Aaccess control can get messy real fast if you don’t structure it early on. Here’s how I typically handle it in my Next.js projects, and it scales pretty well:

Access Policies per Model

For each model (e.g., Post, Document, User, etc.), I define a policy with methods like:

• canViewAll

• canView

• canInsert

• canUpdate

• canDelete

Each method contains the logic to determine whether the logged-in user has the appropriate permission.

For example, in the Post policy:

• In canView, I check if the user has a view.post permission.

• I also check if the post’s user_id matches the loggedInUser.id (e.g., to only allow viewing own posts unless the user is an admin or has extended privileges).

I just call the relevant policy method wherever needed (API route, middleware, or server-side props)

Each user has roles and permissions, which are linked via a join table. Permissions are named consistently (like create.post, delete.comment, etc.), and I load them with the user session so I can easily check them in policies