticDocumentType');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticDocumentType');
+    }
+
+    public function restore(AuthUser $authUser, StaticDocumentType $staticDocumentType): bool
+    {
+        return $authUser->can('Restore:StaticDocumentType');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticDocumentType $staticDocumentType): bool
+    {
+        return $authUser->can('ForceDelete:StaticDocumentType');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticDocumentType');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticDocumentType');
+    }
+
+    public function replicate(AuthUser $authUser, StaticDocumentType $staticDocumentType): bool
+    {
+        return $authUser->can('Replicate:StaticDocumentType');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticDocumentType');
+    }
+}
diff --git a/packages/data/src/Policies/StaticEasSchemePolicy.php b/packages/data/src/Policies/StaticEasSchemePolicy.php
new file mode 100644
index 0000000000..25b3777420
--- /dev/null
+++ b/packages/data/src/Policies/StaticEasSchemePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticEasScheme;
+
+class StaticEasSchemePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticEasScheme');
+    }
+
+    public function view(AuthUser $authUser, StaticEasScheme $staticEasScheme): bool
+    {
+        return $authUser->can('View:StaticEasScheme');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticEasScheme');
+    }
+
+    public function update(AuthUser $authUser, StaticEasScheme $staticEasScheme): bool
+    {
+        return $authUser->can('Update:StaticEasScheme');
+    }
+
+    public function delete(AuthUser $authUser, StaticEasScheme $staticEasScheme): bool
+    {
+        return $authUser->can('Delete:StaticEasScheme');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticEasScheme');
+    }
+
+    public function restore(AuthUser $authUser, StaticEasScheme $staticEasScheme): bool
+    {
+        return $authUser->can('Restore:StaticEasScheme');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticEasScheme $staticEasScheme): bool
+    {
+        return $authUser->can('ForceDelete:StaticEasScheme');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticEasScheme');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticEasScheme');
+    }
+
+    public function replicate(AuthUser $authUser, StaticEasScheme $staticEasScheme): bool
+    {
+        return $authUser->can('Replicate:StaticEasScheme');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticEasScheme');
+    }
+}
diff --git a/packages/data/src/Policies/StaticIcdSchemePolicy.php b/packages/data/src/Policies/StaticIcdSchemePolicy.php
new file mode 100644
index 0000000000..37b7160d97
--- /dev/null
+++ b/packages/data/src/Policies/StaticIcdSchemePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticIcdScheme;
+
+class StaticIcdSchemePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticIcdScheme');
+    }
+
+    public function view(AuthUser $authUser, StaticIcdScheme $staticIcdScheme): bool
+    {
+        return $authUser->can('View:StaticIcdScheme');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticIcdScheme');
+    }
+
+    public function update(AuthUser $authUser, StaticIcdScheme $staticIcdScheme): bool
+    {
+        return $authUser->can('Update:StaticIcdScheme');
+    }
+
+    public function delete(AuthUser $authUser, StaticIcdScheme $staticIcdScheme): bool
+    {
+        return $authUser->can('Delete:StaticIcdScheme');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticIcdScheme');
+    }
+
+    public function restore(AuthUser $authUser, StaticIcdScheme $staticIcdScheme): bool
+    {
+        return $authUser->can('Restore:StaticIcdScheme');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticIcdScheme $staticIcdScheme): bool
+    {
+        return $authUser->can('ForceDelete:StaticIcdScheme');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticIcdScheme');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticIcdScheme');
+    }
+
+    public function replicate(AuthUser $authUser, StaticIcdScheme $staticIcdScheme): bool
+    {
+        return $authUser->can('Replicate:StaticIcdScheme');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticIcdScheme');
+    }
+}
diff --git a/packages/data/src/Policies/StaticIncotermPolicy.php b/packages/data/src/Policies/StaticIncotermPolicy.php
new file mode 100644
index 0000000000..7c2510f8e2
--- /dev/null
+++ b/packages/data/src/Policies/StaticIncotermPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticIncoterm;
+
+class StaticIncotermPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticIncoterm');
+    }
+
+    public function view(AuthUser $authUser, StaticIncoterm $staticIncoterm): bool
+    {
+        return $authUser->can('View:StaticIncoterm');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticIncoterm');
+    }
+
+    public function update(AuthUser $authUser, StaticIncoterm $staticIncoterm): bool
+    {
+        return $authUser->can('Update:StaticIncoterm');
+    }
+
+    public function delete(AuthUser $authUser, StaticIncoterm $staticIncoterm): bool
+    {
+        return $authUser->can('Delete:StaticIncoterm');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticIncoterm');
+    }
+
+    public function restore(AuthUser $authUser, StaticIncoterm $staticIncoterm): bool
+    {
+        return $authUser->can('Restore:StaticIncoterm');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticIncoterm $staticIncoterm): bool
+    {
+        return $authUser->can('ForceDelete:StaticIncoterm');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticIncoterm');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticIncoterm');
+    }
+
+    public function replicate(AuthUser $authUser, StaticIncoterm $staticIncoterm): bool
+    {
+        return $authUser->can('Replicate:StaticIncoterm');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticIncoterm');
+    }
+}
diff --git a/packages/data/src/Policies/StaticLanguagePolicy.php b/packages/data/src/Policies/StaticLanguagePolicy.php
new file mode 100644
index 0000000000..a831d0cb74
--- /dev/null
+++ b/packages/data/src/Policies/StaticLanguagePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticLanguage;
+
+class StaticLanguagePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticLanguage');
+    }
+
+    public function view(AuthUser $authUser, StaticLanguage $staticLanguage): bool
+    {
+        return $authUser->can('View:StaticLanguage');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticLanguage');
+    }
+
+    public function update(AuthUser $authUser, StaticLanguage $staticLanguage): bool
+    {
+        return $authUser->can('Update:StaticLanguage');
+    }
+
+    public function delete(AuthUser $authUser, StaticLanguage $staticLanguage): bool
+    {
+        return $authUser->can('Delete:StaticLanguage');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticLanguage');
+    }
+
+    public function restore(AuthUser $authUser, StaticLanguage $staticLanguage): bool
+    {
+        return $authUser->can('Restore:StaticLanguage');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticLanguage $staticLanguage): bool
+    {
+        return $authUser->can('ForceDelete:StaticLanguage');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticLanguage');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticLanguage');
+    }
+
+    public function replicate(AuthUser $authUser, StaticLanguage $staticLanguage): bool
+    {
+        return $authUser->can('Replicate:StaticLanguage');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticLanguage');
+    }
+}
diff --git a/packages/data/src/Policies/StaticLocalePolicy.php b/packages/data/src/Policies/StaticLocalePolicy.php
new file mode 100644
index 0000000000..4be9412cd1
--- /dev/null
+++ b/packages/data/src/Policies/StaticLocalePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticLocale;
+
+class StaticLocalePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticLocale');
+    }
+
+    public function view(AuthUser $authUser, StaticLocale $staticLocale): bool
+    {
+        return $authUser->can('View:StaticLocale');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticLocale');
+    }
+
+    public function update(AuthUser $authUser, StaticLocale $staticLocale): bool
+    {
+        return $authUser->can('Update:StaticLocale');
+    }
+
+    public function delete(AuthUser $authUser, StaticLocale $staticLocale): bool
+    {
+        return $authUser->can('Delete:StaticLocale');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticLocale');
+    }
+
+    public function restore(AuthUser $authUser, StaticLocale $staticLocale): bool
+    {
+        return $authUser->can('Restore:StaticLocale');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticLocale $staticLocale): bool
+    {
+        return $authUser->can('ForceDelete:StaticLocale');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticLocale');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticLocale');
+    }
+
+    public function replicate(AuthUser $authUser, StaticLocale $staticLocale): bool
+    {
+        return $authUser->can('Replicate:StaticLocale');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticLocale');
+    }
+}
diff --git a/packages/data/src/Policies/StaticPaymentMeanPolicy.php b/packages/data/src/Policies/StaticPaymentMeanPolicy.php
new file mode 100644
index 0000000000..48087bbbb1
--- /dev/null
+++ b/packages/data/src/Policies/StaticPaymentMeanPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticPaymentMean;
+
+class StaticPaymentMeanPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticPaymentMean');
+    }
+
+    public function view(AuthUser $authUser, StaticPaymentMean $staticPaymentMean): bool
+    {
+        return $authUser->can('View:StaticPaymentMean');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticPaymentMean');
+    }
+
+    public function update(AuthUser $authUser, StaticPaymentMean $staticPaymentMean): bool
+    {
+        return $authUser->can('Update:StaticPaymentMean');
+    }
+
+    public function delete(AuthUser $authUser, StaticPaymentMean $staticPaymentMean): bool
+    {
+        return $authUser->can('Delete:StaticPaymentMean');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticPaymentMean');
+    }
+
+    public function restore(AuthUser $authUser, StaticPaymentMean $staticPaymentMean): bool
+    {
+        return $authUser->can('Restore:StaticPaymentMean');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticPaymentMean $staticPaymentMean): bool
+    {
+        return $authUser->can('ForceDelete:StaticPaymentMean');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticPaymentMean');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticPaymentMean');
+    }
+
+    public function replicate(AuthUser $authUser, StaticPaymentMean $staticPaymentMean): bool
+    {
+        return $authUser->can('Replicate:StaticPaymentMean');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticPaymentMean');
+    }
+}
diff --git a/packages/data/src/Policies/StaticTimezonePolicy.php b/packages/data/src/Policies/StaticTimezonePolicy.php
new file mode 100644
index 0000000000..61f62b3e97
--- /dev/null
+++ b/packages/data/src/Policies/StaticTimezonePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticTimezone;
+
+class StaticTimezonePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticTimezone');
+    }
+
+    public function view(AuthUser $authUser, StaticTimezone $staticTimezone): bool
+    {
+        return $authUser->can('View:StaticTimezone');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticTimezone');
+    }
+
+    public function update(AuthUser $authUser, StaticTimezone $staticTimezone): bool
+    {
+        return $authUser->can('Update:StaticTimezone');
+    }
+
+    public function delete(AuthUser $authUser, StaticTimezone $staticTimezone): bool
+    {
+        return $authUser->can('Delete:StaticTimezone');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticTimezone');
+    }
+
+    public function restore(AuthUser $authUser, StaticTimezone $staticTimezone): bool
+    {
+        return $authUser->can('Restore:StaticTimezone');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticTimezone $staticTimezone): bool
+    {
+        return $authUser->can('ForceDelete:StaticTimezone');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticTimezone');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticTimezone');
+    }
+
+    public function replicate(AuthUser $authUser, StaticTimezone $staticTimezone): bool
+    {
+        return $authUser->can('Replicate:StaticTimezone');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticTimezone');
+    }
+}
diff --git a/packages/data/src/Policies/StaticUnitPolicy.php b/packages/data/src/Policies/StaticUnitPolicy.php
new file mode 100644
index 0000000000..8eb6862333
--- /dev/null
+++ b/packages/data/src/Policies/StaticUnitPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticUnit;
+
+class StaticUnitPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticUnit');
+    }
+
+    public function view(AuthUser $authUser, StaticUnit $staticUnit): bool
+    {
+        return $authUser->can('View:StaticUnit');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticUnit');
+    }
+
+    public function update(AuthUser $authUser, StaticUnit $staticUnit): bool
+    {
+        return $authUser->can('Update:StaticUnit');
+    }
+
+    public function delete(AuthUser $authUser, StaticUnit $staticUnit): bool
+    {
+        return $authUser->can('Delete:StaticUnit');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticUnit');
+    }
+
+    public function restore(AuthUser $authUser, StaticUnit $staticUnit): bool
+    {
+        return $authUser->can('Restore:StaticUnit');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticUnit $staticUnit): bool
+    {
+        return $authUser->can('ForceDelete:StaticUnit');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticUnit');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticUnit');
+    }
+
+    public function replicate(AuthUser $authUser, StaticUnit $staticUnit): bool
+    {
+        return $authUser->can('Replicate:StaticUnit');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticUnit');
+    }
+}
diff --git a/packages/data/src/Policies/StaticVatCategoryPolicy.php b/packages/data/src/Policies/StaticVatCategoryPolicy.php
new file mode 100644
index 0000000000..95337d569b
--- /dev/null
+++ b/packages/data/src/Policies/StaticVatCategoryPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticVatCategory;
+
+class StaticVatCategoryPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticVatCategory');
+    }
+
+    public function view(AuthUser $authUser, StaticVatCategory $staticVatCategory): bool
+    {
+        return $authUser->can('View:StaticVatCategory');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticVatCategory');
+    }
+
+    public function update(AuthUser $authUser, StaticVatCategory $staticVatCategory): bool
+    {
+        return $authUser->can('Update:StaticVatCategory');
+    }
+
+    public function delete(AuthUser $authUser, StaticVatCategory $staticVatCategory): bool
+    {
+        return $authUser->can('Delete:StaticVatCategory');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticVatCategory');
+    }
+
+    public function restore(AuthUser $authUser, StaticVatCategory $staticVatCategory): bool
+    {
+        return $authUser->can('Restore:StaticVatCategory');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticVatCategory $staticVatCategory): bool
+    {
+        return $authUser->can('ForceDelete:StaticVatCategory');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticVatCategory');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticVatCategory');
+    }
+
+    public function replicate(AuthUser $authUser, StaticVatCategory $staticVatCategory): bool
+    {
+        return $authUser->can('Replicate:StaticVatCategory');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticVatCategory');
+    }
+}
diff --git a/packages/data/src/Policies/StaticVatExemptionReasonPolicy.php b/packages/data/src/Policies/StaticVatExemptionReasonPolicy.php
new file mode 100644
index 0000000000..ea4e546974
--- /dev/null
+++ b/packages/data/src/Policies/StaticVatExemptionReasonPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Data\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Data\Models\StaticVatExemptionReason;
+
+class StaticVatExemptionReasonPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:StaticVatExemptionReason');
+    }
+
+    public function view(AuthUser $authUser, StaticVatExemptionReason $staticVatExemptionReason): bool
+    {
+        return $authUser->can('View:StaticVatExemptionReason');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:StaticVatExemptionReason');
+    }
+
+    public function update(AuthUser $authUser, StaticVatExemptionReason $staticVatExemptionReason): bool
+    {
+        return $authUser->can('Update:StaticVatExemptionReason');
+    }
+
+    public function delete(AuthUser $authUser, StaticVatExemptionReason $staticVatExemptionReason): bool
+    {
+        return $authUser->can('Delete:StaticVatExemptionReason');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:StaticVatExemptionReason');
+    }
+
+    public function restore(AuthUser $authUser, StaticVatExemptionReason $staticVatExemptionReason): bool
+    {
+        return $authUser->can('Restore:StaticVatExemptionReason');
+    }
+
+    public function forceDelete(AuthUser $authUser, StaticVatExemptionReason $staticVatExemptionReason): bool
+    {
+        return $authUser->can('ForceDelete:StaticVatExemptionReason');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:StaticVatExemptionReason');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:StaticVatExemptionReason');
+    }
+
+    public function replicate(AuthUser $authUser, StaticVatExemptionReason $staticVatExemptionReason): bool
+    {
+        return $authUser->can('Replicate:StaticVatExemptionReason');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:StaticVatExemptionReason');
+    }
+}
diff --git a/packages/department/src/Policies/DepartmentPolicy.php b/packages/department/src/Policies/DepartmentPolicy.php
new file mode 100644
index 0000000000..679a7c2ca2
--- /dev/null
+++ b/packages/department/src/Policies/DepartmentPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Department\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Department\Models\Department;
+
+class DepartmentPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Department');
+    }
+
+    public function view(AuthUser $authUser, Department $department): bool
+    {
+        return $authUser->can('View:Department');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Department');
+    }
+
+    public function update(AuthUser $authUser, Department $department): bool
+    {
+        return $authUser->can('Update:Department');
+    }
+
+    public function delete(AuthUser $authUser, Department $department): bool
+    {
+        return $authUser->can('Delete:Department');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Department');
+    }
+
+    public function restore(AuthUser $authUser, Department $department): bool
+    {
+        return $authUser->can('Restore:Department');
+    }
+
+    public function forceDelete(AuthUser $authUser, Department $department): bool
+    {
+        return $authUser->can('ForceDelete:Department');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Department');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Department');
+    }
+
+    public function replicate(AuthUser $authUser, Department $department): bool
+    {
+        return $authUser->can('Replicate:Department');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Department');
+    }
+}
diff --git a/packages/impersonate/README.md b/packages/impersonate/README.md
index ca22cebd5c..0abb774ada 100644
--- a/packages/impersonate/README.md
+++ b/packages/impersonate/README.md
@@ -7,6 +7,7 @@ Filament user impersonation for Moox — built on [stechstudio/filament-imperson
 ## Features
 
 - Global enable switch plus an allowlist of targets (`impersonate.enabled` / `impersonate.targets`)
+- Optional Shield/Spatie gate (`impersonate.permissions`) — config **and** permission must pass
 - Registers enter/leave listeners that log to moox/audit when that package is installed
 - While impersonating, Spatie activity causer resolves to the real admin (via moox/audit `CauserResolver`)
 - Filament action factory so resources soft-depend on this package instead of STS directly
@@ -45,7 +46,9 @@ use Moox\Impersonate\Filament\Actions\ImpersonateAction;
 
 public static function impersonateAction(): ?Action
 {
-    if (! class_exists(ImpersonateAction::class) || ! ImpersonateAction::isEnabled('finance')) {
+    $user = auth()->user();
+
+    if (! class_exists(ImpersonateAction::class) || ! ImpersonateAction::userMay($user, 'finance')) {
         return null;
     }
 
@@ -56,7 +59,7 @@ public static function impersonateAction(): ?Action
 }
 ```
 
-Targets need `canBeImpersonated(): bool` on the model; admins need `canImpersonate(): bool`.
+Targets need `canBeImpersonated(): bool` on the model; admins need `canImpersonate(): bool` (should call `ImpersonateAction::userMay($this)`).
 
 ### Config
 
@@ -68,6 +71,8 @@ MOOX_IMPERSONATE_TARGETS=finance,portal
 MOOX_IMPERSONATE_AUDIT=true
 ```
 
+Who may impersonate is **not** an env flag — register Shield custom permissions `Impersonate:PortalUser` / `Impersonate:FinanceUser` and assign them to Admin/Support roles.
+
 ### User-device trust while impersonating
 
 When `moox/user-device` is installed, trusted-device enforcement and device tracking are **skipped while impersonating**. That is intentional for support: the admin already passed admin auth and must not need the customer’s trusted device. Enter/leave still go to the audit log (when audit is enabled). Do not treat this as a missing control — document it in your security review if needed.
diff --git a/packages/impersonate/config/impersonate.php b/packages/impersonate/config/impersonate.php
index 39ade11ffa..b207775e88 100644
--- a/packages/impersonate/config/impersonate.php
+++ b/packages/impersonate/config/impersonate.php
@@ -48,4 +48,23 @@
         'log_name' => env('MOOX_IMPERSONATE_AUDIT_LOG', 'impersonate'),
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Shield / Spatie permissions
+    |--------------------------------------------------------------------------
+    |
+    | Who may impersonate is controlled by Shield roles — not by .env.
+    | Ops only toggles enabled + targets above. Permission names are app
+    | constants; register the same keys as Filament Shield custom permissions.
+    |
+    */
+
+    'permissions' => [
+        'required' => true,
+        'targets' => [
+            'portal' => 'Impersonate:PortalUser',
+            'finance' => 'Impersonate:FinanceUser',
+        ],
+    ],
+
 ];
diff --git a/packages/impersonate/docs/IDEA.md b/packages/impersonate/docs/IDEA.md
index 7f34837da9..3ca4573497 100644
--- a/packages/impersonate/docs/IDEA.md
+++ b/packages/impersonate/docs/IDEA.md
@@ -4,7 +4,7 @@ Thin Moox layer around [stechstudio/filament-impersonate](https://github.com/ste
 
 - Soft-depends on **moox/audit** for enter/leave activity logs and attributing causer to the real admin
 - Does not depend on panel-specific packages (finance, portal, user, …)
-- Consumers soft-check `class_exists(Moox\Impersonate\Filament\Actions\ImpersonateAction::class)` before adding Filament actions
-- `MOOX_IMPERSONATE_ENABLED` defaults to **false** (opt-in)
-- `MOOX_IMPERSONATE_TARGETS` is a comma-separated allowlist (e.g. `finance,portal`)
+- Consumers soft-check `ImpersonateAction::userMay($user, 'portal'|'finance')` (config allowlist + Shield permission)
+- **Env (ops):** `MOOX_IMPERSONATE_ENABLED` (default false) and `MOOX_IMPERSONATE_TARGETS` (e.g. `finance,portal`)
+- **Shield (who):** fixed permissions `Impersonate:PortalUser` / `Impersonate:FinanceUser` — not env toggles
 - With **moox/user-device**, device trust/tracking is skipped while impersonating (documented support behaviour, not a config flag)
diff --git a/packages/impersonate/src/Filament/Actions/ImpersonateAction.php b/packages/impersonate/src/Filament/Actions/ImpersonateAction.php
index e421838697..eb4811f4f9 100644
--- a/packages/impersonate/src/Filament/Actions/ImpersonateAction.php
+++ b/packages/impersonate/src/Filament/Actions/ImpersonateAction.php
@@ -4,13 +4,15 @@
 
 namespace Moox\Impersonate\Filament\Actions;
 
+use Illuminate\Contracts\Auth\Access\Authorizable;
+use Illuminate\Contracts\Auth\Authenticatable;
 use STS\FilamentImpersonate\Actions\Impersonate;
 
 /**
  * Thin factory around stechstudio/filament-impersonate.
  *
  * Soft-coupling for consumers (no hard require):
- *   if (! class_exists(ImpersonateAction::class) || ! ImpersonateAction::isEnabled('finance')) {
+ *   if (! class_exists(ImpersonateAction::class) || ! ImpersonateAction::userMay($user, 'finance')) {
  *       return null;
  *   }
  */
@@ -42,6 +44,58 @@ public static function isEnabled(?string $target = null, ?array $config = null):
         return in_array($target, $targets, true);
     }
 
+    /**
+     * Config allowlist plus optional Shield/Spatie permission for the target.
+     *
+     * @param  array{
+     *     enabled?: mixed,
+     *     targets?: list<string>|array<string, mixed>,
+     *     permissions?: array{required?: mixed, targets?: array<string, string>}
+     * }|null  $config
+     */
+    public static function userMay(?Authenticatable $user, ?string $target = null, ?array $config = null): bool
+    {
+        if ($user === null) {
+            return false;
+        }
+
+        $config ??= [
+            'enabled' => config('impersonate.enabled', true),
+            'targets' => config('impersonate.targets', []),
+            'permissions' => config('impersonate.permissions', []),
+        ];
+
+        if (! self::isEnabled($target, $config)) {
+            return false;
+        }
+
+        $permissions = is_array($config['permissions'] ?? null) ? $config['permissions'] : [];
+
+        if (! filter_var($permissions['required'] ?? true, FILTER_VALIDATE_BOOLEAN)) {
+            return true;
+        }
+
+        if (! $user instanceof Authorizable) {
+            return false;
+        }
+
+        $map = is_array($permissions['targets'] ?? null) ? $permissions['targets'] : [];
+
+        if ($target !== null && $target !== '') {
+            $permission = $map[$target] ?? null;
+
+            return is_string($permission) && $permission !== '' && $user->can($permission);
+        }
+
+        foreach ($map as $permission) {
+            if (is_string($permission) && $permission !== '' && $user->can($permission)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     /**
      * @return list<string>
      */
diff --git a/packages/impersonate/tests/Unit/ImpersonateActionTest.php b/packages/impersonate/tests/Unit/ImpersonateActionTest.php
index 539545e49c..9842d1cee3 100644
--- a/packages/impersonate/tests/Unit/ImpersonateActionTest.php
+++ b/packages/impersonate/tests/Unit/ImpersonateActionTest.php
@@ -2,6 +2,8 @@
 
 declare(strict_types=1);
 
+use Illuminate\Contracts\Auth\Access\Authorizable;
+use Illuminate\Contracts\Auth\Authenticatable;
 use Moox\Impersonate\Filament\Actions\ImpersonateAction;
 
 it('exposes the ImpersonateAction helper', function (): void {
@@ -28,3 +30,98 @@
     expect(ImpersonateAction::isEnabled(null, $config))->toBeFalse()
         ->and(ImpersonateAction::isEnabled('finance', $config))->toBeFalse();
 });
+
+it('requires a mapped shield permission when permissions.required is true', function (): void {
+    $user = new class implements Authenticatable, Authorizable
+    {
+        /** @var list<string> */
+        public array $abilities = ['Impersonate:PortalUser'];
+
+        public function getAuthIdentifierName(): string
+        {
+            return 'id';
+        }
+
+        public function getAuthIdentifier(): mixed
+        {
+            return 1;
+        }
+
+        public function getAuthPasswordName(): string
+        {
+            return 'password';
+        }
+
+        public function getAuthPassword(): string
+        {
+            return '';
+        }
+
+        public function getRememberToken(): ?string
+        {
+            return null;
+        }
+
+        public function setRememberToken($value): void
+        {
+        }
+
+        public function getRememberTokenName(): string
+        {
+            return 'remember_token';
+        }
+
+        public function can($abilities, $arguments = []): bool
+        {
+            $abilities = is_array($abilities) ? $abilities : [$abilities];
+
+            foreach ($abilities as $ability) {
+                if (! in_array($ability, $this->abilities, true)) {
+                    return false;
+                }
+            }
+
+            return true;
+        }
+
+        public function cannot($abilities, $arguments = []): bool
+        {
+            return ! $this->can($abilities, $arguments);
+        }
+    };
+
+    $config = [
+        'enabled' => true,
+        'targets' => ['finance', 'portal'],
+        'permissions' => [
+            'required' => true,
+            'targets' => [
+                'portal' => 'Impersonate:PortalUser',
+                'finance' => 'Impersonate:FinanceUser',
+            ],
+        ],
+    ];
+
+    expect(ImpersonateAction::userMay($user, 'portal', $config))->toBeTrue()
+        ->and(ImpersonateAction::userMay($user, 'finance', $config))->toBeFalse()
+        ->and(ImpersonateAction::userMay($user, null, $config))->toBeTrue();
+
+    $config['permissions']['required'] = false;
+
+    expect(ImpersonateAction::userMay($user, 'finance', $config))->toBeTrue();
+});
+
+it('denies userMay when there is no user or permissions are required without a match', function (): void {
+    $config = [
+        'enabled' => true,
+        'targets' => ['portal'],
+        'permissions' => [
+            'required' => true,
+            'targets' => [
+                'portal' => 'Impersonate:PortalUser',
+            ],
+        ],
+    ];
+
+    expect(ImpersonateAction::userMay(null, 'portal', $config))->toBeFalse();
+});
diff --git a/packages/jobs/src/Policies/FailedJobPolicy.php b/packages/jobs/src/Policies/FailedJobPolicy.php
new file mode 100644
index 0000000000..d6f2263acb
--- /dev/null
+++ b/packages/jobs/src/Policies/FailedJobPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Jobs\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Jobs\Models\FailedJob;
+
+class FailedJobPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:FailedJob');
+    }
+
+    public function view(AuthUser $authUser, FailedJob $failedJob): bool
+    {
+        return $authUser->can('View:FailedJob');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:FailedJob');
+    }
+
+    public function update(AuthUser $authUser, FailedJob $failedJob): bool
+    {
+        return $authUser->can('Update:FailedJob');
+    }
+
+    public function delete(AuthUser $authUser, FailedJob $failedJob): bool
+    {
+        return $authUser->can('Delete:FailedJob');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:FailedJob');
+    }
+
+    public function restore(AuthUser $authUser, FailedJob $failedJob): bool
+    {
+        return $authUser->can('Restore:FailedJob');
+    }
+
+    public function forceDelete(AuthUser $authUser, FailedJob $failedJob): bool
+    {
+        return $authUser->can('ForceDelete:FailedJob');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:FailedJob');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:FailedJob');
+    }
+
+    public function replicate(AuthUser $authUser, FailedJob $failedJob): bool
+    {
+        return $authUser->can('Replicate:FailedJob');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:FailedJob');
+    }
+}
diff --git a/packages/jobs/src/Policies/JobBatchPolicy.php b/packages/jobs/src/Policies/JobBatchPolicy.php
new file mode 100644
index 0000000000..7429f3f6db
--- /dev/null
+++ b/packages/jobs/src/Policies/JobBatchPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Jobs\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Jobs\Models\JobBatch;
+
+class JobBatchPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:JobBatch');
+    }
+
+    public function view(AuthUser $authUser, JobBatch $jobBatch): bool
+    {
+        return $authUser->can('View:JobBatch');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:JobBatch');
+    }
+
+    public function update(AuthUser $authUser, JobBatch $jobBatch): bool
+    {
+        return $authUser->can('Update:JobBatch');
+    }
+
+    public function delete(AuthUser $authUser, JobBatch $jobBatch): bool
+    {
+        return $authUser->can('Delete:JobBatch');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:JobBatch');
+    }
+
+    public function restore(AuthUser $authUser, JobBatch $jobBatch): bool
+    {
+        return $authUser->can('Restore:JobBatch');
+    }
+
+    public function forceDelete(AuthUser $authUser, JobBatch $jobBatch): bool
+    {
+        return $authUser->can('ForceDelete:JobBatch');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:JobBatch');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:JobBatch');
+    }
+
+    public function replicate(AuthUser $authUser, JobBatch $jobBatch): bool
+    {
+        return $authUser->can('Replicate:JobBatch');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:JobBatch');
+    }
+}
diff --git a/packages/jobs/src/Policies/JobManagerPolicy.php b/packages/jobs/src/Policies/JobManagerPolicy.php
new file mode 100644
index 0000000000..0f3dc4e005
--- /dev/null
+++ b/packages/jobs/src/Policies/JobManagerPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Jobs\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Jobs\Models\JobManager;
+
+class JobManagerPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:JobManager');
+    }
+
+    public function view(AuthUser $authUser, JobManager $jobManager): bool
+    {
+        return $authUser->can('View:JobManager');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:JobManager');
+    }
+
+    public function update(AuthUser $authUser, JobManager $jobManager): bool
+    {
+        return $authUser->can('Update:JobManager');
+    }
+
+    public function delete(AuthUser $authUser, JobManager $jobManager): bool
+    {
+        return $authUser->can('Delete:JobManager');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:JobManager');
+    }
+
+    public function restore(AuthUser $authUser, JobManager $jobManager): bool
+    {
+        return $authUser->can('Restore:JobManager');
+    }
+
+    public function forceDelete(AuthUser $authUser, JobManager $jobManager): bool
+    {
+        return $authUser->can('ForceDelete:JobManager');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:JobManager');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:JobManager');
+    }
+
+    public function replicate(AuthUser $authUser, JobManager $jobManager): bool
+    {
+        return $authUser->can('Replicate:JobManager');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:JobManager');
+    }
+}
diff --git a/packages/jobs/src/Policies/JobPolicy.php b/packages/jobs/src/Policies/JobPolicy.php
new file mode 100644
index 0000000000..64c6606518
--- /dev/null
+++ b/packages/jobs/src/Policies/JobPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Jobs\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Jobs\Models\Job;
+
+class JobPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Job');
+    }
+
+    public function view(AuthUser $authUser, Job $job): bool
+    {
+        return $authUser->can('View:Job');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Job');
+    }
+
+    public function update(AuthUser $authUser, Job $job): bool
+    {
+        return $authUser->can('Update:Job');
+    }
+
+    public function delete(AuthUser $authUser, Job $job): bool
+    {
+        return $authUser->can('Delete:Job');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Job');
+    }
+
+    public function restore(AuthUser $authUser, Job $job): bool
+    {
+        return $authUser->can('Restore:Job');
+    }
+
+    public function forceDelete(AuthUser $authUser, Job $job): bool
+    {
+        return $authUser->can('ForceDelete:Job');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Job');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Job');
+    }
+
+    public function replicate(AuthUser $authUser, Job $job): bool
+    {
+        return $authUser->can('Replicate:Job');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Job');
+    }
+}
diff --git a/packages/kosit-validator/src/Policies/KositValidationPolicy.php b/packages/kosit-validator/src/Policies/KositValidationPolicy.php
new file mode 100644
index 0000000000..69cd17a827
--- /dev/null
+++ b/packages/kosit-validator/src/Policies/KositValidationPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\KositValidator\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\KositValidator\Models\KositValidation;
+
+class KositValidationPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:KositValidation');
+    }
+
+    public function view(AuthUser $authUser, KositValidation $kositValidation): bool
+    {
+        return $authUser->can('View:KositValidation');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:KositValidation');
+    }
+
+    public function update(AuthUser $authUser, KositValidation $kositValidation): bool
+    {
+        return $authUser->can('Update:KositValidation');
+    }
+
+    public function delete(AuthUser $authUser, KositValidation $kositValidation): bool
+    {
+        return $authUser->can('Delete:KositValidation');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:KositValidation');
+    }
+
+    public function restore(AuthUser $authUser, KositValidation $kositValidation): bool
+    {
+        return $authUser->can('Restore:KositValidation');
+    }
+
+    public function forceDelete(AuthUser $authUser, KositValidation $kositValidation): bool
+    {
+        return $authUser->can('ForceDelete:KositValidation');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:KositValidation');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:KositValidation');
+    }
+
+    public function replicate(AuthUser $authUser, KositValidation $kositValidation): bool
+    {
+        return $authUser->can('Replicate:KositValidation');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:KositValidation');
+    }
+}
diff --git a/packages/localization/src/Policies/LocalizationPolicy.php b/packages/localization/src/Policies/LocalizationPolicy.php
new file mode 100644
index 0000000000..f46e9f5fee
--- /dev/null
+++ b/packages/localization/src/Policies/LocalizationPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Localization\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Localization\Models\Localization;
+
+class LocalizationPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Localization');
+    }
+
+    public function view(AuthUser $authUser, Localization $localization): bool
+    {
+        return $authUser->can('View:Localization');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Localization');
+    }
+
+    public function update(AuthUser $authUser, Localization $localization): bool
+    {
+        return $authUser->can('Update:Localization');
+    }
+
+    public function delete(AuthUser $authUser, Localization $localization): bool
+    {
+        return $authUser->can('Delete:Localization');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Localization');
+    }
+
+    public function restore(AuthUser $authUser, Localization $localization): bool
+    {
+        return $authUser->can('Restore:Localization');
+    }
+
+    public function forceDelete(AuthUser $authUser, Localization $localization): bool
+    {
+        return $authUser->can('ForceDelete:Localization');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Localization');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Localization');
+    }
+
+    public function replicate(AuthUser $authUser, Localization $localization): bool
+    {
+        return $authUser->can('Replicate:Localization');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Localization');
+    }
+}
diff --git a/packages/login-link/src/Policies/LoginLinkPolicy.php b/packages/login-link/src/Policies/LoginLinkPolicy.php
new file mode 100644
index 0000000000..df431ec307
--- /dev/null
+++ b/packages/login-link/src/Policies/LoginLinkPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\LoginLink\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\LoginLink\Models\LoginLink;
+
+class LoginLinkPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:LoginLink');
+    }
+
+    public function view(AuthUser $authUser, LoginLink $loginLink): bool
+    {
+        return $authUser->can('View:LoginLink');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:LoginLink');
+    }
+
+    public function update(AuthUser $authUser, LoginLink $loginLink): bool
+    {
+        return $authUser->can('Update:LoginLink');
+    }
+
+    public function delete(AuthUser $authUser, LoginLink $loginLink): bool
+    {
+        return $authUser->can('Delete:LoginLink');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:LoginLink');
+    }
+
+    public function restore(AuthUser $authUser, LoginLink $loginLink): bool
+    {
+        return $authUser->can('Restore:LoginLink');
+    }
+
+    public function forceDelete(AuthUser $authUser, LoginLink $loginLink): bool
+    {
+        return $authUser->can('ForceDelete:LoginLink');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:LoginLink');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:LoginLink');
+    }
+
+    public function replicate(AuthUser $authUser, LoginLink $loginLink): bool
+    {
+        return $authUser->can('Replicate:LoginLink');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:LoginLink');
+    }
+}
diff --git a/packages/login-link/src/Policies/LoginLinkProcessPolicy.php b/packages/login-link/src/Policies/LoginLinkProcessPolicy.php
new file mode 100644
index 0000000000..0e72c09881
--- /dev/null
+++ b/packages/login-link/src/Policies/LoginLinkProcessPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\LoginLink\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\LoginLink\Models\LoginLinkProcess;
+
+class LoginLinkProcessPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:LoginLinkProcess');
+    }
+
+    public function view(AuthUser $authUser, LoginLinkProcess $loginLinkProcess): bool
+    {
+        return $authUser->can('View:LoginLinkProcess');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:LoginLinkProcess');
+    }
+
+    public function update(AuthUser $authUser, LoginLinkProcess $loginLinkProcess): bool
+    {
+        return $authUser->can('Update:LoginLinkProcess');
+    }
+
+    public function delete(AuthUser $authUser, LoginLinkProcess $loginLinkProcess): bool
+    {
+        return $authUser->can('Delete:LoginLinkProcess');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:LoginLinkProcess');
+    }
+
+    public function restore(AuthUser $authUser, LoginLinkProcess $loginLinkProcess): bool
+    {
+        return $authUser->can('Restore:LoginLinkProcess');
+    }
+
+    public function forceDelete(AuthUser $authUser, LoginLinkProcess $loginLinkProcess): bool
+    {
+        return $authUser->can('ForceDelete:LoginLinkProcess');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:LoginLinkProcess');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:LoginLinkProcess');
+    }
+
+    public function replicate(AuthUser $authUser, LoginLinkProcess $loginLinkProcess): bool
+    {
+        return $authUser->can('Replicate:LoginLinkProcess');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:LoginLinkProcess');
+    }
+}
diff --git a/packages/mail-inbox/src/Policies/InboxMessagePolicy.php b/packages/mail-inbox/src/Policies/InboxMessagePolicy.php
new file mode 100644
index 0000000000..74ca7f4c25
--- /dev/null
+++ b/packages/mail-inbox/src/Policies/InboxMessagePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\MailInbox\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\MailInbox\Models\InboxMessage;
+
+class InboxMessagePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:InboxMessage');
+    }
+
+    public function view(AuthUser $authUser, InboxMessage $inboxMessage): bool
+    {
+        return $authUser->can('View:InboxMessage');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:InboxMessage');
+    }
+
+    public function update(AuthUser $authUser, InboxMessage $inboxMessage): bool
+    {
+        return $authUser->can('Update:InboxMessage');
+    }
+
+    public function delete(AuthUser $authUser, InboxMessage $inboxMessage): bool
+    {
+        return $authUser->can('Delete:InboxMessage');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:InboxMessage');
+    }
+
+    public function restore(AuthUser $authUser, InboxMessage $inboxMessage): bool
+    {
+        return $authUser->can('Restore:InboxMessage');
+    }
+
+    public function forceDelete(AuthUser $authUser, InboxMessage $inboxMessage): bool
+    {
+        return $authUser->can('ForceDelete:InboxMessage');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:InboxMessage');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:InboxMessage');
+    }
+
+    public function replicate(AuthUser $authUser, InboxMessage $inboxMessage): bool
+    {
+        return $authUser->can('Replicate:InboxMessage');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:InboxMessage');
+    }
+}
diff --git a/packages/mail-inbox/src/Policies/MailInboxSyncStatePolicy.php b/packages/mail-inbox/src/Policies/MailInboxSyncStatePolicy.php
new file mode 100644
index 0000000000..d428ff85f4
--- /dev/null
+++ b/packages/mail-inbox/src/Policies/MailInboxSyncStatePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\MailInbox\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\MailInbox\Models\MailInboxSyncState;
+
+class MailInboxSyncStatePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:MailInboxSyncState');
+    }
+
+    public function view(AuthUser $authUser, MailInboxSyncState $mailInboxSyncState): bool
+    {
+        return $authUser->can('View:MailInboxSyncState');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:MailInboxSyncState');
+    }
+
+    public function update(AuthUser $authUser, MailInboxSyncState $mailInboxSyncState): bool
+    {
+        return $authUser->can('Update:MailInboxSyncState');
+    }
+
+    public function delete(AuthUser $authUser, MailInboxSyncState $mailInboxSyncState): bool
+    {
+        return $authUser->can('Delete:MailInboxSyncState');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:MailInboxSyncState');
+    }
+
+    public function restore(AuthUser $authUser, MailInboxSyncState $mailInboxSyncState): bool
+    {
+        return $authUser->can('Restore:MailInboxSyncState');
+    }
+
+    public function forceDelete(AuthUser $authUser, MailInboxSyncState $mailInboxSyncState): bool
+    {
+        return $authUser->can('ForceDelete:MailInboxSyncState');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:MailInboxSyncState');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:MailInboxSyncState');
+    }
+
+    public function replicate(AuthUser $authUser, MailInboxSyncState $mailInboxSyncState): bool
+    {
+        return $authUser->can('Replicate:MailInboxSyncState');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:MailInboxSyncState');
+    }
+}
diff --git a/packages/mail-outbox/src/Policies/MailSendLogPolicy.php b/packages/mail-outbox/src/Policies/MailSendLogPolicy.php
new file mode 100644
index 0000000000..acbb1eebe7
--- /dev/null
+++ b/packages/mail-outbox/src/Policies/MailSendLogPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\MailOutbox\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\MailOutbox\Models\MailSendLog;
+
+class MailSendLogPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:MailSendLog');
+    }
+
+    public function view(AuthUser $authUser, MailSendLog $mailSendLog): bool
+    {
+        return $authUser->can('View:MailSendLog');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:MailSendLog');
+    }
+
+    public function update(AuthUser $authUser, MailSendLog $mailSendLog): bool
+    {
+        return $authUser->can('Update:MailSendLog');
+    }
+
+    public function delete(AuthUser $authUser, MailSendLog $mailSendLog): bool
+    {
+        return $authUser->can('Delete:MailSendLog');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:MailSendLog');
+    }
+
+    public function restore(AuthUser $authUser, MailSendLog $mailSendLog): bool
+    {
+        return $authUser->can('Restore:MailSendLog');
+    }
+
+    public function forceDelete(AuthUser $authUser, MailSendLog $mailSendLog): bool
+    {
+        return $authUser->can('ForceDelete:MailSendLog');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:MailSendLog');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:MailSendLog');
+    }
+
+    public function replicate(AuthUser $authUser, MailSendLog $mailSendLog): bool
+    {
+        return $authUser->can('Replicate:MailSendLog');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:MailSendLog');
+    }
+}
diff --git a/packages/mail-template/src/Policies/MailLayoutPolicy.php b/packages/mail-template/src/Policies/MailLayoutPolicy.php
new file mode 100644
index 0000000000..431dc9ab07
--- /dev/null
+++ b/packages/mail-template/src/Policies/MailLayoutPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\MailTemplate\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\MailTemplate\Models\MailLayout;
+
+class MailLayoutPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:MailLayout');
+    }
+
+    public function view(AuthUser $authUser, MailLayout $mailLayout): bool
+    {
+        return $authUser->can('View:MailLayout');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:MailLayout');
+    }
+
+    public function update(AuthUser $authUser, MailLayout $mailLayout): bool
+    {
+        return $authUser->can('Update:MailLayout');
+    }
+
+    public function delete(AuthUser $authUser, MailLayout $mailLayout): bool
+    {
+        return $authUser->can('Delete:MailLayout');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:MailLayout');
+    }
+
+    public function restore(AuthUser $authUser, MailLayout $mailLayout): bool
+    {
+        return $authUser->can('Restore:MailLayout');
+    }
+
+    public function forceDelete(AuthUser $authUser, MailLayout $mailLayout): bool
+    {
+        return $authUser->can('ForceDelete:MailLayout');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:MailLayout');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:MailLayout');
+    }
+
+    public function replicate(AuthUser $authUser, MailLayout $mailLayout): bool
+    {
+        return $authUser->can('Replicate:MailLayout');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:MailLayout');
+    }
+}
diff --git a/packages/mail-template/src/Policies/MailTemplatePolicy.php b/packages/mail-template/src/Policies/MailTemplatePolicy.php
new file mode 100644
index 0000000000..2918154c9b
--- /dev/null
+++ b/packages/mail-template/src/Policies/MailTemplatePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\MailTemplate\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\MailTemplate\Models\MailTemplate;
+
+class MailTemplatePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:MailTemplate');
+    }
+
+    public function view(AuthUser $authUser, MailTemplate $mailTemplate): bool
+    {
+        return $authUser->can('View:MailTemplate');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:MailTemplate');
+    }
+
+    public function update(AuthUser $authUser, MailTemplate $mailTemplate): bool
+    {
+        return $authUser->can('Update:MailTemplate');
+    }
+
+    public function delete(AuthUser $authUser, MailTemplate $mailTemplate): bool
+    {
+        return $authUser->can('Delete:MailTemplate');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:MailTemplate');
+    }
+
+    public function restore(AuthUser $authUser, MailTemplate $mailTemplate): bool
+    {
+        return $authUser->can('Restore:MailTemplate');
+    }
+
+    public function forceDelete(AuthUser $authUser, MailTemplate $mailTemplate): bool
+    {
+        return $authUser->can('ForceDelete:MailTemplate');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:MailTemplate');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:MailTemplate');
+    }
+
+    public function replicate(AuthUser $authUser, MailTemplate $mailTemplate): bool
+    {
+        return $authUser->can('Replicate:MailTemplate');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:MailTemplate');
+    }
+}
diff --git a/packages/mail-testing/src/Pages/MailTestingPage.php b/packages/mail-testing/src/Pages/MailTestingPage.php
index d0652e636f..28004f832a 100644
--- a/packages/mail-testing/src/Pages/MailTestingPage.php
+++ b/packages/mail-testing/src/Pages/MailTestingPage.php
@@ -5,6 +5,7 @@
 namespace Moox\MailTesting\Pages;
 
 use Filament\Actions\Action;
+use Filament\Facades\Filament;
 use Filament\Forms\Components\Repeater;
 use Filament\Forms\Components\Select;
 use Filament\Forms\Components\TextInput;
@@ -51,6 +52,22 @@ class MailTestingPage extends Page
 
     protected static ?int $navigationSort = 80;
 
+    public static function shouldRegisterNavigation(): bool
+    {
+        return static::canAccess() && parent::shouldRegisterNavigation();
+    }
+
+    public static function canAccess(): bool
+    {
+        $user = Filament::auth()?->user();
+
+        if ($user && method_exists($user, 'can')) {
+            return (bool) $user->can('View:MailTestingPage');
+        }
+
+        return parent::canAccess();
+    }
+
     /**
      * @var array<string, mixed>|null
      */
diff --git a/packages/mail-testing/src/Policies/MailTestingMessagePolicy.php b/packages/mail-testing/src/Policies/MailTestingMessagePolicy.php
new file mode 100644
index 0000000000..a6ed1754af
--- /dev/null
+++ b/packages/mail-testing/src/Policies/MailTestingMessagePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\MailTesting\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\MailTesting\Models\MailTestingMessage;
+
+class MailTestingMessagePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:MailTestingMessage');
+    }
+
+    public function view(AuthUser $authUser, MailTestingMessage $mailTestingMessage): bool
+    {
+        return $authUser->can('View:MailTestingMessage');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:MailTestingMessage');
+    }
+
+    public function update(AuthUser $authUser, MailTestingMessage $mailTestingMessage): bool
+    {
+        return $authUser->can('Update:MailTestingMessage');
+    }
+
+    public function delete(AuthUser $authUser, MailTestingMessage $mailTestingMessage): bool
+    {
+        return $authUser->can('Delete:MailTestingMessage');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:MailTestingMessage');
+    }
+
+    public function restore(AuthUser $authUser, MailTestingMessage $mailTestingMessage): bool
+    {
+        return $authUser->can('Restore:MailTestingMessage');
+    }
+
+    public function forceDelete(AuthUser $authUser, MailTestingMessage $mailTestingMessage): bool
+    {
+        return $authUser->can('ForceDelete:MailTestingMessage');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:MailTestingMessage');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:MailTestingMessage');
+    }
+
+    public function replicate(AuthUser $authUser, MailTestingMessage $mailTestingMessage): bool
+    {
+        return $authUser->can('Replicate:MailTestingMessage');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:MailTestingMessage');
+    }
+}
diff --git a/packages/media/src/Policies/MediaCollectionPolicy.php b/packages/media/src/Policies/MediaCollectionPolicy.php
new file mode 100644
index 0000000000..999829845b
--- /dev/null
+++ b/packages/media/src/Policies/MediaCollectionPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Media\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Media\Models\MediaCollection;
+
+class MediaCollectionPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:MediaCollection');
+    }
+
+    public function view(AuthUser $authUser, MediaCollection $mediaCollection): bool
+    {
+        return $authUser->can('View:MediaCollection');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:MediaCollection');
+    }
+
+    public function update(AuthUser $authUser, MediaCollection $mediaCollection): bool
+    {
+        return $authUser->can('Update:MediaCollection');
+    }
+
+    public function delete(AuthUser $authUser, MediaCollection $mediaCollection): bool
+    {
+        return $authUser->can('Delete:MediaCollection');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:MediaCollection');
+    }
+
+    public function restore(AuthUser $authUser, MediaCollection $mediaCollection): bool
+    {
+        return $authUser->can('Restore:MediaCollection');
+    }
+
+    public function forceDelete(AuthUser $authUser, MediaCollection $mediaCollection): bool
+    {
+        return $authUser->can('ForceDelete:MediaCollection');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:MediaCollection');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:MediaCollection');
+    }
+
+    public function replicate(AuthUser $authUser, MediaCollection $mediaCollection): bool
+    {
+        return $authUser->can('Replicate:MediaCollection');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:MediaCollection');
+    }
+}
diff --git a/packages/media/src/Policies/MediaPolicy.php b/packages/media/src/Policies/MediaPolicy.php
index 0b5da9d04b..4343db7174 100644
--- a/packages/media/src/Policies/MediaPolicy.php
+++ b/packages/media/src/Policies/MediaPolicy.php
@@ -1,45 +1,74 @@
 <?php
 
+declare(strict_types=1);
+
 namespace Moox\Media\Policies;
 
 use Illuminate\Auth\Access\HandlesAuthorization;
-use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Foundation\Auth\User as AuthUser;
 use Moox\Media\Models\Media;
 
 class MediaPolicy
 {
     use HandlesAuthorization;
 
-    public function viewAny(?Authenticatable $user): bool
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Media');
+    }
+
+    public function view(AuthUser $authUser, Media $media): bool
+    {
+        return $authUser->can('View:Media');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Media');
+    }
+
+    public function update(AuthUser $authUser, Media $media): bool
     {
-        return true;
+        return $authUser->can('Update:Media');
     }
 
-    public function view(?Authenticatable $user, Media $media): bool
+    public function delete(AuthUser $authUser, Media $media): bool
     {
-        return true;
+        return $authUser->can('Delete:Media');
     }
 
-    public function create(Authenticatable $user): bool
+    public function deleteAny(AuthUser $authUser): bool
     {
-        return true;
+        return $authUser->can('DeleteAny:Media');
     }
 
-    public function update(Authenticatable $user, Media $media): bool
+    public function restore(AuthUser $authUser, Media $media): bool
     {
-        if ($media->getOriginal('write_protected')) {
-            return false;
-        }
+        return $authUser->can('Restore:Media');
+    }
+
+    public function forceDelete(AuthUser $authUser, Media $media): bool
+    {
+        return $authUser->can('ForceDelete:Media');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Media');
+    }
 
-        return true;
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Media');
     }
 
-    public function delete(Authenticatable $user, Media $media): bool
+    public function replicate(AuthUser $authUser, Media $media): bool
     {
-        if ($media->getOriginal('write_protected')) {
-            return false;
-        }
+        return $authUser->can('Replicate:Media');
+    }
 
-        return true;
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Media');
     }
 }
diff --git a/packages/page/src/Policies/PagePolicy.php b/packages/page/src/Policies/PagePolicy.php
new file mode 100644
index 0000000000..4b19093eb8
--- /dev/null
+++ b/packages/page/src/Policies/PagePolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Page\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Page\Models\Page;
+
+class PagePolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Page');
+    }
+
+    public function view(AuthUser $authUser, Page $page): bool
+    {
+        return $authUser->can('View:Page');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Page');
+    }
+
+    public function update(AuthUser $authUser, Page $page): bool
+    {
+        return $authUser->can('Update:Page');
+    }
+
+    public function delete(AuthUser $authUser, Page $page): bool
+    {
+        return $authUser->can('Delete:Page');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Page');
+    }
+
+    public function restore(AuthUser $authUser, Page $page): bool
+    {
+        return $authUser->can('Restore:Page');
+    }
+
+    public function forceDelete(AuthUser $authUser, Page $page): bool
+    {
+        return $authUser->can('ForceDelete:Page');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Page');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Page');
+    }
+
+    public function replicate(AuthUser $authUser, Page $page): bool
+    {
+        return $authUser->can('Replicate:Page');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Page');
+    }
+}
diff --git a/packages/product/src/Policies/ProductPolicy.php b/packages/product/src/Policies/ProductPolicy.php
new file mode 100644
index 0000000000..b885e51163
--- /dev/null
+++ b/packages/product/src/Policies/ProductPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Product\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Product\Models\Product;
+
+class ProductPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Product');
+    }
+
+    public function view(AuthUser $authUser, Product $product): bool
+    {
+        return $authUser->can('View:Product');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Product');
+    }
+
+    public function update(AuthUser $authUser, Product $product): bool
+    {
+        return $authUser->can('Update:Product');
+    }
+
+    public function delete(AuthUser $authUser, Product $product): bool
+    {
+        return $authUser->can('Delete:Product');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Product');
+    }
+
+    public function restore(AuthUser $authUser, Product $product): bool
+    {
+        return $authUser->can('Restore:Product');
+    }
+
+    public function forceDelete(AuthUser $authUser, Product $product): bool
+    {
+        return $authUser->can('ForceDelete:Product');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Product');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Product');
+    }
+
+    public function replicate(AuthUser $authUser, Product $product): bool
+    {
+        return $authUser->can('Replicate:Product');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Product');
+    }
+}
diff --git a/packages/productgroup/src/Policies/ProductGroupPolicy.php b/packages/productgroup/src/Policies/ProductGroupPolicy.php
new file mode 100644
index 0000000000..a3d71e9f93
--- /dev/null
+++ b/packages/productgroup/src/Policies/ProductGroupPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\ProductGroup\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\ProductGroup\Models\ProductGroup;
+
+class ProductGroupPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:ProductGroup');
+    }
+
+    public function view(AuthUser $authUser, ProductGroup $productGroup): bool
+    {
+        return $authUser->can('View:ProductGroup');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:ProductGroup');
+    }
+
+    public function update(AuthUser $authUser, ProductGroup $productGroup): bool
+    {
+        return $authUser->can('Update:ProductGroup');
+    }
+
+    public function delete(AuthUser $authUser, ProductGroup $productGroup): bool
+    {
+        return $authUser->can('Delete:ProductGroup');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:ProductGroup');
+    }
+
+    public function restore(AuthUser $authUser, ProductGroup $productGroup): bool
+    {
+        return $authUser->can('Restore:ProductGroup');
+    }
+
+    public function forceDelete(AuthUser $authUser, ProductGroup $productGroup): bool
+    {
+        return $authUser->can('ForceDelete:ProductGroup');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:ProductGroup');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:ProductGroup');
+    }
+
+    public function replicate(AuthUser $authUser, ProductGroup $productGroup): bool
+    {
+        return $authUser->can('Replicate:ProductGroup');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:ProductGroup');
+    }
+}
diff --git a/packages/prompts/src/Filament/Pages/RunCommandPage.php b/packages/prompts/src/Filament/Pages/RunCommandPage.php
index c30d57734b..0e749363d1 100644
--- a/packages/prompts/src/Filament/Pages/RunCommandPage.php
+++ b/packages/prompts/src/Filament/Pages/RunCommandPage.php
@@ -2,6 +2,7 @@
 
 namespace Moox\Prompts\Filament\Pages;
 
+use Filament\Facades\Filament;
 use Filament\Pages\Page;
 use Illuminate\Contracts\Console\Kernel;
 
@@ -9,6 +10,22 @@ class RunCommandPage extends Page
 {
     protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-command-line';
 
+    public static function shouldRegisterNavigation(): bool
+    {
+        return static::canAccess() && parent::shouldRegisterNavigation();
+    }
+
+    public static function canAccess(): bool
+    {
+        $user = Filament::auth()?->user();
+
+        if ($user && method_exists($user, 'can')) {
+            return (bool) $user->can('View:RunCommandPage');
+        }
+
+        return parent::canAccess();
+    }
+
     protected string $view = 'moox-prompts::filament.pages.run-command';
 
     protected static ?string $navigationLabel = null;
diff --git a/packages/prompts/src/Policies/CommandExecutionPolicy.php b/packages/prompts/src/Policies/CommandExecutionPolicy.php
new file mode 100644
index 0000000000..898c706aa1
--- /dev/null
+++ b/packages/prompts/src/Policies/CommandExecutionPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Prompts\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Prompts\Models\CommandExecution;
+
+class CommandExecutionPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:CommandExecution');
+    }
+
+    public function view(AuthUser $authUser, CommandExecution $commandExecution): bool
+    {
+        return $authUser->can('View:CommandExecution');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:CommandExecution');
+    }
+
+    public function update(AuthUser $authUser, CommandExecution $commandExecution): bool
+    {
+        return $authUser->can('Update:CommandExecution');
+    }
+
+    public function delete(AuthUser $authUser, CommandExecution $commandExecution): bool
+    {
+        return $authUser->can('Delete:CommandExecution');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:CommandExecution');
+    }
+
+    public function restore(AuthUser $authUser, CommandExecution $commandExecution): bool
+    {
+        return $authUser->can('Restore:CommandExecution');
+    }
+
+    public function forceDelete(AuthUser $authUser, CommandExecution $commandExecution): bool
+    {
+        return $authUser->can('ForceDelete:CommandExecution');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:CommandExecution');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:CommandExecution');
+    }
+
+    public function replicate(AuthUser $authUser, CommandExecution $commandExecution): bool
+    {
+        return $authUser->can('Replicate:CommandExecution');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:CommandExecution');
+    }
+}
diff --git a/packages/staff/src/Policies/StaffPolicy.php b/packages/staff/src/Policies/StaffPolicy.php
new file mode 100644
index 0000000000..f39d150291
--- /dev/null
+++ b/packages/staff/src/Policies/StaffPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Staff\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Staff\Models\Staff;
+
+class StaffPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Staff');
+    }
+
+    public function view(AuthUser $authUser, Staff $staff): bool
+    {
+        return $authUser->can('View:Staff');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Staff');
+    }
+
+    public function update(AuthUser $authUser, Staff $staff): bool
+    {
+        return $authUser->can('Update:Staff');
+    }
+
+    public function delete(AuthUser $authUser, Staff $staff): bool
+    {
+        return $authUser->can('Delete:Staff');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Staff');
+    }
+
+    public function restore(AuthUser $authUser, Staff $staff): bool
+    {
+        return $authUser->can('Restore:Staff');
+    }
+
+    public function forceDelete(AuthUser $authUser, Staff $staff): bool
+    {
+        return $authUser->can('ForceDelete:Staff');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Staff');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Staff');
+    }
+
+    public function replicate(AuthUser $authUser, Staff $staff): bool
+    {
+        return $authUser->can('Replicate:Staff');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Staff');
+    }
+}
diff --git a/packages/supplier/src/Policies/SupplierPolicy.php b/packages/supplier/src/Policies/SupplierPolicy.php
new file mode 100644
index 0000000000..03f7c6b1a7
--- /dev/null
+++ b/packages/supplier/src/Policies/SupplierPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Supplier\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Supplier\Models\Supplier;
+
+class SupplierPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Supplier');
+    }
+
+    public function view(AuthUser $authUser, Supplier $supplier): bool
+    {
+        return $authUser->can('View:Supplier');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Supplier');
+    }
+
+    public function update(AuthUser $authUser, Supplier $supplier): bool
+    {
+        return $authUser->can('Update:Supplier');
+    }
+
+    public function delete(AuthUser $authUser, Supplier $supplier): bool
+    {
+        return $authUser->can('Delete:Supplier');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Supplier');
+    }
+
+    public function restore(AuthUser $authUser, Supplier $supplier): bool
+    {
+        return $authUser->can('Restore:Supplier');
+    }
+
+    public function forceDelete(AuthUser $authUser, Supplier $supplier): bool
+    {
+        return $authUser->can('ForceDelete:Supplier');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Supplier');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Supplier');
+    }
+
+    public function replicate(AuthUser $authUser, Supplier $supplier): bool
+    {
+        return $authUser->can('Replicate:Supplier');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Supplier');
+    }
+}
diff --git a/packages/tag/src/Policies/TagPolicy.php b/packages/tag/src/Policies/TagPolicy.php
new file mode 100644
index 0000000000..5574bfeea9
--- /dev/null
+++ b/packages/tag/src/Policies/TagPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Tag\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Tag\Models\Tag;
+
+class TagPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:Tag');
+    }
+
+    public function view(AuthUser $authUser, Tag $tag): bool
+    {
+        return $authUser->can('View:Tag');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:Tag');
+    }
+
+    public function update(AuthUser $authUser, Tag $tag): bool
+    {
+        return $authUser->can('Update:Tag');
+    }
+
+    public function delete(AuthUser $authUser, Tag $tag): bool
+    {
+        return $authUser->can('Delete:Tag');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:Tag');
+    }
+
+    public function restore(AuthUser $authUser, Tag $tag): bool
+    {
+        return $authUser->can('Restore:Tag');
+    }
+
+    public function forceDelete(AuthUser $authUser, Tag $tag): bool
+    {
+        return $authUser->can('ForceDelete:Tag');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:Tag');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:Tag');
+    }
+
+    public function replicate(AuthUser $authUser, Tag $tag): bool
+    {
+        return $authUser->can('Replicate:Tag');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:Tag');
+    }
+}
diff --git a/packages/transform/src/Policies/TransformDefinitionPolicy.php b/packages/transform/src/Policies/TransformDefinitionPolicy.php
new file mode 100644
index 0000000000..26dfa18293
--- /dev/null
+++ b/packages/transform/src/Policies/TransformDefinitionPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Transform\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Transform\Models\TransformDefinition;
+
+class TransformDefinitionPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:TransformDefinition');
+    }
+
+    public function view(AuthUser $authUser, TransformDefinition $transformDefinition): bool
+    {
+        return $authUser->can('View:TransformDefinition');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:TransformDefinition');
+    }
+
+    public function update(AuthUser $authUser, TransformDefinition $transformDefinition): bool
+    {
+        return $authUser->can('Update:TransformDefinition');
+    }
+
+    public function delete(AuthUser $authUser, TransformDefinition $transformDefinition): bool
+    {
+        return $authUser->can('Delete:TransformDefinition');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:TransformDefinition');
+    }
+
+    public function restore(AuthUser $authUser, TransformDefinition $transformDefinition): bool
+    {
+        return $authUser->can('Restore:TransformDefinition');
+    }
+
+    public function forceDelete(AuthUser $authUser, TransformDefinition $transformDefinition): bool
+    {
+        return $authUser->can('ForceDelete:TransformDefinition');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:TransformDefinition');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:TransformDefinition');
+    }
+
+    public function replicate(AuthUser $authUser, TransformDefinition $transformDefinition): bool
+    {
+        return $authUser->can('Replicate:TransformDefinition');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:TransformDefinition');
+    }
+}
diff --git a/packages/transform/src/Policies/TransformRecordPolicy.php b/packages/transform/src/Policies/TransformRecordPolicy.php
new file mode 100644
index 0000000000..afb6f3c511
--- /dev/null
+++ b/packages/transform/src/Policies/TransformRecordPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\Transform\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\Transform\Models\TransformRecord;
+
+class TransformRecordPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:TransformRecord');
+    }
+
+    public function view(AuthUser $authUser, TransformRecord $transformRecord): bool
+    {
+        return $authUser->can('View:TransformRecord');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:TransformRecord');
+    }
+
+    public function update(AuthUser $authUser, TransformRecord $transformRecord): bool
+    {
+        return $authUser->can('Update:TransformRecord');
+    }
+
+    public function delete(AuthUser $authUser, TransformRecord $transformRecord): bool
+    {
+        return $authUser->can('Delete:TransformRecord');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:TransformRecord');
+    }
+
+    public function restore(AuthUser $authUser, TransformRecord $transformRecord): bool
+    {
+        return $authUser->can('Restore:TransformRecord');
+    }
+
+    public function forceDelete(AuthUser $authUser, TransformRecord $transformRecord): bool
+    {
+        return $authUser->can('ForceDelete:TransformRecord');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:TransformRecord');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:TransformRecord');
+    }
+
+    public function replicate(AuthUser $authUser, TransformRecord $transformRecord): bool
+    {
+        return $authUser->can('Replicate:TransformRecord');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:TransformRecord');
+    }
+}
diff --git a/packages/verapdf/src/Policies/VeraPdfValidationPolicy.php b/packages/verapdf/src/Policies/VeraPdfValidationPolicy.php
new file mode 100644
index 0000000000..44d53ed79d
--- /dev/null
+++ b/packages/verapdf/src/Policies/VeraPdfValidationPolicy.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Moox\VeraPdf\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Foundation\Auth\User as AuthUser;
+use Moox\VeraPdf\Models\VeraPdfValidation;
+
+class VeraPdfValidationPolicy
+{
+    use HandlesAuthorization;
+
+    public function viewAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ViewAny:VeraPdfValidation');
+    }
+
+    public function view(AuthUser $authUser, VeraPdfValidation $veraPdfValidation): bool
+    {
+        return $authUser->can('View:VeraPdfValidation');
+    }
+
+    public function create(AuthUser $authUser): bool
+    {
+        return $authUser->can('Create:VeraPdfValidation');
+    }
+
+    public function update(AuthUser $authUser, VeraPdfValidation $veraPdfValidation): bool
+    {
+        return $authUser->can('Update:VeraPdfValidation');
+    }
+
+    public function delete(AuthUser $authUser, VeraPdfValidation $veraPdfValidation): bool
+    {
+        return $authUser->can('Delete:VeraPdfValidation');
+    }
+
+    public function deleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('DeleteAny:VeraPdfValidation');
+    }
+
+    public function restore(AuthUser $authUser, VeraPdfValidation $veraPdfValidation): bool
+    {
+        return $authUser->can('Restore:VeraPdfValidation');
+    }
+
+    public function forceDelete(AuthUser $authUser, VeraPdfValidation $veraPdfValidation): bool
+    {
+        return $authUser->can('ForceDelete:VeraPdfValidation');
+    }
+
+    public function forceDeleteAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('ForceDeleteAny:VeraPdfValidation');
+    }
+
+    public function restoreAny(AuthUser $authUser): bool
+    {
+        return $authUser->can('RestoreAny:VeraPdfValidation');
+    }
+
+    public function replicate(AuthUser $authUser, VeraPdfValidation $veraPdfValidation): bool
+    {
+        return $authUser->can('Replicate:VeraPdfValidation');
+    }
+
+    public function reorder(AuthUser $authUser): bool
+    {
+        return $authUser->can('Reorder:VeraPdfValidation');
+    }
+}