From 63fcc0ebc3a41a91eb4a48265d9d637f80afcf31 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 26 Aug 2025 10:27:31 +0200
Subject: [PATCH] feat(acl): Change views/backend code to able to use proper
 ACL's later on. Currently it is not enabled.

---
 app/Http/Kernel.php                           |   2 +
 app/Http/Middleware/CanAccessTerminal.php     |  31 +++
 app/Http/Middleware/CanCreateResources.php    |   9 +-
 app/Http/Middleware/CanUpdateResource.php     |  75 +++++
 app/Livewire/Destination/Show.php             |   7 +
 app/Livewire/Notifications/Discord.php        |   6 +
 app/Livewire/Notifications/Email.php          |   7 +
 app/Livewire/Notifications/Pushover.php       |   6 +
 app/Livewire/Notifications/Slack.php          |   6 +
 app/Livewire/Notifications/Telegram.php       |   6 +
 .../Project/Application/Preview/Form.php      |   5 +
 app/Livewire/Project/Application/Previews.php |   1 +
 app/Livewire/Project/Database/Import.php      |   1 +
 app/Livewire/Project/Index.php                |   1 +
 .../Project/Service/Configuration.php         |  45 +--
 app/Livewire/Project/Service/Database.php     | 102 ++++---
 app/Livewire/Project/Service/FileStorage.php  |  13 +
 app/Livewire/Project/Service/Index.php        |  11 +-
 .../Service/ServiceApplicationView.php        |  54 ++--
 app/Livewire/Project/Service/Storage.php      |   5 +
 .../Shared/EnvironmentVariable/Add.php        |   3 +
 .../Shared/EnvironmentVariable/Show.php       |  18 +-
 app/Livewire/Project/Shared/HealthChecks.php  |   5 +
 .../Project/Shared/ResourceLimits.php         |   4 +
 .../Project/Shared/ScheduledTask/Add.php      |  23 ++
 .../Project/Shared/ScheduledTask/Show.php     |   7 +
 app/Livewire/Project/Shared/Storages/Add.php  |   9 +
 app/Livewire/Project/Shared/Storages/Show.php |   9 +
 app/Livewire/Project/Shared/Tags.php          |   6 +
 app/Livewire/Project/Shared/Webhooks.php      |   3 +
 app/Livewire/Security/ApiTokens.php           |  39 +++
 app/Livewire/Security/PrivateKey/Index.php    |   4 +
 .../Proxy/DynamicConfigurationNavbar.php      |  15 +-
 .../SharedVariables/Environment/Show.php      |   5 +
 app/Livewire/SharedVariables/Project/Show.php |   5 +
 app/Livewire/SharedVariables/Team/Index.php   |   5 +
 app/Livewire/Source/Github/Change.php         |  19 +-
 app/Livewire/Source/Github/Create.php         |   5 +
 app/Livewire/Storage/Create.php               |   5 +
 app/Livewire/Storage/Form.php                 |   9 +-
 app/Livewire/Team/Index.php                   |   5 +
 app/Livewire/Team/Invitations.php             |   5 +
 app/Livewire/Team/InviteLink.php              |   4 +
 app/Livewire/Team/Member.php                  |  11 +
 app/Livewire/Team/Member/Index.php            |   6 +-
 app/Livewire/Terminal/Index.php               |   1 -
 app/Models/SharedEnvironmentVariable.php      |  15 +
 app/Policies/ApiTokenPolicy.php               | 109 ++++++++
 app/Policies/ApplicationPolicy.php            |  52 +++-
 app/Policies/ApplicationPreviewPolicy.php     |  30 +-
 app/Policies/ApplicationSettingPolicy.php     |  18 +-
 app/Policies/DatabasePolicy.php               |  33 ++-
 app/Policies/EnvironmentPolicy.php            |  18 +-
 app/Policies/GithubAppPolicy.php              |  79 ++++++
 app/Policies/NotificationPolicy.php           |  56 ++++
 app/Policies/PrivateKeyPolicy.php             |  12 +-
 app/Policies/ProjectPolicy.php                |  18 +-
 app/Policies/ResourceCreatePolicy.php         |   7 +-
 app/Policies/S3StoragePolicy.php              |  19 +-
 app/Policies/ServerPolicy.php                 |  16 +-
 app/Policies/ServiceApplicationPolicy.php     |  63 +++++
 app/Policies/ServiceDatabasePolicy.php        |  63 +++++
 app/Policies/ServicePolicy.php                |  60 +++-
 .../SharedEnvironmentVariablePolicy.php       |  79 ++++++
 app/Policies/StandaloneDockerPolicy.php       |  17 +-
 app/Policies/SwarmDockerPolicy.php            |  17 +-
 app/Policies/TeamPolicy.php                   | 104 +++++++
 app/Providers/AuthServiceProvider.php         |  25 ++
 app/View/Components/Forms/Button.php          |  13 +
 app/View/Components/Forms/Checkbox.php        |  14 +
 app/View/Components/Forms/Input.php           |  15 +-
 app/View/Components/Forms/Select.php          |  15 +-
 app/View/Components/Forms/Textarea.php        |  13 +-
 resources/views/components/navbar.blade.php   |  58 ++--
 .../livewire/destination/index.blade.php      |   8 +-
 .../livewire/destination/new/docker.blade.php |  43 +--
 .../views/livewire/destination/show.blade.php |  10 +-
 .../livewire/notifications/discord.blade.php  |  38 +--
 .../livewire/notifications/email.blade.php    |  92 ++++---
 .../livewire/notifications/pushover.blade.php |  38 +--
 .../livewire/notifications/slack.blade.php    |  36 +--
 .../livewire/notifications/telegram.blade.php |  64 ++---
 .../project/application/advanced.blade.php    |  78 +++---
 .../project/application/general.blade.php     | 257 +++++++++---------
 .../project/application/heading.blade.php     |  10 +-
 .../application/preview/form.blade.php        |   8 +-
 .../application/previews-compose.blade.php    |   2 +-
 .../project/application/previews.blade.php    | 184 +++++++------
 .../project/application/rollback.blade.php    |  26 +-
 .../project/application/source.blade.php      |  90 +++---
 .../project/application/swarm.blade.php       |   6 +-
 .../project/database/backup/index.blade.php   |   8 +-
 .../database/clickhouse/general.blade.php     |  37 +--
 .../project/database/configuration.blade.php  |   8 +-
 .../database/dragonfly/general.blade.php      |  38 +--
 .../project/database/heading.blade.php        |  10 +-
 .../project/database/import.blade.php         |   4 +-
 .../project/database/keydb/general.blade.php  |  40 +--
 .../database/mariadb/general.blade.php        |  52 ++--
 .../database/mongodb/general.blade.php        |  56 ++--
 .../project/database/mysql/general.blade.php  |  38 +--
 .../database/postgresql/general.blade.php     |  75 ++---
 .../project/database/redis/general.blade.php  |  47 ++--
 .../database/scheduled-backups.blade.php      |   4 +-
 .../project/environment-edit.blade.php        |  11 +-
 .../views/livewire/project/index.blade.php    |  12 +-
 .../project/service/configuration.blade.php   |  76 +++---
 .../project/service/database.blade.php        |  38 +--
 .../project/service/edit-domain.blade.php     |   4 +-
 .../project/service/file-storage.blade.php    | 100 ++++---
 .../project/service/heading.blade.php         |  10 +-
 .../livewire/project/service/index.blade.php  |   8 +-
 .../service-application-view.blade.php        |  52 ++--
 .../project/service/stack-form.blade.php      |  18 +-
 .../project/service/storage.blade.php         |   8 +-
 .../shared/environment-variable/all.blade.php |  55 ++--
 .../environment-variable/show.blade.php       | 198 +++++++++-----
 .../project/shared/health-checks.blade.php    |  28 +-
 .../project/shared/resource-limits.blade.php  |  17 +-
 .../shared/resource-operations.blade.php      |  99 ++++---
 .../shared/scheduled-task/all.blade.php       |  16 +-
 .../project/shared/storages/all.blade.php     |   4 +-
 .../project/shared/storages/show.blade.php    |  74 +++--
 .../livewire/project/shared/tags.blade.php    |  59 ++--
 .../project/shared/webhooks.blade.php         |  53 +++-
 .../views/livewire/project/show.blade.php     |  33 +--
 .../livewire/security/api-tokens.blade.php    | 104 ++++---
 .../security/private-key/index.blade.php      |  14 +-
 .../security/private-key/show.blade.php       |  34 +--
 .../views/livewire/server/advanced.blade.php  |  14 +-
 .../server/ca-certificate/show.blade.php      |  54 ++--
 .../server/cloudflare-tunnel.blade.php        |  44 ++-
 .../livewire/server/destinations.blade.php    |  12 +-
 .../livewire/server/docker-cleanup.blade.php  |  39 +--
 .../views/livewire/server/index.blade.php     |   8 +-
 .../livewire/server/log-drains.blade.php      |  37 +--
 .../views/livewire/server/navbar.blade.php    |  28 +-
 .../server/private-key/show.blade.php         |  12 +-
 .../views/livewire/server/proxy.blade.php     |  68 +++--
 .../dynamic-configuration-navbar.blade.php    |  16 +-
 .../proxy/dynamic-configurations.blade.php    |  10 +-
 .../proxy/new-dynamic-configuration.blade.php |   7 +-
 .../views/livewire/server/show.blade.php      | 172 +++++++-----
 .../environment/index.blade.php               |   4 +-
 .../environment/show.blade.php                |   8 +-
 .../shared-variables/project/show.blade.php   |  10 +-
 .../shared-variables/team/index.blade.php     |   8 +-
 .../livewire/source/github/change.blade.php   | 255 +++++++++--------
 .../livewire/source/github/create.blade.php   |  99 +++----
 .../views/livewire/storage/create.blade.php   |  53 ++--
 .../views/livewire/storage/form.blade.php     |  44 +--
 .../views/livewire/storage/index.blade.php    |   8 +-
 resources/views/livewire/team/index.blade.php | 124 +++++----
 .../views/livewire/team/invitations.blade.php | 108 ++++----
 .../views/livewire/team/invite-link.blade.php |  36 +--
 .../views/livewire/team/member.blade.php      |   8 +-
 .../livewire/team/member/index.blade.php      |   4 +-
 resources/views/source/all.blade.php          |  20 +-
 routes/web.php                                |  29 +-
 159 files changed, 3610 insertions(+), 1922 deletions(-)
 create mode 100644 app/Http/Middleware/CanAccessTerminal.php
 create mode 100644 app/Http/Middleware/CanUpdateResource.php
 create mode 100644 app/Policies/ApiTokenPolicy.php
 create mode 100644 app/Policies/GithubAppPolicy.php
 create mode 100644 app/Policies/NotificationPolicy.php
 create mode 100644 app/Policies/ServiceApplicationPolicy.php
 create mode 100644 app/Policies/ServiceDatabasePolicy.php
 create mode 100644 app/Policies/SharedEnvironmentVariablePolicy.php
 create mode 100644 app/Policies/TeamPolicy.php

diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 465d15470..e9d7b82b2 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -72,5 +72,7 @@ class Kernel extends HttpKernel
         'api.ability' => \App\Http\Middleware\ApiAbility::class,
         'api.sensitive' => \App\Http\Middleware\ApiSensitiveData::class,
         'can.create.resources' => \App\Http\Middleware\CanCreateResources::class,
+        'can.update.resource' => \App\Http\Middleware\CanUpdateResource::class,
+        'can.access.terminal' => \App\Http\Middleware\CanAccessTerminal::class,
     ];
 }
diff --git a/app/Http/Middleware/CanAccessTerminal.php b/app/Http/Middleware/CanAccessTerminal.php
new file mode 100644
index 000000000..dcccd819b
--- /dev/null
+++ b/app/Http/Middleware/CanAccessTerminal.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class CanAccessTerminal
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        return $next($request);
+
+        // if (! auth()->check()) {
+        //     abort(401, 'Authentication required');
+        // }
+
+        // // Only admins/owners can access terminal functionality
+        // if (! auth()->user()->can('canAccessTerminal')) {
+        //     abort(403, 'Access to terminal functionality is restricted to team administrators');
+        // }
+
+        // return $next($request);
+    }
+}
diff --git a/app/Http/Middleware/CanCreateResources.php b/app/Http/Middleware/CanCreateResources.php
index e91118ab0..ba0ab67c1 100644
--- a/app/Http/Middleware/CanCreateResources.php
+++ b/app/Http/Middleware/CanCreateResources.php
@@ -16,10 +16,11 @@ class CanCreateResources
      */
     public function handle(Request $request, Closure $next): Response
     {
-        if (! Gate::allows('createAnyResource')) {
-            abort(403, 'You do not have permission to create resources.');
-        }
-
         return $next($request);
+        // if (! Gate::allows('createAnyResource')) {
+        //     abort(403, 'You do not have permission to create resources.');
+        // }
+
+        // return $next($request);
     }
 }
diff --git a/app/Http/Middleware/CanUpdateResource.php b/app/Http/Middleware/CanUpdateResource.php
new file mode 100644
index 000000000..372af4498
--- /dev/null
+++ b/app/Http/Middleware/CanUpdateResource.php
@@ -0,0 +1,75 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
+use Symfony\Component\HttpFoundation\Response;
+
+class CanUpdateResource
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        return $next($request);
+
+        // Get resource from route parameters
+        // $resource = null;
+        // if ($request->route('application_uuid')) {
+        //     $resource = Application::where('uuid', $request->route('application_uuid'))->first();
+        // } elseif ($request->route('service_uuid')) {
+        //     $resource = Service::where('uuid', $request->route('service_uuid'))->first();
+        // } elseif ($request->route('stack_service_uuid')) {
+        //     // Handle ServiceApplication or ServiceDatabase
+        //     $stack_service_uuid = $request->route('stack_service_uuid');
+        //     $resource = ServiceApplication::where('uuid', $stack_service_uuid)->first() ??
+        //                ServiceDatabase::where('uuid', $stack_service_uuid)->first();
+        // } elseif ($request->route('database_uuid')) {
+        //     // Try different database types
+        //     $database_uuid = $request->route('database_uuid');
+        //     $resource = StandalonePostgresql::where('uuid', $database_uuid)->first() ??
+        //                StandaloneMysql::where('uuid', $database_uuid)->first() ??
+        //                StandaloneMariadb::where('uuid', $database_uuid)->first() ??
+        //                StandaloneRedis::where('uuid', $database_uuid)->first() ??
+        //                StandaloneKeydb::where('uuid', $database_uuid)->first() ??
+        //                StandaloneDragonfly::where('uuid', $database_uuid)->first() ??
+        //                StandaloneClickhouse::where('uuid', $database_uuid)->first() ??
+        //                StandaloneMongodb::where('uuid', $database_uuid)->first();
+        // } elseif ($request->route('server_uuid')) {
+        //     // For server routes, check if user can manage servers
+        //     if (! auth()->user()->isAdmin()) {
+        //         abort(403, 'You do not have permission to access this resource.');
+        //     }
+
+        //     return $next($request);
+        // } elseif ($request->route('environment_uuid')) {
+        //     $resource = Environment::where('uuid', $request->route('environment_uuid'))->first();
+        // } elseif ($request->route('project_uuid')) {
+        //     $resource = Project::ownedByCurrentTeam()->where('uuid', $request->route('project_uuid'))->first();
+        // }
+
+        // if (! $resource) {
+        //     abort(404, 'Resource not found.');
+        // }
+
+        // if (! Gate::allows('update', $resource)) {
+        //     abort(403, 'You do not have permission to update this resource.');
+        // }
+
+        // return $next($request);
+    }
+}
diff --git a/app/Livewire/Destination/Show.php b/app/Livewire/Destination/Show.php
index 5c4d6c170..98cf72376 100644
--- a/app/Livewire/Destination/Show.php
+++ b/app/Livewire/Destination/Show.php
@@ -5,12 +5,15 @@
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\SwarmDocker;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     #[Locked]
     public $destination;
 
@@ -63,6 +66,8 @@ public function syncData(bool $toModel = false)
     public function submit()
     {
         try {
+            $this->authorize('update', $this->destination);
+
             $this->syncData(true);
             $this->dispatch('success', 'Destination saved.');
         } catch (\Throwable $e) {
@@ -73,6 +78,8 @@ public function submit()
     public function delete()
     {
         try {
+            $this->authorize('delete', $this->destination);
+
             if ($this->destination->getMorphClass() === \App\Models\StandaloneDocker::class) {
                 if ($this->destination->attachedTo()) {
                     return $this->dispatch('error', 'You must delete all resources before deleting this destination.');
diff --git a/app/Livewire/Notifications/Discord.php b/app/Livewire/Notifications/Discord.php
index e0425fa17..28d1cb866 100644
--- a/app/Livewire/Notifications/Discord.php
+++ b/app/Livewire/Notifications/Discord.php
@@ -5,11 +5,14 @@
 use App\Models\DiscordNotificationSettings;
 use App\Models\Team;
 use App\Notifications\Test;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Discord extends Component
 {
+    use AuthorizesRequests;
+
     public Team $team;
 
     public DiscordNotificationSettings $settings;
@@ -67,6 +70,7 @@ public function mount()
         try {
             $this->team = auth()->user()->currentTeam();
             $this->settings = $this->team->discordNotificationSettings;
+            $this->authorize('view', $this->settings);
             $this->syncData();
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -77,6 +81,7 @@ public function syncData(bool $toModel = false)
     {
         if ($toModel) {
             $this->validate();
+            $this->authorize('update', $this->settings);
             $this->settings->discord_enabled = $this->discordEnabled;
             $this->settings->discord_webhook_url = $this->discordWebhookUrl;
 
@@ -182,6 +187,7 @@ public function saveModel()
     public function sendTestNotification()
     {
         try {
+            $this->authorize('sendTest', $this->settings);
             $this->team->notify(new Test(channel: 'discord'));
             $this->dispatch('success', 'Test notification sent.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Notifications/Email.php b/app/Livewire/Notifications/Email.php
index 128321ed2..d62a08417 100644
--- a/app/Livewire/Notifications/Email.php
+++ b/app/Livewire/Notifications/Email.php
@@ -5,6 +5,7 @@
 use App\Models\EmailNotificationSettings;
 use App\Models\Team;
 use App\Notifications\Test;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\RateLimiter;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
@@ -12,6 +13,8 @@
 
 class Email extends Component
 {
+    use AuthorizesRequests;
+
     protected $listeners = ['refresh' => '$refresh'];
 
     #[Locked]
@@ -110,6 +113,7 @@ public function mount()
             $this->team = auth()->user()->currentTeam();
             $this->emails = auth()->user()->email;
             $this->settings = $this->team->emailNotificationSettings;
+            $this->authorize('view', $this->settings);
             $this->syncData();
             $this->testEmailAddress = auth()->user()->email;
         } catch (\Throwable $e) {
@@ -121,6 +125,7 @@ public function syncData(bool $toModel = false)
     {
         if ($toModel) {
             $this->validate();
+            $this->authorize('update', $this->settings);
             $this->settings->smtp_enabled = $this->smtpEnabled;
             $this->settings->smtp_from_address = $this->smtpFromAddress;
             $this->settings->smtp_from_name = $this->smtpFromName;
@@ -311,6 +316,7 @@ public function submitResend()
     public function sendTestEmail()
     {
         try {
+            $this->authorize('sendTest', $this->settings);
             $this->validate([
                 'testEmailAddress' => 'required|email',
             ], [
@@ -338,6 +344,7 @@ function () {
 
     public function copyFromInstanceSettings()
     {
+        $this->authorize('update', $this->settings);
         $settings = instanceSettings();
         $this->smtpFromAddress = $settings->smtp_from_address;
         $this->smtpFromName = $settings->smtp_from_name;
diff --git a/app/Livewire/Notifications/Pushover.php b/app/Livewire/Notifications/Pushover.php
index bd5ab79c8..9c7ff64ad 100644
--- a/app/Livewire/Notifications/Pushover.php
+++ b/app/Livewire/Notifications/Pushover.php
@@ -5,12 +5,15 @@
 use App\Models\PushoverNotificationSettings;
 use App\Models\Team;
 use App\Notifications\Test;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Pushover extends Component
 {
+    use AuthorizesRequests;
+
     protected $listeners = ['refresh' => '$refresh'];
 
     #[Locked]
@@ -72,6 +75,7 @@ public function mount()
         try {
             $this->team = auth()->user()->currentTeam();
             $this->settings = $this->team->pushoverNotificationSettings;
+            $this->authorize('view', $this->settings);
             $this->syncData();
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -82,6 +86,7 @@ public function syncData(bool $toModel = false)
     {
         if ($toModel) {
             $this->validate();
+            $this->authorize('update', $this->settings);
             $this->settings->pushover_enabled = $this->pushoverEnabled;
             $this->settings->pushover_user_key = $this->pushoverUserKey;
             $this->settings->pushover_api_token = $this->pushoverApiToken;
@@ -175,6 +180,7 @@ public function saveModel()
     public function sendTestNotification()
     {
         try {
+            $this->authorize('sendTest', $this->settings);
             $this->team->notify(new Test(channel: 'pushover'));
             $this->dispatch('success', 'Test notification sent.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Notifications/Slack.php b/app/Livewire/Notifications/Slack.php
index 9c847ce57..d21399c42 100644
--- a/app/Livewire/Notifications/Slack.php
+++ b/app/Livewire/Notifications/Slack.php
@@ -5,12 +5,15 @@
 use App\Models\SlackNotificationSettings;
 use App\Models\Team;
 use App\Notifications\Test;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Slack extends Component
 {
+    use AuthorizesRequests;
+
     protected $listeners = ['refresh' => '$refresh'];
 
     #[Locked]
@@ -69,6 +72,7 @@ public function mount()
         try {
             $this->team = auth()->user()->currentTeam();
             $this->settings = $this->team->slackNotificationSettings;
+            $this->authorize('view', $this->settings);
             $this->syncData();
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -79,6 +83,7 @@ public function syncData(bool $toModel = false)
     {
         if ($toModel) {
             $this->validate();
+            $this->authorize('update', $this->settings);
             $this->settings->slack_enabled = $this->slackEnabled;
             $this->settings->slack_webhook_url = $this->slackWebhookUrl;
 
@@ -168,6 +173,7 @@ public function saveModel()
     public function sendTestNotification()
     {
         try {
+            $this->authorize('sendTest', $this->settings);
             $this->team->notify(new Test(channel: 'slack'));
             $this->dispatch('success', 'Test notification sent.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Notifications/Telegram.php b/app/Livewire/Notifications/Telegram.php
index 07393d4ea..ca9df47c1 100644
--- a/app/Livewire/Notifications/Telegram.php
+++ b/app/Livewire/Notifications/Telegram.php
@@ -5,12 +5,15 @@
 use App\Models\Team;
 use App\Models\TelegramNotificationSettings;
 use App\Notifications\Test;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Telegram extends Component
 {
+    use AuthorizesRequests;
+
     protected $listeners = ['refresh' => '$refresh'];
 
     #[Locked]
@@ -111,6 +114,7 @@ public function mount()
         try {
             $this->team = auth()->user()->currentTeam();
             $this->settings = $this->team->telegramNotificationSettings;
+            $this->authorize('view', $this->settings);
             $this->syncData();
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -121,6 +125,7 @@ public function syncData(bool $toModel = false)
     {
         if ($toModel) {
             $this->validate();
+            $this->authorize('update', $this->settings);
             $this->settings->telegram_enabled = $this->telegramEnabled;
             $this->settings->telegram_token = $this->telegramToken;
             $this->settings->telegram_chat_id = $this->telegramChatId;
@@ -241,6 +246,7 @@ public function saveModel()
     public function sendTestNotification()
     {
         try {
+            $this->authorize('sendTest', $this->settings);
             $this->team->notify(new Test(channel: 'telegram'));
             $this->dispatch('success', 'Test notification sent.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Project/Application/Preview/Form.php b/app/Livewire/Project/Application/Preview/Form.php
index edcab44c8..ff951ec54 100644
--- a/app/Livewire/Project/Application/Preview/Form.php
+++ b/app/Livewire/Project/Application/Preview/Form.php
@@ -3,12 +3,15 @@
 namespace App\Livewire\Project\Application\Preview;
 
 use App\Models\Application;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 use Spatie\Url\Url;
 
 class Form extends Component
 {
+    use AuthorizesRequests;
+
     public Application $application;
 
     #[Validate('required')]
@@ -27,6 +30,7 @@ public function mount()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->application);
             $this->resetErrorBag();
             $this->validate();
             $this->application->preview_url_template = str_replace(' ', '', $this->previewUrlTemplate);
@@ -41,6 +45,7 @@ public function submit()
     public function resetToDefault()
     {
         try {
+            $this->authorize('update', $this->application);
             $this->application->preview_url_template = '{{pr_id}}.{{domain}}';
             $this->previewUrlTemplate = $this->application->preview_url_template;
             $this->application->save();
diff --git a/app/Livewire/Project/Application/Previews.php b/app/Livewire/Project/Application/Previews.php
index 5f07b02f3..9164c1475 100644
--- a/app/Livewire/Project/Application/Previews.php
+++ b/app/Livewire/Project/Application/Previews.php
@@ -38,6 +38,7 @@ public function mount()
     public function load_prs()
     {
         try {
+            $this->authorize('update', $this->application);
             ['rate_limit_remaining' => $rate_limit_remaining, 'data' => $data] = githubApi(source: $this->application->source, endpoint: "/repos/{$this->application->git_repository}/pulls");
             $this->rate_limit_remaining = $rate_limit_remaining;
             $this->pull_requests = $data->sortBy('number')->values();
diff --git a/app/Livewire/Project/Database/Import.php b/app/Livewire/Project/Database/Import.php
index 6622abaaf..3f974f63d 100644
--- a/app/Livewire/Project/Database/Import.php
+++ b/app/Livewire/Project/Database/Import.php
@@ -176,6 +176,7 @@ public function runImport()
             return;
         }
         try {
+            $this->importRunning = true;
             $this->importCommands = [];
             if (filled($this->customLocation)) {
                 $backupFileName = '/tmp/restore_'.$this->resource->uuid;
diff --git a/app/Livewire/Project/Index.php b/app/Livewire/Project/Index.php
index 5347d74f0..5381fa78d 100644
--- a/app/Livewire/Project/Index.php
+++ b/app/Livewire/Project/Index.php
@@ -20,6 +20,7 @@ public function mount()
         $this->private_keys = PrivateKey::ownedByCurrentTeam()->get();
         $this->projects = Project::ownedByCurrentTeam()->get()->map(function ($project) {
             $project->settingsRoute = route('project.edit', ['project_uuid' => $project->uuid]);
+            $project->canUpdate = auth()->user()->can('update', $project);
 
             return $project;
         });
diff --git a/app/Livewire/Project/Service/Configuration.php b/app/Livewire/Project/Service/Configuration.php
index 8ac74e7de..559851e3a 100644
--- a/app/Livewire/Project/Service/Configuration.php
+++ b/app/Livewire/Project/Service/Configuration.php
@@ -3,11 +3,14 @@
 namespace App\Livewire\Project\Service;
 
 use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class Configuration extends Component
 {
+    use AuthorizesRequests;
+
     public $currentRoute;
 
     public $project;
@@ -40,24 +43,30 @@ public function render()
 
     public function mount()
     {
-        $this->parameters = get_route_parameters();
-        $this->currentRoute = request()->route()->getName();
-        $this->query = request()->query();
-        $project = currentTeam()
-            ->projects()
-            ->select('id', 'uuid', 'team_id')
-            ->where('uuid', request()->route('project_uuid'))
-            ->firstOrFail();
-        $environment = $project->environments()
-            ->select('id', 'uuid', 'name', 'project_id')
-            ->where('uuid', request()->route('environment_uuid'))
-            ->firstOrFail();
-        $this->service = $environment->services()->whereUuid(request()->route('service_uuid'))->firstOrFail();
+        try {
+            $this->parameters = get_route_parameters();
+            $this->currentRoute = request()->route()->getName();
+            $this->query = request()->query();
+            $project = currentTeam()
+                ->projects()
+                ->select('id', 'uuid', 'team_id')
+                ->where('uuid', request()->route('project_uuid'))
+                ->firstOrFail();
+            $environment = $project->environments()
+                ->select('id', 'uuid', 'name', 'project_id')
+                ->where('uuid', request()->route('environment_uuid'))
+                ->firstOrFail();
+            $this->service = $environment->services()->whereUuid(request()->route('service_uuid'))->firstOrFail();
 
-        $this->project = $project;
-        $this->environment = $environment;
-        $this->applications = $this->service->applications->sort();
-        $this->databases = $this->service->databases->sort();
+            $this->authorize('view', $this->service);
+
+            $this->project = $project;
+            $this->environment = $environment;
+            $this->applications = $this->service->applications->sort();
+            $this->databases = $this->service->databases->sort();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function refreshServices()
@@ -70,6 +79,7 @@ public function refreshServices()
     public function restartApplication($id)
     {
         try {
+            $this->authorize('update', $this->service);
             $application = $this->service->applications->find($id);
             if ($application) {
                 $application->restart();
@@ -83,6 +93,7 @@ public function restartApplication($id)
     public function restartDatabase($id)
     {
         try {
+            $this->authorize('update', $this->service);
             $database = $this->service->databases->find($id);
             if ($database) {
                 $database->restart();
diff --git a/app/Livewire/Project/Service/Database.php b/app/Livewire/Project/Service/Database.php
index 0af757c8c..abf4c45a7 100644
--- a/app/Livewire/Project/Service/Database.php
+++ b/app/Livewire/Project/Service/Database.php
@@ -6,6 +6,7 @@
 use App\Actions\Database\StopDatabaseProxy;
 use App\Models\InstanceSettings;
 use App\Models\ServiceDatabase;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
@@ -13,6 +14,8 @@
 
 class Database extends Component
 {
+    use AuthorizesRequests;
+
     public ServiceDatabase $database;
 
     public ?string $db_url_public = null;
@@ -40,24 +43,31 @@ public function render()
 
     public function mount()
     {
-        $this->parameters = get_route_parameters();
-        if ($this->database->is_public) {
-            $this->db_url_public = $this->database->getServiceDatabaseUrl();
+        try {
+            $this->parameters = get_route_parameters();
+            $this->authorize('view', $this->database);
+            if ($this->database->is_public) {
+                $this->db_url_public = $this->database->getServiceDatabaseUrl();
+            }
+            $this->refreshFileStorages();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->refreshFileStorages();
     }
 
     public function delete($password)
     {
-        if (! data_get(InstanceSettings::get(), 'disable_two_step_confirmation')) {
-            if (! Hash::check($password, Auth::user()->password)) {
-                $this->addError('password', 'The provided password is incorrect.');
-
-                return;
-            }
-        }
-
         try {
+            $this->authorize('delete', $this->database);
+
+            if (! data_get(InstanceSettings::get(), 'disable_two_step_confirmation')) {
+                if (! Hash::check($password, Auth::user()->password)) {
+                    $this->addError('password', 'The provided password is incorrect.');
+
+                    return;
+                }
+            }
+
             $this->database->delete();
             $this->dispatch('success', 'Database deleted.');
 
@@ -69,24 +79,35 @@ public function delete($password)
 
     public function instantSaveExclude()
     {
-        $this->submit();
+        try {
+            $this->authorize('update', $this->database);
+            $this->submit();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function instantSaveLogDrain()
     {
-        if (! $this->database->service->destination->server->isLogDrainEnabled()) {
-            $this->database->is_log_drain_enabled = false;
-            $this->dispatch('error', 'Log drain is not enabled on the server. Please enable it first.');
+        try {
+            $this->authorize('update', $this->database);
+            if (! $this->database->service->destination->server->isLogDrainEnabled()) {
+                $this->database->is_log_drain_enabled = false;
+                $this->dispatch('error', 'Log drain is not enabled on the server. Please enable it first.');
 
-            return;
+                return;
+            }
+            $this->submit();
+            $this->dispatch('success', 'You need to restart the service for the changes to take effect.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->submit();
-        $this->dispatch('success', 'You need to restart the service for the changes to take effect.');
     }
 
     public function convertToApplication()
     {
         try {
+            $this->authorize('update', $this->database);
             $service = $this->database->service;
             $serviceDatabase = $this->database;
 
@@ -122,28 +143,33 @@ public function convertToApplication()
 
     public function instantSave()
     {
-        if ($this->database->is_public && ! $this->database->public_port) {
-            $this->dispatch('error', 'Public port is required.');
-            $this->database->is_public = false;
-
-            return;
-        }
-        if ($this->database->is_public) {
-            if (! str($this->database->status)->startsWith('running')) {
-                $this->dispatch('error', 'Database must be started to be publicly accessible.');
+        try {
+            $this->authorize('update', $this->database);
+            if ($this->database->is_public && ! $this->database->public_port) {
+                $this->dispatch('error', 'Public port is required.');
                 $this->database->is_public = false;
 
                 return;
             }
-            StartDatabaseProxy::run($this->database);
-            $this->db_url_public = $this->database->getServiceDatabaseUrl();
-            $this->dispatch('success', 'Database is now publicly accessible.');
-        } else {
-            StopDatabaseProxy::run($this->database);
-            $this->db_url_public = null;
-            $this->dispatch('success', 'Database is no longer publicly accessible.');
+            if ($this->database->is_public) {
+                if (! str($this->database->status)->startsWith('running')) {
+                    $this->dispatch('error', 'Database must be started to be publicly accessible.');
+                    $this->database->is_public = false;
+
+                    return;
+                }
+                StartDatabaseProxy::run($this->database);
+                $this->db_url_public = $this->database->getServiceDatabaseUrl();
+                $this->dispatch('success', 'Database is now publicly accessible.');
+            } else {
+                StopDatabaseProxy::run($this->database);
+                $this->db_url_public = null;
+                $this->dispatch('success', 'Database is no longer publicly accessible.');
+            }
+            $this->submit();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->submit();
     }
 
     public function refreshFileStorages()
@@ -154,11 +180,13 @@ public function refreshFileStorages()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->database);
             $this->validate();
             $this->database->save();
             updateCompose($this->database);
             $this->dispatch('success', 'Database saved.');
-        } catch (\Throwable) {
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         } finally {
             $this->dispatch('generateDockerCompose');
         }
diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index 5b88c15eb..2933a8cca 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -15,12 +15,15 @@
 use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
 use Livewire\Component;
 
 class FileStorage extends Component
 {
+    use AuthorizesRequests;
+
     public LocalFileVolume $fileStorage;
 
     public ServiceApplication|StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse|ServiceDatabase|Application $resource;
@@ -54,6 +57,8 @@ public function mount()
     public function convertToDirectory()
     {
         try {
+            $this->authorize('update', $this->resource);
+
             $this->fileStorage->deleteStorageOnServer();
             $this->fileStorage->is_directory = true;
             $this->fileStorage->content = null;
@@ -70,6 +75,8 @@ public function convertToDirectory()
     public function loadStorageOnServer()
     {
         try {
+            $this->authorize('update', $this->resource);
+
             $this->fileStorage->loadStorageOnServer();
             $this->dispatch('success', 'File storage loaded from server.');
         } catch (\Throwable $e) {
@@ -82,6 +89,8 @@ public function loadStorageOnServer()
     public function convertToFile()
     {
         try {
+            $this->authorize('update', $this->resource);
+
             $this->fileStorage->deleteStorageOnServer();
             $this->fileStorage->is_directory = false;
             $this->fileStorage->content = null;
@@ -99,6 +108,8 @@ public function convertToFile()
 
     public function delete($password)
     {
+        $this->authorize('update', $this->resource);
+
         if (! data_get(InstanceSettings::get(), 'disable_two_step_confirmation')) {
             if (! Hash::check($password, Auth::user()->password)) {
                 $this->addError('password', 'The provided password is incorrect.');
@@ -127,6 +138,8 @@ public function delete($password)
 
     public function submit()
     {
+        $this->authorize('update', $this->resource);
+
         $original = $this->fileStorage->getOriginal();
         try {
             $this->validate();
diff --git a/app/Livewire/Project/Service/Index.php b/app/Livewire/Project/Service/Index.php
index 39f4e106d..8d37d3e31 100644
--- a/app/Livewire/Project/Service/Index.php
+++ b/app/Livewire/Project/Service/Index.php
@@ -5,11 +5,14 @@
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
 
 class Index extends Component
 {
+    use AuthorizesRequests;
+
     public ?Service $service = null;
 
     public ?ServiceApplication $serviceApplication = null;
@@ -36,6 +39,7 @@ public function mount()
             if (! $this->service) {
                 return redirect()->route('dashboard');
             }
+            $this->authorize('view', $this->service);
             $service = $this->service->applications()->whereUuid($this->parameters['stack_service_uuid'])->first();
             if ($service) {
                 $this->serviceApplication = $service;
@@ -52,7 +56,12 @@ public function mount()
 
     public function generateDockerCompose()
     {
-        $this->service->parse();
+        try {
+            $this->authorize('update', $this->service);
+            $this->service->parse();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function render()
diff --git a/app/Livewire/Project/Service/ServiceApplicationView.php b/app/Livewire/Project/Service/ServiceApplicationView.php
index 64f7ab95c..5e178374b 100644
--- a/app/Livewire/Project/Service/ServiceApplicationView.php
+++ b/app/Livewire/Project/Service/ServiceApplicationView.php
@@ -4,6 +4,7 @@
 
 use App\Models\InstanceSettings;
 use App\Models\ServiceApplication;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
@@ -12,6 +13,8 @@
 
 class ServiceApplicationView extends Component
 {
+    use AuthorizesRequests;
+
     public ServiceApplication $application;
 
     public $parameters;
@@ -34,32 +37,44 @@ class ServiceApplicationView extends Component
 
     public function instantSave()
     {
-        $this->submit();
+        try {
+            $this->authorize('update', $this->application);
+            $this->submit();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function instantSaveAdvanced()
     {
-        if (! $this->application->service->destination->server->isLogDrainEnabled()) {
-            $this->application->is_log_drain_enabled = false;
-            $this->dispatch('error', 'Log drain is not enabled on the server. Please enable it first.');
+        try {
+            $this->authorize('update', $this->application);
+            if (! $this->application->service->destination->server->isLogDrainEnabled()) {
+                $this->application->is_log_drain_enabled = false;
+                $this->dispatch('error', 'Log drain is not enabled on the server. Please enable it first.');
 
-            return;
+                return;
+            }
+            $this->application->save();
+            $this->dispatch('success', 'You need to restart the service for the changes to take effect.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        $this->application->save();
-        $this->dispatch('success', 'You need to restart the service for the changes to take effect.');
     }
 
     public function delete($password)
     {
-        if (! data_get(InstanceSettings::get(), 'disable_two_step_confirmation')) {
-            if (! Hash::check($password, Auth::user()->password)) {
-                $this->addError('password', 'The provided password is incorrect.');
-
-                return;
-            }
-        }
-
         try {
+            $this->authorize('delete', $this->application);
+
+            if (! data_get(InstanceSettings::get(), 'disable_two_step_confirmation')) {
+                if (! Hash::check($password, Auth::user()->password)) {
+                    $this->addError('password', 'The provided password is incorrect.');
+
+                    return;
+                }
+            }
+
             $this->application->delete();
             $this->dispatch('success', 'Application deleted.');
 
@@ -71,12 +86,18 @@ public function delete($password)
 
     public function mount()
     {
-        $this->parameters = get_route_parameters();
+        try {
+            $this->parameters = get_route_parameters();
+            $this->authorize('view', $this->application);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function convertToDatabase()
     {
         try {
+            $this->authorize('update', $this->application);
             $service = $this->application->service;
             $serviceApplication = $this->application;
 
@@ -111,6 +132,7 @@ public function convertToDatabase()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->application);
             $this->application->fqdn = str($this->application->fqdn)->replaceEnd(',', '')->trim();
             $this->application->fqdn = str($this->application->fqdn)->replaceStart(',', '')->trim();
             $this->application->fqdn = str($this->application->fqdn)->trim()->explode(',')->map(function ($domain) {
diff --git a/app/Livewire/Project/Service/Storage.php b/app/Livewire/Project/Service/Storage.php
index 4b64a8b5e..26cd54425 100644
--- a/app/Livewire/Project/Service/Storage.php
+++ b/app/Livewire/Project/Service/Storage.php
@@ -3,10 +3,13 @@
 namespace App\Livewire\Project\Service;
 
 use App\Models\LocalPersistentVolume;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Storage extends Component
 {
+    use AuthorizesRequests;
+
     public $resource;
 
     public $fileStorage;
@@ -42,6 +45,8 @@ public function refreshStorages()
     public function addNewVolume($data)
     {
         try {
+            $this->authorize('update', $this->resource);
+
             LocalPersistentVolume::create([
                 'name' => $data['name'],
                 'mount_path' => $data['mount_path'],
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Add.php b/app/Livewire/Project/Shared/EnvironmentVariable/Add.php
index 0dbf0f957..cf7843f84 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Add.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Add.php
@@ -2,10 +2,13 @@
 
 namespace App\Livewire\Project\Shared\EnvironmentVariable;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Add extends Component
 {
+    use AuthorizesRequests;
+
     public $parameters;
 
     public bool $shared = false;
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
index 966d626b1..1a9daf77b 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
@@ -5,11 +5,12 @@
 use App\Models\EnvironmentVariable as ModelsEnvironmentVariable;
 use App\Models\SharedEnvironmentVariable;
 use App\Traits\EnvironmentVariableProtection;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Show extends Component
 {
-    use EnvironmentVariableProtection;
+    use AuthorizesRequests, EnvironmentVariableProtection;
 
     public $parameters;
 
@@ -75,6 +76,11 @@ public function mount()
         }
     }
 
+    public function getResourceProperty()
+    {
+        return $this->env->resourceable ?? $this->env;
+    }
+
     public function refresh()
     {
         $this->syncData();
@@ -140,6 +146,8 @@ public function serialize()
 
     public function lock()
     {
+        $this->authorize('update', $this->env);
+
         $this->env->is_shown_once = true;
         if ($this->isSharedVariable) {
             unset($this->env->is_required);
@@ -158,6 +166,8 @@ public function instantSave()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->env);
+
             if (! $this->isSharedVariable && $this->is_required && str($this->value)->isEmpty()) {
                 $oldValue = $this->env->getOriginal('value');
                 $this->value = $oldValue;
@@ -179,9 +189,11 @@ public function submit()
     public function delete()
     {
         try {
+            $this->authorize('delete', $this->env);
+
             // Check if the variable is used in Docker Compose
-            if ($this->type === 'service' || $this->type === 'application' && $this->env->resource()?->docker_compose) {
-                [$isUsed, $reason] = $this->isEnvironmentVariableUsedInDockerCompose($this->env->key, $this->env->resource()?->docker_compose);
+            if ($this->type === 'service' || $this->type === 'application' && $this->env->resourceable?->docker_compose) {
+                [$isUsed, $reason] = $this->isEnvironmentVariableUsedInDockerCompose($this->env->key, $this->env->resourceable?->docker_compose);
 
                 if ($isUsed) {
                     $this->dispatch('error', "Cannot delete environment variable '{$this->env->key}' <br><br>Please remove it from the Docker Compose file first.");
diff --git a/app/Livewire/Project/Shared/HealthChecks.php b/app/Livewire/Project/Shared/HealthChecks.php
index 83162e36a..ae94f7cf2 100644
--- a/app/Livewire/Project/Shared/HealthChecks.php
+++ b/app/Livewire/Project/Shared/HealthChecks.php
@@ -2,10 +2,13 @@
 
 namespace App\Livewire\Project\Shared;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class HealthChecks extends Component
 {
+    use AuthorizesRequests;
+
     public $resource;
 
     protected $rules = [
@@ -27,6 +30,7 @@ class HealthChecks extends Component
 
     public function instantSave()
     {
+        $this->authorize('update', $this->resource);
         $this->resource->save();
         $this->dispatch('success', 'Health check updated.');
     }
@@ -34,6 +38,7 @@ public function instantSave()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->resource);
             $this->validate();
             $this->resource->save();
             $this->dispatch('success', 'Health check updated.');
diff --git a/app/Livewire/Project/Shared/ResourceLimits.php b/app/Livewire/Project/Shared/ResourceLimits.php
index 608dfbf02..196badec8 100644
--- a/app/Livewire/Project/Shared/ResourceLimits.php
+++ b/app/Livewire/Project/Shared/ResourceLimits.php
@@ -2,10 +2,13 @@
 
 namespace App\Livewire\Project\Shared;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class ResourceLimits extends Component
 {
+    use AuthorizesRequests;
+
     public $resource;
 
     protected $rules = [
@@ -31,6 +34,7 @@ class ResourceLimits extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->resource);
             if (! $this->resource->limits_memory) {
                 $this->resource->limits_memory = '0';
             }
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Add.php b/app/Livewire/Project/Shared/ScheduledTask/Add.php
index c286fee5a..e4b666532 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Add.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Add.php
@@ -3,12 +3,15 @@
 namespace App\Livewire\Project\Shared\ScheduledTask;
 
 use App\Models\ScheduledTask;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class Add extends Component
 {
+    use AuthorizesRequests;
+
     public $parameters;
 
     #[Locked]
@@ -20,6 +23,9 @@ class Add extends Component
     #[Locked]
     public Collection $containerNames;
 
+    #[Locked]
+    public $resource;
+
     public string $name;
 
     public string $command;
@@ -45,6 +51,22 @@ class Add extends Component
     public function mount()
     {
         $this->parameters = get_route_parameters();
+
+        // Get the resource based on type and id
+        switch ($this->type) {
+            case 'application':
+                $this->resource = \App\Models\Application::findOrFail($this->id);
+                break;
+            case 'service':
+                $this->resource = \App\Models\Service::findOrFail($this->id);
+                break;
+            case 'standalone-postgresql':
+                $this->resource = \App\Models\StandalonePostgresql::findOrFail($this->id);
+                break;
+            default:
+                throw new \Exception('Invalid resource type');
+        }
+
         if ($this->containerNames->count() > 0) {
             $this->container = $this->containerNames->first();
         }
@@ -53,6 +75,7 @@ public function mount()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->resource);
             $this->validate();
             $isValid = validate_cron_expression($this->frequency);
             if (! $isValid) {
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index fe6e36d5c..c8d07ae36 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -6,12 +6,15 @@
 use App\Models\Application;
 use App\Models\ScheduledTask;
 use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     public Application|Service $resource;
 
     public ScheduledTask $task;
@@ -109,6 +112,7 @@ public function syncData(bool $toModel = false)
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->resource);
             $this->syncData(true);
             $this->dispatch('success', 'Scheduled task updated.');
             $this->refreshTasks();
@@ -120,6 +124,7 @@ public function instantSave()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->resource);
             $this->syncData(true);
             $this->dispatch('success', 'Scheduled task updated.');
         } catch (\Exception $e) {
@@ -139,6 +144,7 @@ public function refreshTasks()
     public function delete()
     {
         try {
+            $this->authorize('update', $this->resource);
             $this->task->delete();
 
             if ($this->type === 'application') {
@@ -154,6 +160,7 @@ public function delete()
     public function executeNow()
     {
         try {
+            $this->authorize('update', $this->resource);
             ScheduledTaskJob::dispatch($this->task);
             $this->dispatch('success', 'Scheduled task executed.');
         } catch (\Exception $e) {
diff --git a/app/Livewire/Project/Shared/Storages/Add.php b/app/Livewire/Project/Shared/Storages/Add.php
index dc015386c..006d41c14 100644
--- a/app/Livewire/Project/Shared/Storages/Add.php
+++ b/app/Livewire/Project/Shared/Storages/Add.php
@@ -4,10 +4,13 @@
 
 use App\Models\Application;
 use App\Models\LocalFileVolume;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Add extends Component
 {
+    use AuthorizesRequests;
+
     public $resource;
 
     public $uuid;
@@ -77,6 +80,8 @@ public function mount()
     public function submitFileStorage()
     {
         try {
+            $this->authorize('update', $this->resource);
+
             $this->validate([
                 'file_storage_path' => 'string',
                 'file_storage_content' => 'nullable|string',
@@ -112,6 +117,8 @@ public function submitFileStorage()
     public function submitFileStorageDirectory()
     {
         try {
+            $this->authorize('update', $this->resource);
+
             $this->validate([
                 'file_storage_directory_source' => 'string',
                 'file_storage_directory_destination' => 'string',
@@ -140,6 +147,8 @@ public function submitFileStorageDirectory()
     public function submitPersistentVolume()
     {
         try {
+            $this->authorize('update', $this->resource);
+
             $this->validate([
                 'name' => 'required|string',
                 'mount_path' => 'required|string',
diff --git a/app/Livewire/Project/Shared/Storages/Show.php b/app/Livewire/Project/Shared/Storages/Show.php
index 54b1be3af..3928ee1d4 100644
--- a/app/Livewire/Project/Shared/Storages/Show.php
+++ b/app/Livewire/Project/Shared/Storages/Show.php
@@ -4,14 +4,19 @@
 
 use App\Models\InstanceSettings;
 use App\Models\LocalPersistentVolume;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
 use Livewire\Component;
 
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     public LocalPersistentVolume $storage;
 
+    public $resource;
+
     public bool $isReadOnly = false;
 
     public bool $isFirst = true;
@@ -34,6 +39,8 @@ class Show extends Component
 
     public function submit()
     {
+        $this->authorize('update', $this->resource);
+
         $this->validate();
         $this->storage->save();
         $this->dispatch('success', 'Storage updated successfully');
@@ -41,6 +48,8 @@ public function submit()
 
     public function delete($password)
     {
+        $this->authorize('update', $this->resource);
+
         if (! data_get(InstanceSettings::get(), 'disable_two_step_confirmation')) {
             if (! Hash::check($password, Auth::user()->password)) {
                 $this->addError('password', 'The provided password is incorrect.');
diff --git a/app/Livewire/Project/Shared/Tags.php b/app/Livewire/Project/Shared/Tags.php
index 811859cb8..37b8b277a 100644
--- a/app/Livewire/Project/Shared/Tags.php
+++ b/app/Livewire/Project/Shared/Tags.php
@@ -3,12 +3,15 @@
 namespace App\Livewire\Project\Shared;
 
 use App\Models\Tag;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 // Refactored ✅
 class Tags extends Component
 {
+    use AuthorizesRequests;
+
     public $resource = null;
 
     #[Validate('required|string|min:2')]
@@ -34,6 +37,7 @@ public function loadTags()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->resource);
             $this->validate();
             $tags = str($this->newTags)->trim()->explode(' ');
             foreach ($tags as $tag) {
@@ -66,6 +70,7 @@ public function submit()
     public function addTag(string $id, string $name)
     {
         try {
+            $this->authorize('update', $this->resource);
             $name = strip_tags($name);
             if ($this->resource->tags()->where('id', $id)->exists()) {
                 $this->dispatch('error', 'Duplicate tags.', "Tag <span class='dark:text-warning'>$name</span> already added.");
@@ -83,6 +88,7 @@ public function addTag(string $id, string $name)
     public function deleteTag(string $id)
     {
         try {
+            $this->authorize('update', $this->resource);
             $this->resource->tags()->detach($id);
             $found_more_tags = Tag::ownedByCurrentTeam()->find($id);
             if ($found_more_tags && $found_more_tags->applications()->count() == 0 && $found_more_tags->services()->count() == 0) {
diff --git a/app/Livewire/Project/Shared/Webhooks.php b/app/Livewire/Project/Shared/Webhooks.php
index 57c65c4dd..eafc653d5 100644
--- a/app/Livewire/Project/Shared/Webhooks.php
+++ b/app/Livewire/Project/Shared/Webhooks.php
@@ -2,11 +2,14 @@
 
 namespace App\Livewire\Project\Shared;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 // Refactored ✅
 class Webhooks extends Component
 {
+    use AuthorizesRequests;
+
     public $resource;
 
     public ?string $deploywebhook;
diff --git a/app/Livewire/Security/ApiTokens.php b/app/Livewire/Security/ApiTokens.php
index 72684bdc6..a263acedf 100644
--- a/app/Livewire/Security/ApiTokens.php
+++ b/app/Livewire/Security/ApiTokens.php
@@ -3,10 +3,14 @@
 namespace App\Livewire\Security;
 
 use App\Models\InstanceSettings;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Laravel\Sanctum\PersonalAccessToken;
 use Livewire\Component;
 
 class ApiTokens extends Component
 {
+    use AuthorizesRequests;
+
     public ?string $description = null;
 
     public $tokens = [];
@@ -15,6 +19,10 @@ class ApiTokens extends Component
 
     public $isApiEnabled;
 
+    public bool $canUseRootPermissions = false;
+
+    public bool $canUseWritePermissions = false;
+
     public function render()
     {
         return view('livewire.security.api-tokens');
@@ -23,6 +31,8 @@ public function render()
     public function mount()
     {
         $this->isApiEnabled = InstanceSettings::get()->is_api_enabled;
+        $this->canUseRootPermissions = auth()->user()->can('useRootPermissions', PersonalAccessToken::class);
+        $this->canUseWritePermissions = auth()->user()->can('useWritePermissions', PersonalAccessToken::class);
         $this->getTokens();
     }
 
@@ -33,6 +43,23 @@ private function getTokens()
 
     public function updatedPermissions($permissionToUpdate)
     {
+        // Check if user is trying to use restricted permissions
+        if ($permissionToUpdate == 'root' && ! $this->canUseRootPermissions) {
+            $this->dispatch('error', 'You do not have permission to use root permissions.');
+            // Remove root from permissions if it was somehow added
+            $this->permissions = array_diff($this->permissions, ['root']);
+
+            return;
+        }
+
+        if (in_array($permissionToUpdate, ['write', 'write:sensitive']) && ! $this->canUseWritePermissions) {
+            $this->dispatch('error', 'You do not have permission to use write permissions.');
+            // Remove write permissions if they were somehow added
+            $this->permissions = array_diff($this->permissions, ['write', 'write:sensitive']);
+
+            return;
+        }
+
         if ($permissionToUpdate == 'root') {
             $this->permissions = ['root'];
         } elseif ($permissionToUpdate == 'read:sensitive' && ! in_array('read', $this->permissions)) {
@@ -50,6 +77,17 @@ public function updatedPermissions($permissionToUpdate)
     public function addNewToken()
     {
         try {
+            $this->authorize('create', PersonalAccessToken::class);
+
+            // Validate permissions based on user role
+            if (in_array('root', $this->permissions) && ! $this->canUseRootPermissions) {
+                throw new \Exception('You do not have permission to create tokens with root permissions.');
+            }
+
+            if (array_intersect(['write', 'write:sensitive'], $this->permissions) && ! $this->canUseWritePermissions) {
+                throw new \Exception('You do not have permission to create tokens with write permissions.');
+            }
+
             $this->validate([
                 'description' => 'required|min:3|max:255',
             ]);
@@ -65,6 +103,7 @@ public function revoke(int $id)
     {
         try {
             $token = auth()->user()->tokens()->where('id', $id)->firstOrFail();
+            $this->authorize('delete', $token);
             $token->delete();
             $this->getTokens();
         } catch (\Exception $e) {
diff --git a/app/Livewire/Security/PrivateKey/Index.php b/app/Livewire/Security/PrivateKey/Index.php
index 76441a67e..950ec152d 100644
--- a/app/Livewire/Security/PrivateKey/Index.php
+++ b/app/Livewire/Security/PrivateKey/Index.php
@@ -3,10 +3,13 @@
 namespace App\Livewire\Security\PrivateKey;
 
 use App\Models\PrivateKey;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Index extends Component
 {
+    use AuthorizesRequests;
+
     public function render()
     {
         $privateKeys = PrivateKey::ownedByCurrentTeam(['name', 'uuid', 'is_git_related', 'description'])->get();
@@ -18,6 +21,7 @@ public function render()
 
     public function cleanupUnusedKeys()
     {
+        $this->authorize('create', PrivateKey::class);
         PrivateKey::cleanupUnusedKeys();
         $this->dispatch('success', 'Unused keys have been cleaned up.');
     }
diff --git a/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php b/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
index 392ad38fa..f377bbeb9 100644
--- a/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
+++ b/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
@@ -3,12 +3,17 @@
 namespace App\Livewire\Server\Proxy;
 
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class DynamicConfigurationNavbar extends Component
 {
+    use AuthorizesRequests;
+
     public $server_id;
 
+    public Server $server;
+
     public $fileName = '';
 
     public $value = '';
@@ -17,18 +22,18 @@ class DynamicConfigurationNavbar extends Component
 
     public function delete(string $fileName)
     {
-        $server = Server::ownedByCurrentTeam()->whereId($this->server_id)->first();
-        $proxy_path = $server->proxyPath();
-        $proxy_type = $server->proxyType();
+        $this->authorize('update', $this->server);
+        $proxy_path = $this->server->proxyPath();
+        $proxy_type = $this->server->proxyType();
         $file = str_replace('|', '.', $fileName);
         if ($proxy_type === 'CADDY' && $file === 'Caddyfile') {
             $this->dispatch('error', 'Cannot delete Caddyfile.');
 
             return;
         }
-        instant_remote_process(["rm -f {$proxy_path}/dynamic/{$file}"], $server);
+        instant_remote_process(["rm -f {$proxy_path}/dynamic/{$file}"], $this->server);
         if ($proxy_type === 'CADDY') {
-            $server->reloadCaddy();
+            $this->server->reloadCaddy();
         }
         $this->dispatch('success', 'File deleted.');
         $this->dispatch('loadDynamicConfigurations');
diff --git a/app/Livewire/SharedVariables/Environment/Show.php b/app/Livewire/SharedVariables/Environment/Show.php
index e88ac5f13..bee757a64 100644
--- a/app/Livewire/SharedVariables/Environment/Show.php
+++ b/app/Livewire/SharedVariables/Environment/Show.php
@@ -4,10 +4,13 @@
 
 use App\Models\Application;
 use App\Models\Project;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     public Project $project;
 
     public Application $application;
@@ -21,6 +24,8 @@ class Show extends Component
     public function saveKey($data)
     {
         try {
+            $this->authorize('update', $this->environment);
+
             $found = $this->environment->environment_variables()->where('key', $data['key'])->first();
             if ($found) {
                 throw new \Exception('Variable already exists.');
diff --git a/app/Livewire/SharedVariables/Project/Show.php b/app/Livewire/SharedVariables/Project/Show.php
index 0171283c4..712a9960b 100644
--- a/app/Livewire/SharedVariables/Project/Show.php
+++ b/app/Livewire/SharedVariables/Project/Show.php
@@ -3,10 +3,13 @@
 namespace App\Livewire\SharedVariables\Project;
 
 use App\Models\Project;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Show extends Component
 {
+    use AuthorizesRequests;
+
     public Project $project;
 
     protected $listeners = ['refreshEnvs' => '$refresh', 'saveKey' => 'saveKey',  'environmentVariableDeleted' => '$refresh'];
@@ -14,6 +17,8 @@ class Show extends Component
     public function saveKey($data)
     {
         try {
+            $this->authorize('update', $this->project);
+
             $found = $this->project->environment_variables()->where('key', $data['key'])->first();
             if ($found) {
                 throw new \Exception('Variable already exists.');
diff --git a/app/Livewire/SharedVariables/Team/Index.php b/app/Livewire/SharedVariables/Team/Index.php
index a76ccf58a..82473528c 100644
--- a/app/Livewire/SharedVariables/Team/Index.php
+++ b/app/Livewire/SharedVariables/Team/Index.php
@@ -3,10 +3,13 @@
 namespace App\Livewire\SharedVariables\Team;
 
 use App\Models\Team;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Index extends Component
 {
+    use AuthorizesRequests;
+
     public Team $team;
 
     protected $listeners = ['refreshEnvs' => '$refresh', 'saveKey' => 'saveKey',  'environmentVariableDeleted' => '$refresh'];
@@ -14,6 +17,8 @@ class Index extends Component
     public function saveKey($data)
     {
         try {
+            $this->authorize('update', $this->team);
+
             $found = $this->team->environment_variables()->where('key', $data['key'])->first();
             if ($found) {
                 throw new \Exception('Variable already exists.');
diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index e73c9dc73..9ad5444b9 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -5,6 +5,7 @@
 use App\Jobs\GithubAppPermissionJob;
 use App\Models\GithubApp;
 use App\Models\PrivateKey;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Http;
 use Lcobucci\JWT\Configuration;
 use Lcobucci\JWT\Signer\Key\InMemory;
@@ -13,7 +14,9 @@
 
 class Change extends Component
 {
-    public string $webhook_endpoint;
+    use AuthorizesRequests;
+
+    public string $webhook_endpoint = '';
 
     public ?string $ipv4 = null;
 
@@ -69,6 +72,8 @@ public function boot()
     public function checkPermissions()
     {
         try {
+            $this->authorize('view', $this->github_app);
+
             GithubAppPermissionJob::dispatchSync($this->github_app);
             $this->github_app->refresh()->makeVisible('client_secret')->makeVisible('webhook_secret');
             $this->dispatch('success', 'Github App permissions updated.');
@@ -155,7 +160,7 @@ public function mount()
             if (isCloud() && ! isDev()) {
                 $this->webhook_endpoint = config('app.url');
             } else {
-                $this->webhook_endpoint = $this->ipv4;
+                $this->webhook_endpoint = $this->ipv4 ?? '';
                 $this->is_system_wide = $this->github_app->is_system_wide;
             }
         } catch (\Throwable $e) {
@@ -195,6 +200,8 @@ private function generateGithubJwt($private_key, $app_id): string
     public function updateGithubAppName()
     {
         try {
+            $this->authorize('update', $this->github_app);
+
             $privateKey = PrivateKey::ownedByCurrentTeam()->find($this->github_app->private_key_id);
 
             if (! $privateKey) {
@@ -237,6 +244,8 @@ public function updateGithubAppName()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->github_app);
+
             $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
             $this->validate([
                 'github_app.name' => 'required|string',
@@ -262,6 +271,8 @@ public function submit()
 
     public function createGithubAppManually()
     {
+        $this->authorize('update', $this->github_app);
+
         $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
         $this->github_app->app_id = '1234567890';
         $this->github_app->installation_id = '1234567890';
@@ -272,6 +283,8 @@ public function createGithubAppManually()
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->github_app);
+
             $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
             $this->github_app->save();
             $this->dispatch('success', 'Github App updated.');
@@ -283,6 +296,8 @@ public function instantSave()
     public function delete()
     {
         try {
+            $this->authorize('delete', $this->github_app);
+
             if ($this->github_app->applications->isNotEmpty()) {
                 $this->dispatch('error', 'This source is being used by an application. Please delete all applications first.');
                 $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
diff --git a/app/Livewire/Source/Github/Create.php b/app/Livewire/Source/Github/Create.php
index 136d3525e..f5d851b64 100644
--- a/app/Livewire/Source/Github/Create.php
+++ b/app/Livewire/Source/Github/Create.php
@@ -3,10 +3,13 @@
 namespace App\Livewire\Source\Github;
 
 use App\Models\GithubApp;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Create extends Component
 {
+    use AuthorizesRequests;
+
     public string $name;
 
     public ?string $organization = null;
@@ -29,6 +32,8 @@ public function mount()
     public function createGitHubApp()
     {
         try {
+            $this->authorize('createAnyResource');
+
             $this->validate([
                 'name' => 'required|string',
                 'organization' => 'nullable|string',
diff --git a/app/Livewire/Storage/Create.php b/app/Livewire/Storage/Create.php
index 9cbc516da..9efeb948c 100644
--- a/app/Livewire/Storage/Create.php
+++ b/app/Livewire/Storage/Create.php
@@ -4,11 +4,14 @@
 
 use App\Models\S3Storage;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Uri;
 use Livewire\Component;
 
 class Create extends Component
 {
+    use AuthorizesRequests;
+
     public string $name;
 
     public string $description;
@@ -94,6 +97,8 @@ public function updatedEndpoint($value)
     public function submit()
     {
         try {
+            $this->authorize('create', S3Storage::class);
+
             $this->validate();
             $this->storage = new S3Storage;
             $this->storage->name = $this->name;
diff --git a/app/Livewire/Storage/Form.php b/app/Livewire/Storage/Form.php
index fd2222d32..41541f6b9 100644
--- a/app/Livewire/Storage/Form.php
+++ b/app/Livewire/Storage/Form.php
@@ -4,10 +4,13 @@
 
 use App\Models\S3Storage;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Form extends Component
 {
+    use AuthorizesRequests;
+
     public S3Storage $storage;
 
     protected function rules(): array
@@ -60,6 +63,8 @@ protected function messages(): array
     public function testConnection()
     {
         try {
+            $this->authorize('validateConnection', $this->storage);
+
             $this->storage->testConnection(shouldSave: true);
 
             return $this->dispatch('success', 'Connection is working.', 'Tested with "ListObjectsV2" action.');
@@ -83,8 +88,10 @@ public function delete()
 
     public function submit()
     {
-        $this->validate();
         try {
+            $this->authorize('update', $this->storage);
+
+            $this->validate();
             $this->testConnection();
         } catch (\Throwable $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Team/Index.php b/app/Livewire/Team/Index.php
index accaab8d9..8b9b70e14 100644
--- a/app/Livewire/Team/Index.php
+++ b/app/Livewire/Team/Index.php
@@ -5,12 +5,15 @@
 use App\Models\Team;
 use App\Models\TeamInvitation;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Livewire\Component;
 
 class Index extends Component
 {
+    use AuthorizesRequests;
+
     public $invitations = [];
 
     public Team $team;
@@ -58,6 +61,7 @@ public function submit()
     {
         $this->validate();
         try {
+            $this->authorize('update', $this->team);
             $this->team->save();
             refreshSession();
             $this->dispatch('success', 'Team updated.');
@@ -69,6 +73,7 @@ public function submit()
     public function delete()
     {
         $currentTeam = currentTeam();
+        $this->authorize('delete', $currentTeam);
         $currentTeam->delete();
 
         $currentTeam->members->each(function ($user) use ($currentTeam) {
diff --git a/app/Livewire/Team/Invitations.php b/app/Livewire/Team/Invitations.php
index 3af0e0e92..523f640b9 100644
--- a/app/Livewire/Team/Invitations.php
+++ b/app/Livewire/Team/Invitations.php
@@ -4,10 +4,13 @@
 
 use App\Models\TeamInvitation;
 use App\Models\User;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Invitations extends Component
 {
+    use AuthorizesRequests;
+
     public $invitations;
 
     protected $listeners = ['refreshInvitations'];
@@ -15,6 +18,8 @@ class Invitations extends Component
     public function deleteInvitation(int $invitation_id)
     {
         try {
+            $this->authorize('manageInvitations', currentTeam());
+
             $invitation = TeamInvitation::ownedByCurrentTeam()->findOrFail($invitation_id);
             $user = User::whereEmail($invitation->email)->first();
             if (filled($user)) {
diff --git a/app/Livewire/Team/InviteLink.php b/app/Livewire/Team/InviteLink.php
index fb0c51e54..0bac39db8 100644
--- a/app/Livewire/Team/InviteLink.php
+++ b/app/Livewire/Team/InviteLink.php
@@ -4,6 +4,7 @@
 
 use App\Models\TeamInvitation;
 use App\Models\User;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Notifications\Messages\MailMessage;
 use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\Hash;
@@ -13,6 +14,8 @@
 
 class InviteLink extends Component
 {
+    use AuthorizesRequests;
+
     public string $email;
 
     public string $role = 'member';
@@ -40,6 +43,7 @@ public function viaLink()
     private function generateInviteLink(bool $sendEmail = false)
     {
         try {
+            $this->authorize('manageInvitations', currentTeam());
             $this->validate();
             if (auth()->user()->role() === 'admin' && $this->role === 'owner') {
                 throw new \Exception('Admins cannot invite owners.');
diff --git a/app/Livewire/Team/Member.php b/app/Livewire/Team/Member.php
index 890d640a0..96c98c637 100644
--- a/app/Livewire/Team/Member.php
+++ b/app/Livewire/Team/Member.php
@@ -4,16 +4,21 @@
 
 use App\Enums\Role;
 use App\Models\User;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Cache;
 use Livewire\Component;
 
 class Member extends Component
 {
+    use AuthorizesRequests;
+
     public User $member;
 
     public function makeAdmin()
     {
         try {
+            $this->authorize('manageMembers', currentTeam());
+
             if (Role::from(auth()->user()->role())->lt(Role::ADMIN)
                 || Role::from($this->getMemberRole())->gt(auth()->user()->role())) {
                 throw new \Exception('You are not authorized to perform this action.');
@@ -28,6 +33,8 @@ public function makeAdmin()
     public function makeOwner()
     {
         try {
+            $this->authorize('manageMembers', currentTeam());
+
             if (Role::from(auth()->user()->role())->lt(Role::OWNER)
                 || Role::from($this->getMemberRole())->gt(auth()->user()->role())) {
                 throw new \Exception('You are not authorized to perform this action.');
@@ -42,6 +49,8 @@ public function makeOwner()
     public function makeReadonly()
     {
         try {
+            $this->authorize('manageMembers', currentTeam());
+
             if (Role::from(auth()->user()->role())->lt(Role::ADMIN)
                 || Role::from($this->getMemberRole())->gt(auth()->user()->role())) {
                 throw new \Exception('You are not authorized to perform this action.');
@@ -56,6 +65,8 @@ public function makeReadonly()
     public function remove()
     {
         try {
+            $this->authorize('manageMembers', currentTeam());
+
             if (Role::from(auth()->user()->role())->lt(Role::ADMIN)
                 || Role::from($this->getMemberRole())->gt(auth()->user()->role())) {
                 throw new \Exception('You are not authorized to perform this action.');
diff --git a/app/Livewire/Team/Member/Index.php b/app/Livewire/Team/Member/Index.php
index 00b745fe4..e057ba3f6 100644
--- a/app/Livewire/Team/Member/Index.php
+++ b/app/Livewire/Team/Member/Index.php
@@ -3,15 +3,19 @@
 namespace App\Livewire\Team\Member;
 
 use App\Models\TeamInvitation;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Index extends Component
 {
+    use AuthorizesRequests;
+
     public $invitations = [];
 
     public function mount()
     {
-        if (auth()->user()->isAdminFromSession()) {
+        // Only load invitations for users who can manage them
+        if (auth()->user()->can('manageInvitations', currentTeam())) {
             $this->invitations = TeamInvitation::whereTeamId(currentTeam()->id)->get();
         }
     }
diff --git a/app/Livewire/Terminal/Index.php b/app/Livewire/Terminal/Index.php
index dfeb5da66..03dbc1d91 100644
--- a/app/Livewire/Terminal/Index.php
+++ b/app/Livewire/Terminal/Index.php
@@ -18,7 +18,6 @@ class Index extends Component
 
     public function mount()
     {
-        $this->authorize('useTerminal', Server::class);
         $this->servers = Server::isReachable()->get()->filter(function ($server) {
             return $server->isTerminalEnabled();
         });
diff --git a/app/Models/SharedEnvironmentVariable.php b/app/Models/SharedEnvironmentVariable.php
index aab8b8735..7956f006a 100644
--- a/app/Models/SharedEnvironmentVariable.php
+++ b/app/Models/SharedEnvironmentVariable.php
@@ -12,4 +12,19 @@ class SharedEnvironmentVariable extends Model
         'key' => 'string',
         'value' => 'encrypted',
     ];
+
+    public function team()
+    {
+        return $this->belongsTo(Team::class);
+    }
+
+    public function project()
+    {
+        return $this->belongsTo(Project::class);
+    }
+
+    public function environment()
+    {
+        return $this->belongsTo(Environment::class);
+    }
 }
diff --git a/app/Policies/ApiTokenPolicy.php b/app/Policies/ApiTokenPolicy.php
new file mode 100644
index 000000000..761227118
--- /dev/null
+++ b/app/Policies/ApiTokenPolicy.php
@@ -0,0 +1,109 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+use Laravel\Sanctum\PersonalAccessToken;
+
+class ApiTokenPolicy
+{
+    /**
+     * Determine whether the user can view any API tokens.
+     */
+    public function viewAny(User $user): bool
+    {
+        // Authorization temporarily disabled
+        /*
+        // Users can view their own API tokens
+        return true;
+        */
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the API token.
+     */
+    public function view(User $user, PersonalAccessToken $token): bool
+    {
+        // Authorization temporarily disabled
+        /*
+        // Users can only view their own tokens
+        return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
+        */
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create API tokens.
+     */
+    public function create(User $user): bool
+    {
+        // Authorization temporarily disabled
+        /*
+        // All authenticated users can create their own API tokens
+        return true;
+        */
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the API token.
+     */
+    public function update(User $user, PersonalAccessToken $token): bool
+    {
+        // Authorization temporarily disabled
+        /*
+        // Users can only update their own tokens
+        return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
+        */
+        return true;
+    }
+
+    /**
+     * Determine whether the user can delete the API token.
+     */
+    public function delete(User $user, PersonalAccessToken $token): bool
+    {
+        // Authorization temporarily disabled
+        /*
+        // Users can only delete their own tokens
+        return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
+        */
+        return true;
+    }
+
+    /**
+     * Determine whether the user can manage their own API tokens.
+     */
+    public function manage(User $user): bool
+    {
+        // Authorization temporarily disabled
+        /*
+        // All authenticated users can manage their own API tokens
+        return true;
+        */
+        return true;
+    }
+
+    /**
+     * Determine whether the user can use root permissions for API tokens.
+     */
+    public function useRootPermissions(User $user): bool
+    {
+        // Only admins and owners can use root permissions
+        return $user->isAdmin() || $user->isOwner();
+    }
+
+    /**
+     * Determine whether the user can use write permissions for API tokens.
+     */
+    public function useWritePermissions(User $user): bool
+    {
+        // Authorization temporarily disabled
+        /*
+        // Only admins and owners can use write permissions
+        return $user->isAdmin() || $user->isOwner();
+        */
+        return true;
+    }
+}
diff --git a/app/Policies/ApplicationPolicy.php b/app/Policies/ApplicationPolicy.php
index 62deb50b1..d64a436ad 100644
--- a/app/Policies/ApplicationPolicy.php
+++ b/app/Policies/ApplicationPolicy.php
@@ -13,6 +13,10 @@ class ApplicationPolicy
      */
     public function viewAny(User $user): bool
     {
+        // Authorization temporarily disabled
+        /*
+        return true;
+        */
         return true;
     }
 
@@ -21,6 +25,10 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, Application $application): bool
     {
+        // Authorization temporarily disabled
+        /*
+        return true;
+        */
         return true;
     }
 
@@ -29,11 +37,15 @@ public function view(User $user, Application $application): bool
      */
     public function create(User $user): bool
     {
+        // Authorization temporarily disabled
+        /*
         if ($user->isAdmin()) {
             return true;
         }
 
         return false;
+        */
+        return true;
     }
 
     /**
@@ -41,11 +53,15 @@ public function create(User $user): bool
      */
     public function update(User $user, Application $application): Response
     {
+        // Authorization temporarily disabled
+        /*
         if ($user->isAdmin()) {
             return Response::allow();
         }
 
         return Response::deny('As a member, you cannot update this application.<br/><br/>You need at least admin or owner permissions.');
+        */
+        return Response::allow();
     }
 
     /**
@@ -53,11 +69,15 @@ public function update(User $user, Application $application): Response
      */
     public function delete(User $user, Application $application): bool
     {
+        // Authorization temporarily disabled
+        /*
         if ($user->isAdmin()) {
             return true;
         }
 
         return false;
+        */
+        return true;
     }
 
     /**
@@ -65,6 +85,10 @@ public function delete(User $user, Application $application): bool
      */
     public function restore(User $user, Application $application): bool
     {
+        // Authorization temporarily disabled
+        /*
+        return true;
+        */
         return true;
     }
 
@@ -73,7 +97,11 @@ public function restore(User $user, Application $application): bool
      */
     public function forceDelete(User $user, Application $application): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $application->team()->first()->id) !== null;
+        // Authorization temporarily disabled
+        /*
+        return $user->isAdmin() && $user->teams->contains('id', $application->team()->first()->id);
+        */
+        return true;
     }
 
     /**
@@ -81,7 +109,11 @@ public function forceDelete(User $user, Application $application): bool
      */
     public function deploy(User $user, Application $application): bool
     {
-        return $user->teams()->get()->firstWhere('id', $application->team()->first()->id) !== null;
+        // Authorization temporarily disabled
+        /*
+        return $user->teams->contains('id', $application->team()->first()->id);
+        */
+        return true;
     }
 
     /**
@@ -89,7 +121,11 @@ public function deploy(User $user, Application $application): bool
      */
     public function manageDeployments(User $user, Application $application): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $application->team()->first()->id) !== null;
+        // Authorization temporarily disabled
+        /*
+        return $user->isAdmin() && $user->teams->contains('id', $application->team()->first()->id);
+        */
+        return true;
     }
 
     /**
@@ -97,7 +133,11 @@ public function manageDeployments(User $user, Application $application): bool
      */
     public function manageEnvironment(User $user, Application $application): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $application->team()->first()->id) !== null;
+        // Authorization temporarily disabled
+        /*
+        return $user->isAdmin() && $user->teams->contains('id', $application->team()->first()->id);
+        */
+        return true;
     }
 
     /**
@@ -105,6 +145,10 @@ public function manageEnvironment(User $user, Application $application): bool
      */
     public function cleanupDeploymentQueue(User $user): bool
     {
+        // Authorization temporarily disabled
+        /*
         return $user->isAdmin();
+        */
+        return true;
     }
 }
diff --git a/app/Policies/ApplicationPreviewPolicy.php b/app/Policies/ApplicationPreviewPolicy.php
index 26cf13fcc..14efbdef9 100644
--- a/app/Policies/ApplicationPreviewPolicy.php
+++ b/app/Policies/ApplicationPreviewPolicy.php
@@ -21,7 +21,8 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, ApplicationPreview $applicationPreview): bool
     {
-        return $user->teams()->get()->firstWhere('id', $applicationPreview->application->team()->first()->id) !== null;
+        // return $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
+        return true;
     }
 
     /**
@@ -29,7 +30,8 @@ public function view(User $user, ApplicationPreview $applicationPreview): bool
      */
     public function create(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -37,11 +39,12 @@ public function create(User $user): bool
      */
     public function update(User $user, ApplicationPreview $applicationPreview): Response
     {
-        if ($user->isAdmin()) {
-            return Response::allow();
-        }
+        // if ($user->isAdmin()) {
+        //    return Response::allow();
+        // }
 
-        return Response::deny('As a member, you cannot update this preview.<br/><br/>You need at least admin or owner permissions.');
+        // return Response::deny('As a member, you cannot update this preview.<br/><br/>You need at least admin or owner permissions.');
+        return true;
     }
 
     /**
@@ -49,7 +52,8 @@ public function update(User $user, ApplicationPreview $applicationPreview): Resp
      */
     public function delete(User $user, ApplicationPreview $applicationPreview): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $applicationPreview->application->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
+        return true;
     }
 
     /**
@@ -57,7 +61,8 @@ public function delete(User $user, ApplicationPreview $applicationPreview): bool
      */
     public function restore(User $user, ApplicationPreview $applicationPreview): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $applicationPreview->application->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
+        return true;
     }
 
     /**
@@ -65,7 +70,8 @@ public function restore(User $user, ApplicationPreview $applicationPreview): boo
      */
     public function forceDelete(User $user, ApplicationPreview $applicationPreview): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $applicationPreview->application->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
+        return true;
     }
 
     /**
@@ -73,7 +79,8 @@ public function forceDelete(User $user, ApplicationPreview $applicationPreview):
      */
     public function deploy(User $user, ApplicationPreview $applicationPreview): bool
     {
-        return $user->teams()->get()->firstWhere('id', $applicationPreview->application->team()->first()->id) !== null;
+        // return $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
+        return true;
     }
 
     /**
@@ -81,6 +88,7 @@ public function deploy(User $user, ApplicationPreview $applicationPreview): bool
      */
     public function manageDeployments(User $user, ApplicationPreview $applicationPreview): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $applicationPreview->application->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $applicationPreview->application->team()->first()->id);
+        return true;
     }
 }
diff --git a/app/Policies/ApplicationSettingPolicy.php b/app/Policies/ApplicationSettingPolicy.php
index ff5e81d2f..848dc9aee 100644
--- a/app/Policies/ApplicationSettingPolicy.php
+++ b/app/Policies/ApplicationSettingPolicy.php
@@ -20,7 +20,8 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, ApplicationSetting $applicationSetting): bool
     {
-        return $user->teams()->get()->firstWhere('id', $applicationSetting->application->team()->first()->id) !== null;
+        // return $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
+        return true;
     }
 
     /**
@@ -28,7 +29,8 @@ public function view(User $user, ApplicationSetting $applicationSetting): bool
      */
     public function create(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -36,7 +38,8 @@ public function create(User $user): bool
      */
     public function update(User $user, ApplicationSetting $applicationSetting): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $applicationSetting->application->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
+        return true;
     }
 
     /**
@@ -44,7 +47,8 @@ public function update(User $user, ApplicationSetting $applicationSetting): bool
      */
     public function delete(User $user, ApplicationSetting $applicationSetting): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $applicationSetting->application->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
+        return true;
     }
 
     /**
@@ -52,7 +56,8 @@ public function delete(User $user, ApplicationSetting $applicationSetting): bool
      */
     public function restore(User $user, ApplicationSetting $applicationSetting): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $applicationSetting->application->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
+        return true;
     }
 
     /**
@@ -60,6 +65,7 @@ public function restore(User $user, ApplicationSetting $applicationSetting): boo
      */
     public function forceDelete(User $user, ApplicationSetting $applicationSetting): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $applicationSetting->application->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $applicationSetting->application->team()->first()->id);
+        return true;
     }
 }
diff --git a/app/Policies/DatabasePolicy.php b/app/Policies/DatabasePolicy.php
index b38dad923..520c0006e 100644
--- a/app/Policies/DatabasePolicy.php
+++ b/app/Policies/DatabasePolicy.php
@@ -20,7 +20,8 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, $database): bool
     {
-        return $user->teams()->get()->firstWhere('id', $database->team()->first()->id) !== null;
+        // return $user->teams->contains('id', $database->team()->first()->id);
+        return true;
     }
 
     /**
@@ -28,7 +29,8 @@ public function view(User $user, $database): bool
      */
     public function create(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -36,11 +38,12 @@ public function create(User $user): bool
      */
     public function update(User $user, $database): Response
     {
-        if ($user->isAdmin() && $user->teams()->get()->firstWhere('id', $database->team()->first()->id) !== null) {
-            return Response::allow();
-        }
+        // if ($user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id)) {
+        //    return Response::allow();
+        // }
 
-        return Response::deny('As a member, you cannot update this database.<br/><br/>You need at least admin or owner permissions.');
+        // return Response::deny('As a member, you cannot update this database.<br/><br/>You need at least admin or owner permissions.');
+        return true;
     }
 
     /**
@@ -48,7 +51,8 @@ public function update(User $user, $database): Response
      */
     public function delete(User $user, $database): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $database->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
+        return true;
     }
 
     /**
@@ -56,7 +60,8 @@ public function delete(User $user, $database): bool
      */
     public function restore(User $user, $database): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $database->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
+        return true;
     }
 
     /**
@@ -64,7 +69,8 @@ public function restore(User $user, $database): bool
      */
     public function forceDelete(User $user, $database): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $database->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
+        return true;
     }
 
     /**
@@ -72,7 +78,8 @@ public function forceDelete(User $user, $database): bool
      */
     public function manage(User $user, $database): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $database->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
+        return true;
     }
 
     /**
@@ -80,7 +87,8 @@ public function manage(User $user, $database): bool
      */
     public function manageBackups(User $user, $database): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $database->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
+        return true;
     }
 
     /**
@@ -88,6 +96,7 @@ public function manageBackups(User $user, $database): bool
      */
     public function manageEnvironment(User $user, $database): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $database->team()->first()->id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $database->team()->first()->id);
+        return true;
     }
 }
diff --git a/app/Policies/EnvironmentPolicy.php b/app/Policies/EnvironmentPolicy.php
index 9fdcb3abe..7199abb25 100644
--- a/app/Policies/EnvironmentPolicy.php
+++ b/app/Policies/EnvironmentPolicy.php
@@ -20,7 +20,8 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, Environment $environment): bool
     {
-        return $user->teams()->get()->firstWhere('id', $environment->project->team_id) !== null;
+        // return $user->teams->contains('id', $environment->project->team_id);
+        return true;
     }
 
     /**
@@ -28,7 +29,8 @@ public function view(User $user, Environment $environment): bool
      */
     public function create(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -36,7 +38,8 @@ public function create(User $user): bool
      */
     public function update(User $user, Environment $environment): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $environment->project->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
+        return true;
     }
 
     /**
@@ -44,7 +47,8 @@ public function update(User $user, Environment $environment): bool
      */
     public function delete(User $user, Environment $environment): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $environment->project->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
+        return true;
     }
 
     /**
@@ -52,7 +56,8 @@ public function delete(User $user, Environment $environment): bool
      */
     public function restore(User $user, Environment $environment): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $environment->project->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
+        return true;
     }
 
     /**
@@ -60,6 +65,7 @@ public function restore(User $user, Environment $environment): bool
      */
     public function forceDelete(User $user, Environment $environment): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $environment->project->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $environment->project->team_id);
+        return true;
     }
 }
diff --git a/app/Policies/GithubAppPolicy.php b/app/Policies/GithubAppPolicy.php
new file mode 100644
index 000000000..56bec7032
--- /dev/null
+++ b/app/Policies/GithubAppPolicy.php
@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\GithubApp;
+use App\Models\User;
+
+class GithubAppPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, GithubApp $githubApp): bool
+    {
+        // return $user->teams->contains('id', $githubApp->team_id) || $githubApp->is_system_wide;
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        // return $user->isAdmin();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, GithubApp $githubApp): bool
+    {
+        if ($githubApp->is_system_wide) {
+            // return $user->isAdmin();
+            return true;
+        }
+
+        // return $user->isAdmin() && $user->teams->contains('id', $githubApp->team_id);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, GithubApp $githubApp): bool
+    {
+        if ($githubApp->is_system_wide) {
+            // return $user->isAdmin();
+            return true;
+        }
+
+        // return $user->isAdmin() && $user->teams->contains('id', $githubApp->team_id);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, GithubApp $githubApp): bool
+    {
+        return false;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, GithubApp $githubApp): bool
+    {
+        return false;
+    }
+}
diff --git a/app/Policies/NotificationPolicy.php b/app/Policies/NotificationPolicy.php
new file mode 100644
index 000000000..4f3be431d
--- /dev/null
+++ b/app/Policies/NotificationPolicy.php
@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+use Illuminate\Database\Eloquent\Model;
+
+class NotificationPolicy
+{
+    /**
+     * Determine whether the user can view the notification settings.
+     */
+    public function view(User $user, Model $notificationSettings): bool
+    {
+        // Check if the notification settings belong to the user's current team
+        if (! $notificationSettings->team) {
+            return false;
+        }
+
+        // return $user->teams()->where('teams.id', $notificationSettings->team->id)->exists();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the notification settings.
+     */
+    public function update(User $user, Model $notificationSettings): bool
+    {
+        // Check if the notification settings belong to the user's current team
+        if (! $notificationSettings->team) {
+            return false;
+        }
+
+        // Only owners and admins can update notification settings
+        //  return $user->isAdmin() || $user->isOwner();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can manage (create, update, delete) notification settings.
+     */
+    public function manage(User $user, Model $notificationSettings): bool
+    {
+        // return $this->update($user, $notificationSettings);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can send test notifications.
+     */
+    public function sendTest(User $user, Model $notificationSettings): bool
+    {
+        // return $this->update($user, $notificationSettings);
+        return true;
+    }
+}
diff --git a/app/Policies/PrivateKeyPolicy.php b/app/Policies/PrivateKeyPolicy.php
index 6b9fd2171..996054c95 100644
--- a/app/Policies/PrivateKeyPolicy.php
+++ b/app/Policies/PrivateKeyPolicy.php
@@ -20,7 +20,8 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, PrivateKey $privateKey): bool
     {
-        return $user->teams()->get()->firstWhere('id', $privateKey->team_id) !== null;
+        // return $user->teams->contains('id', $privateKey->team_id);
+        return true;
     }
 
     /**
@@ -28,7 +29,8 @@ public function view(User $user, PrivateKey $privateKey): bool
      */
     public function create(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -36,7 +38,8 @@ public function create(User $user): bool
      */
     public function update(User $user, PrivateKey $privateKey): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $privateKey->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $privateKey->team_id);
+        return true;
     }
 
     /**
@@ -44,7 +47,8 @@ public function update(User $user, PrivateKey $privateKey): bool
      */
     public function delete(User $user, PrivateKey $privateKey): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $privateKey->team_id) !== null;
+        //  return $user->isAdmin() && $user->teams->contains('id', $privateKey->team_id);
+        return true;
     }
 
     /**
diff --git a/app/Policies/ProjectPolicy.php b/app/Policies/ProjectPolicy.php
index 27ed159bd..e188c293f 100644
--- a/app/Policies/ProjectPolicy.php
+++ b/app/Policies/ProjectPolicy.php
@@ -20,7 +20,8 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, Project $project): bool
     {
-        return $user->teams()->get()->firstWhere('id', $project->team_id) !== null;
+        // return $user->teams->contains('id', $project->team_id);
+        return true;
     }
 
     /**
@@ -28,7 +29,8 @@ public function view(User $user, Project $project): bool
      */
     public function create(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -36,7 +38,8 @@ public function create(User $user): bool
      */
     public function update(User $user, Project $project): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $project->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
+        return true;
     }
 
     /**
@@ -44,7 +47,8 @@ public function update(User $user, Project $project): bool
      */
     public function delete(User $user, Project $project): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $project->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
+        return true;
     }
 
     /**
@@ -52,7 +56,8 @@ public function delete(User $user, Project $project): bool
      */
     public function restore(User $user, Project $project): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $project->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
+        return true;
     }
 
     /**
@@ -60,6 +65,7 @@ public function restore(User $user, Project $project): bool
      */
     public function forceDelete(User $user, Project $project): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $project->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $project->team_id);
+        return true;
     }
 }
diff --git a/app/Policies/ResourceCreatePolicy.php b/app/Policies/ResourceCreatePolicy.php
index 58f6ba212..9ed2b66ab 100644
--- a/app/Policies/ResourceCreatePolicy.php
+++ b/app/Policies/ResourceCreatePolicy.php
@@ -30,6 +30,7 @@ class ResourceCreatePolicy
         StandaloneClickhouse::class,
         Service::class,
         Application::class,
+        GithubApp::class,
     ];
 
     /**
@@ -37,7 +38,8 @@ class ResourceCreatePolicy
      */
     public function createAny(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -49,7 +51,8 @@ public function create(User $user, string $resourceClass): bool
             return false;
         }
 
-        return $user->isAdmin();
+        //  return $user->isAdmin();
+        return true;
     }
 
     /**
diff --git a/app/Policies/S3StoragePolicy.php b/app/Policies/S3StoragePolicy.php
index 9b24dd31a..982c7c523 100644
--- a/app/Policies/S3StoragePolicy.php
+++ b/app/Policies/S3StoragePolicy.php
@@ -3,7 +3,6 @@
 namespace App\Policies;
 
 use App\Models\S3Storage;
-use App\Models\Server;
 use App\Models\User;
 
 class S3StoragePolicy
@@ -21,7 +20,7 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, S3Storage $storage): bool
     {
-        return $user->teams()->get()->firstWhere('id', $storage->team_id)->exists();
+        return $user->teams->contains('id', $storage->team_id);
     }
 
     /**
@@ -35,9 +34,10 @@ public function create(User $user): bool
     /**
      * Determine whether the user can update the model.
      */
-    public function update(User $user, Server $server): bool
+    public function update(User $user, S3Storage $storage): bool
     {
-        return $user->teams()->get()->firstWhere('id', $server->team_id)->exists() && $user->isAdmin();
+        // return $user->teams->contains('id', $storage->team_id) && $user->isAdmin();
+        return $user->teams->contains('id', $storage->team_id);
     }
 
     /**
@@ -45,7 +45,8 @@ public function update(User $user, Server $server): bool
      */
     public function delete(User $user, S3Storage $storage): bool
     {
-        return $user->teams()->get()->firstWhere('id', $storage->team_id)->exists() && $user->isAdmin();
+        // return $user->teams->contains('id', $storage->team_id) && $user->isAdmin();
+        return $user->teams->contains('id', $storage->team_id);
     }
 
     /**
@@ -63,4 +64,12 @@ public function forceDelete(User $user, S3Storage $storage): bool
     {
         return false;
     }
+
+    /**
+     * Determine whether the user can validate the connection of the model.
+     */
+    public function validateConnection(User $user, S3Storage $storage): bool
+    {
+        return $user->teams->contains('id', $storage->team_id);
+    }
 }
diff --git a/app/Policies/ServerPolicy.php b/app/Policies/ServerPolicy.php
index a9a64e801..5cc6b739f 100644
--- a/app/Policies/ServerPolicy.php
+++ b/app/Policies/ServerPolicy.php
@@ -20,7 +20,7 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, Server $server): bool
     {
-        return $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+        return $user->teams->contains('id', $server->team_id);
     }
 
     /**
@@ -36,7 +36,7 @@ public function create(User $user): bool
      */
     public function update(User $user, Server $server): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+        return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
     }
 
     /**
@@ -44,7 +44,7 @@ public function update(User $user, Server $server): bool
      */
     public function delete(User $user, Server $server): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+        return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
     }
 
     /**
@@ -68,7 +68,7 @@ public function forceDelete(User $user, Server $server): bool
      */
     public function manageProxy(User $user, Server $server): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+        return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
     }
 
     /**
@@ -76,7 +76,7 @@ public function manageProxy(User $user, Server $server): bool
      */
     public function manageSentinel(User $user, Server $server): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+        return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
     }
 
     /**
@@ -84,7 +84,7 @@ public function manageSentinel(User $user, Server $server): bool
      */
     public function manageCaCertificate(User $user, Server $server): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+        return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
     }
 
     /**
@@ -92,7 +92,7 @@ public function manageCaCertificate(User $user, Server $server): bool
      */
     public function viewTerminal(User $user, Server $server): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+        return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
     }
 
     /**
@@ -100,6 +100,6 @@ public function viewTerminal(User $user, Server $server): bool
      */
     public function viewSecurity(User $user, Server $server): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $server->team_id) !== null;
+        return $user->isAdmin() && $user->teams->contains('id', $server->team_id);
     }
 }
diff --git a/app/Policies/ServiceApplicationPolicy.php b/app/Policies/ServiceApplicationPolicy.php
new file mode 100644
index 000000000..af380a90f
--- /dev/null
+++ b/app/Policies/ServiceApplicationPolicy.php
@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\ServiceApplication;
+use App\Models\User;
+use Illuminate\Support\Facades\Gate;
+
+class ServiceApplicationPolicy
+{
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, ServiceApplication $serviceApplication): bool
+    {
+        return Gate::allows('view', $serviceApplication->service);
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        // return $user->isAdmin();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, ServiceApplication $serviceApplication): bool
+    {
+        // return Gate::allows('update', $serviceApplication->service);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, ServiceApplication $serviceApplication): bool
+    {
+        // return Gate::allows('delete', $serviceApplication->service);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, ServiceApplication $serviceApplication): bool
+    {
+        // return Gate::allows('update', $serviceApplication->service);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, ServiceApplication $serviceApplication): bool
+    {
+        // return Gate::allows('delete', $serviceApplication->service);
+        return true;
+    }
+}
diff --git a/app/Policies/ServiceDatabasePolicy.php b/app/Policies/ServiceDatabasePolicy.php
new file mode 100644
index 000000000..023434a24
--- /dev/null
+++ b/app/Policies/ServiceDatabasePolicy.php
@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\ServiceDatabase;
+use App\Models\User;
+use Illuminate\Support\Facades\Gate;
+
+class ServiceDatabasePolicy
+{
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, ServiceDatabase $serviceDatabase): bool
+    {
+        return Gate::allows('view', $serviceDatabase->service);
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        // return $user->isAdmin();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, ServiceDatabase $serviceDatabase): bool
+    {
+        // return Gate::allows('update', $serviceDatabase->service);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, ServiceDatabase $serviceDatabase): bool
+    {
+        // return Gate::allows('delete', $serviceDatabase->service);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, ServiceDatabase $serviceDatabase): bool
+    {
+        // return Gate::allows('update', $serviceDatabase->service);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, ServiceDatabase $serviceDatabase): bool
+    {
+        // return Gate::allows('delete', $serviceDatabase->service);
+        return true;
+    }
+}
diff --git a/app/Policies/ServicePolicy.php b/app/Policies/ServicePolicy.php
index c3f1f9a9a..7ab0fe7d0 100644
--- a/app/Policies/ServicePolicy.php
+++ b/app/Policies/ServicePolicy.php
@@ -28,7 +28,8 @@ public function view(User $user, Service $service): bool
      */
     public function create(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -36,7 +37,13 @@ public function create(User $user): bool
      */
     public function update(User $user, Service $service): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $service->team()->first()->id) !== null;
+        $team = $service->team();
+        if (! $team) {
+            return false;
+        }
+
+        // return $user->isAdmin() && $user->teams->contains('id', $team->id);
+        return true;
     }
 
     /**
@@ -44,11 +51,12 @@ public function update(User $user, Service $service): bool
      */
     public function delete(User $user, Service $service): bool
     {
-        if ($user->isAdmin()) {
-            return true;
-        }
+        // if ($user->isAdmin()) {
+        //    return true;
+        // }
 
-        return false;
+        // return false;
+        return true;
     }
 
     /**
@@ -56,6 +64,7 @@ public function delete(User $user, Service $service): bool
      */
     public function restore(User $user, Service $service): bool
     {
+        // return true;
         return true;
     }
 
@@ -64,16 +73,23 @@ public function restore(User $user, Service $service): bool
      */
     public function forceDelete(User $user, Service $service): bool
     {
-        if ($user->isAdmin()) {
-            return true;
-        }
+        // if ($user->isAdmin()) {
+        //    return true;
+        // }
 
-        return false;
+        // return false;
+        return true;
     }
 
     public function stop(User $user, Service $service): bool
     {
-        return $user->teams()->get()->firstWhere('id', $service->team()->first()->id) !== null;
+        $team = $service->team();
+        if (! $team) {
+            return false;
+        }
+
+        // return $user->teams->contains('id', $team->id);
+        return true;
     }
 
     /**
@@ -81,7 +97,13 @@ public function stop(User $user, Service $service): bool
      */
     public function manageEnvironment(User $user, Service $service): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $service->team()->first()->id) !== null;
+        $team = $service->team();
+        if (! $team) {
+            return false;
+        }
+
+        // return $user->isAdmin() && $user->teams->contains('id', $team->id);
+        return true;
     }
 
     /**
@@ -89,6 +111,18 @@ public function manageEnvironment(User $user, Service $service): bool
      */
     public function deploy(User $user, Service $service): bool
     {
-        return $user->teams()->get()->firstWhere('id', $service->team()->first()->id) !== null;
+        $team = $service->team();
+        if (! $team) {
+            return false;
+        }
+
+        // return $user->teams->contains('id', $team->id);
+        return true;
+    }
+
+    public function accessTerminal(User $user, Service $service): bool
+    {
+        // return $user->isAdmin() || $user->teams->contains('id', $service->team()->id);
+        return true;
     }
 }
diff --git a/app/Policies/SharedEnvironmentVariablePolicy.php b/app/Policies/SharedEnvironmentVariablePolicy.php
new file mode 100644
index 000000000..b465d8a0c
--- /dev/null
+++ b/app/Policies/SharedEnvironmentVariablePolicy.php
@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\SharedEnvironmentVariable;
+use App\Models\User;
+
+class SharedEnvironmentVariablePolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
+    {
+        return $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        // return $user->isAdmin();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
+    {
+        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
+    {
+        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
+    {
+        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
+    {
+        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
+        return true;
+    }
+
+    /**
+     * Determine whether the user can manage environment variables.
+     */
+    public function manageEnvironment(User $user, SharedEnvironmentVariable $sharedEnvironmentVariable): bool
+    {
+        // return $user->isAdmin() && $user->teams->contains('id', $sharedEnvironmentVariable->team_id);
+        return true;
+    }
+}
diff --git a/app/Policies/StandaloneDockerPolicy.php b/app/Policies/StandaloneDockerPolicy.php
index 08d7ea6fe..154648599 100644
--- a/app/Policies/StandaloneDockerPolicy.php
+++ b/app/Policies/StandaloneDockerPolicy.php
@@ -20,7 +20,7 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        return $user->teams()->get()->firstWhere('id', $standaloneDocker->server->team_id) !== null;
+        return $user->teams->contains('id', $standaloneDocker->server->team_id);
     }
 
     /**
@@ -28,7 +28,8 @@ public function view(User $user, StandaloneDocker $standaloneDocker): bool
      */
     public function create(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -36,7 +37,8 @@ public function create(User $user): bool
      */
     public function update(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $standaloneDocker->server->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $standaloneDocker->server->team_id);
+        return true;
     }
 
     /**
@@ -44,7 +46,8 @@ public function update(User $user, StandaloneDocker $standaloneDocker): bool
      */
     public function delete(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $standaloneDocker->server->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $standaloneDocker->server->team_id);
+        return true;
     }
 
     /**
@@ -52,7 +55,8 @@ public function delete(User $user, StandaloneDocker $standaloneDocker): bool
      */
     public function restore(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        return false;
+        // return false;
+        return true;
     }
 
     /**
@@ -60,6 +64,7 @@ public function restore(User $user, StandaloneDocker $standaloneDocker): bool
      */
     public function forceDelete(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        return false;
+        // return false;
+        return true;
     }
 }
diff --git a/app/Policies/SwarmDockerPolicy.php b/app/Policies/SwarmDockerPolicy.php
index 94ea7a1ee..979bb5889 100644
--- a/app/Policies/SwarmDockerPolicy.php
+++ b/app/Policies/SwarmDockerPolicy.php
@@ -20,7 +20,7 @@ public function viewAny(User $user): bool
      */
     public function view(User $user, SwarmDocker $swarmDocker): bool
     {
-        return $user->teams()->get()->firstWhere('id', $swarmDocker->server->team_id) !== null;
+        return $user->teams->contains('id', $swarmDocker->server->team_id);
     }
 
     /**
@@ -28,7 +28,8 @@ public function view(User $user, SwarmDocker $swarmDocker): bool
      */
     public function create(User $user): bool
     {
-        return $user->isAdmin();
+        // return $user->isAdmin();
+        return true;
     }
 
     /**
@@ -36,7 +37,8 @@ public function create(User $user): bool
      */
     public function update(User $user, SwarmDocker $swarmDocker): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $swarmDocker->server->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $swarmDocker->server->team_id);
+        return true;
     }
 
     /**
@@ -44,7 +46,8 @@ public function update(User $user, SwarmDocker $swarmDocker): bool
      */
     public function delete(User $user, SwarmDocker $swarmDocker): bool
     {
-        return $user->isAdmin() && $user->teams()->get()->firstWhere('id', $swarmDocker->server->team_id) !== null;
+        // return $user->isAdmin() && $user->teams->contains('id', $swarmDocker->server->team_id);
+        return true;
     }
 
     /**
@@ -52,7 +55,8 @@ public function delete(User $user, SwarmDocker $swarmDocker): bool
      */
     public function restore(User $user, SwarmDocker $swarmDocker): bool
     {
-        return false;
+        // return false;
+        return true;
     }
 
     /**
@@ -60,6 +64,7 @@ public function restore(User $user, SwarmDocker $swarmDocker): bool
      */
     public function forceDelete(User $user, SwarmDocker $swarmDocker): bool
     {
-        return false;
+        // return false;
+        return true;
     }
 }
diff --git a/app/Policies/TeamPolicy.php b/app/Policies/TeamPolicy.php
new file mode 100644
index 000000000..b7ef48943
--- /dev/null
+++ b/app/Policies/TeamPolicy.php
@@ -0,0 +1,104 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Team;
+use App\Models\User;
+
+class TeamPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, Team $team): bool
+    {
+        return $user->teams->contains('id', $team->id);
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        // All authenticated users can create teams
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, Team $team): bool
+    {
+        // Only admins and owners can update team settings
+        if (! $user->teams->contains('id', $team->id)) {
+            return false;
+        }
+
+        // return $user->isAdmin() || $user->isOwner();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, Team $team): bool
+    {
+        // Only admins and owners can delete teams
+        if (! $user->teams->contains('id', $team->id)) {
+            return false;
+        }
+
+        // return $user->isAdmin() || $user->isOwner();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can manage team members.
+     */
+    public function manageMembers(User $user, Team $team): bool
+    {
+        // Only admins and owners can manage team members
+        if (! $user->teams->contains('id', $team->id)) {
+            return false;
+        }
+
+        // return $user->isAdmin() || $user->isOwner();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view admin panel.
+     */
+    public function viewAdmin(User $user, Team $team): bool
+    {
+        // Only admins and owners can view admin panel
+        if (! $user->teams->contains('id', $team->id)) {
+            return false;
+        }
+
+        //  return $user->isAdmin() || $user->isOwner();
+        return true;
+    }
+
+    /**
+     * Determine whether the user can manage invitations.
+     */
+    public function manageInvitations(User $user, Team $team): bool
+    {
+        // Only admins and owners can manage invitations
+        if (! $user->teams->contains('id', $team->id)) {
+            return false;
+        }
+
+        // return $user->isAdmin() || $user->isOwner();
+        return true;
+    }
+}
diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php
index 50d21b724..a17d9ec5e 100644
--- a/app/Providers/AuthServiceProvider.php
+++ b/app/Providers/AuthServiceProvider.php
@@ -23,8 +23,11 @@ class AuthServiceProvider extends ServiceProvider
         \App\Models\ApplicationPreview::class => \App\Policies\ApplicationPreviewPolicy::class,
         \App\Models\ApplicationSetting::class => \App\Policies\ApplicationSettingPolicy::class,
         \App\Models\Service::class => \App\Policies\ServicePolicy::class,
+        \App\Models\ServiceApplication::class => \App\Policies\ServiceApplicationPolicy::class,
+        \App\Models\ServiceDatabase::class => \App\Policies\ServiceDatabasePolicy::class,
         \App\Models\Project::class => \App\Policies\ProjectPolicy::class,
         \App\Models\Environment::class => \App\Policies\EnvironmentPolicy::class,
+        \App\Models\SharedEnvironmentVariable::class => \App\Policies\SharedEnvironmentVariablePolicy::class,
         // Database policies - all use the shared DatabasePolicy
         \App\Models\StandalonePostgresql::class => \App\Policies\DatabasePolicy::class,
         \App\Models\StandaloneMysql::class => \App\Policies\DatabasePolicy::class,
@@ -35,6 +38,22 @@ class AuthServiceProvider extends ServiceProvider
         \App\Models\StandaloneDragonfly::class => \App\Policies\DatabasePolicy::class,
         \App\Models\StandaloneClickhouse::class => \App\Policies\DatabasePolicy::class,
 
+        // Notification policies - all use the shared NotificationPolicy
+        \App\Models\EmailNotificationSettings::class => \App\Policies\NotificationPolicy::class,
+        \App\Models\DiscordNotificationSettings::class => \App\Policies\NotificationPolicy::class,
+        \App\Models\TelegramNotificationSettings::class => \App\Policies\NotificationPolicy::class,
+        \App\Models\SlackNotificationSettings::class => \App\Policies\NotificationPolicy::class,
+        \App\Models\PushoverNotificationSettings::class => \App\Policies\NotificationPolicy::class,
+
+        // API Token policy
+        \Laravel\Sanctum\PersonalAccessToken::class => \App\Policies\ApiTokenPolicy::class,
+
+        // Team policy
+        \App\Models\Team::class => \App\Policies\TeamPolicy::class,
+
+        // Git source policies
+        \App\Models\GithubApp::class => \App\Policies\GithubAppPolicy::class,
+
     ];
 
     /**
@@ -44,5 +63,11 @@ public function boot(): void
     {
         // Register gates for resource creation policy
         Gate::define('createAnyResource', [ResourceCreatePolicy::class, 'createAny']);
+
+        // Register gate for terminal access
+        Gate::define('canAccessTerminal', function ($user) {
+            // return $user->isAdmin() || $user->isOwner();
+            return true;
+        });
     }
 }
diff --git a/app/View/Components/Forms/Button.php b/app/View/Components/Forms/Button.php
index bf88d3f88..b54444261 100644
--- a/app/View/Components/Forms/Button.php
+++ b/app/View/Components/Forms/Button.php
@@ -4,6 +4,7 @@
 
 use Closure;
 use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
 
 class Button extends Component
@@ -17,7 +18,19 @@ public function __construct(
         public ?string $modalId = null,
         public string $defaultClass = 'button',
         public bool $showLoadingIndicator = true,
+        public ?string $canGate = null,
+        public mixed $canResource = null,
+        public bool $autoDisable = true,
     ) {
+        // Handle authorization-based disabling
+        if ($this->canGate && $this->canResource && $this->autoDisable) {
+            $hasPermission = Gate::allows($this->canGate, $this->canResource);
+
+            if (! $hasPermission) {
+                $this->disabled = true;
+            }
+        }
+
         if ($this->noStyle) {
             $this->defaultClass = '';
         }
diff --git a/app/View/Components/Forms/Checkbox.php b/app/View/Components/Forms/Checkbox.php
index 8db739642..ece7f0e35 100644
--- a/app/View/Components/Forms/Checkbox.php
+++ b/app/View/Components/Forms/Checkbox.php
@@ -4,6 +4,7 @@
 
 use Closure;
 use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
 
 class Checkbox extends Component
@@ -22,7 +23,20 @@ public function __construct(
         public string|bool $instantSave = false,
         public bool $disabled = false,
         public string $defaultClass = 'dark:border-neutral-700 text-coolgray-400 focus:ring-warning dark:bg-coolgray-100 rounded-sm cursor-pointer dark:disabled:bg-base dark:disabled:cursor-not-allowed',
+        public ?string $canGate = null,
+        public mixed $canResource = null,
+        public bool $autoDisable = true,
     ) {
+        // Handle authorization-based disabling
+        if ($this->canGate && $this->canResource && $this->autoDisable) {
+            $hasPermission = Gate::allows($this->canGate, $this->canResource);
+
+            if (! $hasPermission) {
+                $this->disabled = true;
+                $this->instantSave = false; // Disable instant save for unauthorized users
+            }
+        }
+
         if ($this->disabled) {
             $this->defaultClass .= ' opacity-40';
         }
diff --git a/app/View/Components/Forms/Input.php b/app/View/Components/Forms/Input.php
index a7bd87949..83c98c0df 100644
--- a/app/View/Components/Forms/Input.php
+++ b/app/View/Components/Forms/Input.php
@@ -4,6 +4,7 @@
 
 use Closure;
 use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
 use Visus\Cuid2\Cuid2;
 
@@ -26,7 +27,19 @@ public function __construct(
         public ?int $minlength = null,
         public ?int $maxlength = null,
         public bool $autofocus = false,
-    ) {}
+        public ?string $canGate = null,
+        public mixed $canResource = null,
+        public bool $autoDisable = true,
+    ) {
+        // Handle authorization-based disabling
+        if ($this->canGate && $this->canResource && $this->autoDisable) {
+            $hasPermission = Gate::allows($this->canGate, $this->canResource);
+
+            if (! $hasPermission) {
+                $this->disabled = true;
+            }
+        }
+    }
 
     public function render(): View|Closure|string
     {
diff --git a/app/View/Components/Forms/Select.php b/app/View/Components/Forms/Select.php
index feb4bf343..49b69136b 100644
--- a/app/View/Components/Forms/Select.php
+++ b/app/View/Components/Forms/Select.php
@@ -4,6 +4,7 @@
 
 use Closure;
 use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
 use Visus\Cuid2\Cuid2;
 
@@ -19,9 +20,19 @@ public function __construct(
         public ?string $helper = null,
         public bool $required = false,
         public bool $disabled = false,
-        public string $defaultClass = 'select w-full'
+        public string $defaultClass = 'select w-full',
+        public ?string $canGate = null,
+        public mixed $canResource = null,
+        public bool $autoDisable = true,
     ) {
-        //
+        // Handle authorization-based disabling
+        if ($this->canGate && $this->canResource && $this->autoDisable) {
+            $hasPermission = Gate::allows($this->canGate, $this->canResource);
+
+            if (! $hasPermission) {
+                $this->disabled = true;
+            }
+        }
     }
 
     /**
diff --git a/app/View/Components/Forms/Textarea.php b/app/View/Components/Forms/Textarea.php
index 6081c2a8a..3148d2566 100644
--- a/app/View/Components/Forms/Textarea.php
+++ b/app/View/Components/Forms/Textarea.php
@@ -4,6 +4,7 @@
 
 use Closure;
 use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\View\Component;
 use Visus\Cuid2\Cuid2;
 
@@ -33,8 +34,18 @@ public function __construct(
         public string $defaultClassInput = 'input',
         public ?int $minlength = null,
         public ?int $maxlength = null,
+        public ?string $canGate = null,
+        public mixed $canResource = null,
+        public bool $autoDisable = true,
     ) {
-        //
+        // Handle authorization-based disabling
+        if ($this->canGate && $this->canResource && $this->autoDisable) {
+            $hasPermission = Gate::allows($this->canGate, $this->canResource);
+
+            if (! $hasPermission) {
+                $this->disabled = true;
+            }
+        }
     }
 
     /**
diff --git a/resources/views/components/navbar.blade.php b/resources/views/components/navbar.blade.php
index 1a145aa4b..7ec7e4d4c 100644
--- a/resources/views/components/navbar.blade.php
+++ b/resources/views/components/navbar.blade.php
@@ -59,20 +59,20 @@
                 if (this.zoom === '90') {
                     const style = document.createElement('style');
                     style.textContent = `
-                        html {
-                            font-size: 93.75%;
-                        }
-    
-                        :root {
-                            --vh: 1vh;
-                        }
-    
-                        @media (min-width: 1024px) {
-                            html {
-                                font-size: 87.5%;
-                            }
-                        }
-                    `;
+                                    html {
+                                        font-size: 93.75%;
+                                    }
+                
+                                    :root {
+                                        --vh: 1vh;
+                                    }
+                
+                                    @media (min-width: 1024px) {
+                                        html {
+                                            font-size: 87.5%;
+                                        }
+                                    }
+                                `;
                     document.head.appendChild(style);
                 }
             }
@@ -229,20 +229,22 @@ class="{{ request()->is('tags*') ? 'menu-item-active menu-item' : 'menu-item' }}
                             Tags
                         </a>
                     </li>
-                    <li>
-                        <a title="Terminal"
-                            class="{{ request()->is('terminal*') ? 'menu-item-active menu-item' : 'menu-item' }}"
-                            href="{{ route('terminal') }}">
-                            <svg class="icon" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"
-                                stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
-                                stroke-linejoin="round">
-                                <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                                <path d="M5 7l5 5l-5 5" />
-                                <path d="M12 19l7 0" />
-                            </svg>
-                            Terminal
-                        </a>
-                    </li>
+                    @can('canAccessTerminal')
+                        <li>
+                            <a title="Terminal"
+                                class="{{ request()->is('terminal*') ? 'menu-item-active menu-item' : 'menu-item' }}"
+                                href="{{ route('terminal') }}">
+                                <svg class="icon" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"
+                                    stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
+                                    stroke-linejoin="round">
+                                    <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                                    <path d="M5 7l5 5l-5 5" />
+                                    <path d="M12 19l7 0" />
+                                </svg>
+                                Terminal
+                            </a>
+                        </li>
+                    @endcan
                     <li>
                         <a title="Profile"
                             class="{{ request()->is('profile*') ? 'menu-item-active menu-item' : 'menu-item' }}"
diff --git a/resources/views/livewire/destination/index.blade.php b/resources/views/livewire/destination/index.blade.php
index 16e9597e5..d0a21c1f0 100644
--- a/resources/views/livewire/destination/index.blade.php
+++ b/resources/views/livewire/destination/index.blade.php
@@ -5,9 +5,11 @@
     <div class="flex items-center gap-2">
         <h1>Destinations</h1>
         @if ($servers->count() > 0)
-            <x-modal-input buttonTitle="+ Add" title="New Destination">
-                <livewire:destination.new.docker />
-            </x-modal-input>
+            @can('createAnyResource')
+                <x-modal-input buttonTitle="+ Add" title="New Destination">
+                    <livewire:destination.new.docker />
+                </x-modal-input>
+            @endcan
         @endif
     </div>
     <div class="subtitle">Network endpoints to deploy your resources.</div>
diff --git a/resources/views/livewire/destination/new/docker.blade.php b/resources/views/livewire/destination/new/docker.blade.php
index 1502f70af..795b33e81 100644
--- a/resources/views/livewire/destination/new/docker.blade.php
+++ b/resources/views/livewire/destination/new/docker.blade.php
@@ -1,18 +1,25 @@
-<div class="w-full ">
-    <div class="subtitle">Destinations are used to segregate resources by network.</div>
-    <form class="flex flex-col gap-4" wire:submit='submit'>
-        <div class="flex gap-2">
-            <x-forms.input id="name" label="Name" required />
-            <x-forms.input id="network" label="Network" required />
-        </div>
-        <x-forms.select id="serverId" label="Select a server" required wire:change="generateName">
-            <option disabled>Select a server</option>
-            @foreach ($servers as $server)
-                <option value="{{ $server->id }}">{{ $server->name }}</option>
-            @endforeach
-        </x-forms.select>
-        <x-forms.button type="submit">
-            Continue
-        </x-forms.button>
-    </form>
-</div>
+@can('createAnyResource')
+    <div class="w-full ">
+        <div class="subtitle">Destinations are used to segregate resources by network.</div>
+        <form class="flex flex-col gap-4" wire:submit='submit'>
+            <div class="flex gap-2">
+                <x-forms.input id="name" label="Name" required />
+                <x-forms.input id="network" label="Network" required />
+            </div>
+            <x-forms.select id="serverId" label="Select a server" required wire:change="generateName">
+                <option disabled>Select a server</option>
+                @foreach ($servers as $server)
+                    <option value="{{ $server->id }}">{{ $server->name }}</option>
+                @endforeach
+            </x-forms.select>
+            <x-forms.button type="submit">
+                Continue
+            </x-forms.button>
+        </form>
+    </div>
+@else
+    <div class="text-gray-500 p-4 text-center">
+        <p>You don't have permission to create new destinations.</p>
+        <p class="text-sm">Please contact your team administrator for access.</p>
+    </div>
+@endcan
diff --git a/resources/views/livewire/destination/show.blade.php b/resources/views/livewire/destination/show.blade.php
index 6c3a9d9dd..f12388770 100644
--- a/resources/views/livewire/destination/show.blade.php
+++ b/resources/views/livewire/destination/show.blade.php
@@ -2,14 +2,14 @@
     <form class="flex flex-col">
         <div class="flex items-center gap-2">
             <h1>Destination</h1>
-            <x-forms.button wire:click.prevent='submit' type="submit">
-                Save
-            </x-forms.button>
+            <x-forms.button canGate="update" :canResource="$destination" wire:click.prevent='submit'
+                type="submit">Save</x-forms.button>
             @if ($network !== 'coolify')
                 <x-modal-confirmation title="Confirm Destination Deletion?" buttonTitle="Delete Destination" isErrorButton
                     submitAction="delete" :actions="['This will delete the selected destination/network.']" confirmationText="{{ $destination->name }}"
                     confirmationLabel="Please confirm the execution of the actions by entering the Destination Name below"
-                    shortConfirmationLabel="Destination Name" :confirmWithPassword="false" step2ButtonText="Permanently Delete" />
+                    shortConfirmationLabel="Destination Name" :confirmWithPassword="false" step2ButtonText="Permanently Delete" 
+                    canGate="delete" :canResource="$destination" />
             @endif
         </div>
 
@@ -19,7 +19,7 @@
             <div class="subtitle ">A swarm Docker network. WIP</div>
         @endif
         <div class="flex gap-2">
-            <x-forms.input id="name" label="Name" />
+            <x-forms.input canGate="update" :canResource="$destination" id="name" label="Name" />
             <x-forms.input id="serverIp" label="Server IP" readonly />
             @if ($destination->getMorphClass() === 'App\Models\StandaloneDocker')
                 <x-forms.input id="network" label="Docker Network" readonly />
diff --git a/resources/views/livewire/notifications/discord.blade.php b/resources/views/livewire/notifications/discord.blade.php
index 4118af5f1..dbf56b027 100644
--- a/resources/views/livewire/notifications/discord.blade.php
+++ b/resources/views/livewire/notifications/discord.blade.php
@@ -6,27 +6,27 @@
     <form wire:submit='submit' class="flex flex-col gap-4 pb-4">
         <div class="flex items-center gap-2">
             <h2>Discord</h2>
-            <x-forms.button type="submit">
+            <x-forms.button canGate="update" :canResource="$settings" type="submit">
                 Save
             </x-forms.button>
             @if ($discordEnabled)
-                <x-forms.button class="normal-case dark:text-white btn btn-xs no-animation btn-primary"
+                <x-forms.button canGate="sendTest" :canResource="$settings" class="normal-case dark:text-white btn btn-xs no-animation btn-primary"
                     wire:click="sendTestNotification">
                     Send Test Notification
                 </x-forms.button>
             @else
-                <x-forms.button disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
+                <x-forms.button canGate="sendTest" :canResource="$settings" disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
                     Send Test Notification
                 </x-forms.button>
             @endif
         </div>
         <div class="w-48">
-            <x-forms.checkbox instantSave="instantSaveDiscordEnabled" id="discordEnabled" label="Enabled" />
-            <x-forms.checkbox instantSave="instantSaveDiscordPingEnabled" id="discordPingEnabled"
+            <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSaveDiscordEnabled" id="discordEnabled" label="Enabled" />
+            <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSaveDiscordPingEnabled" id="discordPingEnabled"
                 helper="If enabled, a ping (@here) will be sent to the notification when a critical event happens."
                 label="Ping Enabled" />
         </div>
-        <x-forms.input type="password"
+        <x-forms.input canGate="update" :canResource="$settings" type="password"
             helper="Create a Discord Server and generate a Webhook URL. <br><a class='inline-block underline dark:text-white' href='https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks' target='_blank'>Webhook Documentation</a>"
             required id="discordWebhookUrl" label="Webhook" />
     </form>
@@ -38,11 +38,11 @@
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Deployments</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="deploymentSuccessDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentSuccessDiscordNotifications"
                     label="Deployment Success" />
-                <x-forms.checkbox instantSave="saveModel" id="deploymentFailureDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentFailureDiscordNotifications"
                     label="Deployment Failure" />
-                <x-forms.checkbox instantSave="saveModel"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel"
                     helper="Send a notification when a container status changes. It will notify for Stopped and Restarted events of a container."
                     id="statusChangeDiscordNotifications" label="Container Status Changes" />
             </div>
@@ -50,35 +50,35 @@
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Backups</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="backupSuccessDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupSuccessDiscordNotifications"
                     label="Backup Success" />
-                <x-forms.checkbox instantSave="saveModel" id="backupFailureDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupFailureDiscordNotifications"
                     label="Backup Failure" />
             </div>
         </div>
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Scheduled Tasks</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="scheduledTaskSuccessDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskSuccessDiscordNotifications"
                     label="Scheduled Task Success" />
-                <x-forms.checkbox instantSave="saveModel" id="scheduledTaskFailureDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskFailureDiscordNotifications"
                     label="Scheduled Task Failure" />
             </div>
         </div>
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Server</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="dockerCleanupSuccessDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupSuccessDiscordNotifications"
                     label="Docker Cleanup Success" />
-                <x-forms.checkbox instantSave="saveModel" id="dockerCleanupFailureDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupFailureDiscordNotifications"
                     label="Docker Cleanup Failure" />
-                <x-forms.checkbox instantSave="saveModel" id="serverDiskUsageDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverDiskUsageDiscordNotifications"
                     label="Server Disk Usage" />
-                <x-forms.checkbox instantSave="saveModel" id="serverReachableDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverReachableDiscordNotifications"
                     label="Server Reachable" />
-                <x-forms.checkbox instantSave="saveModel" id="serverUnreachableDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverUnreachableDiscordNotifications"
                     label="Server Unreachable" />
-                <x-forms.checkbox instantSave="saveModel" id="serverPatchDiscordNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverPatchDiscordNotifications"
                     label="Server Patching" />
             </div>
         </div>
diff --git a/resources/views/livewire/notifications/email.blade.php b/resources/views/livewire/notifications/email.blade.php
index 74380f2cd..a3b46fc89 100644
--- a/resources/views/livewire/notifications/email.blade.php
+++ b/resources/views/livewire/notifications/email.blade.php
@@ -6,41 +6,43 @@
     <form wire:submit='submit' class="flex flex-col gap-4 pb-4">
         <div class="flex items-center gap-2">
             <h2>Email</h2>
-            <x-forms.button type="submit">
+            <x-forms.button canGate="update" :canResource="$settings" type="submit">
                 Save
             </x-forms.button>
             @if (auth()->user()->isAdminFromSession())
-                @if ($team->isNotificationEnabled('email'))
-                    <x-modal-input buttonTitle="Send Test Email" title="Send Test Email">
-                        <form wire:submit.prevent="sendTestEmail" class="flex flex-col w-full gap-2">
-                            <x-forms.input wire:model="testEmailAddress" placeholder="test@example.com"
-                                id="testEmailAddress" label="Recipient" required />
-                            <x-forms.button type="submit" @click="modalOpen=false">
-                                Send Email
-                            </x-forms.button>
-                        </form>
-                    </x-modal-input>
-                @else
-                    <x-forms.button disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
-                        Send Test Email
-                    </x-forms.button>
-                @endif
+                @can('sendTest', $settings)
+                    @if ($team->isNotificationEnabled('email'))
+                        <x-modal-input buttonTitle="Send Test Email" title="Send Test Email">
+                            <form wire:submit.prevent="sendTestEmail" class="flex flex-col w-full gap-2">
+                                <x-forms.input wire:model="testEmailAddress" placeholder="test@example.com"
+                                    id="testEmailAddress" label="Recipient" required />
+                                <x-forms.button type="submit" @click="modalOpen=false">
+                                    Send Email
+                                </x-forms.button>
+                            </form>
+                        </x-modal-input>
+                    @else
+                        <x-forms.button disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
+                            Send Test Email
+                        </x-forms.button>
+                    @endif
+                @endcan
             @endif
         </div>
         @if (!isCloud())
             <div class="w-96">
-                <x-forms.checkbox instantSave="instantSave()" id="useInstanceEmailSettings"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSave()" id="useInstanceEmailSettings"
                     label="Use system wide (transactional) email settings" />
             </div>
         @endif
         @if (!$useInstanceEmailSettings)
             <div class="flex gap-2">
-                <x-forms.input required id="smtpFromName" helper="Name used in emails." label="From Name" />
-                <x-forms.input required id="smtpFromAddress" helper="Email address used in emails."
+                <x-forms.input canGate="update" :canResource="$settings" required id="smtpFromName" helper="Name used in emails." label="From Name" />
+                <x-forms.input canGate="update" :canResource="$settings" required id="smtpFromAddress" helper="Email address used in emails."
                     label="From Address" />
             </div>
             @if (isInstanceAdmin() && !$useInstanceEmailSettings)
-                <x-forms.button wire:click='copyFromInstanceSettings'>
+                <x-forms.button canGate="update" :canResource="$settings" wire:click='copyFromInstanceSettings'>
                     Copy from Instance Settings
                 </x-forms.button>
             @endif
@@ -48,7 +50,7 @@
     </form>
     @if (isCloud())
         <div class="w-64 py-4">
-            <x-forms.checkbox instantSave="instantSave()" id="useInstanceEmailSettings"
+            <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSave()" id="useInstanceEmailSettings"
                 label="Use Hosted Email Service" />
         </div>
     @endif
@@ -58,29 +60,29 @@
                 class="p-4 border dark:border-coolgray-300 border-neutral-200 flex flex-col gap-2">
                 <div class="flex items-center gap-2">
                     <h3>SMTP Server</h3>
-                    <x-forms.button type="submit">
+                    <x-forms.button canGate="update" :canResource="$settings" type="submit">
                         Save
                     </x-forms.button>
                 </div>
                 <div class="w-32">
-                    <x-forms.checkbox wire:model="smtpEnabled" instantSave="instantSave('SMTP')" id="smtpEnabled"
+                    <x-forms.checkbox canGate="update" :canResource="$settings" wire:model="smtpEnabled" instantSave="instantSave('SMTP')" id="smtpEnabled"
                         label="Enabled" />
                 </div>
                 <div class="flex flex-col">
                     <div class="flex flex-col gap-4">
                         <div class="flex flex-col w-full gap-2 xl:flex-row">
-                            <x-forms.input required id="smtpHost" placeholder="smtp.mailgun.org" label="Host" />
-                            <x-forms.input required id="smtpPort" placeholder="587" label="Port" />
-                            <x-forms.select required id="smtpEncryption" label="Encryption">
+                            <x-forms.input canGate="update" :canResource="$settings" required id="smtpHost" placeholder="smtp.mailgun.org" label="Host" />
+                            <x-forms.input canGate="update" :canResource="$settings" required id="smtpPort" placeholder="587" label="Port" />
+                            <x-forms.select canGate="update" :canResource="$settings" required id="smtpEncryption" label="Encryption">
                                 <option value="starttls">StartTLS</option>
                                 <option value="tls">TLS/SSL</option>
                                 <option value="none">None</option>
                             </x-forms.select>
                         </div>
                         <div class="flex flex-col w-full gap-2 xl:flex-row">
-                            <x-forms.input id="smtpUsername" label="SMTP Username" />
-                            <x-forms.input id="smtpPassword" type="password" label="SMTP Password" />
-                            <x-forms.input id="smtpTimeout" helper="Timeout value for sending emails."
+                            <x-forms.input canGate="update" :canResource="$settings" id="smtpUsername" label="SMTP Username" />
+                            <x-forms.input canGate="update" :canResource="$settings" id="smtpPassword" type="password" label="SMTP Password" />
+                            <x-forms.input canGate="update" :canResource="$settings" id="smtpTimeout" helper="Timeout value for sending emails."
                                 label="Timeout" />
                         </div>
                     </div>
@@ -90,18 +92,18 @@ class="p-4 border dark:border-coolgray-300 border-neutral-200 flex flex-col gap-
                 class="p-4 border dark:border-coolgray-300 border-neutral-200 flex flex-col gap-2">
                 <div class="flex items-center gap-2">
                     <h3>Resend</h3>
-                    <x-forms.button type="submit">
+                    <x-forms.button canGate="update" :canResource="$settings" type="submit">
                         Save
                     </x-forms.button>
                 </div>
                 <div class="w-32">
-                    <x-forms.checkbox wire:model="resendEnabled" instantSave="instantSave('Resend')" id="resendEnabled"
+                    <x-forms.checkbox canGate="update" :canResource="$settings" wire:model="resendEnabled" instantSave="instantSave('Resend')" id="resendEnabled"
                         label="Enabled" />
                 </div>
                 <div class="flex flex-col">
                     <div class="flex flex-col gap-4">
                         <div class="flex flex-col w-full gap-2 xl:flex-row">
-                            <x-forms.input required type="password" id="resendApiKey" placeholder="API key"
+                            <x-forms.input canGate="update" :canResource="$settings" required type="password" id="resendApiKey" placeholder="API key"
                                 label="API Key" />
                         </div>
                     </div>
@@ -117,11 +119,11 @@ class="p-4 border dark:border-coolgray-300 border-neutral-200 flex flex-col gap-
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Deployments</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="deploymentSuccessEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentSuccessEmailNotifications"
                     label="Deployment Success" />
-                <x-forms.checkbox instantSave="saveModel" id="deploymentFailureEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentFailureEmailNotifications"
                     label="Deployment Failure" />
-                <x-forms.checkbox instantSave="saveModel"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel"
                     helper="Send an email when a container status changes. It will send and email for Stopped and Restarted events of a container."
                     id="statusChangeEmailNotifications" label="Container Status Changes" />
             </div>
@@ -129,35 +131,35 @@ class="p-4 border dark:border-coolgray-300 border-neutral-200 flex flex-col gap-
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Backups</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="backupSuccessEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupSuccessEmailNotifications"
                     label="Backup Success" />
-                <x-forms.checkbox instantSave="saveModel" id="backupFailureEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupFailureEmailNotifications"
                     label="Backup Failure" />
             </div>
         </div>
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Scheduled Tasks</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="scheduledTaskSuccessEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskSuccessEmailNotifications"
                     label="Scheduled Task Success" />
-                <x-forms.checkbox instantSave="saveModel" id="scheduledTaskFailureEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskFailureEmailNotifications"
                     label="Scheduled Task Failure" />
             </div>
         </div>
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Server</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="dockerCleanupSuccessEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupSuccessEmailNotifications"
                     label="Docker Cleanup Success" />
-                <x-forms.checkbox instantSave="saveModel" id="dockerCleanupFailureEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupFailureEmailNotifications"
                     label="Docker Cleanup Failure" />
-                <x-forms.checkbox instantSave="saveModel" id="serverDiskUsageEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverDiskUsageEmailNotifications"
                     label="Server Disk Usage" />
-                <x-forms.checkbox instantSave="saveModel" id="serverReachableEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverReachableEmailNotifications"
                     label="Server Reachable" />
-                <x-forms.checkbox instantSave="saveModel" id="serverUnreachableEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverUnreachableEmailNotifications"
                     label="Server Unreachable" />
-                <x-forms.checkbox instantSave="saveModel" id="serverPatchEmailNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverPatchEmailNotifications"
                     label="Server Patching" />
             </div>
         </div>
diff --git a/resources/views/livewire/notifications/pushover.blade.php b/resources/views/livewire/notifications/pushover.blade.php
index f0123a070..8c967030f 100644
--- a/resources/views/livewire/notifications/pushover.blade.php
+++ b/resources/views/livewire/notifications/pushover.blade.php
@@ -6,28 +6,28 @@
     <form wire:submit='submit' class="flex flex-col gap-4 pb-4">
         <div class="flex items-center gap-2">
             <h2>Pushover</h2>
-            <x-forms.button type="submit">
+            <x-forms.button canGate="update" :canResource="$settings" type="submit">
                 Save
             </x-forms.button>
             @if ($pushoverEnabled)
-                <x-forms.button class="normal-case dark:text-white btn btn-xs no-animation btn-primary"
+                <x-forms.button canGate="sendTest" :canResource="$settings" class="normal-case dark:text-white btn btn-xs no-animation btn-primary"
                     wire:click="sendTestNotification">
                     Send Test Notification
                 </x-forms.button>
             @else
-                <x-forms.button disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
+                <x-forms.button canGate="sendTest" :canResource="$settings" disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
                     Send Test Notification
                 </x-forms.button>
             @endif
         </div>
         <div class="w-32">
-            <x-forms.checkbox instantSave="instantSavePushoverEnabled" id="pushoverEnabled" label="Enabled" />
+            <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSavePushoverEnabled" id="pushoverEnabled" label="Enabled" />
         </div>
         <div class="flex  gap-2">
-            <x-forms.input type="password"
+            <x-forms.input canGate="update" :canResource="$settings" type="password"
                 helper="Get your User Key in Pushover. You need to be logged in to Pushover to see your user key in the top right corner. <br><a class='inline-block underline dark:text-white' href='https://pushover.net/' target='_blank'>Pushover Dashboard</a>"
                 required id="pushoverUserKey" label="User Key" />
-            <x-forms.input type="password"
+            <x-forms.input canGate="update" :canResource="$settings" type="password"
                 helper="Generate an API Token/Key in Pushover by creating a new application. <br><a class='inline-block underline dark:text-white' href='https://pushover.net/apps/build' target='_blank'>Create Pushover Application</a>"
                 required id="pushoverApiToken" label="API Token" />
         </div>
@@ -40,11 +40,11 @@
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Deployments</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="deploymentSuccessPushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentSuccessPushoverNotifications"
                     label="Deployment Success" />
-                <x-forms.checkbox instantSave="saveModel" id="deploymentFailurePushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentFailurePushoverNotifications"
                     label="Deployment Failure" />
-                <x-forms.checkbox instantSave="saveModel"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel"
                     helper="Send a notification when a container status changes. It will notify for Stopped and Restarted events of a container."
                     id="statusChangePushoverNotifications" label="Container Status Changes" />
             </div>
@@ -52,35 +52,35 @@
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Backups</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="backupSuccessPushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupSuccessPushoverNotifications"
                     label="Backup Success" />
-                <x-forms.checkbox instantSave="saveModel" id="backupFailurePushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupFailurePushoverNotifications"
                     label="Backup Failure" />
             </div>
         </div>
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Scheduled Tasks</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="scheduledTaskSuccessPushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskSuccessPushoverNotifications"
                     label="Scheduled Task Success" />
-                <x-forms.checkbox instantSave="saveModel" id="scheduledTaskFailurePushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskFailurePushoverNotifications"
                     label="Scheduled Task Failure" />
             </div>
         </div>
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Server</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="dockerCleanupSuccessPushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupSuccessPushoverNotifications"
                     label="Docker Cleanup Success" />
-                <x-forms.checkbox instantSave="saveModel" id="dockerCleanupFailurePushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupFailurePushoverNotifications"
                     label="Docker Cleanup Failure" />
-                <x-forms.checkbox instantSave="saveModel" id="serverDiskUsagePushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverDiskUsagePushoverNotifications"
                     label="Server Disk Usage" />
-                <x-forms.checkbox instantSave="saveModel" id="serverReachablePushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverReachablePushoverNotifications"
                     label="Server Reachable" />
-                <x-forms.checkbox instantSave="saveModel" id="serverUnreachablePushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverUnreachablePushoverNotifications"
                     label="Server Unreachable" />
-                <x-forms.checkbox instantSave="saveModel" id="serverPatchPushoverNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverPatchPushoverNotifications"
                     label="Server Patching" />
             </div>
         </div>
diff --git a/resources/views/livewire/notifications/slack.blade.php b/resources/views/livewire/notifications/slack.blade.php
index 22c145460..ce4dd5d2d 100644
--- a/resources/views/livewire/notifications/slack.blade.php
+++ b/resources/views/livewire/notifications/slack.blade.php
@@ -6,24 +6,24 @@
     <form wire:submit='submit' class="flex flex-col gap-4 pb-4">
         <div class="flex items-center gap-2">
             <h2>Slack</h2>
-            <x-forms.button type="submit">
+            <x-forms.button canGate="update" :canResource="$settings" type="submit">
                 Save
             </x-forms.button>
             @if ($slackEnabled)
-                <x-forms.button class="normal-case dark:text-white btn btn-xs no-animation btn-primary"
+                <x-forms.button canGate="sendTest" :canResource="$settings" class="normal-case dark:text-white btn btn-xs no-animation btn-primary"
                     wire:click="sendTestNotification">
                     Send Test Notification
                 </x-forms.button>
             @else
-                <x-forms.button disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
+                <x-forms.button canGate="sendTest" :canResource="$settings" disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
                     Send Test Notification
                 </x-forms.button>
             @endif
         </div>
         <div class="w-32">
-            <x-forms.checkbox instantSave="instantSaveSlackEnabled" id="slackEnabled" label="Enabled" />
+            <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSaveSlackEnabled" id="slackEnabled" label="Enabled" />
         </div>
-        <x-forms.input type="password"
+        <x-forms.input canGate="update" :canResource="$settings" type="password"
             helper="Create a Slack APP and generate a Incoming Webhook URL. <br><a class='inline-block underline dark:text-white' href='https://api.slack.com/apps' target='_blank'>Create Slack APP</a>"
             required id="slackWebhookUrl" label="Webhook" />
     </form>
@@ -35,11 +35,11 @@
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Deployments</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="deploymentSuccessSlackNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentSuccessSlackNotifications"
                     label="Deployment Success" />
-                <x-forms.checkbox instantSave="saveModel" id="deploymentFailureSlackNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentFailureSlackNotifications"
                     label="Deployment Failure" />
-                <x-forms.checkbox instantSave="saveModel"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel"
                     helper="Send a notification when a container status changes. It will notify for Stopped and Restarted events of a container."
                     id="statusChangeSlackNotifications" label="Container Status Changes" />
             </div>
@@ -47,33 +47,33 @@
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Backups</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="backupSuccessSlackNotifications" label="Backup Success" />
-                <x-forms.checkbox instantSave="saveModel" id="backupFailureSlackNotifications" label="Backup Failure" />
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupSuccessSlackNotifications" label="Backup Success" />
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupFailureSlackNotifications" label="Backup Failure" />
             </div>
         </div>
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Scheduled Tasks</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="scheduledTaskSuccessSlackNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskSuccessSlackNotifications"
                     label="Scheduled Task Success" />
-                <x-forms.checkbox instantSave="saveModel" id="scheduledTaskFailureSlackNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskFailureSlackNotifications"
                     label="Scheduled Task Failure" />
             </div>
         </div>
         <div class="border dark:border-coolgray-300 border-neutral-200 p-4 rounded-lg">
             <h3 class="font-medium mb-3">Server</h3>
             <div class="flex flex-col gap-1.5 pl-1">
-                <x-forms.checkbox instantSave="saveModel" id="dockerCleanupSuccessSlackNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupSuccessSlackNotifications"
                     label="Docker Cleanup Success" />
-                <x-forms.checkbox instantSave="saveModel" id="dockerCleanupFailureSlackNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupFailureSlackNotifications"
                     label="Docker Cleanup Failure" />
-                <x-forms.checkbox instantSave="saveModel" id="serverDiskUsageSlackNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverDiskUsageSlackNotifications"
                     label="Server Disk Usage" />
-                <x-forms.checkbox instantSave="saveModel" id="serverReachableSlackNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverReachableSlackNotifications"
                     label="Server Reachable" />
-                <x-forms.checkbox instantSave="saveModel" id="serverUnreachableSlackNotifications"
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverUnreachableSlackNotifications"
                     label="Server Unreachable" />
-                <x-forms.checkbox instantSave="saveModel" id="serverPatchSlackNotifications" label="Server Patching" />
+                <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverPatchSlackNotifications" label="Server Patching" />
             </div>
         </div>
     </div>
diff --git a/resources/views/livewire/notifications/telegram.blade.php b/resources/views/livewire/notifications/telegram.blade.php
index d4312f8d2..7b07b4e22 100644
--- a/resources/views/livewire/notifications/telegram.blade.php
+++ b/resources/views/livewire/notifications/telegram.blade.php
@@ -6,28 +6,28 @@
     <form wire:submit='submit' class="flex flex-col gap-4 pb-4">
         <div class="flex items-center gap-2">
             <h2>Telegram</h2>
-            <x-forms.button type="submit">
+            <x-forms.button canGate="update" :canResource="$settings" type="submit">
                 Save
             </x-forms.button>
             @if ($telegramEnabled)
-                <x-forms.button class="normal-case dark:text-white btn btn-xs no-animation btn-primary"
+                <x-forms.button canGate="sendTest" :canResource="$settings" class="normal-case dark:text-white btn btn-xs no-animation btn-primary"
                     wire:click="sendTestNotification">
                     Send Test Notification
                 </x-forms.button>
             @else
-                <x-forms.button disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
+                <x-forms.button canGate="sendTest" :canResource="$settings" disabled class="normal-case dark:text-white btn btn-xs no-animation btn-primary">
                     Send Test Notification
                 </x-forms.button>
             @endif
         </div>
         <div class="w-32">
-            <x-forms.checkbox instantSave="instantSaveTelegramEnabled" id="telegramEnabled" label="Enabled" />
+            <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSaveTelegramEnabled" id="telegramEnabled" label="Enabled" />
         </div>
         <div class="flex gap-2">
-            <x-forms.input type="password" autocomplete="new-password"
+            <x-forms.input canGate="update" :canResource="$settings" type="password" autocomplete="new-password"
                 helper="Get it from the <a class='inline-block underline dark:text-white' href='https://t.me/botfather' target='_blank'>BotFather Bot</a> on Telegram."
                 required id="telegramToken" label="Bot API Token" />
-            <x-forms.input type="password" autocomplete="new-password"
+            <x-forms.input canGate="update" :canResource="$settings" type="password" autocomplete="new-password"
                 helper="Add your bot to a group chat and add its Chat ID here." required id="telegramChatId"
                 label="Chat ID" />
         </div>
@@ -42,27 +42,27 @@
             <div class="flex flex-col gap-1.5 pl-1">
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="deploymentSuccessTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentSuccessTelegramNotifications"
                             label="Deployment Success" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsDeploymentSuccessThreadId" />
                 </div>
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="deploymentFailureTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentFailureTelegramNotifications"
                             label="Deployment Failure" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsDeploymentFailureThreadId" />
                 </div>
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="statusChangeTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="statusChangeTelegramNotifications"
                             label="Container Status Changes"
                             helper="Send a notification when a container status changes. It will send a notification for Stopped and Restarted events of a container." />
                     </div>
-                    <x-forms.input type="password" id="telegramNotificationsStatusChangeThreadId"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" id="telegramNotificationsStatusChangeThreadId"
                         placeholder="Custom Telegram Thread ID" />
                 </div>
             </div>
@@ -72,19 +72,19 @@
             <div class="flex flex-col gap-1.5 pl-1">
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="backupSuccessTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupSuccessTelegramNotifications"
                             label="Backup Success" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsBackupSuccessThreadId" />
                 </div>
 
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="backupFailureTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupFailureTelegramNotifications"
                             label="Backup Failure" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsBackupFailureThreadId" />
                 </div>
             </div>
@@ -95,19 +95,19 @@
             <div class="flex flex-col gap-1.5 pl-1">
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="scheduledTaskSuccessTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskSuccessTelegramNotifications"
                             label="Scheduled Task Success" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsScheduledTaskSuccessThreadId" />
                 </div>
 
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="scheduledTaskFailureTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskFailureTelegramNotifications"
                             label="Scheduled Task Failure" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsScheduledTaskFailureThreadId" />
                 </div>
             </div>
@@ -118,55 +118,55 @@
             <div class="flex flex-col gap-1.5 pl-1">
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="dockerCleanupSuccessTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupSuccessTelegramNotifications"
                             label="Docker Cleanup Success" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsDockerCleanupSuccessThreadId" />
                 </div>
 
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="dockerCleanupFailureTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupFailureTelegramNotifications"
                             label="Docker Cleanup Failure" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsDockerCleanupFailureThreadId" />
                 </div>
 
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="serverDiskUsageTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverDiskUsageTelegramNotifications"
                             label="Server Disk Usage" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsServerDiskUsageThreadId" />
                 </div>
 
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="serverReachableTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverReachableTelegramNotifications"
                             label="Server Reachable" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsServerReachableThreadId" />
                 </div>
 
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="serverUnreachableTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverUnreachableTelegramNotifications"
                             label="Server Unreachable" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsServerUnreachableThreadId" />
                 </div>
 
                 <div class="pl-1 flex gap-2">
                     <div class="w-96">
-                        <x-forms.checkbox instantSave="saveModel" id="serverPatchTelegramNotifications"
+                        <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverPatchTelegramNotifications"
                             label="Server Patching" />
                     </div>
-                    <x-forms.input type="password" placeholder="Custom Telegram Thread ID"
+                    <x-forms.input canGate="update" :canResource="$settings" type="password" placeholder="Custom Telegram Thread ID"
                         id="telegramNotificationsServerPatchThreadId" />
                 </div>
             </div>
diff --git a/resources/views/livewire/project/application/advanced.blade.php b/resources/views/livewire/project/application/advanced.blade.php
index df2b49d48..6dd5c872c 100644
--- a/resources/views/livewire/project/application/advanced.blade.php
+++ b/resources/views/livewire/project/application/advanced.blade.php
@@ -8,76 +8,73 @@
             <h3>General</h3>
             @if ($application->git_based())
                 <x-forms.checkbox helper="Automatically deploy new commits based on Git webhooks." instantSave
-                    id="isAutoDeployEnabled" label="Auto Deploy" />
+                    id="isAutoDeployEnabled" label="Auto Deploy" canGate="update" :canResource="$application" />
                 <x-forms.checkbox
                     helper="Allow to automatically deploy Preview Deployments for all opened PR's.<br><br>Closing a PR will delete Preview Deployments."
-                    instantSave id="isPreviewDeploymentsEnabled" label="Preview Deployments" />
+                    instantSave id="isPreviewDeploymentsEnabled" label="Preview Deployments" canGate="update"
+                    :canResource="$application" />
             @endif
-            <x-forms.checkbox helper="Disable Docker build cache on every deployment." instantSave id="disableBuildCache"
-                label="Disable Build Cache" />
+            <x-forms.checkbox helper="Disable Docker build cache on every deployment." instantSave
+                id="disableBuildCache" label="Disable Build Cache" canGate="update" :canResource="$application" />
 
             @if ($application->settings->is_container_label_readonly_enabled)
                 <x-forms.checkbox
                     helper="Your application will be available only on https if your domain starts with https://..."
-                    instantSave id="isForceHttpsEnabled" label="Force Https" />
+                    instantSave id="isForceHttpsEnabled" label="Force Https" canGate="update" :canResource="$application" />
                 <x-forms.checkbox label="Enable Gzip Compression"
                     helper="You can disable gzip compression if you want. Some services are compressing data by default. In this case, you do not need this."
-                    instantSave id="isGzipEnabled" />
+                    instantSave id="isGzipEnabled" canGate="update" :canResource="$application" />
                 <x-forms.checkbox helper="Strip Prefix is used to remove prefixes from paths. Like /api/ to /api."
-                    instantSave id="isStripprefixEnabled" label="Strip Prefixes" />
+                    instantSave id="isStripprefixEnabled" label="Strip Prefixes" canGate="update" :canResource="$application" />
             @else
                 <x-forms.checkbox disabled
                     helper="Readonly labels are disabled. You need to set the labels in the labels section." instantSave
-                    id="isForceHttpsEnabled" label="Force Https" />
+                    id="isForceHttpsEnabled" label="Force Https" canGate="update" :canResource="$application" />
                 <x-forms.checkbox label="Enable Gzip Compression" disabled
                     helper="Readonly labels are disabled. You need to set the labels in the labels section." instantSave
-                    id="isGzipEnabled" />
+                    id="isGzipEnabled" canGate="update" :canResource="$application" />
                 <x-forms.checkbox
                     helper="Readonly labels are disabled. You need to set the labels in the labels section." disabled
-                    instantSave id="isStripprefixEnabled" label="Strip Prefixes" />
+                    instantSave id="isStripprefixEnabled" label="Strip Prefixes" canGate="update" :canResource="$application" />
             @endif
             @if ($application->build_pack === 'dockercompose')
                 <h3>Docker Compose</h3>
                 <x-forms.checkbox instantSave id="isRawComposeDeploymentEnabled" label="Raw Compose Deployment"
-                    helper="WARNING: Advanced use cases only. Your docker compose file will be deployed as-is. Nothing is modified by Coolify. You need to configure the proxy parts. More info in the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/compose#raw-docker-compose-deployment'>documentation.</a>" />
+                    helper="WARNING: Advanced use cases only. Your docker compose file will be deployed as-is. Nothing is modified by Coolify. You need to configure the proxy parts. More info in the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/compose#raw-docker-compose-deployment'>documentation.</a>"
+                    canGate="update" :canResource="$application" />
             @endif
             <h3 class="pt-4">Container Names</h3>
             <x-forms.checkbox
                 helper="The deployed container will have the same name ({{ $application->uuid }}). <span class='font-bold dark:text-warning'>You will lose the rolling update feature!</span>"
-                instantSave id="isConsistentContainerNameEnabled" label="Consistent Container Names" />
+                instantSave id="isConsistentContainerNameEnabled" label="Consistent Container Names" canGate="update"
+                :canResource="$application" />
             @if ($isConsistentContainerNameEnabled === false)
                 <form class="flex items-end gap-2 " wire:submit.prevent='saveCustomName'>
                     <x-forms.input
                         helper="You can add a custom name for your container.<br><br>The name will be converted to slug format when you save it. <span class='font-bold dark:text-warning'>You will lose the rolling update feature!</span>"
-                        instantSave id="customInternalName" label="Custom Container Name" />
-                    @can('update', $application)
-                        <x-forms.button type="submit">
-                            Save
-                        </x-forms.button>
-                    @else
-                        <x-forms.button type="submit" disabled
-                            title="You don't have permission to update this application. Contact your team administrator for access.">
-                            Save
-                        </x-forms.button>
-                    @endcan
+                        instantSave id="customInternalName" label="Custom Container Name" canGate="update"
+                        :canResource="$application" />
+                    <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
                 </form>
             @endif
             @if ($application->build_pack === 'dockercompose')
                 <h3 class="pt-4">Network</h3>
                 <x-forms.checkbox instantSave id="isConnectToDockerNetworkEnabled" label="Connect To Predefined Network"
-                    helper="By default, you do not reach the Coolify defined networks.<br>Starting a docker compose based resource will have an internal network. <br>If you connect to a Coolify defined network, you maybe need to use different internal DNS names to connect to a resource.<br><br>For more information, check <a class='underline dark:text-white' target='_blank' href='https://coolify.io/docs/knowledge-base/docker/compose#connect-to-predefined-networks'>this</a>." />
+                    helper="By default, you do not reach the Coolify defined networks.<br>Starting a docker compose based resource will have an internal network. <br>If you connect to a Coolify defined network, you maybe need to use different internal DNS names to connect to a resource.<br><br>For more information, check <a class='underline dark:text-white' target='_blank' href='https://coolify.io/docs/knowledge-base/docker/compose#connect-to-predefined-networks'>this</a>."
+                    canGate="update" :canResource="$application" />
             @endif
             <h3 class="pt-4">Logs</h3>
             <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
-                instantSave id="isLogDrainEnabled" label="Drain Logs" />
+                instantSave id="isLogDrainEnabled" label="Drain Logs" canGate="update" :canResource="$application" />
             @if ($application->git_based())
                 <h3>Git</h3>
                 <x-forms.checkbox instantSave id="isGitSubmodulesEnabled" label="Submodules"
-                    helper="Allow Git Submodules during build process." />
+                    helper="Allow Git Submodules during build process." canGate="update" :canResource="$application" />
                 <x-forms.checkbox instantSave id="isGitLfsEnabled" label="LFS"
-                    helper="Allow Git LFS during build process." />
+                    helper="Allow Git LFS during build process." canGate="update" :canResource="$application" />
                 <x-forms.checkbox instantSave id="isGitShallowCloneEnabled" label="Shallow Clone"
-                    helper="Use shallow cloning (--depth=1) to speed up deployments by only fetching the latest commit history. This reduces clone time and resource usage, especially for large repositories." />
+                    helper="Use shallow cloning (--depth=1) to speed up deployments by only fetching the latest commit history. This reduces clone time and resource usage, especially for large repositories."
+                    canGate="update" :canResource="$application" />
             @endif
         </div>
 
@@ -87,16 +84,7 @@
             <div class="flex gap-2 items-end pt-4">
                 <h3>GPU</h3>
                 @if ($isGpuEnabled)
-                    @can('update', $application)
-                        <x-forms.button type="submit">
-                            Save
-                        </x-forms.button>
-                    @else
-                        <x-forms.button type="submit" disabled
-                            title="You don't have permission to update this application. Contact your team administrator for access.">
-                            Save
-                        </x-forms.button>
-                    @endcan
+                    <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
                 @endif
             </div>
         @endif
@@ -104,21 +92,23 @@
             <div class="md:w-96 pb-4">
                 <x-forms.checkbox
                     helper="Enable GPU usage for this application. More info <a href='https://docs.docker.com/compose/gpu-support/' class='underline dark:text-white' target='_blank'>here</a>."
-                    instantSave id="isGpuEnabled" label="Enable GPU" />
+                    instantSave id="isGpuEnabled" label="Enable GPU" canGate="update" :canResource="$application" />
             </div>
         @endif
         @if ($isGpuEnabled)
             <div class="flex flex-col w-full gap-2 ">
                 <div class="flex gap-2 items-end">
-                    <x-forms.input label="GPU Driver" id="gpuDriver"> </x-forms.input>
-                    <x-forms.input label="GPU Count" placeholder="empty means use all GPUs" id="gpuCount">
+                    <x-forms.input label="GPU Driver" id="gpuDriver" canGate="update" :canResource="$application">
+                    </x-forms.input>
+                    <x-forms.input label="GPU Count" placeholder="empty means use all GPUs" id="gpuCount"
+                        canGate="update" :canResource="$application">
                     </x-forms.input>
                 </div>
-
                 <x-forms.input label="GPU Device Ids" placeholder="0,2"
                     helper="Comma separated list of device ids. More info <a href='https://docs.docker.com/compose/gpu-support/#access-specific-devices' class='underline dark:text-white' target='_blank'>here</a>."
-                    id="gpuDeviceIds"> </x-forms.input>
-                <x-forms.textarea rows="10" label="GPU Options" id="gpuOptions"> </x-forms.textarea>
+                    id="gpuDeviceIds" canGate="update" :canResource="$application"> </x-forms.input>
+                <x-forms.textarea rows="10" label="GPU Options" id="gpuOptions" canGate="update"
+                    :canResource="$application"> </x-forms.textarea>
             </div>
         @endif
     </form>
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index b473286f0..b833fc7bb 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -1,56 +1,35 @@
-<div x-data="{ initLoadingCompose: $wire.entangle('initLoadingCompose') }">
+<div x-data="{
+    initLoadingCompose: $wire.entangle('initLoadingCompose'),
+    canUpdate: @js(auth()->user()->can('update', $application)),
+    shouldDisable() {
+        return this.initLoadingCompose || !this.canUpdate;
+    }
+}">
     <form wire:submit='submit' class="flex flex-col pb-32">
         <div class="flex items-center gap-2">
             <h2>General</h2>
-            @can('update', $application)
-                <x-forms.button type="submit">
-                    Save
-                </x-forms.button>
-            @else
-                <x-forms.button type="submit" disabled
-                    title="You don't have permission to update this application. Contact your team administrator for access.">
-                    Save
-                </x-forms.button>
-            @endcan
-
-            {{-- <x-forms.button wire:click="downloadConfig">
-                Download Config
-            </x-forms.button> --}}
-            {{-- <x-modal-input buttonTitle="Upload Config" title="Upload Config" :closeOutside="false">
-                <livewire:project.shared.upload-config :applicationId="$application->id" />
-            </x-modal-input> --}}
-
+            <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
         </div>
         <div>General configuration for your application.</div>
         <div class="flex flex-col gap-2 py-4">
             <div class="flex flex-col items-end gap-2 xl:flex-row">
-                <x-forms.input x-bind:disabled="initLoadingCompose" id="application.name" label="Name" required />
-                <x-forms.input x-bind:disabled="initLoadingCompose" id="application.description" label="Description" />
+                <x-forms.input x-bind:disabled="shouldDisable()" id="application.name" label="Name" required />
+                <x-forms.input x-bind:disabled="shouldDisable()" id="application.description" label="Description" />
             </div>
 
             @if (!$application->dockerfile && $application->build_pack !== 'dockerimage')
                 <div class="flex flex-col gap-2">
                     <div class="flex gap-2">
-                        @can('update', $application)
-                            <x-forms.select x-bind:disabled="initLoadingCompose" wire:model.live="application.build_pack"
-                                label="Build Pack" required>
-                                <option value="nixpacks">Nixpacks</option>
-                                <option value="static">Static</option>
-                                <option value="dockerfile">Dockerfile</option>
-                                <option value="dockercompose">Docker Compose</option>
-                            </x-forms.select>
-                        @else
-                            <x-forms.select disabled label="Build Pack" required>
-                                <option value="nixpacks" @if ($application->build_pack === 'nixpacks') selected @endif>Nixpacks</option>
-                                <option value="static" @if ($application->build_pack === 'static') selected @endif>Static</option>
-                                <option value="dockerfile" @if ($application->build_pack === 'dockerfile') selected @endif>Dockerfile
-                                </option>
-                                <option value="dockercompose" @if ($application->build_pack === 'dockercompose') selected @endif>Docker
-                                    Compose</option>
-                            </x-forms.select>
-                        @endcan
+                        <x-forms.select x-bind:disabled="shouldDisable()" wire:model.live="application.build_pack"
+                            label="Build Pack" required>
+                            <option value="nixpacks">Nixpacks</option>
+                            <option value="static">Static</option>
+                            <option value="dockerfile">Dockerfile</option>
+                            <option value="dockercompose">Docker Compose</option>
+                        </x-forms.select>
                         @if ($application->settings->is_static || $application->build_pack === 'static')
-                            <x-forms.select id="application.static_image" label="Static Image" required>
+                            <x-forms.select x-bind:disabled="!canUpdate" id="application.static_image"
+                                label="Static Image" required>
                                 <option value="nginx:alpine">nginx:alpine</option>
                                 <option disabled value="apache:alpine">apache:alpine</option>
                             </x-forms.select>
@@ -69,7 +48,8 @@
                                         <x-forms.input
                                             helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "
                                             label="Domains for {{ str($serviceName)->headline() }}"
-                                            id="parsedServiceDomains.{{ str($serviceName)->slug('_') }}.domain"></x-forms.input>
+                                            id="parsedServiceDomains.{{ str($serviceName)->slug('_') }}.domain"
+                                            x-bind:disabled="shouldDisable()"></x-forms.input>
                                         @can('update', $application)
                                             <x-forms.button wire:click="generateDomain('{{ $serviceName }}')">Generate
                                                 Domain</x-forms.button>
@@ -85,27 +65,23 @@
             @if ($application->settings->is_static || $application->build_pack === 'static')
                 <x-forms.textarea id="application.custom_nginx_configuration"
                     placeholder="Empty means default configuration will be used." label="Custom Nginx Configuration"
-                    helper="You can add custom Nginx configuration here." />
+                    helper="You can add custom Nginx configuration here." x-bind:disabled="!canUpdate" />
                 @can('update', $application)
                     <x-forms.button wire:click="generateNginxConfiguration">
                         Generate Default Nginx Configuration
                     </x-forms.button>
-                @else
-                    <x-forms.button wire:click="generateNginxConfiguration" disabled
-                        title="You don't have permission to update this application. Contact your team administrator for access.">
-                        Generate Default Nginx Configuration
-                    </x-forms.button>
                 @endcan
             @endif
             <div class="w-96 pb-6">
                 @if ($application->could_set_build_commands())
                     <x-forms.checkbox instantSave id="application.settings.is_static" label="Is it a static site?"
-                        helper="If your application is a static site or the final build assets should be served as a static site, enable this." />
+                        helper="If your application is a static site or the final build assets should be served as a static site, enable this."
+                        x-bind:disabled="!canUpdate" />
                 @endif
                 @if ($application->settings->is_static && $application->build_pack !== 'static')
                     <x-forms.checkbox label="Is it a SPA (Single Page Application)?"
-                        helper="If your application is a SPA, enable this." id="application.settings.is_spa"
-                        instantSave></x-forms.checkbox>
+                        helper="If your application is a SPA, enable this." id="application.settings.is_spa" instantSave
+                        x-bind:disabled="!canUpdate"></x-forms.checkbox>
                 @endif
             </div>
             @if ($application->build_pack !== 'dockercompose')
@@ -113,11 +89,13 @@
                     @if ($application->settings->is_container_label_readonly_enabled == false)
                         <x-forms.input placeholder="https://coolify.io" wire:model.blur-sm="application.fqdn"
                             label="Domains" readonly
-                            helper="Readonly labels are disabled. You can set the domains in the labels section." />
+                            helper="Readonly labels are disabled. You can set the domains in the labels section."
+                            x-bind:disabled="!canUpdate" />
                     @else
                         <x-forms.input placeholder="https://coolify.io" wire:model.blur-sm="application.fqdn"
                             label="Domains"
-                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. " />
+                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "
+                            x-bind:disabled="!canUpdate" />
                         @can('update', $application)
                             <x-forms.button wire:click="getWildcardDomain">Generate Domain
                             </x-forms.button>
@@ -128,32 +106,38 @@
                     @if ($application->settings->is_container_label_readonly_enabled == false)
                         @if ($application->redirect === 'both')
                             <x-forms.input label="Direction" value="Allow www & non-www." readonly
-                                helper="Readonly labels are disabled. You can set the direction in the labels section." />
+                                helper="Readonly labels are disabled. You can set the direction in the labels section."
+                                x-bind:disabled="!canUpdate" />
                         @elseif ($application->redirect === 'www')
                             <x-forms.input label="Direction" value="Redirect to www." readonly
-                                helper="Readonly labels are disabled. You can set the direction in the labels section." />
+                                helper="Readonly labels are disabled. You can set the direction in the labels section."
+                                x-bind:disabled="!canUpdate" />
                         @elseif ($application->redirect === 'non-www')
                             <x-forms.input label="Direction" value="Redirect to non-www." readonly
-                                helper="Readonly labels are disabled. You can set the direction in the labels section." />
+                                helper="Readonly labels are disabled. You can set the direction in the labels section."
+                                x-bind:disabled="!canUpdate" />
                         @endif
                     @else
                         <x-forms.select label="Direction" id="application.redirect" required
-                            helper="You must need to add www and non-www as an A DNS record. Make sure the www domain is added under Domains.">
+                            helper="You must need to add www and non-www as an A DNS record. Make sure the www domain is added under Domains."
+                            x-bind:disabled="!canUpdate">
                             <option value="both">Allow www & non-www.</option>
                             <option value="www">Redirect to www.</option>
                             <option value="non-www">Redirect to non-www.</option>
                         </x-forms.select>
                         @if ($application->settings->is_container_label_readonly_enabled)
-                            <x-modal-confirmation title="Confirm Redirection Setting?" buttonTitle="Set Direction"
-                                submitAction="setRedirect" :actions="['All traffic will be redirected to the selected direction.']"
-                                confirmationText="{{ $application->fqdn . '/' }}"
-                                confirmationLabel="Please confirm the execution of the action by entering the Application URL below"
-                                shortConfirmationLabel="Application URL" :confirmWithPassword="false"
-                                step2ButtonText="Set Direction">
-                                <x-slot:customButton>
-                                    <div class="w-[7.2rem]">Set Direction</div>
-                                </x-slot:customButton>
-                            </x-modal-confirmation>
+                            @can('update', $application)
+                                <x-modal-confirmation title="Confirm Redirection Setting?" buttonTitle="Set Direction"
+                                    submitAction="setRedirect" :actions="['All traffic will be redirected to the selected direction.']"
+                                    confirmationText="{{ $application->fqdn . '/' }}"
+                                    confirmationLabel="Please confirm the execution of the action by entering the Application URL below"
+                                    shortConfirmationLabel="Application URL" :confirmWithPassword="false"
+                                    step2ButtonText="Set Direction">
+                                    <x-slot:customButton>
+                                        <div class="w-[7.2rem]">Set Direction</div>
+                                    </x-slot:customButton>
+                                </x-modal-confirmation>
+                            @endcan
                         @endif
                     @endif
                 </div>
@@ -177,11 +161,15 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                 <div class="flex flex-col gap-2 xl:flex-row">
                     @if ($application->build_pack === 'dockerimage')
                         @if ($application->destination->server->isSwarm())
-                            <x-forms.input required id="application.docker_registry_image_name" label="Docker Image" />
-                            <x-forms.input id="application.docker_registry_image_tag" label="Docker Image Tag" />
+                            <x-forms.input required id="application.docker_registry_image_name" label="Docker Image"
+                                x-bind:disabled="!canUpdate" />
+                            <x-forms.input id="application.docker_registry_image_tag" label="Docker Image Tag"
+                                x-bind:disabled="!canUpdate" />
                         @else
-                            <x-forms.input id="application.docker_registry_image_name" label="Docker Image" />
-                            <x-forms.input id="application.docker_registry_image_tag" label="Docker Image Tag" />
+                            <x-forms.input id="application.docker_registry_image_name" label="Docker Image"
+                                x-bind:disabled="!canUpdate" />
+                            <x-forms.input id="application.docker_registry_image_tag" label="Docker Image Tag"
+                                x-bind:disabled="!canUpdate" />
                         @endif
                     @else
                         @if (
@@ -189,19 +177,20 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                                 $application->additional_servers->count() > 0 ||
                                 $application->settings->is_build_server_enabled)
                             <x-forms.input id="application.docker_registry_image_name" required label="Docker Image"
-                                placeholder="Required!" />
+                                placeholder="Required!" x-bind:disabled="!canUpdate" />
                             <x-forms.input id="application.docker_registry_image_tag"
                                 helper="If set, it will tag the built image with this tag too. <br><br>Example: If you set it to 'latest', it will push the image with the commit sha tag + with the latest tag."
-                                placeholder="Empty means latest will be used." label="Docker Image Tag" />
+                                placeholder="Empty means latest will be used." label="Docker Image Tag"
+                                x-bind:disabled="!canUpdate" />
                         @else
                             <x-forms.input id="application.docker_registry_image_name"
                                 helper="Empty means it won't push the image to a docker registry."
                                 placeholder="Empty means it won't push the image to a docker registry."
-                                label="Docker Image" />
+                                label="Docker Image" x-bind:disabled="!canUpdate" />
                             <x-forms.input id="application.docker_registry_image_tag"
                                 placeholder="Empty means only push commit sha tag."
                                 helper="If set, it will tag the built image with this tag too. <br><br>Example: If you set it to 'latest', it will push the image with the commit sha tag + with the latest tag."
-                                label="Docker Image Tag" />
+                                label="Docker Image Tag" x-bind:disabled="!canUpdate" />
                         @endif
                     @endif
                 </div>
@@ -212,17 +201,21 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                     <x-forms.input
                         helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
                         placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k --hostname=myapp"
-                        id="application.custom_docker_run_options" label="Custom Docker Options" />
+                        id="application.custom_docker_run_options" label="Custom Docker Options"
+                        x-bind:disabled="!canUpdate" />
                 @else
                     @if ($application->could_set_build_commands())
                         @if ($application->build_pack === 'nixpacks')
                             <div class="flex flex-col gap-2 xl:flex-row">
                                 <x-forms.input helper="If you modify this, you probably need to have a nixpacks.toml"
-                                    id="application.install_command" label="Install Command" />
+                                    id="application.install_command" label="Install Command"
+                                    x-bind:disabled="!canUpdate" />
                                 <x-forms.input helper="If you modify this, you probably need to have a nixpacks.toml"
-                                    id="application.build_command" label="Build Command" />
+                                    id="application.build_command" label="Build Command"
+                                    x-bind:disabled="!canUpdate" />
                                 <x-forms.input helper="If you modify this, you probably need to have a nixpacks.toml"
-                                    id="application.start_command" label="Start Command" />
+                                    id="application.start_command" label="Start Command"
+                                    x-bind:disabled="!canUpdate" />
                             </div>
                             <div class="pt-1 text-xs">Nixpacks will detect the required configuration
                                 automatically.
@@ -240,10 +233,10 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                                     <div class="flex flex-col gap-2">
                                     @endcan
                                     <div class="flex gap-2">
-                                        <x-forms.input x-bind:disabled="initLoadingCompose" placeholder="/"
+                                        <x-forms.input x-bind:disabled="shouldDisable()" placeholder="/"
                                             id="application.base_directory" label="Base Directory"
                                             helper="Directory to use as root. Useful for monorepos." />
-                                        <x-forms.input x-bind:disabled="initLoadingCompose"
+                                        <x-forms.input x-bind:disabled="shouldDisable()"
                                             placeholder="/docker-compose.yaml"
                                             id="application.docker_compose_location" label="Docker Compose Location"
                                             helper="It is calculated together with the Base Directory:<br><span class='dark:text-warning'>{{ Str::start($application->base_directory . $application->docker_compose_location, '/') }}</span>" />
@@ -252,7 +245,8 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                                         <x-forms.checkbox instantSave
                                             id="application.settings.is_preserve_repository_enabled"
                                             label="Preserve Repository During Deployment"
-                                            helper="Git repository (based on the base directory settings) will be copied to the deployment directory." />
+                                            helper="Git repository (based on the base directory settings) will be copied to the deployment directory."
+                                            x-bind:disabled="shouldDisable()" />
                                     </div>
                                     <div class="pt-4">The following commands are for advanced use cases.
                                         Only
@@ -260,13 +254,13 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                                         know what are
                                         you doing.</div>
                                     <div class="flex gap-2">
-                                        <x-forms.input placeholder="docker compose build"
-                                            x-bind:disabled="initLoadingCompose"
+                                        <x-forms.input x-bind:disabled="shouldDisable()"
+                                            placeholder="docker compose build"
                                             id="application.docker_compose_custom_build_command"
                                             helper="If you use this, you need to specify paths relatively and should use the same compose file in the custom command, otherwise the automatically configured labels / etc won't work.<br><br>So in your case, use: <span class='dark:text-warning'>docker compose -f .{{ Str::start($application->base_directory . $application->docker_compose_location, '/') }} build</span>"
                                             label="Custom Build Command" />
-                                        <x-forms.input placeholder="docker compose up -d"
-                                            x-bind:disabled="initLoadingCompose"
+                                        <x-forms.input x-bind:disabled="shouldDisable()"
+                                            placeholder="docker compose up -d"
                                             id="application.docker_compose_custom_start_command"
                                             helper="If you use this, you need to specify paths relatively and should use the same compose file in the custom command, otherwise the automatically configured labels / etc won't work.<br><br>So in your case, use: <span class='dark:text-warning'>docker compose -f .{{ Str::start($application->base_directory . $application->docker_compose_location, '/') }} up -d</span>"
                                             label="Custom Start Command" />
@@ -276,25 +270,28 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                                 <div class="flex flex-col gap-2 xl:flex-row">
                                     <x-forms.input placeholder="/" id="application.base_directory"
                                         label="Base Directory"
-                                        helper="Directory to use as root. Useful for monorepos." />
+                                        helper="Directory to use as root. Useful for monorepos."
+                                        x-bind:disabled="!canUpdate" />
                                     @if ($application->build_pack === 'dockerfile' && !$application->dockerfile)
                                         <x-forms.input placeholder="/Dockerfile" id="application.dockerfile_location"
                                             label="Dockerfile Location"
-                                            helper="It is calculated together with the Base Directory:<br><span class='dark:text-warning'>{{ Str::start($application->base_directory . $application->dockerfile_location, '/') }}</span>" />
+                                            helper="It is calculated together with the Base Directory:<br><span class='dark:text-warning'>{{ Str::start($application->base_directory . $application->dockerfile_location, '/') }}</span>"
+                                            x-bind:disabled="!canUpdate" />
                                     @endif
 
                                     @if ($application->build_pack === 'dockerfile')
                                         <x-forms.input id="application.dockerfile_target_build"
                                             label="Docker Build Stage Target"
-                                            helper="Useful if you have multi-staged dockerfile." />
+                                            helper="Useful if you have multi-staged dockerfile."
+                                            x-bind:disabled="!canUpdate" />
                                     @endif
                                     @if ($application->could_set_build_commands())
                                         @if ($application->settings->is_static)
                                             <x-forms.input placeholder="/dist" id="application.publish_directory"
-                                                label="Publish Directory" required />
+                                                label="Publish Directory" required x-bind:disabled="!canUpdate" />
                                         @else
                                             <x-forms.input placeholder="/" id="application.publish_directory"
-                                                label="Publish Directory" />
+                                                label="Publish Directory" x-bind:disabled="!canUpdate" />
                                         @endif
                                     @endif
 
@@ -304,20 +301,21 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                                         <x-forms.textarea
                                             helper="Gitignore-style rules to filter Git based webhook deployments."
                                             placeholder="src/pages/**" id="application.watch_paths"
-                                            label="Watch Paths" />
+                                            label="Watch Paths" x-bind:disabled="!canUpdate" />
                                     </div>
                                 @endif
                                 <x-forms.input
                                     helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
                                     placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k --hostname=myapp"
-                                    id="application.custom_docker_run_options" label="Custom Docker Options" />
+                                    id="application.custom_docker_run_options" label="Custom Docker Options"
+                                    x-bind:disabled="!canUpdate" />
 
                                 @if ($application->build_pack !== 'dockercompose')
                                     <div class="pt-2 w-96">
                                         <x-forms.checkbox
                                             helper="Use a build server to build your application. You can configure your build server in the Server settings. For more info, check the <a href='https://coolify.io/docs/knowledge-base/server/build-server' class='underline' target='_blank'>documentation</a>."
                                             instantSave id="application.settings.is_build_server_enabled"
-                                            label="Use a Build Server?" />
+                                            label="Use a Build Server?" x-bind:disabled="!canUpdate" />
                                     </div>
                                 @endif
                         @endif
@@ -327,8 +325,10 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
             @if ($application->build_pack === 'dockercompose')
                 <div class="flex items-center gap-2 pb-4">
                     <h3>Docker Compose</h3>
-                    <x-forms.button wire:target='initLoadingCompose'
-                        x-on:click="$wire.dispatch('loadCompose', false)">Reload Compose File</x-forms.button>
+                    @can('update', $application)
+                        <x-forms.button wire:target='initLoadingCompose'
+                            x-on:click="$wire.dispatch('loadCompose', false)">Reload Compose File</x-forms.button>
+                    @endcan
                 </div>
                 @if ($application->settings->is_raw_compose_deployment_enabled)
                     <x-forms.textarea rows="10" readonly id="application.docker_compose_raw"
@@ -350,7 +350,8 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                 <div class="w-96">
                     <x-forms.checkbox label="Escape special characters in labels?"
                         helper="By default, $ (and other chars) is escaped. So if you write $ in the labels, it will be saved as $$.<br><br>If you want to use env variables inside the labels, turn this off."
-                        id="application.settings.is_container_label_escape_enabled" instantSave></x-forms.checkbox>
+                        id="application.settings.is_container_label_escape_enabled" instantSave
+                        x-bind:disabled="!canUpdate"></x-forms.checkbox>
                     {{-- <x-forms.checkbox label="Readonly labels"
                         helper="Labels are readonly by default. Readonly means that edits you do to the labels could be lost and Coolify will autogenerate the labels for you. If you want to edit the labels directly, disable this option. <br><br>Be careful, it could break the proxy configuration after you restart the container as Coolify will now NOT autogenerate the labels for you (ofc you can always reset the labels to the coolify defaults manually)."
                         id="application.settings.is_container_label_readonly_enabled" instantSave></x-forms.checkbox> --}}
@@ -358,32 +359,36 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
             @endif
             @if ($application->dockerfile)
                 <x-forms.textarea label="Dockerfile" id="application.dockerfile" monacoEditorLanguage="dockerfile"
-                    useMonacoEditor rows="6"> </x-forms.textarea>
+                    useMonacoEditor rows="6" x-bind:disabled="!canUpdate"> </x-forms.textarea>
             @endif
             @if ($application->build_pack !== 'dockercompose')
                 <h3 class="pt-8">Network</h3>
                 <div class="flex flex-col gap-2 xl:flex-row">
                     @if ($application->settings->is_static || $application->build_pack === 'static')
-                        <x-forms.input id="application.ports_exposes" label="Ports Exposes" readonly />
+                        <x-forms.input id="application.ports_exposes" label="Ports Exposes" readonly
+                            x-bind:disabled="!canUpdate" />
                     @else
                         @if ($application->settings->is_container_label_readonly_enabled === false)
                             <x-forms.input placeholder="3000,3001" id="application.ports_exposes"
                                 label="Ports Exposes" readonly
-                                helper="Readonly labels are disabled. You can set the ports manually in the labels section." />
+                                helper="Readonly labels are disabled. You can set the ports manually in the labels section."
+                                x-bind:disabled="!canUpdate" />
                         @else
                             <x-forms.input placeholder="3000,3001" id="application.ports_exposes"
                                 label="Ports Exposes" required
-                                helper="A comma separated list of ports your application uses. The first port will be used as default healthcheck port if nothing defined in the Healthcheck menu. Be sure to set this correctly." />
+                                helper="A comma separated list of ports your application uses. The first port will be used as default healthcheck port if nothing defined in the Healthcheck menu. Be sure to set this correctly."
+                                x-bind:disabled="!canUpdate" />
                         @endif
                     @endif
                     @if (!$application->destination->server->isSwarm())
                         <x-forms.input placeholder="3000:3000" id="application.ports_mappings" label="Ports Mappings"
-                            helper="A comma separated list of ports you would like to map to the host system. Useful when you do not want to use domains.<br><br><span class='inline-block font-bold dark:text-warning'>Example:</span><br>3000:3000,3002:3002<br><br>Rolling update is not supported if you have a port mapped to the host." />
+                            helper="A comma separated list of ports you would like to map to the host system. Useful when you do not want to use domains.<br><br><span class='inline-block font-bold dark:text-warning'>Example:</span><br>3000:3000,3002:3002<br><br>Rolling update is not supported if you have a port mapped to the host."
+                            x-bind:disabled="!canUpdate" />
                     @endif
                     @if (!$application->destination->server->isSwarm())
                         <x-forms.input id="application.custom_network_aliases" label="Network Aliases"
                             helper="A comma separated list of custom network aliases you would like to add for container in Docker network.<br><br><span class='inline-block font-bold dark:text-warning'>Example:</span><br>api.internal,api.local"
-                            wire:model="application.custom_network_aliases" />
+                            wire:model="application.custom_network_aliases" x-bind:disabled="!canUpdate" />
                     @endif
                 </div>
 
@@ -391,60 +396,66 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                 <div>
                     <div class="w-96">
                         <x-forms.checkbox helper="This will add the proper proxy labels to the container." instantSave
-                            label="Enable" id="application.is_http_basic_auth_enabled" />
+                            label="Enable" id="application.is_http_basic_auth_enabled"
+                            x-bind:disabled="!canUpdate" />
                     </div>
                     @if ($application->is_http_basic_auth_enabled)
                         <div class="flex gap-2 py-2">
-                            <x-forms.input id="application.http_basic_auth_username" label="Username" required />
+                            <x-forms.input id="application.http_basic_auth_username" label="Username" required
+                                x-bind:disabled="!canUpdate" />
                             <x-forms.input id="application.http_basic_auth_password" type="password" label="Password"
-                                required />
+                                required x-bind:disabled="!canUpdate" />
                         </div>
                     @endif
                 </div>
 
                 @if ($application->settings->is_container_label_readonly_enabled)
                     <x-forms.textarea readonly disabled label="Container Labels" rows="15" id="customLabels"
-                        monacoEditorLanguage="ini" useMonacoEditor></x-forms.textarea>
+                        monacoEditorLanguage="ini" useMonacoEditor x-bind:disabled="!canUpdate"></x-forms.textarea>
                 @else
                     <x-forms.textarea label="Container Labels" rows="15" id="customLabels"
-                        monacoEditorLanguage="ini" useMonacoEditor></x-forms.textarea>
+                        monacoEditorLanguage="ini" useMonacoEditor x-bind:disabled="!canUpdate"></x-forms.textarea>
                 @endif
                 <div class="w-96">
                     <x-forms.checkbox label="Readonly labels"
                         helper="Labels are readonly by default. Readonly means that edits you do to the labels could be lost and Coolify will autogenerate the labels for you. If you want to edit the labels directly, disable this option. <br><br>Be careful, it could break the proxy configuration after you restart the container as Coolify will now NOT autogenerate the labels for you (ofc you can always reset the labels to the coolify defaults manually)."
-                        id="application.settings.is_container_label_readonly_enabled" instantSave></x-forms.checkbox>
+                        id="application.settings.is_container_label_readonly_enabled" instantSave
+                        x-bind:disabled="!canUpdate"></x-forms.checkbox>
                     <x-forms.checkbox label="Escape special characters in labels?"
                         helper="By default, $ (and other chars) is escaped. So if you write $ in the labels, it will be saved as $$.<br><br>If you want to use env variables inside the labels, turn this off."
-                        id="application.settings.is_container_label_escape_enabled" instantSave></x-forms.checkbox>
+                        id="application.settings.is_container_label_escape_enabled" instantSave
+                        x-bind:disabled="!canUpdate"></x-forms.checkbox>
                 </div>
-                <x-modal-confirmation title="Confirm Labels Reset to Coolify Defaults?"
-                    buttonTitle="Reset Labels to Defaults" buttonFullWidth submitAction="resetDefaultLabels(true)"
-                    :actions="[
-                        'All your custom proxy labels will be lost.',
-                        'Proxy labels (traefik, caddy, etc) will be reset to the coolify defaults.',
-                    ]" confirmationText="{{ $application->fqdn . '/' }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Application URL below"
-                    shortConfirmationLabel="Application URL" :confirmWithPassword="false"
-                    step2ButtonText="Permanently Reset Labels" />
+                @can('update', $application)
+                    <x-modal-confirmation title="Confirm Labels Reset to Coolify Defaults?"
+                        buttonTitle="Reset Labels to Defaults" buttonFullWidth submitAction="resetDefaultLabels(true)"
+                        :actions="[
+                            'All your custom proxy labels will be lost.',
+                            'Proxy labels (traefik, caddy, etc) will be reset to the coolify defaults.',
+                        ]" confirmationText="{{ $application->fqdn . '/' }}"
+                        confirmationLabel="Please confirm the execution of the actions by entering the Application URL below"
+                        shortConfirmationLabel="Application URL" :confirmWithPassword="false"
+                        step2ButtonText="Permanently Reset Labels" />
+                @endcan
             @endif
 
             <h3 class="pt-8">Pre/Post Deployment Commands</h3>
             <div class="flex flex-col gap-2 xl:flex-row">
-                <x-forms.input x-bind:disabled="initLoadingCompose" placeholder="php artisan migrate"
+                <x-forms.input x-bind:disabled="shouldDisable()" placeholder="php artisan migrate"
                     id="application.pre_deployment_command" label="Pre-deployment "
                     helper="An optional script or command to execute in the existing container before the deployment begins.<br>It is always executed with 'sh -c', so you do not need add it manually." />
                 @if ($application->build_pack === 'dockercompose')
-                    <x-forms.input x-bind:disabled="initLoadingCompose"
-                        id="application.pre_deployment_command_container" label="Container Name"
+                    <x-forms.input x-bind:disabled="shouldDisable()" id="application.pre_deployment_command_container"
+                        label="Container Name"
                         helper="The name of the container to execute within. You can leave it blank if your application only has one container." />
                 @endif
             </div>
             <div class="flex flex-col gap-2 xl:flex-row">
-                <x-forms.input x-bind:disabled="initLoadingCompose" placeholder="php artisan migrate"
+                <x-forms.input x-bind:disabled="shouldDisable()" placeholder="php artisan migrate"
                     id="application.post_deployment_command" label="Post-deployment "
                     helper="An optional script or command to execute in the newly built container after the deployment completes.<br>It is always executed with 'sh -c', so you do not need add it manually." />
                 @if ($application->build_pack === 'dockercompose')
-                    <x-forms.input x-bind:disabled="initLoadingCompose"
+                    <x-forms.input x-bind:disabled="shouldDisable()"
                         id="application.post_deployment_command_container" label="Container Name"
                         helper="The name of the container to execute within. You can leave it blank if your application only has one container." />
                 @endif
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 2b44e0ddd..1a8812929 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -15,10 +15,12 @@
                 Logs
             </a>
             @if (!$application->destination->server->isSwarm())
-                <a class="{{ request()->routeIs('project.application.command') ? 'dark:text-white' : '' }}"
-                    href="{{ route('project.application.command', $parameters) }}">
-                    Terminal
-                </a>
+                @can('canAccessTerminal')
+                    <a class="{{ request()->routeIs('project.application.command') ? 'dark:text-white' : '' }}"
+                        href="{{ route('project.application.command', $parameters) }}">
+                        Terminal
+                    </a>
+                @endcan
             @endif
             <x-applications.links :application="$application" />
         </nav>
diff --git a/resources/views/livewire/project/application/preview/form.blade.php b/resources/views/livewire/project/application/preview/form.blade.php
index a273de810..e00d824ef 100644
--- a/resources/views/livewire/project/application/preview/form.blade.php
+++ b/resources/views/livewire/project/application/preview/form.blade.php
@@ -1,13 +1,15 @@
 <form wire:submit='submit'>
     <div class="flex items-center gap-2">
         <h2>Preview Deployments</h2>
-        <x-forms.button type="submit">Save</x-forms.button>
-        <x-forms.button isHighlighted wire:click="resetToDefault">Reset template to default</x-forms.button>
+        @can('update', $application)
+            <x-forms.button type="submit">Save</x-forms.button>
+            <x-forms.button isHighlighted wire:click="resetToDefault">Reset template to default</x-forms.button>
+        @endcan
     </div>
     <div class="pb-4 ">Preview Deployments based on pull requests are here.</div>
     <div class="flex flex-col gap-2 pb-4">
         <x-forms.input id="previewUrlTemplate" label="Preview URL Template"
-            helper="Templates:<br/><span class='text-helper'>@@{{ random }}</span> to generate random sub-domain each time a PR is deployed<br/><span class='text-helper'>@@{{ pr_id }}</span> to use pull request ID as sub-domain or <span class='text-helper'>@@{{ domain }}</span> to replace the domain name with the application's domain name." />
+            helper="Templates:<br/><span class='text-helper'>@@{{ random }}</span> to generate random sub-domain each time a PR is deployed<br/><span class='text-helper'>@@{{ pr_id }}</span> to use pull request ID as sub-domain or <span class='text-helper'>@@{{ domain }}</span> to replace the domain name with the application's domain name." canGate="update" :canResource="$application" />
         @if ($previewUrlTemplate)
             <div class="">Domain Preview: {{ $previewUrlTemplate }}</div>
         @endif
diff --git a/resources/views/livewire/project/application/previews-compose.blade.php b/resources/views/livewire/project/application/previews-compose.blade.php
index 4e50ad18d..ffed66814 100644
--- a/resources/views/livewire/project/application/previews-compose.blade.php
+++ b/resources/views/livewire/project/application/previews-compose.blade.php
@@ -1,6 +1,6 @@
 <form wire:submit="save" class="flex items-end gap-2">
     <x-forms.input helper="One domain per preview." label="Domains for {{ str($serviceName)->headline() }}"
-        id="service.domain"></x-forms.input>
+        id="service.domain" canGate="update" :canResource="$preview->application"></x-forms.input>
     <x-forms.button type="submit">Save</x-forms.button>
     <x-forms.button wire:click="generate">Generate
         Domain</x-forms.button>
diff --git a/resources/views/livewire/project/application/previews.blade.php b/resources/views/livewire/project/application/previews.blade.php
index 5decc26cf..6a2ef485f 100644
--- a/resources/views/livewire/project/application/previews.blade.php
+++ b/resources/views/livewire/project/application/previews.blade.php
@@ -7,9 +7,11 @@ class="dark:text-warning">{{ $application->destination->server->name }}</span>.<
     <div>
         @if ($application->is_github_based())
             <div class="flex items-center gap-2">
-                <h3>Pull Requests on Git</h3>
-                <x-forms.button wire:click="load_prs">Load Pull Requests
-                </x-forms.button>
+                @can('update', $application)
+                    <h3>Pull Requests on Git</h3>
+                    <x-forms.button wire:click="load_prs">Load Pull Requests
+                    </x-forms.button>
+                @endcan
             </div>
         @endif
         @isset($rate_limit_remaining)
@@ -40,19 +42,23 @@ class="dark:text-warning">{{ $application->destination->server->name }}</span>.<
                                         </a>
                                     </td>
                                     <td class="flex flex-col gap-1 md:flex-row">
-                                        <x-forms.button
-                                            wire:click="add('{{ data_get($pull_request, 'number') }}', '{{ data_get($pull_request, 'html_url') }}')">
-                                            Configure
-                                        </x-forms.button>
-                                        <x-forms.button
-                                            wire:click="add_and_deploy('{{ data_get($pull_request, 'number') }}', '{{ data_get($pull_request, 'html_url') }}')">
-                                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning"
-                                                viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor"
-                                                fill="none" stroke-linecap="round" stroke-linejoin="round">
-                                                <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                                                <path d="M7 4v16l13 -8z" />
-                                            </svg>Deploy
-                                        </x-forms.button>
+                                        @can('update', $application)
+                                            <x-forms.button
+                                                wire:click="add('{{ data_get($pull_request, 'number') }}', '{{ data_get($pull_request, 'html_url') }}')">
+                                                Configure
+                                            </x-forms.button>
+                                        @endcan
+                                        @can('deploy', $application)
+                                            <x-forms.button
+                                                wire:click="add_and_deploy('{{ data_get($pull_request, 'number') }}', '{{ data_get($pull_request, 'html_url') }}')">
+                                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning"
+                                                    viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor"
+                                                    fill="none" stroke-linecap="round" stroke-linejoin="round">
+                                                    <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                                                    <path d="M7 4v16l13 -8z" />
+                                                </svg>Deploy
+                                            </x-forms.button>
+                                        @endcan
                                     </td>
                                 </tr>
                             @endforeach
@@ -106,10 +112,12 @@ class="dark:text-warning">{{ $application->destination->server->name }}</span>.<
                                 <form wire:submit="save_preview('{{ $preview->id }}')"
                                     class="flex items-end gap-2 pt-4">
                                     <x-forms.input label="Domain" helper="One domain per preview."
-                                        id="application.previews.{{ $previewName }}.fqdn"></x-forms.input>
-                                    <x-forms.button type="submit">Save</x-forms.button>
-                                    <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">Generate
-                                        Domain</x-forms.button>
+                                        id="application.previews.{{ $previewName }}.fqdn" canGate="update" :canResource="$application"></x-forms.input>
+                                    @can('update', $application)
+                                        <x-forms.button type="submit">Save</x-forms.button>
+                                        <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">Generate
+                                            Domain</x-forms.button>
+                                    @endcan
                                 </form>
                             @else
                                 @foreach (collect(json_decode($preview->docker_compose_domains)) as $serviceName => $service)
@@ -122,82 +130,90 @@ class="flex items-end gap-2 pt-4">
                     @else
                         <form wire:submit="save_preview('{{ $preview->id }}')" class="flex items-end gap-2 pt-4">
                             <x-forms.input label="Domain" helper="One domain per preview."
-                                id="application.previews.{{ $previewName }}.fqdn"></x-forms.input>
-                            <x-forms.button type="submit">Save</x-forms.button>
-                            <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">Generate
-                                Domain</x-forms.button>
+                                id="application.previews.{{ $previewName }}.fqdn" canGate="update" :canResource="$application"></x-forms.input>
+                            @can('update', $application)
+                                <x-forms.button type="submit">Save</x-forms.button>
+                                <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">Generate
+                                    Domain</x-forms.button>
+                            @endcan
                         </form>
                     @endif
                     <div class="flex flex-col xl:flex-row xl:items-center gap-2 pt-6">
                         <div class="flex-1"></div>
-                        <x-forms.button
-                            wire:click="force_deploy_without_cache({{ data_get($preview, 'pull_request_id') }})">
-                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5" viewBox="0 0 24 24"
-                                stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
-                                stroke-linejoin="round">
-                                <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                                <path
-                                    d="M12.983 8.978c3.955 -.182 7.017 -1.446 7.017 -2.978c0 -1.657 -3.582 -3 -8 -3c-1.661 0 -3.204 .19 -4.483 .515m-2.783 1.228c-.471 .382 -.734 .808 -.734 1.257c0 1.22 1.944 2.271 4.734 2.74" />
-                                <path
-                                    d="M4 6v6c0 1.657 3.582 3 8 3c.986 0 1.93 -.067 2.802 -.19m3.187 -.82c1.251 -.53 2.011 -1.228 2.011 -1.99v-6" />
-                                <path d="M4 12v6c0 1.657 3.582 3 8 3c3.217 0 5.991 -.712 7.261 -1.74m.739 -3.26v-4" />
-                                <path d="M3 3l18 18" />
-                            </svg>
-                            Force deploy (without
-                            cache)
-                        </x-forms.button>
-                        <x-forms.button wire:click="deploy({{ data_get($preview, 'pull_request_id') }})">
-                            @if (data_get($preview, 'status') === 'exited')
-                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning"
-                                    viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" fill="none"
-                                    stroke-linecap="round" stroke-linejoin="round">
+                        @can('deploy', $application)
+                            <x-forms.button
+                                wire:click="force_deploy_without_cache({{ data_get($preview, 'pull_request_id') }})">
+                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5" viewBox="0 0 24 24"
+                                    stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
+                                    stroke-linejoin="round">
                                     <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                                    <path d="M7 4v16l13 -8z" />
-                                </svg>
-                                Deploy
-                            @else
-                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-orange-400"
-                                    viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" fill="none"
-                                    stroke-linecap="round" stroke-linejoin="round">
-                                    <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
                                     <path
-                                        d="M10.09 4.01l.496 -.495a2 2 0 0 1 2.828 0l7.071 7.07a2 2 0 0 1 0 2.83l-7.07 7.07a2 2 0 0 1 -2.83 0l-7.07 -7.07a2 2 0 0 1 0 -2.83l3.535 -3.535h-3.988">
-                                    </path>
-                                    <path d="M7.05 11.038v-3.988"></path>
-                                </svg> Redeploy
-                            @endif
-                        </x-forms.button>
-                        @if (data_get($preview, 'status') !== 'exited')
-                            <x-modal-confirmation title="Confirm Preview Deployment Stopping?" buttonTitle="Stop"
-                                submitAction="stop({{ data_get($preview, 'pull_request_id') }})" :actions="[
-                                    'This preview deployment will be stopped.',
-                                    'If the preview deployment is currently in use data could be lost.',
-                                    'All non-persistent data of this preview deployment (containers, networks, unused images) will be deleted (don\'t worry, no data is lost and you can start the preview deployment again).',
-                                ]"
-                                :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Stop Preview Deployment">
-                                <x-slot:customButton>
-                                    <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error"
+                                        d="M12.983 8.978c3.955 -.182 7.017 -1.446 7.017 -2.978c0 -1.657 -3.582 -3 -8 -3c-1.661 0 -3.204 .19 -4.483 .515m-2.783 1.228c-.471 .382 -.734 .808 -.734 1.257c0 1.22 1.944 2.271 4.734 2.74" />
+                                    <path
+                                        d="M4 6v6c0 1.657 3.582 3 8 3c.986 0 1.93 -.067 2.802 -.19m3.187 -.82c1.251 -.53 2.011 -1.228 2.011 -1.99v-6" />
+                                    <path d="M4 12v6c0 1.657 3.582 3 8 3c3.217 0 5.991 -.712 7.261 -1.74m.739 -3.26v-4" />
+                                    <path d="M3 3l18 18" />
+                                </svg>
+                                Force deploy (without
+                                cache)
+                            </x-forms.button>
+                            <x-forms.button wire:click="deploy({{ data_get($preview, 'pull_request_id') }})">
+                                @if (data_get($preview, 'status') === 'exited')
+                                    <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning"
+                                        viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" fill="none"
+                                        stroke-linecap="round" stroke-linejoin="round">
+                                        <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                                        <path d="M7 4v16l13 -8z" />
+                                    </svg>
+                                    Deploy
+                                @else
+                                    <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-orange-400"
                                         viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" fill="none"
                                         stroke-linecap="round" stroke-linejoin="round">
                                         <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
                                         <path
-                                            d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                            d="M10.09 4.01l.496 -.495a2 2 0 0 1 2.828 0l7.071 7.07a2 2 0 0 1 0 2.83l-7.07 7.07a2 2 0 0 1 -2.83 0l-7.07 -7.07a2 2 0 0 1 0 -2.83l3.535 -3.535h-3.988">
                                         </path>
-                                        <path
-                                            d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                        </path>
-                                    </svg>
-                                    Stop
-                                </x-slot:customButton>
-                            </x-modal-confirmation>
+                                        <path d="M7.05 11.038v-3.988"></path>
+                                    </svg> Redeploy
+                                @endif
+                            </x-forms.button>
+                        @endcan
+                        @if (data_get($preview, 'status') !== 'exited')
+                            @can('deploy', $application)
+                                <x-modal-confirmation title="Confirm Preview Deployment Stopping?" buttonTitle="Stop"
+                                    submitAction="stop({{ data_get($preview, 'pull_request_id') }})" :actions="[
+                                        'This preview deployment will be stopped.',
+                                        'If the preview deployment is currently in use data could be lost.',
+                                        'All non-persistent data of this preview deployment (containers, networks, unused images) will be deleted (don\'t worry, no data is lost and you can start the preview deployment again).',
+                                    ]"
+                                    :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Stop Preview Deployment">
+                                    <x-slot:customButton>
+                                        <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error"
+                                            viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" fill="none"
+                                            stroke-linecap="round" stroke-linejoin="round">
+                                            <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
+                                            <path
+                                                d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                            </path>
+                                            <path
+                                                d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                            </path>
+                                        </svg>
+                                        Stop
+                                    </x-slot:customButton>
+                                </x-modal-confirmation>
+                            @endcan
                         @endif
-                        <x-modal-confirmation title="Confirm Preview Deployment Deletion?" buttonTitle="Delete"
-                            isErrorButton submitAction="delete({{ data_get($preview, 'pull_request_id') }})"
-                            :actions="[
-                                'All containers of this preview deployment will be stopped and permanently deleted.',
-                            ]" confirmationText="{{ data_get($preview, 'fqdn') . '/' }}"
-                            confirmationLabel="Please confirm the execution of the actions by entering the Preview Deployment name below"
-                            shortConfirmationLabel="Preview Deployment Name" :confirmWithPassword="false" />
+                        @can('delete', $application)
+                            <x-modal-confirmation title="Confirm Preview Deployment Deletion?" buttonTitle="Delete"
+                                isErrorButton submitAction="delete({{ data_get($preview, 'pull_request_id') }})"
+                                :actions="[
+                                    'All containers of this preview deployment will be stopped and permanently deleted.',
+                                ]" confirmationText="{{ data_get($preview, 'fqdn') . '/' }}"
+                                confirmationLabel="Please confirm the execution of the actions by entering the Preview Deployment name below"
+                                shortConfirmationLabel="Preview Deployment Name" :confirmWithPassword="false" />
+                        @endcan
                     </div>
                 </div>
             @endforeach
diff --git a/resources/views/livewire/project/application/rollback.blade.php b/resources/views/livewire/project/application/rollback.blade.php
index cf4467534..1844316f9 100644
--- a/resources/views/livewire/project/application/rollback.blade.php
+++ b/resources/views/livewire/project/application/rollback.blade.php
@@ -1,7 +1,9 @@
 <div x-init="$wire.loadImages">
     <div class="flex items-center gap-2">
         <h2>Rollback</h2>
-        <x-forms.button wire:click='loadImages(true)'>Reload Available Images</x-forms.button>
+        @can('view', $application)
+            <x-forms.button wire:click='loadImages(true)'>Reload Available Images</x-forms.button>
+        @endcan
     </div>
     <div class="pb-4 ">You can easily rollback to a previously built (local) images
         quickly.</div>
@@ -26,16 +28,18 @@
                             <div class="text-xs">{{ $date }}</div>
                         </div>
                         <div class="flex justify-end p-2">
-                            @if (data_get($image, 'is_current'))
-                                <x-forms.button disabled tooltip="This image is currently running.">
-                                    Rollback
-                                </x-forms.button>
-                            @else
-                                <x-forms.button class="dark:bg-coolgray-100"
-                                    wire:click="rollbackImage('{{ data_get($image, 'tag') }}')">
-                                    Rollback
-                                </x-forms.button>
-                            @endif
+                            @can('deploy', $application)
+                                @if (data_get($image, 'is_current'))
+                                    <x-forms.button disabled tooltip="This image is currently running.">
+                                        Rollback
+                                    </x-forms.button>
+                                @else
+                                    <x-forms.button class="dark:bg-coolgray-100"
+                                        wire:click="rollbackImage('{{ data_get($image, 'tag') }}')">
+                                        Rollback
+                                    </x-forms.button>
+                                @endif
+                            @endcan
                         </div>
                     </div>
                 </div>
diff --git a/resources/views/livewire/project/application/source.blade.php b/resources/views/livewire/project/application/source.blade.php
index 85382055e..9e746fadb 100644
--- a/resources/views/livewire/project/application/source.blade.php
+++ b/resources/views/livewire/project/application/source.blade.php
@@ -2,7 +2,9 @@
     <form wire:submit='submit' class="flex flex-col">
         <div class="flex items-center gap-2">
             <h2>Source</h2>
-            <x-forms.button type="submit">Save</x-forms.button>
+            @can('update', $application)
+                <x-forms.button type="submit">Save</x-forms.button>
+            @endcan
             <a target="_blank" class="hover:no-underline" href="{{ $application?->gitBranchLocation }}">
                 <x-forms.button>
                     Open Repository
@@ -32,11 +34,11 @@ class="font-bold text-warning">{{ data_get($application, 'source.name', 'No sour
                 </div>
             @endif
             <div class="flex gap-2">
-                <x-forms.input placeholder="coollabsio/coolify-example" id="gitRepository" label="Repository" />
-                <x-forms.input placeholder="main" id="gitBranch" label="Branch" />
+                <x-forms.input placeholder="coollabsio/coolify-example" id="gitRepository" label="Repository" canGate="update" :canResource="$application" />
+                <x-forms.input placeholder="main" id="gitBranch" label="Branch" canGate="update" :canResource="$application" />
             </div>
             <div class="flex items-end gap-2">
-                <x-forms.input placeholder="HEAD" id="gitCommitSha" placeholder="HEAD" label="Commit SHA" />
+                <x-forms.input placeholder="HEAD" id="gitCommitSha" placeholder="HEAD" label="Commit SHA" canGate="update" :canResource="$application" />
             </div>
         </div>
 
@@ -46,45 +48,49 @@ class="font-bold text-warning">{{ data_get($application, 'source.name', 'No sour
                     class="dark:text-warning">{{ $privateKeyName }}</span>
             </div>
 
-            <h4 class="py-2 ">Select another Private Key</h4>
-            <div class="flex flex-wrap gap-2">
-                @foreach ($privateKeys as $key)
-                    <x-forms.button wire:click="setPrivateKey('{{ $key->id }}')">{{ $key->name }}
-                    </x-forms.button>
-                @endforeach
-            </div>
-        @else
-            <div class="pt-4">
-                <h3 class="pb-2">Change Git Source</h3>
-                <div class="grid grid-cols-1 gap-2">
-                    @forelse ($sources as $source)
-                        <div wire:key="{{ $source->name }}">
-                            <x-modal-confirmation title="Change Git Source" :actions="['Change git source to ' . $source->name]" :buttonFullWidth="true"
-                                :isHighlightedButton="$application->source_id === $source->id" :disabled="$application->source_id === $source->id"
-                                submitAction="changeSource({{ $source->id }}, {{ $source->getMorphClass() }})"
-                                :confirmWithText="true" confirmationText="Change Git Source"
-                                confirmationLabel="Please confirm changing the git source by entering the text below"
-                                shortConfirmationLabel="Confirmation Text" :confirmWithPassword="false">
-                                <x-slot:customButton>
-                                    <div class="flex items-center gap-2">
-                                        <div class="box-title">
-                                            {{ $source->name }}
-                                            @if ($application->source_id === $source->id)
-                                                <span class="text-xs">(current)</span>
-                                            @endif
-                                        </div>
-                                        <div class="box-description">
-                                            {{ $source->organization ?? 'Personal Account' }}
-                                        </div>
-                                    </div>
-                                </x-slot:customButton>
-                            </x-modal-confirmation>
-                        </div>
-                    @empty
-                        <div>No other sources found</div>
-                    @endforelse
+            @can('update', $application)
+                <h4 class="py-2 ">Select another Private Key</h4>
+                <div class="flex flex-wrap gap-2">
+                    @foreach ($privateKeys as $key)
+                        <x-forms.button wire:click="setPrivateKey('{{ $key->id }}')">{{ $key->name }}
+                        </x-forms.button>
+                    @endforeach
                 </div>
-            </div>
+            @endcan
+        @else
+            @can('update', $application)
+                <div class="pt-4">
+                    <h3 class="pb-2">Change Git Source</h3>
+                    <div class="grid grid-cols-1 gap-2">
+                        @forelse ($sources as $source)
+                            <div wire:key="{{ $source->name }}">
+                                <x-modal-confirmation title="Change Git Source" :actions="['Change git source to ' . $source->name]" :buttonFullWidth="true"
+                                    :isHighlightedButton="$application->source_id === $source->id" :disabled="$application->source_id === $source->id"
+                                    submitAction="changeSource({{ $source->id }}, {{ $source->getMorphClass() }})"
+                                    :confirmWithText="true" confirmationText="Change Git Source"
+                                    confirmationLabel="Please confirm changing the git source by entering the text below"
+                                    shortConfirmationLabel="Confirmation Text" :confirmWithPassword="false">
+                                    <x-slot:customButton>
+                                        <div class="flex items-center gap-2">
+                                            <div class="box-title">
+                                                {{ $source->name }}
+                                                @if ($application->source_id === $source->id)
+                                                    <span class="text-xs">(current)</span>
+                                                @endif
+                                            </div>
+                                            <div class="box-description">
+                                                {{ $source->organization ?? 'Personal Account' }}
+                                            </div>
+                                        </div>
+                                    </x-slot:customButton>
+                                </x-modal-confirmation>
+                            </div>
+                        @empty
+                            <div>No other sources found</div>
+                        @endforelse
+                    </div>
+                </div>
+            @endcan
         @endif
     </form>
 </div>
diff --git a/resources/views/livewire/project/application/swarm.blade.php b/resources/views/livewire/project/application/swarm.blade.php
index 1822f948b..a7da02627 100644
--- a/resources/views/livewire/project/application/swarm.blade.php
+++ b/resources/views/livewire/project/application/swarm.blade.php
@@ -15,14 +15,14 @@
         </div>
         <div class="flex flex-col gap-2 py-4">
             <div class="flex flex-col items-end gap-2 xl:flex-row">
-                <x-forms.input id="swarmReplicas" label="Replicas" required />
+                <x-forms.input id="swarmReplicas" label="Replicas" required canGate="update" :canResource="$application" />
                 <x-forms.checkbox instantSave helper="If turned off, this resource will start on manager nodes too."
-                    id="isSwarmOnlyWorkerNodes" label="Only Start on Worker nodes" />
+                    id="isSwarmOnlyWorkerNodes" label="Only Start on Worker nodes" canGate="update" :canResource="$application" />
             </div>
             <x-forms.textarea id="swarmPlacementConstraints" rows="7" label="Custom Placement Constraints"
                 placeholder="placement:
     constraints:
-        - 'node.role == worker'" />
+        - 'node.role == worker'" canGate="update" :canResource="$application" />
         </div>
     </form>
 
diff --git a/resources/views/livewire/project/database/backup/index.blade.php b/resources/views/livewire/project/database/backup/index.blade.php
index 91f0676aa..05a0ce04e 100644
--- a/resources/views/livewire/project/database/backup/index.blade.php
+++ b/resources/views/livewire/project/database/backup/index.blade.php
@@ -8,9 +8,11 @@
     <div>
         <div class="flex gap-2">
             <h2 class="pb-4">Scheduled Backups</h2>
-            <x-modal-input buttonTitle="+ Add" title="New Scheduled Backup">
-                <livewire:project.database.create-scheduled-backup :database="$database" />
-            </x-modal-input>
+            @can('update', $database)
+                <x-modal-input buttonTitle="+ Add" title="New Scheduled Backup">
+                    <livewire:project.database.create-scheduled-backup :database="$database" />
+                </x-modal-input>
+            @endcan
         </div>
         <livewire:project.database.scheduled-backups :database="$database" />
     </div>
diff --git a/resources/views/livewire/project/database/clickhouse/general.blade.php b/resources/views/livewire/project/database/clickhouse/general.blade.php
index e91663f35..9017f7c09 100644
--- a/resources/views/livewire/project/database/clickhouse/general.blade.php
+++ b/resources/views/livewire/project/database/clickhouse/general.blade.php
@@ -2,54 +2,56 @@
     <form wire:submit="submit" class="flex flex-col gap-2">
         <div class="flex items-center gap-2">
             <h2>General</h2>
-            <x-forms.button type="submit">
+            <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
         </div>
         <div class="flex gap-2">
-            <x-forms.input label="Name" id="name" />
-            <x-forms.input label="Description" id="description" />
-            <x-forms.input label="Image" id="image" required
+            <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
+            <x-forms.input label="Description" id="description" canGate="update" :canResource="$database" />
+            <x-forms.input label="Image" id="image" required canGate="update" :canResource="$database"
                 helper="For all available images, check here:<br><br><a target='_blank' href='https://hub.docker.com/r/clickhouse/clickhouse-server/'>https://hub.docker.com/r/clickhouse/clickhouse-server/</a>" />
         </div>
 
         @if ($database->started_at)
             <div class="flex gap-2">
                 <x-forms.input label="Initial Username" id="clickhouseAdminUser" placeholder="If empty: clickhouse"
-                    readonly helper="You can only change this in the database." />
+                    readonly helper="You can only change this in the database." canGate="update" :canResource="$database" />
                 <x-forms.input label="Initial Password" id="clickhouseAdminPassword" type="password" required readonly
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
             </div>
         @else
             <div class=" dark:text-warning">Please verify these values. You can only modify them before the initial
                 start. After that, you need to modify it in the database.
             </div>
             <div class="flex gap-2">
-                <x-forms.input label="Username" id="clickhouseAdminUser" required />
-                <x-forms.input label="Password" id="clickhouseAdminPassword" type="password" required />
+                <x-forms.input label="Username" id="clickhouseAdminUser" required canGate="update" :canResource="$database" />
+                <x-forms.input label="Password" id="clickhouseAdminPassword" type="password" required canGate="update"
+                    :canResource="$database" />
             </div>
         @endif
         <x-forms.input
             helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
             placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k"
-            id="customDockerRunOptions" label="Custom Docker Options" />
+            id="customDockerRunOptions" label="Custom Docker Options" canGate="update" :canResource="$database" />
         <div class="flex flex-col gap-2">
             <h3 class="py-2">Network</h3>
             <div class="flex items-end gap-2">
                 <x-forms.input placeholder="3000:5432" id="portsMappings" label="Ports Mappings"
-                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433" />
+                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433"
+                    canGate="update" :canResource="$database" />
             </div>
             <x-forms.input label="Clickhouse URL (internal)"
                 helper="If you change the user/password/port, this could be different. This is with the default values."
-                type="password" readonly wire:model="dbUrl" />
+                type="password" readonly wire:model="dbUrl" canGate="update" :canResource="$database" />
             @if ($dbUrlPublic)
                 <x-forms.input label="Clickhouse URL (public)"
                     helper="If you change the user/password/port, this could be different. This is with the default values."
-                    type="password" readonly wire:model="dbUrlPublic" />
+                    type="password" readonly wire:model="dbUrlPublic" canGate="update" :canResource="$database" />
             @else
                 <x-forms.input label="Clickhouse URL (public)"
                     helper="If you change the user/password/port, this could be different. This is with the default values."
-                    readonly value="Starting the database will generate this." />
+                    readonly value="Starting the database will generate this." canGate="update" :canResource="$database" />
             @endif
         </div>
         <div>
@@ -71,14 +73,17 @@
                         </x-slide-over>
                     @endif
                 </div>
-                <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" />
+                <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" canGate="update"
+                    :canResource="$database" />
             </div>
-            <x-forms.input placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port" />
+            <x-forms.input placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port"
+                canGate="update" :canResource="$database" />
         </div>
     </form>
     <h3 class="pt-4">Advanced</h3>
     <div class="w-64">
         <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
-            instantSave="instantSaveAdvanced" id="isLogDrainEnabled" label="Drain Logs" />
+            instantSave="instantSaveAdvanced" id="isLogDrainEnabled" label="Drain Logs" canGate="update"
+            :canResource="$database" />
     </div>
 </div>
diff --git a/resources/views/livewire/project/database/configuration.blade.php b/resources/views/livewire/project/database/configuration.blade.php
index 5e1600461..a57f0fac2 100644
--- a/resources/views/livewire/project/database/configuration.blade.php
+++ b/resources/views/livewire/project/database/configuration.blade.php
@@ -17,9 +17,11 @@
             <a class='menu-item' wire:current.exact="menu-item-active"
                 href="{{ route('project.database.persistent-storage', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid, 'database_uuid' => $database->uuid]) }}">Persistent
                 Storage</a>
-            <a class='menu-item' wire:current.exact="menu-item-active"
-                href="{{ route('project.database.import-backups', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid, 'database_uuid' => $database->uuid]) }}">Import
-                Backups</a>
+            @can('update', $database)
+                <a class='menu-item' wire:current.exact="menu-item-active"
+                    href="{{ route('project.database.import-backups', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid, 'database_uuid' => $database->uuid]) }}">Import
+                    Backups</a>
+            @endcan
             <a class='menu-item' wire:current.exact="menu-item-active"
                 href="{{ route('project.database.webhooks', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid, 'database_uuid' => $database->uuid]) }}">Webhooks</a>
             <a class="menu-item" wire:current.exact="menu-item-active"
diff --git a/resources/views/livewire/project/database/dragonfly/general.blade.php b/resources/views/livewire/project/database/dragonfly/general.blade.php
index 60ad75d05..855a2ecdc 100644
--- a/resources/views/livewire/project/database/dragonfly/general.blade.php
+++ b/resources/views/livewire/project/database/dragonfly/general.blade.php
@@ -2,51 +2,53 @@
     <form wire:submit="submit" class="flex flex-col gap-2">
         <div class="flex items-center gap-2">
             <h2>General</h2>
-            <x-forms.button type="submit">
+            <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
         </div>
         <div class="flex gap-2">
-            <x-forms.input label="Name" id="name" />
-            <x-forms.input label="Description" id="description" />
-            <x-forms.input label="Image" id="image" required />
+            <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
+            <x-forms.input label="Description" id="description" canGate="update" :canResource="$database" />
+            <x-forms.input label="Image" id="image" required canGate="update" :canResource="$database" />
         </div>
         <x-forms.input
             helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
             placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k"
-            id="customDockerRunOptions" label="Custom Docker Options" />
+            id="customDockerRunOptions" label="Custom Docker Options" canGate="update" :canResource="$database" />
 
         @if ($database->started_at)
             <div class="flex gap-2">
                 <x-forms.input label="Initial Password" id="dragonflyPassword" type="password" required readonly
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
             </div>
         @else
             <div class=" dark:text-warning">Please verify these values. You can only modify them before the initial
                 start. After that, you need to modify it in the database.
             </div>
             <div class="flex gap-2">
-                <x-forms.input label="Password" id="dragonflyPassword" type="password" required />
+                <x-forms.input label="Password" id="dragonflyPassword" type="password" required canGate="update"
+                    :canResource="$database" />
             </div>
         @endif
         <div class="flex flex-col gap-2">
             <h3 class="py-2">Network</h3>
             <div class="flex items-end gap-2">
                 <x-forms.input placeholder="3000:5432" id="portsMappings" label="Ports Mappings"
-                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433" />
+                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433"
+                    canGate="update" :canResource="$database" />
             </div>
             <x-forms.input label="Dragonfly URL (internal)"
                 helper="If you change the user/password/port, this could be different. This is with the default values."
-                type="password" readonly wire:model="dbUrl" />
+                type="password" readonly wire:model="dbUrl" canGate="update" :canResource="$database" />
 
             @if ($dbUrlPublic)
                 <x-forms.input label="Dragonfly URL (public)"
                     helper="If you change the user/password/port, this could be different. This is with the default values."
-                    type="password" readonly wire:model="dbUrlPublic" />
+                    type="password" readonly wire:model="dbUrlPublic" canGate="update" :canResource="$database" />
             @else
                 <x-forms.input label="Dragonfly URL (public)"
                     helper="If you change the user/password/port, this could be different. This is with the default values."
-                    readonly value="Starting the database will generate this." />
+                    readonly value="Starting the database will generate this." canGate="update" :canResource="$database" />
             @endif
         </div>
         <div class="flex flex-col gap-2">
@@ -79,11 +81,12 @@
                 <div class="w-64">
                     @if (str($database->status)->contains('exited'))
                         <x-forms.checkbox id="enable_ssl" label="Enable SSL" wire:model.live="enable_ssl"
-                            instantSave="instantSaveSSL" />
+                            instantSave="instantSaveSSL" canGate="update" :canResource="$database" />
                     @else
                         <x-forms.checkbox id="enable_ssl" label="Enable SSL" wire:model.live="enable_ssl"
                             instantSave="instantSaveSSL" disabled
-                            helper="Database should be stopped to change this settings." />
+                            helper="Database should be stopped to change this settings." canGate="update"
+                            :canResource="$database" />
                     @endif
                 </div>
             </div>
@@ -107,14 +110,17 @@
                         </x-slide-over>
                     @endif
                 </div>
-                <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" />
+                <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" canGate="update"
+                    :canResource="$database" />
             </div>
-            <x-forms.input placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port" />
+            <x-forms.input placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port"
+                canGate="update" :canResource="$database" />
         </div>
     </form>
     <h3 class="pt-4">Advanced</h3>
     <div class="w-64">
         <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
-            instantSave="instantSaveAdvanced" id="isLogDrainEnabled" label="Drain Logs" />
+            instantSave="instantSaveAdvanced" id="isLogDrainEnabled" label="Drain Logs" canGate="update"
+            :canResource="$database" />
     </div>
 </div>
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index 3df3b0e53..b09adcc4e 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -18,10 +18,12 @@ class="flex overflow-x-scroll shrink-0 gap-6 items-center whitespace-nowrap sm:o
                 href="{{ route('project.database.logs', $parameters) }}">
                 Logs
             </a>
-            <a class="{{ request()->routeIs('project.database.command') ? 'dark:text-white' : '' }}"
-                href="{{ route('project.database.command', $parameters) }}">
-                Terminal
-            </a>
+            @can('canAccessTerminal')
+                <a class="{{ request()->routeIs('project.database.command') ? 'dark:text-white' : '' }}"
+                    href="{{ route('project.database.command', $parameters) }}">
+                    Terminal
+                </a>
+            @endcan
             @if (
                 $database->getMorphClass() === 'App\Models\StandalonePostgresql' ||
                     $database->getMorphClass() === 'App\Models\StandaloneMongodb' ||
diff --git a/resources/views/livewire/project/database/import.blade.php b/resources/views/livewire/project/database/import.blade.php
index d7baf602f..c6501e031 100644
--- a/resources/views/livewire/project/database/import.blade.php
+++ b/resources/views/livewire/project/database/import.blade.php
@@ -108,8 +108,8 @@
                 <div>Location: <span x-text="filename ?? 'N/A'"></span> <span x-text="filesize">/ </span></div>
                 <x-forms.button class="w-full my-4" wire:click='runImport'>Restore Backup</x-forms.button>
             </div>
-            <div class="container w-full mx-auto">
-                <livewire:activity-monitor header="Database Restore Output" />
+            <div class="container w-full mx-auto" x-show="$wire.importRunning">
+                <livewire:activity-monitor header="Database Restore Output" :showWaiting="false" />
             </div>
         @else
             <div>Database must be running to restore a backup.</div>
diff --git a/resources/views/livewire/project/database/keydb/general.blade.php b/resources/views/livewire/project/database/keydb/general.blade.php
index 065303f75..a4b0eb471 100644
--- a/resources/views/livewire/project/database/keydb/general.blade.php
+++ b/resources/views/livewire/project/database/keydb/general.blade.php
@@ -2,51 +2,53 @@
     <form wire:submit="submit" class="flex flex-col gap-2">
         <div class="flex items-center gap-2">
             <h2>General</h2>
-            <x-forms.button type="submit">
+            <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
         </div>
         <div class="flex gap-2">
-            <x-forms.input label="Name" id="name" />
-            <x-forms.input label="Description" id="description" />
-            <x-forms.input label="Image" id="image" required
+            <x-forms.input label="Name" id="name" canGate="update" :canResource="$database" />
+            <x-forms.input label="Description" id="description" canGate="update" :canResource="$database" />
+            <x-forms.input label="Image" id="image" required canGate="update" :canResource="$database"
                 helper="For all available images, check here:<br><br><a target='_blank' href=https://hub.docker.com/r/eqalpha/keydb'>https://hub.docker.com/r/eqalpha/keydb</a>" />
         </div>
 
         @if ($database->started_at)
             <div class="flex gap-2">
                 <x-forms.input label="Initial Password" id="keydbPassword" type="password" required readonly
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
             </div>
         @else
             <div class=" dark:text-warning">Please verify these values. You can only modify them before the initial
                 start. After that, you need to modify it in the database.
             </div>
             <div class="flex gap-2">
-                <x-forms.input label="Password" id="keydbPassword" type="password" required />
+                <x-forms.input label="Password" id="keydbPassword" type="password" required canGate="update"
+                    :canResource="$database" />
             </div>
         @endif
         <x-forms.input
             helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
             placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k"
-            id="customDockerRunOptions" label="Custom Docker Options" />
+            id="customDockerRunOptions" label="Custom Docker Options" canGate="update" :canResource="$database" />
         <div class="flex flex-col gap-2">
             <h3 class="py-2">Network</h3>
             <div class="flex items-end gap-2">
                 <x-forms.input placeholder="3000:5432" id="portsMappings" label="Ports Mappings"
-                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433" />
+                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433"
+                    canGate="update" :canResource="$database" />
             </div>
             <x-forms.input label="KeyDB URL (internal)"
                 helper="If you change the user/password/port, this could be different. This is with the default values."
-                type="password" readonly wire:model="dbUrl" />
+                type="password" readonly wire:model="dbUrl" canGate="update" :canResource="$database" />
             @if ($dbUrlPublic)
                 <x-forms.input label="KeyDB URL (public)"
                     helper="If you change the user/password/port, this could be different. This is with the default values."
-                    type="password" readonly wire:model="dbUrlPublic" />
+                    type="password" readonly wire:model="dbUrlPublic" canGate="update" :canResource="$database" />
             @else
                 <x-forms.input label="KeyDB URL (public)"
                     helper="If you change the user/password/port, this could be different. This is with the default values."
-                    readonly value="Starting the database will generate this." />
+                    readonly value="Starting the database will generate this." canGate="update" :canResource="$database" />
             @endif
         </div>
         <div class="flex flex-col gap-2">
@@ -79,11 +81,12 @@
                 <div class="w-64">
                     @if (str($database->status)->contains('exited'))
                         <x-forms.checkbox id="enable_ssl" label="Enable SSL" wire:model.live="enable_ssl"
-                            instantSave="instantSaveSSL" />
+                            instantSave="instantSaveSSL" canGate="update" :canResource="$database" />
                     @else
                         <x-forms.checkbox id="enable_ssl" label="Enable SSL" wire:model.live="enable_ssl"
                             instantSave="instantSaveSSL" disabled
-                            helper="Database should be stopped to change this settings." />
+                            helper="Database should be stopped to change this settings." canGate="update"
+                            :canResource="$database" />
                     @endif
                 </div>
             </div>
@@ -107,17 +110,20 @@
                         </x-slide-over>
                     @endif
                 </div>
-                <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" />
+                <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" canGate="update"
+                    :canResource="$database" />
             </div>
-            <x-forms.input placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port" />
+            <x-forms.input placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port"
+                canGate="update" :canResource="$database" />
         </div>
         <x-forms.textarea
             helper="<a target='_blank' class='underline dark:text-white' href='https://raw.githubusercontent.com/Snapchat/KeyDB/unstable/keydb.conf'>KeyDB Default Configuration</a>"
-            label="Custom KeyDB Configuration" rows="10" id="keydbConf" />
+            label="Custom KeyDB Configuration" rows="10" id="keydbConf" canGate="update" :canResource="$database" />
     </form>
     <h3 class="pt-4">Advanced</h3>
     <div class="w-64">
         <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
-            instantSave="instantSaveAdvanced" id="isLogDrainEnabled" label="Drain Logs" />
+            instantSave="instantSaveAdvanced" id="isLogDrainEnabled" label="Drain Logs" canGate="update"
+            :canResource="$database" />
     </div>
 </div>
diff --git a/resources/views/livewire/project/database/mariadb/general.blade.php b/resources/views/livewire/project/database/mariadb/general.blade.php
index 6186e4a82..fdc659408 100644
--- a/resources/views/livewire/project/database/mariadb/general.blade.php
+++ b/resources/views/livewire/project/database/mariadb/general.blade.php
@@ -2,14 +2,14 @@
     <form wire:submit="submit" class="flex flex-col gap-2">
         <div class="flex items-center gap-2">
             <h2>General</h2>
-            <x-forms.button type="submit">
+            <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
         </div>
         <div class="flex gap-2">
-            <x-forms.input label="Name" id="database.name" />
-            <x-forms.input label="Description" id="database.description" />
-            <x-forms.input label="Image" id="database.image" required
+            <x-forms.input label="Name" id="database.name" canGate="update" :canResource="$database" />
+            <x-forms.input label="Description" id="database.description" canGate="update" :canResource="$database" />
+            <x-forms.input label="Image" id="database.image" required canGate="update" :canResource="$database"
                 helper="For all available images, check here:<br><br><a target='_blank' href='https://hub.docker.com/_/mariadb'>https://hub.docker.com/_/mariadb</a>" />
         </div>
         <div class="pt-2 dark:text-warning">If you change the values in the database, please sync it here, otherwise
@@ -18,11 +18,14 @@
         @if ($database->started_at)
             <div class="flex xl:flex-row flex-col gap-2">
                 <x-forms.input label="Root Password" id="database.mariadb_root_password" type="password" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
+                    canGate="update" :canResource="$database" />
                 <x-forms.input label="Normal User" id="database.mariadb_user" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
+                    canGate="update" :canResource="$database" />
                 <x-forms.input label="Normal User Password" id="database.mariadb_password" type="password" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
+                    canGate="update" :canResource="$database" />
             </div>
             <div class="flex flex-col gap-2">
                 <x-forms.input label="Initial Database" id="database.mariadb_database"
@@ -32,37 +35,39 @@
         @else
             <div class="flex xl:flex-row flex-col gap-2 pb-2">
                 <x-forms.input label="Root Password" id="database.mariadb_root_password" type="password"
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
                 <x-forms.input label="Normal User" id="database.mariadb_user" required
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
                 <x-forms.input label="Normal User Password" id="database.mariadb_password" type="password" required
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
             </div>
             <div class="flex flex-col gap-2">
                 <x-forms.input label="Initial Database" id="database.mariadb_database"
                     placeholder="If empty, it will be the same as Username."
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
             </div>
         @endif
         <div class="pt-2">
             <x-forms.input
                 helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
                 placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k"
-                id="database.custom_docker_run_options" label="Custom Docker Options" />
+                id="database.custom_docker_run_options" label="Custom Docker Options" canGate="update"
+                :canResource="$database" />
         </div>
         <div class="flex flex-col gap-2">
             <h3 class="py-2">Network</h3>
             <div class="flex items-end gap-2">
                 <x-forms.input placeholder="3000:5432" id="database.ports_mappings" label="Ports Mappings"
-                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433" />
+                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433"
+                    canGate="update" :canResource="$database" />
             </div>
             <x-forms.input label="MariaDB URL (internal)"
                 helper="If you change the user/password/port, this could be different. This is with the default values."
-                type="password" readonly wire:model="db_url" />
+                type="password" readonly wire:model="db_url" canGate="update" :canResource="$database" />
             @if ($db_url_public)
                 <x-forms.input label="MariaDB URL (public)"
                     helper="If you change the user/password/port, this could be different. This is with the default values."
-                    type="password" readonly wire:model="db_url_public" />
+                    type="password" readonly wire:model="db_url_public" canGate="update" :canResource="$database" />
             @endif
         </div>
 
@@ -98,11 +103,13 @@
                 <div class="w-64">
                     @if (str($database->status)->contains('exited'))
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
-                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" />
+                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" canGate="update"
+                            :canResource="$database" />
                     @else
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
                             wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" disabled
-                            helper="Database should be stopped to change this settings." />
+                            helper="Database should be stopped to change this settings." canGate="update"
+                            :canResource="$database" />
                     @endif
                 </div>
             </div>
@@ -127,16 +134,19 @@
                         </x-slide-over>
                     @endif
                 </div>
-                <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available" />
+                <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available"
+                    canGate="update" :canResource="$database" />
             </div>
             <x-forms.input placeholder="5432" disabled="{{ data_get($database, 'is_public') }}"
-                id="database.public_port" label="Public Port" />
+                id="database.public_port" label="Public Port" canGate="update" :canResource="$database" />
         </div>
-        <x-forms.textarea label="Custom MariaDB Configuration" rows="10" id="database.mariadb_conf" />
+        <x-forms.textarea label="Custom MariaDB Configuration" rows="10" id="database.mariadb_conf"
+            canGate="update" :canResource="$database" />
         <h3 class="pt-4">Advanced</h3>
         <div class="flex flex-col">
             <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
-                instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs" />
+                instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs"
+                canGate="update" :canResource="$database" />
         </div>
     </form>
 </div>
diff --git a/resources/views/livewire/project/database/mongodb/general.blade.php b/resources/views/livewire/project/database/mongodb/general.blade.php
index c92143336..2892e721e 100644
--- a/resources/views/livewire/project/database/mongodb/general.blade.php
+++ b/resources/views/livewire/project/database/mongodb/general.blade.php
@@ -2,14 +2,14 @@
     <form wire:submit="submit" class="flex flex-col gap-2">
         <div class="flex items-center gap-2">
             <h2>General</h2>
-            <x-forms.button type="submit">
+            <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
         </div>
         <div class="flex gap-2">
-            <x-forms.input label="Name" id="database.name" />
-            <x-forms.input label="Description" id="database.description" />
-            <x-forms.input label="Image" id="database.image" required
+            <x-forms.input label="Name" id="database.name" canGate="update" :canResource="$database" />
+            <x-forms.input label="Description" id="database.description" canGate="update" :canResource="$database" />
+            <x-forms.input label="Image" id="database.image" required canGate="update" :canResource="$database"
                 helper="For all available images, check here:<br><br><a target='_blank' href='https://hub.docker.com/_/mongo'>https://hub.docker.com/_/mongo</a>" />
         </div>
         <div class="pt-2 dark:text-warning">If you change the values in the database, please sync it here, otherwise
@@ -19,40 +19,44 @@
             <div class="flex xl:flex-row flex-col gap-2">
                 <x-forms.input label="Initial Username" id="database.mongo_initdb_root_username"
                     placeholder="If empty: postgres"
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
+                    canGate="update" :canResource="$database" />
                 <x-forms.input label="Initial Password" id="database.mongo_initdb_root_password" type="password"
                     required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work."
+                    canGate="update" :canResource="$database" />
                 <x-forms.input label="Initial Database" id="database.mongo_initdb_database"
                     placeholder="If empty, it will be the same as Username." readonly
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
             </div>
         @else
             <div class="flex xl:flex-row flex-col gap-2 pb-2">
                 <x-forms.input required label="Username" id="database.mongo_initdb_root_username"
-                    placeholder="If empty: postgres" />
-                <x-forms.input label="Password" id="database.mongo_initdb_root_password" type="password" required />
+                    placeholder="If empty: postgres" canGate="update" :canResource="$database" />
+                <x-forms.input label="Password" id="database.mongo_initdb_root_password" type="password" required
+                    canGate="update" :canResource="$database" />
                 <x-forms.input required label="Database" id="database.mongo_initdb_database"
-                    placeholder="If empty, it will be the same as Username." />
+                    placeholder="If empty, it will be the same as Username." canGate="update" :canResource="$database" />
             </div>
         @endif
         <x-forms.input
             helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
             placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k"
-            id="database.custom_docker_run_options" label="Custom Docker Options" />
+            id="database.custom_docker_run_options" label="Custom Docker Options" canGate="update" :canResource="$database" />
         <div class="flex flex-col gap-2">
             <h3 class="py-2">Network</h3>
             <div class="flex items-end gap-2">
                 <x-forms.input placeholder="3000:5432" id="database.ports_mappings" label="Ports Mappings"
-                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433" />
+                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433"
+                    canGate="update" :canResource="$database" />
             </div>
             <x-forms.input label="Mongo URL (internal)"
                 helper="If you change the user/password/port, this could be different. This is with the default values."
-                type="password" readonly wire:model="db_url" />
+                type="password" readonly wire:model="db_url" canGate="update" :canResource="$database" />
             @if ($db_url_public)
                 <x-forms.input label="Mongo URL (public)"
                     helper="If you change the user/password/port, this could be different. This is with the default values."
-                    type="password" readonly wire:model="db_url_public" />
+                    type="password" readonly wire:model="db_url_public" canGate="update" :canResource="$database" />
             @endif
         </div>
 
@@ -88,11 +92,13 @@
                 <div class="w-64">
                     @if (str($database->status)->contains('exited'))
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
-                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" />
+                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" canGate="update"
+                            :canResource="$database" />
                     @else
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
                             wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" disabled
-                            helper="Database should be stopped to change this settings." />
+                            helper="Database should be stopped to change this settings." canGate="update"
+                            :canResource="$database" />
                     @endif
                 </div>
                 @if ($database->enable_ssl)
@@ -100,7 +106,8 @@
                         @if (str($database->status)->contains('exited'))
                             <x-forms.select id="database.ssl_mode" label="SSL Mode" wire:model.live="database.ssl_mode"
                                 instantSave="instantSaveSSL"
-                                helper="Choose the SSL verification mode for MongoDB connections">
+                                helper="Choose the SSL verification mode for MongoDB connections" canGate="update"
+                                :canResource="$database">
                                 <option value="allow" title="Allow insecure connections">allow (insecure)</option>
                                 <option value="prefer" title="Prefer secure connections">prefer (secure)</option>
                                 <option value="require" title="Require secure connections">require (secure)</option>
@@ -109,7 +116,8 @@
                             </x-forms.select>
                         @else
                             <x-forms.select id="database.ssl_mode" label="SSL Mode" instantSave="instantSaveSSL"
-                                disabled helper="Database should be stopped to change this settings.">
+                                disabled helper="Database should be stopped to change this settings." canGate="update"
+                                :canResource="$database">
                                 <option value="allow" title="Allow insecure connections">allow (insecure)</option>
                                 <option value="prefer" title="Prefer secure connections">prefer (secure)</option>
                                 <option value="require" title="Require secure connections">require (secure)</option>
@@ -140,16 +148,20 @@
                             </x-slide-over>
                         @endif
                     </div>
-                    <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available" />
+                    <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available"
+                        canGate="update" :canResource="$database" />
                 </div>
                 <x-forms.input placeholder="5432" disabled="{{ data_get($database, 'is_public') }}"
-                    id="database.public_port" label="Public Port" />
+                    id="database.public_port" label="Public Port" canGate="update" :canResource="$database" />
             </div>
-            <x-forms.textarea label="Custom MongoDB Configuration" rows="10" id="database.mongo_conf" />
+            <x-forms.textarea label="Custom MongoDB Configuration" rows="10" id="database.mongo_conf"
+                canGate="update" :canResource="$database" />
             <h3 class="pt-4">Advanced</h3>
             <div class="flex flex-col">
                 <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
-                    instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs" />
+                    instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs"
+                    canGate="update" :canResource="$database" />
             </div>
+        </div>
     </form>
 </div>
diff --git a/resources/views/livewire/project/database/mysql/general.blade.php b/resources/views/livewire/project/database/mysql/general.blade.php
index c9090a4db..c04119f9f 100644
--- a/resources/views/livewire/project/database/mysql/general.blade.php
+++ b/resources/views/livewire/project/database/mysql/general.blade.php
@@ -7,10 +7,10 @@
             </x-forms.button>
         </div>
         <div class="flex gap-2">
-            <x-forms.input label="Name" id="database.name" />
-            <x-forms.input label="Description" id="database.description" />
+            <x-forms.input label="Name" id="database.name" canGate="update" :canResource="$database" />
+            <x-forms.input label="Description" id="database.description" canGate="update" :canResource="$database" />
             <x-forms.input label="Image" id="database.image" required
-                helper="For all available images, check here:<br><br><a target='_blank' href='https://hub.docker.com/_/mysql'>https://hub.docker.com/_/mysql</a>" />
+                helper="For all available images, check here:<br><br><a target='_blank' href='https://hub.docker.com/_/mysql'>https://hub.docker.com/_/mysql</a>" canGate="update" :canResource="$database" />
         </div>
         <div class="pt-2 dark:text-warning">If you change the values in the database, please sync it here, otherwise
             automations (like backups) won't work.
@@ -18,43 +18,43 @@
         @if ($database->started_at)
             <div class="flex xl:flex-row flex-col gap-2">
                 <x-forms.input label="Root Password" id="database.mysql_root_password" type="password" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." canGate="update" :canResource="$database" />
                 <x-forms.input label="Normal User" id="database.mysql_user" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." canGate="update" :canResource="$database" />
                 <x-forms.input label="Normal User Password" id="database.mysql_password" type="password" required
-                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
+                    helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." canGate="update" :canResource="$database" />
             </div>
             <div class="flex flex-col gap-2">
                 <x-forms.input label="Initial Database" id="database.mysql_database"
                     placeholder="If empty, it will be the same as Username." readonly
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
             </div>
         @else
             <div class="flex xl:flex-row flex-col gap-4 pb-2">
                 <x-forms.input label="Root Password" id="database.mysql_root_password" type="password"
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
                 <x-forms.input label="Normal User" id="database.mysql_user" required
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
                 <x-forms.input label="Normal User Password" id="database.mysql_password" type="password" required
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
             </div>
             <div class="flex flex-col gap-2">
                 <x-forms.input label="Initial Database" id="database.mysql_database"
                     placeholder="If empty, it will be the same as Username."
-                    helper="You can only change this in the database." />
+                    helper="You can only change this in the database." canGate="update" :canResource="$database" />
             </div>
         @endif
         <div class="pt-2">
             <x-forms.input
                 helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
                 placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k"
-                id="database.custom_docker_run_options" label="Custom Docker Options" />
+                id="database.custom_docker_run_options" label="Custom Docker Options" canGate="update" :canResource="$database" />
         </div>
         <div class="flex flex-col gap-2">
             <h3 class="py-2">Network</h3>
             <div class="flex items-end gap-2">
                 <x-forms.input placeholder="3000:5432" id="database.ports_mappings" label="Ports Mappings"
-                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433" />
+                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433" canGate="update" :canResource="$database" />
             </div>
             <x-forms.input label="MySQL URL (internal)"
                 helper="If you change the user/password/port, this could be different. This is with the default values."
@@ -98,7 +98,7 @@
                 <div class="w-64">
                     @if (str($database->status)->contains('exited'))
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
-                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" />
+                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" canGate="update" :canResource="$database" />
                     @else
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
                             wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" disabled
@@ -110,7 +110,7 @@
                         @if (str($database->status)->contains('exited'))
                             <x-forms.select id="database.ssl_mode" label="SSL Mode" wire:model.live="database.ssl_mode"
                                 instantSave="instantSaveSSL"
-                                helper="Choose the SSL verification mode for MySQL connections">
+                                helper="Choose the SSL verification mode for MySQL connections" canGate="update" :canResource="$database">
                                 <option value="PREFERRED" title="Prefer secure connections">Prefer (secure)</option>
                                 <option value="REQUIRED" title="Require secure connections">Require (secure)</option>
                                 <option value="VERIFY_CA" title="Verify CA certificate">Verify CA (secure)</option>
@@ -151,16 +151,16 @@
                         </x-slide-over>
                     @endif
                 </div>
-                <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available" />
+                <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available" canGate="update" :canResource="$database" />
             </div>
             <x-forms.input placeholder="5432" disabled="{{ data_get($database, 'is_public') }}"
-                id="database.public_port" label="Public Port" />
+                id="database.public_port" label="Public Port" canGate="update" :canResource="$database" />
         </div>
-        <x-forms.textarea label="Custom Mysql Configuration" rows="10" id="database.mysql_conf" />
+        <x-forms.textarea label="Custom Mysql Configuration" rows="10" id="database.mysql_conf" canGate="update" :canResource="$database" />
         <h3 class="pt-4">Advanced</h3>
         <div class="flex flex-col">
             <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
-                instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs" />
+                instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs" canGate="update" :canResource="$database" />
         </div>
     </form>
 </div>
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 50575f6c7..d93170edf 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -16,14 +16,14 @@
     <form wire:submit="submit" class="flex flex-col gap-2">
         <div class="flex items-center gap-2">
             <h2>General</h2>
-            <x-forms.button type="submit">
+            <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
         </div>
         <div class="flex flex-wrap gap-2 sm:flex-nowrap">
-            <x-forms.input label="Name" id="database.name" />
-            <x-forms.input label="Description" id="database.description" />
-            <x-forms.input label="Image" id="database.image" required
+            <x-forms.input label="Name" id="database.name" canGate="update" :canResource="$database" />
+            <x-forms.input label="Description" id="database.description" canGate="update" :canResource="$database" />
+            <x-forms.input label="Image" id="database.image" required canGate="update" :canResource="$database"
                 helper="For all available images, check here:<br><br><a target='_blank' href='https://hub.docker.com/_/postgres'>https://hub.docker.com/_/postgres</a>" />
         </div>
         <div class="pt-2 dark:text-warning">If you change the values in the database, please sync it here, otherwise
@@ -32,8 +32,10 @@
         @if ($database->started_at)
             <div class="flex xl:flex-row flex-col gap-2">
                 <x-forms.input label="Username" id="database.postgres_user" placeholder="If empty: postgres"
+                    canGate="update" :canResource="$database"
                     helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
                 <x-forms.input label="Password" id="database.postgres_password" type="password" required
+                    canGate="update" :canResource="$database"
                     helper="If you change this in the database, please sync it here, otherwise automations (like backups) won't work." />
                 <x-forms.input label="Initial Database" id="database.postgres_db"
                     placeholder="If empty, it will be the same as Username." readonly
@@ -41,27 +43,30 @@
             </div>
         @else
             <div class="flex xl:flex-row flex-col gap-2 pb-2">
-                <x-forms.input label="Username" id="database.postgres_user" placeholder="If empty: postgres" />
-                <x-forms.input label="Password" id="database.postgres_password" type="password" required />
+                <x-forms.input label="Username" id="database.postgres_user" placeholder="If empty: postgres"
+                    canGate="update" :canResource="$database" />
+                <x-forms.input label="Password" id="database.postgres_password" type="password" required
+                    canGate="update" :canResource="$database" />
                 <x-forms.input label="Initial Database" id="database.postgres_db"
-                    placeholder="If empty, it will be the same as Username." />
+                    placeholder="If empty, it will be the same as Username." canGate="update" :canResource="$database" />
             </div>
         @endif
         <div class="flex gap-2">
-            <x-forms.input label="Initial Database Arguments" id="database.postgres_initdb_args"
-                placeholder="If empty, use default. See in docker docs." />
-            <x-forms.input label="Host Auth Method" id="database.postgres_host_auth_method"
-                placeholder="If empty, use default. See in docker docs." />
+            <x-forms.input label="Initial Database Arguments" canGate="update" :canResource="$database"
+                id="database.postgres_initdb_args" placeholder="If empty, use default. See in docker docs." />
+            <x-forms.input label="Host Auth Method" canGate="update" :canResource="$database"
+                id="database.postgres_host_auth_method" placeholder="If empty, use default. See in docker docs." />
         </div>
         <x-forms.input
             helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
             placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k"
-            id="database.custom_docker_run_options" label="Custom Docker Options" />
+            id="database.custom_docker_run_options" label="Custom Docker Options" canGate="update" :canResource="$database" />
         <div class="flex flex-col gap-2">
             <h3 class="py-2">Network</h3>
             <div class="flex items-end gap-2">
                 <x-forms.input placeholder="3000:5432" id="database.ports_mappings" label="Ports Mappings"
-                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433" />
+                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433"
+                    canGate="update" :canResource="$database" />
             </div>
 
             <x-forms.input label="Postgres URL (internal)"
@@ -81,7 +86,8 @@
                         :actions="[
                             'The SSL certificate of this database will be regenerated.',
                             'You must restart the database after regenerating the certificate to start using the new certificate.',
-                        ]" submitAction="regenerateSslCertificate" :confirmWithText="false" :confirmWithPassword="false" />
+                        ]" submitAction="regenerateSslCertificate" :confirmWithText="false"
+                        :confirmWithPassword="false" />
                 @endif
             </div>
             @if ($database->enable_ssl && $certificateValidUntil)
@@ -102,7 +108,8 @@
                 <div class="w-64" wire:key='enable_ssl'>
                     @if ($database->isExited())
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
-                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" />
+                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" canGate="update"
+                            :canResource="$database" />
                     @else
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
                             wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" disabled
@@ -114,7 +121,8 @@
                         @if ($database->isExited())
                             <x-forms.select id="database.ssl_mode" label="SSL Mode"
                                 wire:model.live="database.ssl_mode" instantSave="instantSaveSSL"
-                                helper="Choose the SSL verification mode for PostgreSQL connections">
+                                helper="Choose the SSL verification mode for PostgreSQL connections" canGate="update"
+                                :canResource="$database">
                                 <option value="allow" title="Allow insecure connections">allow (insecure)</option>
                                 <option value="prefer" title="Prefer secure connections">prefer (secure)</option>
                                 <option value="require" title="Require secure connections">require (secure)</option>
@@ -153,15 +161,16 @@
                         @endif
                     </div>
                     <div class="flex flex-col gap-2 w-64">
-                        <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available" />
+                        <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available"
+                            canGate="update" :canResource="$database" />
                     </div>
                     <x-forms.input placeholder="5432" disabled="{{ data_get($database, 'is_public') }}"
-                        id="database.public_port" label="Public Port" />
+                        id="database.public_port" label="Public Port" canGate="update" :canResource="$database" />
                 </div>
 
                 <div class="flex flex-col gap-2">
                     <x-forms.textarea label="Custom PostgreSQL Configuration" rows="10"
-                        id="database.postgres_conf" />
+                        id="database.postgres_conf" canGate="update" :canResource="$database" />
                 </div>
     </form>
 
@@ -169,23 +178,27 @@
         <h3>Advanced</h3>
         <div class="flex flex-col">
             <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
-                instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs" />
+                instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs"
+                canGate="update" :canResource="$database" />
         </div>
 
         <div class="pb-16">
             <div class="flex items-center gap-2 pb-2">
+
                 <h3>Initialization scripts</h3>
-                <x-modal-input buttonTitle="+ Add" title="New Init Script">
-                    <form class="flex flex-col w-full gap-2 rounded-sm" wire:submit='save_new_init_script'>
-                        <x-forms.input placeholder="create_test_db.sql" id="new_filename" label="Filename"
-                            required />
-                        <x-forms.textarea rows="20" placeholder="CREATE DATABASE test;" id="new_content"
-                            label="Content" required />
-                        <x-forms.button type="submit">
-                            Save
-                        </x-forms.button>
-                    </form>
-                </x-modal-input>
+                @can('update', $database)
+                    <x-modal-input buttonTitle="+ Add" title="New Init Script">
+                        <form class="flex flex-col w-full gap-2 rounded-sm" wire:submit='save_new_init_script'>
+                            <x-forms.input placeholder="create_test_db.sql" id="new_filename" label="Filename"
+                                required />
+                            <x-forms.textarea rows="20" placeholder="CREATE DATABASE test;" id="new_content"
+                                label="Content" required />
+                            <x-forms.button type="submit">
+                                Save
+                            </x-forms.button>
+                        </form>
+                    </x-modal-input>
+                @endcan
             </div>
             <div class="flex flex-col gap-2">
                 @forelse(data_get($database,'init_scripts', []) as $script)
diff --git a/resources/views/livewire/project/database/redis/general.blade.php b/resources/views/livewire/project/database/redis/general.blade.php
index b4876f325..66e913be0 100644
--- a/resources/views/livewire/project/database/redis/general.blade.php
+++ b/resources/views/livewire/project/database/redis/general.blade.php
@@ -2,14 +2,14 @@
     <form wire:submit="submit" class="flex flex-col gap-2">
         <div class="flex items-center gap-2">
             <h2>General</h2>
-            <x-forms.button type="submit">
+            <x-forms.button type="submit" canGate="update" :canResource="$database">
                 Save
             </x-forms.button>
         </div>
         <div class="flex gap-2">
-            <x-forms.input label="Name" id="database.name" />
-            <x-forms.input label="Description" id="database.description" />
-            <x-forms.input label="Image" id="database.image" required
+            <x-forms.input label="Name" id="database.name" canGate="update" :canResource="$database" />
+            <x-forms.input label="Description" id="database.description" canGate="update" :canResource="$database" />
+            <x-forms.input label="Image" id="database.image" required canGate="update" :canResource="$database"
                 helper="For all available images, check here:<br><br><a target='_blank' href='https://hub.docker.com/_/redis'>https://hub.docker.com/_/redis</a>" />
         </div>
         <div class="flex flex-col gap-2">
@@ -21,10 +21,10 @@
                 <div class="flex gap-2">
                     @if (version_compare($redis_version, '6.0', '>='))
                         <x-forms.input label="Username" id="redis_username"
-                            helper="You can only change this in the database." />
+                            helper="You can only change this in the database." canGate="update" :canResource="$database" />
                     @endif
                     <x-forms.input label="Password" id="redis_password" type="password"
-                        helper="You can only change this in the database." />
+                        helper="You can only change this in the database." canGate="update" :canResource="$database" />
                 </div>
             @else
                 <div class="pt-2 dark:text-warning">You can only change the username and password in the database after
@@ -37,7 +37,7 @@
                     If you change the Redis Username in the database, please sync it here, otherwise automations (like backups) won't work.
                     <br><br>
                     Note: If the environment variable REDIS_USERNAME is set as a shared variable (environment, project, or team-based), this input field will become read-only."
-                            :disabled="$this->isSharedVariable('REDIS_USERNAME')" />
+                            :disabled="$this->isSharedVariable('REDIS_USERNAME')" canGate="update" :canResource="$database" />
                     @endif
                     <x-forms.input label="Password" id="redis_password" type="password" required
                         helper="You can change the Redis Password in the input field below or by editing the value of the REDIS_PASSWORD environment variable.
@@ -45,27 +45,28 @@
                 If you change the Redis Password in the database, please sync it here, otherwise automations (like backups) won't work.
                 <br><br>
                 Note: If the environment variable REDIS_PASSWORD is set as a shared variable (environment, project, or team-based), this input field will become read-only."
-                        :disabled="$this->isSharedVariable('REDIS_PASSWORD')" />
+                        :disabled="$this->isSharedVariable('REDIS_PASSWORD')" canGate="update" :canResource="$database" />
                 </div>
             @endif
         </div>
         <x-forms.input
             helper="You can add custom docker run options that will be used when your container is started.<br>Note: Not all options are supported, as they could mess up Coolify's automation and could cause bad experience for users.<br><br>Check the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/custom-commands'>docs.</a>"
             placeholder="--cap-add SYS_ADMIN --device=/dev/fuse --security-opt apparmor:unconfined --ulimit nofile=1024:1024 --tmpfs /run:rw,noexec,nosuid,size=65536k"
-            id="database.custom_docker_run_options" label="Custom Docker Options" />
+            id="database.custom_docker_run_options" label="Custom Docker Options" canGate="update" :canResource="$database" />
         <div class="flex flex-col gap-2">
             <h3 class="py-2">Network</h3>
             <div class="flex items-end gap-2">
                 <x-forms.input placeholder="3000:5432" id="database.ports_mappings" label="Ports Mappings"
-                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433" />
+                    helper="A comma separated list of ports you would like to map to the host system.<br><span class='inline-block font-bold dark:text-warning'>Example</span>3000:5432,3002:5433"
+                    canGate="update" :canResource="$database" />
             </div>
             <x-forms.input label="Redis URL (internal)"
                 helper="If you change the user/password/port, this could be different. This is with the default values."
-                type="password" readonly wire:model="db_url" />
+                type="password" readonly wire:model="db_url" canGate="update" :canResource="$database" />
             @if ($db_url_public)
                 <x-forms.input label="Redis URL (public)"
                     helper="If you change the user/password/port, this could be different. This is with the default values."
-                    type="password" readonly wire:model="db_url_public" />
+                    type="password" readonly wire:model="db_url_public" canGate="update" :canResource="$database" />
             @endif
         </div>
         <div class="flex flex-col gap-2">
@@ -98,11 +99,13 @@
                 <div class="w-64" wire:key='enable_ssl'>
                     @if (str($database->status)->contains('exited'))
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
-                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" />
+                            wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" canGate="update"
+                            :canResource="$database" />
                     @else
                         <x-forms.checkbox id="database.enable_ssl" label="Enable SSL"
                             wire:model.live="database.enable_ssl" instantSave="instantSaveSSL" disabled
-                            helper="Database should be stopped to change this settings." />
+                            helper="Database should be stopped to change this settings." canGate="update"
+                            :canResource="$database" />
                     @endif
                 </div>
             </div>
@@ -126,26 +129,28 @@
                         </x-slide-over>
                     @endif
                 </div>
-                <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available" />
+                <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available"
+                    canGate="update" :canResource="$database" />
             </div>
             <x-forms.input placeholder="5432" disabled="{{ data_get($database, 'is_public') }}"
-                id="database.public_port" label="Public Port" />
+                id="database.public_port" label="Public Port" canGate="update" :canResource="$database" />
         </div>
-        <x-forms.textarea
-    placeholder="# maxmemory 256mb
+        <x-forms.textarea placeholder="# maxmemory 256mb
 # maxmemory-policy allkeys-lru
 # timeout 300"
-    helper="You only need to provide the Redis directives you want to override — Redis will use default values for everything else. <br/><br/>
+            helper="You only need to provide the Redis directives you want to override — Redis will use default values for everything else. <br/><br/>
 ⚠️ <strong>Important:</strong> Coolify automatically applies the requirepass directive using the password shown in the Password field above. If you override requirepass in your custom configuration, make sure it matches the password field to avoid authentication issues. <br/><br/>
 🔗 <strong>Tip:</strong> <a target='_blank' class='underline dark:text-white' href='https://raw.githubusercontent.com/redis/redis/7.2/redis.conf'>View the full Redis default configuration</a> to see what options are available."
-    label="Custom Redis Configuration" rows="10" id="database.redis_conf" />
+            label="Custom Redis Configuration" rows="10" id="database.redis_conf" canGate="update"
+            :canResource="$database" />
 
 
 
         <h3 class="pt-4">Advanced</h3>
         <div class="flex flex-col">
             <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
-                instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs" />
+                instantSave="instantSaveAdvanced" id="database.is_log_drain_enabled" label="Drain Logs"
+                canGate="update" :canResource="$database" />
         </div>
 
     </form>
diff --git a/resources/views/livewire/project/database/scheduled-backups.blade.php b/resources/views/livewire/project/database/scheduled-backups.blade.php
index 7872e436a..c0b8647b2 100644
--- a/resources/views/livewire/project/database/scheduled-backups.blade.php
+++ b/resources/views/livewire/project/database/scheduled-backups.blade.php
@@ -62,7 +62,7 @@
                                 </span>
                             @else
                                 <span
-                                    class="px-3 py-1 rounded-md text-xs font-medium tracking-wide shadow-xs bg-gray-100 text-gray-800 dark:bg-gray-900/30 dark:text-gray-200">
+                                    class="px-3 py-1 rounded-md text-xs font-medium tracking-wide shadow-xs bg-gray-100 text-gray-800 dark:bg-neutral-800 dark:text-gray-200">
                                     No executions yet
                                 </span>
                             @endif
@@ -146,7 +146,7 @@ class="px-3 py-1 rounded-md text-xs font-medium tracking-wide shadow-xs bg-gray-
                                 </span>
                             @else
                                 <span
-                                    class="px-3 py-1 rounded-md text-xs font-medium tracking-wide shadow-xs bg-gray-100 text-gray-800 dark:bg-gray-900/30 dark:text-gray-200">
+                                    class="px-3 py-1 rounded-md text-xs font-medium tracking-wide shadow-xs bg-gray-100 text-gray-800 dark:bg-neutral-800 dark:text-gray-200">
                                     No executions yet
                                 </span>
                             @endif
diff --git a/resources/views/livewire/project/environment-edit.blade.php b/resources/views/livewire/project/environment-edit.blade.php
index 7062d7e0a..078d93456 100644
--- a/resources/views/livewire/project/environment-edit.blade.php
+++ b/resources/views/livewire/project/environment-edit.blade.php
@@ -5,16 +5,7 @@
     <form wire:submit='submit' class="flex flex-col">
         <div class="flex items-end gap-2">
             <h1>Environment: {{ data_get_str($environment, 'name')->limit(15) }}</h1>
-            @can('update', $environment)
-                <x-forms.button type="submit">
-                    Save
-                </x-forms.button>
-            @else
-                <x-forms.button type="submit" disabled
-                    title="You don't have permission to update this environment. Contact your team administrator for access.">
-                    Save
-                </x-forms.button>
-            @endcan
+            <x-forms.button canGate="update" :canResource="$environment" type="submit">Save</x-forms.button>
             @can('delete', $environment)
                 <livewire:project.delete-environment :disabled="!$environment->isEmpty()" :environment_id="$environment->id" />
             @endcan
diff --git a/resources/views/livewire/project/index.blade.php b/resources/views/livewire/project/index.blade.php
index 46ded4424..89da9117e 100644
--- a/resources/views/livewire/project/index.blade.php
+++ b/resources/views/livewire/project/index.blade.php
@@ -4,9 +4,11 @@
     </x-slot>
     <div class="flex gap-2">
         <h1>Projects</h1>
-        <x-modal-input buttonTitle="+ Add" title="New Project">
-            <livewire:project.add-empty />
-        </x-modal-input>
+        @can('createAnyResource')
+            <x-modal-input buttonTitle="+ Add" title="New Project">
+                <livewire:project.add-empty />
+            </x-modal-input>
+        @endcan
     </div>
     <div class="subtitle">All your projects are here.</div>
     <div x-data="searchComponent()">
@@ -24,8 +26,8 @@
                             <div x-text="project.description"></div>
                         </div>
                     </div>
-                    <div
-                        class="flex items-center justify-center gap-2 pt-4 pb-2 mr-4 text-xs lg:py-0 lg:justify-normal">
+                    <div class="flex items-center justify-center gap-2 pt-4 pb-2 mr-4 text-xs lg:py-0 lg:justify-normal"
+                        x-show="project.canUpdate">
                         <a class="mx-4 font-bold hover:underline" wire:click.stop
                             :href="`/project/${project.uuid}/edit`">
                             Settings
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index 94f0bd444..452808282 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -65,27 +65,29 @@
                                     @endif
                                     @if ($application->fqdn)
                                         <span class="flex gap-1 text-xs">{{ Str::limit($application->fqdn, 60) }}
-                                            <x-modal-input title="Edit Domains" :closeOutside="false">
-                                                <x-slot:content>
-                                                    <span class="cursor-pointer">
-                                                        <svg xmlns="http://www.w3.org/2000/svg"
-                                                            class="w-4 h-4 dark:text-warning text-coollabs"
-                                                            viewBox="0 0 24 24">
-                                                            <g fill="none" stroke="currentColor"
-                                                                stroke-linecap="round" stroke-linejoin="round"
-                                                                stroke-width="2">
-                                                                <path
-                                                                    d="m12 15l8.385-8.415a2.1 2.1 0 0 0-2.97-2.97L9 12v3h3zm4-10l3 3" />
-                                                                <path d="M9 7.07A7 7 0 0 0 10 21a7 7 0 0 0 6.929-6" />
-                                                            </g>
-                                                        </svg>
+                                            @can('update', $service)
+                                                <x-modal-input title="Edit Domains" :closeOutside="false">
+                                                    <x-slot:content>
+                                                        <span class="cursor-pointer">
+                                                            <svg xmlns="http://www.w3.org/2000/svg"
+                                                                class="w-4 h-4 dark:text-warning text-coollabs"
+                                                                viewBox="0 0 24 24">
+                                                                <g fill="none" stroke="currentColor"
+                                                                    stroke-linecap="round" stroke-linejoin="round"
+                                                                    stroke-width="2">
+                                                                    <path
+                                                                        d="m12 15l8.385-8.415a2.1 2.1 0 0 0-2.97-2.97L9 12v3h3zm4-10l3 3" />
+                                                                    <path d="M9 7.07A7 7 0 0 0 10 21a7 7 0 0 0 6.929-6" />
+                                                                </g>
+                                                            </svg>
 
-                                                    </span>
-                                                </x-slot:content>
-                                                <livewire:project.service.edit-domain
-                                                    applicationId="{{ $application->id }}"
-                                                    wire:key="edit-domain-{{ $application->id }}" />
-                                            </x-modal-input>
+                                                        </span>
+                                                    </x-slot:content>
+                                                    <livewire:project.service.edit-domain
+                                                        applicationId="{{ $application->id }}"
+                                                        wire:key="edit-domain-{{ $application->id }}" />
+                                                </x-modal-input>
+                                            @endcan
                                         </span>
                                     @endif
                                     <div class="pt-2 text-xs">{{ $application->status }}</div>
@@ -96,14 +98,16 @@ class="w-4 h-4 dark:text-warning text-coollabs"
                                         Settings
                                     </a>
                                     @if (str($application->status)->contains('running'))
-                                        <x-modal-confirmation title="Confirm Service Application Restart?"
-                                            buttonTitle="Restart"
-                                            submitAction="restartApplication({{ $application->id }})" :actions="[
-                                                'The selected service application will be unavailable during the restart.',
-                                                'If the service application is currently in use data could be lost.',
-                                            ]"
-                                            :confirmWithText="false" :confirmWithPassword="false"
-                                            step2ButtonText="Restart Service Container" />
+                                        @can('update', $service)
+                                            <x-modal-confirmation title="Confirm Service Application Restart?"
+                                                buttonTitle="Restart"
+                                                submitAction="restartApplication({{ $application->id }})" :actions="[
+                                                    'The selected service application will be unavailable during the restart.',
+                                                    'If the service application is currently in use data could be lost.',
+                                                ]"
+                                                :confirmWithText="false" :confirmWithPassword="false"
+                                                step2ButtonText="Restart Service Container" />
+                                        @endcan
                                     @endif
                                 </div>
                             </div>
@@ -149,13 +153,15 @@ class="w-4 h-4 dark:text-warning text-coollabs"
                                         Settings
                                     </a>
                                     @if (str($database->status)->contains('running'))
-                                        <x-modal-confirmation title="Confirm Service Database Restart?"
-                                            buttonTitle="Restart" submitAction="restartDatabase({{ $database->id }})"
-                                            :actions="[
-                                                'This service database will be unavailable during the restart.',
-                                                'If the service database is currently in use data could be lost.',
-                                            ]" :confirmWithText="false" :confirmWithPassword="false"
-                                            step2ButtonText="Restart Database" />
+                                        @can('update', $service)
+                                            <x-modal-confirmation title="Confirm Service Database Restart?"
+                                                buttonTitle="Restart" submitAction="restartDatabase({{ $database->id }})"
+                                                :actions="[
+                                                    'This service database will be unavailable during the restart.',
+                                                    'If the service database is currently in use data could be lost.',
+                                                ]" :confirmWithText="false" :confirmWithPassword="false"
+                                                step2ButtonText="Restart Database" />
+                                        @endcan
                                     @endif
                                 </div>
                             </div>
diff --git a/resources/views/livewire/project/service/database.blade.php b/resources/views/livewire/project/service/database.blade.php
index b066a22b1..117ad44c5 100644
--- a/resources/views/livewire/project/service/database.blade.php
+++ b/resources/views/livewire/project/service/database.blade.php
@@ -6,29 +6,33 @@
             @else
                 <h2>{{ Str::headline($database->name) }}</h2>
             @endif
-            <x-forms.button type="submit">Save</x-forms.button>
-            <x-modal-confirmation wire:click="convertToApplication" title="Convert to Application"
-                buttonTitle="Convert to Application" submitAction="convertToApplication" :actions="['The selected resource will be converted to an application.']"
-                confirmationText="{{ Str::headline($database->name) }}"
-                confirmationLabel="Please confirm the execution of the actions by entering the Service Database Name below"
-                shortConfirmationLabel="Service Database Name" />
-            <x-modal-confirmation title="Confirm Service Database Deletion?" buttonTitle="Delete" isErrorButton
-                submitAction="delete" :actions="['The selected service database container will be stopped and permanently deleted.']" confirmationText="{{ Str::headline($database->name) }}"
-                confirmationLabel="Please confirm the execution of the actions by entering the Service Database Name below"
-                shortConfirmationLabel="Service Database Name" />
+            <x-forms.button canGate="update" :canResource="$database" type="submit">Save</x-forms.button>
+            @can('update', $database)
+                <x-modal-confirmation wire:click="convertToApplication" title="Convert to Application"
+                    buttonTitle="Convert to Application" submitAction="convertToApplication" :actions="['The selected resource will be converted to an application.']"
+                    confirmationText="{{ Str::headline($database->name) }}"
+                    confirmationLabel="Please confirm the execution of the actions by entering the Service Database Name below"
+                    shortConfirmationLabel="Service Database Name" />
+            @endcan
+            @can('delete', $database)
+                <x-modal-confirmation title="Confirm Service Database Deletion?" buttonTitle="Delete" isErrorButton
+                    submitAction="delete" :actions="['The selected service database container will be stopped and permanently deleted.']" confirmationText="{{ Str::headline($database->name) }}"
+                    confirmationLabel="Please confirm the execution of the actions by entering the Service Database Name below"
+                    shortConfirmationLabel="Service Database Name" />
+            @endcan
         </div>
         <div class="flex flex-col gap-2">
             <div class="flex gap-2">
-                <x-forms.input label="Name" id="database.human_name" placeholder="Name"></x-forms.input>
-                <x-forms.input label="Description" id="database.description"></x-forms.input>
-                <x-forms.input required
+                <x-forms.input canGate="update" :canResource="$database" label="Name" id="database.human_name" placeholder="Name"></x-forms.input>
+                <x-forms.input canGate="update" :canResource="$database" label="Description" id="database.description"></x-forms.input>
+                <x-forms.input canGate="update" :canResource="$database" required
                     helper="You can change the image you would like to deploy.<br><br><span class='dark:text-warning'>WARNING. You could corrupt your data. Only do it if you know what you are doing.</span>"
                     label="Image" id="database.image"></x-forms.input>
             </div>
             <div class="flex items-end gap-2">
-                <x-forms.input placeholder="5432" disabled="{{ $database->is_public }}" id="database.public_port"
+                <x-forms.input canGate="update" :canResource="$database" placeholder="5432" disabled="{{ $database->is_public }}" id="database.public_port"
                     label="Public Port" />
-                <x-forms.checkbox instantSave id="database.is_public" label="Make it publicly available" />
+                <x-forms.checkbox canGate="update" :canResource="$database" instantSave id="database.is_public" label="Make it publicly available" />
             </div>
             @if ($db_url_public)
                 <x-forms.input label="Database IP:PORT (public)"
@@ -38,10 +42,10 @@
         </div>
         <h3 class="pt-2">Advanced</h3>
         <div class="w-96">
-            <x-forms.checkbox instantSave="instantSaveExclude" label="Exclude from service status"
+            <x-forms.checkbox canGate="update" :canResource="$database" instantSave="instantSaveExclude" label="Exclude from service status"
                 helper="If you do not need to monitor this resource, enable. Useful if this service is optional."
                 id="database.exclude_from_status"></x-forms.checkbox>
-            <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
+            <x-forms.checkbox canGate="update" :canResource="$database" helper="Drain logs to your configured log drain endpoint in your Server settings."
                 instantSave="instantSaveLogDrain" id="database.is_log_drain_enabled" label="Drain Logs" />
         </div>
     </form>
diff --git a/resources/views/livewire/project/service/edit-domain.blade.php b/resources/views/livewire/project/service/edit-domain.blade.php
index 5528834eb..1b4fa48fd 100644
--- a/resources/views/livewire/project/service/edit-domain.blade.php
+++ b/resources/views/livewire/project/service/edit-domain.blade.php
@@ -1,7 +1,7 @@
 <form wire:submit.prevent='submit' class="flex flex-col w-full gap-2">
     <div class="pb-2">Note: If a service has a defined port, do not delete it. <br>If you want to use your custom
         domain, you can add it with a port.</div>
-    <x-forms.input placeholder="https://app.coolify.io" label="Domains" id="application.fqdn"
+    <x-forms.input canGate="update" :canResource="$application" placeholder="https://app.coolify.io" label="Domains" id="application.fqdn"
         helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
-    <x-forms.button type="submit">Save</x-forms.button>
+    <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
 </form>
diff --git a/resources/views/livewire/project/service/file-storage.blade.php b/resources/views/livewire/project/service/file-storage.blade.php
index 0637c9e86..aa0ce66a3 100644
--- a/resources/views/livewire/project/service/file-storage.blade.php
+++ b/resources/views/livewire/project/service/file-storage.blade.php
@@ -6,54 +6,68 @@
         </div>
     </div>
     <form wire:submit='submit' class="flex flex-col gap-2">
-        <div class="flex gap-2">
-            @if ($fileStorage->is_directory)
-                <x-modal-confirmation :ignoreWire="false" title="Confirm Directory Conversion to File?"
-                    buttonTitle="Convert to file" submitAction="convertToFile" :actions="[
-                        'All files in this directory will be permanently deleted and an empty file will be created in its place.',
-                    ]"
-                    confirmationText="{{ $fs_path }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Filepath below"
-                    shortConfirmationLabel="Filepath" :confirmWithPassword="false" step2ButtonText="Convert to file" />
-                <x-modal-confirmation :ignoreWire="false" title="Confirm Directory Deletion?" buttonTitle="Delete"
-                    isErrorButton submitAction="delete" :checkboxes="$directoryDeletionCheckboxes" :actions="[
-                        'The selected directory and all its contents will be permanently deleted from the container.',
-                    ]"
-                    confirmationText="{{ $fs_path }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Filepath below"
-                    shortConfirmationLabel="Filepath" />
-            @else
-                @if (!$fileStorage->is_binary)
-                    <x-modal-confirmation :ignoreWire="false" title="Confirm File Conversion to Directory?"
-                        buttonTitle="Convert to directory" submitAction="convertToDirectory" :actions="[
-                            'The selected file will be permanently deleted and an empty directory will be created in its place.',
+        @can('update', $resource)
+            <div class="flex gap-2">
+                @if ($fileStorage->is_directory)
+                    <x-modal-confirmation :ignoreWire="false" title="Confirm Directory Conversion to File?"
+                        buttonTitle="Convert to file" submitAction="convertToFile" :actions="[
+                            'All files in this directory will be permanently deleted and an empty file will be created in its place.',
                         ]"
                         confirmationText="{{ $fs_path }}"
                         confirmationLabel="Please confirm the execution of the actions by entering the Filepath below"
-                        shortConfirmationLabel="Filepath" :confirmWithPassword="false" step2ButtonText="Convert to directory" />
+                        shortConfirmationLabel="Filepath" :confirmWithPassword="false" step2ButtonText="Convert to file" />
+                    <x-modal-confirmation :ignoreWire="false" title="Confirm Directory Deletion?" buttonTitle="Delete"
+                        isErrorButton submitAction="delete" :checkboxes="$directoryDeletionCheckboxes" :actions="[
+                            'The selected directory and all its contents will be permanently deleted from the container.',
+                        ]"
+                        confirmationText="{{ $fs_path }}"
+                        confirmationLabel="Please confirm the execution of the actions by entering the Filepath below"
+                        shortConfirmationLabel="Filepath" />
+                @else
+                    @if (!$fileStorage->is_binary)
+                        <x-modal-confirmation :ignoreWire="false" title="Confirm File Conversion to Directory?"
+                            buttonTitle="Convert to directory" submitAction="convertToDirectory" :actions="[
+                                'The selected file will be permanently deleted and an empty directory will be created in its place.',
+                            ]"
+                            confirmationText="{{ $fs_path }}"
+                            confirmationLabel="Please confirm the execution of the actions by entering the Filepath below"
+                            shortConfirmationLabel="Filepath" :confirmWithPassword="false" step2ButtonText="Convert to directory" />
+                    @endif
+                    <x-forms.button type="button" wire:click="loadStorageOnServer">Load from server</x-forms.button>
+                    <x-modal-confirmation :ignoreWire="false" title="Confirm File Deletion?" buttonTitle="Delete"
+                        isErrorButton submitAction="delete" :checkboxes="$fileDeletionCheckboxes" :actions="['The selected file will be permanently deleted from the container.']"
+                        confirmationText="{{ $fs_path }}"
+                        confirmationLabel="Please confirm the execution of the actions by entering the Filepath below"
+                        shortConfirmationLabel="Filepath" />
                 @endif
-                <x-forms.button type="button" wire:click="loadStorageOnServer">Load from server</x-forms.button>
-                <x-modal-confirmation :ignoreWire="false" title="Confirm File Deletion?" buttonTitle="Delete"
-                    isErrorButton submitAction="delete" :checkboxes="$fileDeletionCheckboxes" :actions="['The selected file will be permanently deleted from the container.']"
-                    confirmationText="{{ $fs_path }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Filepath below"
-                    shortConfirmationLabel="Filepath" />
-            @endif
-        </div>
+            </div>
+        @endcan
         @if (!$fileStorage->is_directory)
-            @if (data_get($resource, 'settings.is_preserve_repository_enabled'))
-                <div class="w-96">
-                    <x-forms.checkbox instantSave label="Is this based on the Git repository?"
-                        id="fileStorage.is_based_on_git"></x-forms.checkbox>
-                </div>
-            @endif
-            <x-forms.textarea
-                label="{{ $fileStorage->is_based_on_git ? 'Content (refreshed after a successful deployment)' : 'Content' }}"
-                rows="20" id="fileStorage.content"
-                readonly="{{ $fileStorage->is_based_on_git || $fileStorage->is_binary }}"></x-forms.textarea>
-            @if (!$fileStorage->is_based_on_git && !$fileStorage->is_binary)
-                <x-forms.button class="w-full" type="submit">Save</x-forms.button>
-            @endif
+            @can('update', $resource)
+                @if (data_get($resource, 'settings.is_preserve_repository_enabled'))
+                    <div class="w-96">
+                        <x-forms.checkbox instantSave label="Is this based on the Git repository?"
+                            id="fileStorage.is_based_on_git"></x-forms.checkbox>
+                    </div>
+                @endif
+                <x-forms.textarea
+                    label="{{ $fileStorage->is_based_on_git ? 'Content (refreshed after a successful deployment)' : 'Content' }}"
+                    rows="20" id="fileStorage.content"
+                    readonly="{{ $fileStorage->is_based_on_git || $fileStorage->is_binary }}"></x-forms.textarea>
+                @if (!$fileStorage->is_based_on_git && !$fileStorage->is_binary)
+                    <x-forms.button class="w-full" type="submit">Save</x-forms.button>
+                @endif
+            @else
+                @if (data_get($resource, 'settings.is_preserve_repository_enabled'))
+                    <div class="w-96">
+                        <x-forms.checkbox disabled label="Is this based on the Git repository?"
+                            id="fileStorage.is_based_on_git"></x-forms.checkbox>
+                    </div>
+                @endif
+                <x-forms.textarea
+                    label="{{ $fileStorage->is_based_on_git ? 'Content (refreshed after a successful deployment)' : 'Content' }}"
+                    rows="20" id="fileStorage.content" disabled></x-forms.textarea>
+            @endcan
         @endif
     </form>
 </div>
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 8afade4b1..73635d93a 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -18,10 +18,12 @@
                 href="{{ route('project.service.logs', $parameters) }}">
                 <button>Logs</button>
             </a>
-            <a class="{{ request()->routeIs('project.service.command') ? 'dark:text-white' : '' }}"
-                href="{{ route('project.service.command', $parameters) }}">
-                <button>Terminal</button>
-            </a>
+            @can('canAccessTerminal')
+                <a class="{{ request()->routeIs('project.service.command') ? 'dark:text-white' : '' }}"
+                    href="{{ route('project.service.command', $parameters) }}">
+                    <button>Terminal</button>
+                </a>
+            @endcan
             <x-services.links :service="$service" />
         </nav>
         @if ($service->isDeployable)
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index d6afe90e3..9a782fca6 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -38,9 +38,11 @@ class="{{ request()->routeIs('project.service.configuration') ? 'menu-item-activ
                         <div class="flex gap-2">
                             <h2 class="pb-4">Scheduled Backups</h2>
                             @if (filled($serviceDatabase->custom_type) || !$serviceDatabase->is_migrated)
-                                <x-modal-input buttonTitle="+ Add" title="New Scheduled Backup">
-                                    <livewire:project.database.create-scheduled-backup :database="$serviceDatabase" />
-                                </x-modal-input>
+                                @can('update', $serviceDatabase)
+                                    <x-modal-input buttonTitle="+ Add" title="New Scheduled Backup">
+                                        <livewire:project.database.create-scheduled-backup :database="$serviceDatabase" />
+                                    </x-modal-input>
+                                @endcan
                             @endif
                         </div>
                         <livewire:project.database.scheduled-backups :database="$serviceDatabase" />
diff --git a/resources/views/livewire/project/service/service-application-view.blade.php b/resources/views/livewire/project/service/service-application-view.blade.php
index 4685741a7..deaf1429c 100644
--- a/resources/views/livewire/project/service/service-application-view.blade.php
+++ b/resources/views/livewire/project/service/service-application-view.blade.php
@@ -6,35 +6,41 @@
             @else
                 <h2>{{ Str::headline($application->name) }}</h2>
             @endif
-            <x-forms.button type="submit">Save</x-forms.button>
-            <x-modal-confirmation wire:click="convertToDatabase" title="Convert to Database"
-                buttonTitle="Convert to Database" submitAction="convertToDatabase" :actions="['The selected resource will be converted to a service database.']"
-                confirmationText="{{ Str::headline($application->name) }}"
-                confirmationLabel="Please confirm the execution of the actions by entering the Service Application Name below"
-                shortConfirmationLabel="Service Application Name" />
-            <x-modal-confirmation title="Confirm Service Application Deletion?" buttonTitle="Delete" isErrorButton
-                submitAction="delete" :actions="['The selected service application container will be stopped and permanently deleted.']" confirmationText="{{ Str::headline($application->name) }}"
-                confirmationLabel="Please confirm the execution of the actions by entering the Service Application Name below"
-                shortConfirmationLabel="Service Application Name" />
+            <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
+            @can('update', $application)
+                <x-modal-confirmation wire:click="convertToDatabase" title="Convert to Database"
+                    buttonTitle="Convert to Database" submitAction="convertToDatabase" :actions="['The selected resource will be converted to a service database.']"
+                    confirmationText="{{ Str::headline($application->name) }}"
+                    confirmationLabel="Please confirm the execution of the actions by entering the Service Application Name below"
+                    shortConfirmationLabel="Service Application Name" />
+            @endcan
+            @can('delete', $application)
+                <x-modal-confirmation title="Confirm Service Application Deletion?" buttonTitle="Delete" isErrorButton
+                    submitAction="delete" :actions="['The selected service application container will be stopped and permanently deleted.']" confirmationText="{{ Str::headline($application->name) }}"
+                    confirmationLabel="Please confirm the execution of the actions by entering the Service Application Name below"
+                    shortConfirmationLabel="Service Application Name" />
+            @endcan
         </div>
         <div class="flex flex-col gap-2">
             <div class="flex gap-2">
-                <x-forms.input label="Name" id="application.human_name"
+                <x-forms.input canGate="update" :canResource="$application" label="Name" id="application.human_name"
                     placeholder="Human readable name"></x-forms.input>
-                <x-forms.input label="Description" id="application.description"></x-forms.input>
+                <x-forms.input canGate="update" :canResource="$application" label="Description"
+                    id="application.description"></x-forms.input>
             </div>
             <div class="flex gap-2">
                 @if (!$application->serviceType()?->contains(str($application->image)->before(':')))
                     @if ($application->required_fqdn)
-                        <x-forms.input required placeholder="https://app.coolify.io" label="Domains"
-                            id="application.fqdn"
+                        <x-forms.input canGate="update" :canResource="$application" required placeholder="https://app.coolify.io"
+                            label="Domains" id="application.fqdn"
                             helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
                     @else
-                        <x-forms.input placeholder="https://app.coolify.io" label="Domains" id="application.fqdn"
+                        <x-forms.input canGate="update" :canResource="$application" placeholder="https://app.coolify.io"
+                            label="Domains" id="application.fqdn"
                             helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
                     @endif
                 @endif
-                <x-forms.input
+                <x-forms.input canGate="update" :canResource="$application"
                     helper="You can change the image you would like to deploy.<br><br><span class='dark:text-warning'>WARNING. You could corrupt your data. Only do it if you know what you are doing.</span>"
                     label="Image" id="application.image"></x-forms.input>
             </div>
@@ -42,18 +48,22 @@
         <h3 class="py-2 pt-4">Advanced</h3>
         <div class="w-96 flex flex-col gap-1">
             @if (str($application->image)->contains('pocketbase'))
-                <x-forms.checkbox instantSave id="application.is_gzip_enabled" label="Enable Gzip Compression"
+                <x-forms.checkbox canGate="update" :canResource="$application" instantSave id="application.is_gzip_enabled"
+                    label="Enable Gzip Compression"
                     helper="Pocketbase does not need gzip compression, otherwise SSE will not work." disabled />
             @else
-                <x-forms.checkbox instantSave id="application.is_gzip_enabled" label="Enable Gzip Compression"
+                <x-forms.checkbox canGate="update" :canResource="$application" instantSave id="application.is_gzip_enabled"
+                    label="Enable Gzip Compression"
                     helper="You can disable gzip compression if you want. Some services are compressing data by default. In this case, you do not need this." />
             @endif
-            <x-forms.checkbox instantSave id="application.is_stripprefix_enabled" label="Strip Prefixes"
+            <x-forms.checkbox canGate="update" :canResource="$application" instantSave id="application.is_stripprefix_enabled"
+                label="Strip Prefixes"
                 helper="Strip Prefix is used to remove prefixes from paths. Like /api/ to /api." />
-            <x-forms.checkbox instantSave label="Exclude from service status"
+            <x-forms.checkbox canGate="update" :canResource="$application" instantSave label="Exclude from service status"
                 helper="If you do not need to monitor this resource, enable. Useful if this service is optional."
                 id="application.exclude_from_status"></x-forms.checkbox>
-            <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
+            <x-forms.checkbox canGate="update" :canResource="$application"
+                helper="Drain logs to your configured log drain endpoint in your Server settings."
                 instantSave="instantSaveAdvanced" id="application.is_log_drain_enabled" label="Drain Logs" />
         </div>
     </form>
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index 7583cabaf..fff6524ce 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -5,19 +5,21 @@
             @if (isDev())
                 <div>{{ $service->compose_parsing_version }}</div>
             @endif
-            <x-forms.button wire:target='submit' type="submit">Save</x-forms.button>
-            <x-modal-input buttonTitle="Edit Compose File" title="Edit Docker Compose" :closeOutside="false">
-                <livewire:project.service.edit-compose serviceId="{{ $service->id }}" />
-            </x-modal-input>
+            <x-forms.button canGate="update" :canResource="$service" wire:target='submit' type="submit">Save</x-forms.button>
+            @can('update', $service)
+                <x-modal-input buttonTitle="Edit Compose File" title="Edit Docker Compose" :closeOutside="false">
+                    <livewire:project.service.edit-compose serviceId="{{ $service->id }}" />
+                </x-modal-input>
+            @endcan
         </div>
         <div>Configuration</div>
     </div>
     <div class="flex gap-2">
-        <x-forms.input id="service.name" required label="Service Name" placeholder="My super WordPress site" />
-        <x-forms.input id="service.description" label="Description" />
+        <x-forms.input canGate="update" :canResource="$service" id="service.name" required label="Service Name" placeholder="My super WordPress site" />
+        <x-forms.input canGate="update" :canResource="$service" id="service.description" label="Description" />
     </div>
     <div class="w-96">
-        <x-forms.checkbox instantSave id="service.connect_to_docker_network" label="Connect To Predefined Network"
+        <x-forms.checkbox canGate="update" :canResource="$service" instantSave id="service.connect_to_docker_network" label="Connect To Predefined Network"
             helper="By default, you do not reach the Coolify defined networks.<br>Starting a docker compose based resource will have an internal network. <br>If you connect to a Coolify defined network, you maybe need to use different internal DNS names to connect to a resource.<br><br>For more information, check <a class='underline dark:text-white' target='_blank' href='https://coolify.io/docs/knowledge-base/docker/compose#connect-to-predefined-networks'>this</a>." />
     </div>
     @if ($fields->count() > 0)
@@ -34,7 +36,7 @@ class="font-bold">{{ data_get($field, 'serviceName') }}</span>{{ data_get($field
                         <x-helper helper="Variable name: {{ $serviceName }}" />
                     @endif
                 </div>
-                <x-forms.input type="{{ data_get($field, 'isPassword') ? 'password' : 'text' }}"
+                <x-forms.input canGate="update" :canResource="$service" type="{{ data_get($field, 'isPassword') ? 'password' : 'text' }}"
                     required="{{ str(data_get($field, 'rules'))?->contains('required') }}"
                     id="fields.{{ $serviceName }}.value"></x-forms.input>
             @endforeach
diff --git a/resources/views/livewire/project/service/storage.blade.php b/resources/views/livewire/project/service/storage.blade.php
index 0988788e9..41d48f386 100644
--- a/resources/views/livewire/project/service/storage.blade.php
+++ b/resources/views/livewire/project/service/storage.blade.php
@@ -16,9 +16,11 @@
                     volume
                     name, example: <span class='text-helper'>-pr-1</span>" />
             @if ($resource?->build_pack !== 'dockercompose')
-                <x-modal-input :closeOutside="false" buttonTitle="+ Add" title="New Persistent Storage" minWidth="64rem">
-                    <livewire:project.shared.storages.add :resource="$resource" />
-                </x-modal-input>
+                @can('update', $resource)
+                    <x-modal-input :closeOutside="false" buttonTitle="+ Add" title="New Persistent Storage" minWidth="64rem">
+                        <livewire:project.shared.storages.add :resource="$resource" />
+                    </x-modal-input>
+                @endcan
             @endif
         </div>
         <div class="pb-4">Persistent storage to preserve data between deployments.</div>
diff --git a/resources/views/livewire/project/shared/environment-variable/all.blade.php b/resources/views/livewire/project/shared/environment-variable/all.blade.php
index a71f88637..c75407179 100644
--- a/resources/views/livewire/project/shared/environment-variable/all.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/all.blade.php
@@ -2,20 +2,28 @@
     <div>
         <div class="flex items-center gap-2">
             <h2>Environment Variables</h2>
-            <div class="flex flex-col items-center">
-                <x-modal-input buttonTitle="+ Add" title="New Environment Variable" :closeOutside="false">
-                    <livewire:project.shared.environment-variable.add />
-                </x-modal-input>
-            </div>
-            <x-forms.button
-                wire:click='switch'>{{ $view === 'normal' ? 'Developer view' : 'Normal view' }}</x-forms.button>
+            @can('manageEnvironment', $resource)
+                <div class="flex flex-col items-center">
+                    <x-modal-input buttonTitle="+ Add" title="New Environment Variable" :closeOutside="false">
+                        <livewire:project.shared.environment-variable.add />
+                    </x-modal-input>
+                </div>
+                <x-forms.button
+                    wire:click='switch'>{{ $view === 'normal' ? 'Developer view' : 'Normal view' }}</x-forms.button>
+            @endcan
         </div>
         <div>Environment variables (secrets) for this resource. </div>
         @if ($resourceClass === 'App\Models\Application' && data_get($resource, 'build_pack') !== 'dockercompose')
             <div class="w-64 pt-2">
-                <x-forms.checkbox id="is_env_sorting_enabled" label="Sort alphabetically"
-                    helper="Turn this off if one environment is dependent on an other. It will be sorted by creation order (like you pasted them or in the order you created them)."
-                    instantSave></x-forms.checkbox>
+                @can('manageEnvironment', $resource)
+                    <x-forms.checkbox id="is_env_sorting_enabled" label="Sort alphabetically"
+                        helper="Turn this off if one environment is dependent on an other. It will be sorted by creation order (like you pasted them or in the order you created them)."
+                        instantSave></x-forms.checkbox>
+                @else
+                    <x-forms.checkbox id="is_env_sorting_enabled" label="Sort alphabetically"
+                        helper="Turn this off if one environment is dependent on an other. It will be sorted by creation order (like you pasted them or in the order you created them)."
+                        disabled></x-forms.checkbox>
+                @endcan
             </div>
         @endif
         @if ($resource->type() === 'service' || $resource?->build_pack === 'dockercompose')
@@ -62,16 +70,27 @@
         @endif
     @else
         <form wire:submit.prevent='submit' class="flex flex-col gap-2">
-            <x-forms.textarea rows="10" class="whitespace-pre-wrap" id="variables" wire:model="variables"
-                label="Production Environment Variables"></x-forms.textarea>
+            @can('manageEnvironment', $resource)
+                <x-forms.textarea rows="10" class="whitespace-pre-wrap" id="variables" wire:model="variables"
+                    label="Production Environment Variables"></x-forms.textarea>
 
-            @if ($showPreview)
-                <x-forms.textarea rows="10" class="whitespace-pre-wrap"
-                    label="Preview Deployments Environment Variables" id="variablesPreview"
-                    wire:model="variablesPreview"></x-forms.textarea>
-            @endif
+                @if ($showPreview)
+                    <x-forms.textarea rows="10" class="whitespace-pre-wrap"
+                        label="Preview Deployments Environment Variables" id="variablesPreview"
+                        wire:model="variablesPreview"></x-forms.textarea>
+                @endif
 
-            <x-forms.button type="submit" class="btn btn-primary">Save All Environment Variables</x-forms.button>
+                <x-forms.button type="submit" class="btn btn-primary">Save All Environment Variables</x-forms.button>
+            @else
+                <x-forms.textarea rows="10" class="whitespace-pre-wrap" id="variables" wire:model="variables"
+                    label="Production Environment Variables" disabled></x-forms.textarea>
+
+                @if ($showPreview)
+                    <x-forms.textarea rows="10" class="whitespace-pre-wrap"
+                        label="Preview Deployments Environment Variables" id="variablesPreview"
+                        wire:model="variablesPreview" disabled></x-forms.textarea>
+                @endif
+            @endcan
         </form>
     @endif
 </div>
diff --git a/resources/views/livewire/project/shared/environment-variable/show.blade.php b/resources/views/livewire/project/shared/environment-variable/show.blade.php
index 5a197dc7a..63148b74c 100644
--- a/resources/views/livewire/project/shared/environment-variable/show.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show.blade.php
@@ -13,101 +13,151 @@
                         <path d="M11 16a1 1 0 1 0 2 0a1 1 0 0 0-2 0m-3-5V7a4 4 0 1 1 8 0v4" />
                     </g>
                 </svg>
-                <x-modal-confirmation title="Confirm Environment Variable Deletion?" isErrorButton buttonTitle="Delete"
-                    submitAction="delete" :actions="['The selected environment variable will be permanently deleted.']" confirmationText="{{ $env->key }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Environment Variable Name below"
-                    shortConfirmationLabel="Environment Variable Name" :confirmWithPassword="false"
-                    step2ButtonText="Permanently Delete" />
+                @can('delete', $this->env)
+                    <x-modal-confirmation title="Confirm Environment Variable Deletion?" isErrorButton buttonTitle="Delete"
+                        submitAction="delete" :actions="['The selected environment variable will be permanently deleted.']" confirmationText="{{ $env->key }}"
+                        confirmationLabel="Please confirm the execution of the actions by entering the Environment Variable Name below"
+                        shortConfirmationLabel="Environment Variable Name" :confirmWithPassword="false"
+                        step2ButtonText="Permanently Delete" />
+                @endcan
             </div>
         @else
-            @if ($isDisabled)
-                <div class="flex flex-col w-full gap-2 flex-wrap lg:flex-row">
+            @can('update', $this->env)
+                @if ($isDisabled)
+                    <div class="flex flex-col w-full gap-2 lg:flex-row">
+                        <x-forms.input disabled id="key" />
+                        <x-forms.input disabled type="password" id="value" />
+                        @if ($is_shared)
+                            <x-forms.input disabled type="password" id="real_value" />
+                        @endif
+                    </div>
+                @else
+                    <div class="flex flex-col w-full gap-2 lg:flex-row">
+                        @if ($is_multiline)
+                            <x-forms.input :required="$is_redis_credential" isMultiline="{{ $is_multiline }}" id="key" />
+                            <x-forms.textarea :required="$is_redis_credential" type="password" id="value" />
+                        @else
+                            <x-forms.input :disabled="$is_redis_credential" :required="$is_redis_credential" id="key" />
+                            <x-forms.input :required="$is_redis_credential" type="password" id="value" />
+                        @endif
+                        @if ($is_shared)
+                            <x-forms.input :disabled="$is_redis_credential" :required="$is_redis_credential" disabled type="password" id="real_value" />
+                        @endif
+                    </div>
+                @endif
+            @else
+                <div class="flex flex-col w-full gap-2 lg:flex-row">
                     <x-forms.input disabled id="key" />
                     <x-forms.input disabled type="password" id="value" />
                     @if ($is_shared)
                         <x-forms.input disabled type="password" id="real_value" />
                     @endif
                 </div>
-            @else
-                <div class="flex flex-col w-full gap-2 flex-wrap lg:flex-row">
-                    @if ($is_multiline)
-                        <x-forms.input :required="$is_redis_credential" isMultiline="{{ $is_multiline }}" id="key" />
-                        <x-forms.textarea :required="$is_redis_credential" type="password" id="value" />
-                    @else
-                        <x-forms.input :disabled="$is_redis_credential" :required="$is_redis_credential" id="key" />
-                        <x-forms.input :required="$is_redis_credential" type="password" id="value" />
-                    @endif
-                    @if ($is_shared)
-                        <x-forms.input :disabled="$is_redis_credential" :required="$is_redis_credential" disabled type="password" id="real_value" />
-                    @endif
-                </div>
-            @endif
-            <div class="flex flex-col w-full gap-2 flex-wrap lg:flex-row">
-                @if (!$is_redis_credential)
-                    @if ($type === 'service')
-                        <x-forms.checkbox instantSave id="is_build_time"
-                            helper="If you are using Docker, remember to modify the file to be ready to receive the build time args. Ex.: for docker file, add `ARG name_of_the_variable`, or dockercompose add `- 'name_of_the_variable=${name_of_the_variable}'`"
-                            label="Is Build Variable?" />
-                        <x-forms.checkbox instantSave id="is_multiline" label="Is Multiline?" />
-                        <x-forms.checkbox instantSave id="is_literal"
-                            helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
-                            label="Is Literal?" />
-                    @else
-                        @if ($is_shared)
+            @endcan
+            @can('manageEnvironment', $this->resource)
+                <div class="flex flex-col w-full gap-2 lg:flex-row">
+                    @if (!$is_redis_credential)
+                        @if ($type === 'service')
                             <x-forms.checkbox instantSave id="is_build_time"
                                 helper="If you are using Docker, remember to modify the file to be ready to receive the build time args. Ex.: for docker file, add `ARG name_of_the_variable`, or dockercompose add `- 'name_of_the_variable=${name_of_the_variable}'`"
                                 label="Is Build Variable?" />
+                            <x-forms.checkbox instantSave id="is_multiline" label="Is Multiline?" />
                             <x-forms.checkbox instantSave id="is_literal"
                                 helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
                                 label="Is Literal?" />
                         @else
-                            @if ($isSharedVariable)
-                                <x-forms.checkbox instantSave id="is_multiline" label="Is Multiline?" />
-                            @else
+                            @if ($is_shared)
                                 <x-forms.checkbox instantSave id="is_build_time"
-                                    helper="If you are using Docker, remember to modify the file to be ready to receive the build time args. Ex.: for dockerfile, add `ARG name_of_the_variable`, or dockercompose add `- 'name_of_the_variable=${name_of_the_variable}'`"
+                                    helper="If you are using Docker, remember to modify the file to be ready to receive the build time args. Ex.: for docker file, add `ARG name_of_the_variable`, or dockercompose add `- 'name_of_the_variable=${name_of_the_variable}'`"
                                     label="Is Build Variable?" />
-                                <x-forms.checkbox instantSave id="is_multiline" label="Is Multiline?" />
-                                @if ($is_multiline === false)
-                                    <x-forms.checkbox instantSave id="is_literal"
-                                        helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
-                                        label="Is Literal?" />
+                                <x-forms.checkbox instantSave id="is_literal"
+                                    helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
+                                    label="Is Literal?" />
+                            @else
+                                @if ($isSharedVariable)
+                                    <x-forms.checkbox instantSave id="is_multiline" label="Is Multiline?" />
+                                @else
+                                    <x-forms.checkbox instantSave id="is_build_time"
+                                        helper="If you are using Docker, remember to modify the file to be ready to receive the build time args. Ex.: for dockerfile, add `ARG name_of_the_variable`, or dockercompose add `- 'name_of_the_variable=${name_of_the_variable}'`"
+                                        label="Is Build Variable?" />
+                                    <x-forms.checkbox instantSave id="is_multiline" label="Is Multiline?" />
+                                    @if ($is_multiline === false)
+                                        <x-forms.checkbox instantSave id="is_literal"
+                                            helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
+                                            label="Is Literal?" />
+                                    @endif
                                 @endif
                             @endif
                         @endif
                     @endif
-                @endif
-                <div class="flex-1"></div>
-                @if ($isDisabled)
-                    <x-forms.button disabled type="submit">
-                        Update
-                    </x-forms.button>
-                    <x-forms.button wire:click='lock'>
-                        Lock
-                    </x-forms.button>
-                    <x-modal-confirmation title="Confirm Environment Variable Deletion?" isErrorButton
-                        buttonTitle="Delete" submitAction="delete" :actions="['The selected environment variable will be permanently deleted.']"
-                        confirmationText="{{ $key }}"
-                        buttonFullWidth="true"
-                        confirmationLabel="Please confirm the execution of the actions by entering the Environment Variable Name below"
-                        shortConfirmationLabel="Environment Variable Name" :confirmWithPassword="false"
-                        step2ButtonText="Permanently Delete" />
-                @else
-                    <x-forms.button type="submit">
-                        Update
-                    </x-forms.button>
-                    <x-forms.button wire:click='lock'>
-                        Lock
-                    </x-forms.button>
-                    <x-modal-confirmation title="Confirm Environment Variable Deletion?" isErrorButton
-                        buttonTitle="Delete" submitAction="delete" :actions="['The selected environment variable will be permanently deleted.']"
-                        confirmationText="{{ $key }}"
-                        buttonFullWidth="true"
-                        confirmationLabel="Please confirm the execution of the actions by entering the Environment Variable Name below"
-                        shortConfirmationLabel="Environment Variable Name" :confirmWithPassword="false"
-                        step2ButtonText="Permanently Delete" />
-                @endif
-            </div>
+                    <div class="flex-1"></div>
+                    @if ($isDisabled)
+                        <x-forms.button disabled type="submit">
+                            Update
+                        </x-forms.button>
+                        <x-forms.button wire:click='lock'>
+                            Lock
+                        </x-forms.button>
+                        <x-modal-confirmation title="Confirm Environment Variable Deletion?" isErrorButton
+                            buttonTitle="Delete" submitAction="delete" :actions="['The selected environment variable will be permanently deleted.']"
+                            confirmationText="{{ $key }}" buttonFullWidth="true"
+                            confirmationLabel="Please confirm the execution of the actions by entering the Environment Variable Name below"
+                            shortConfirmationLabel="Environment Variable Name" :confirmWithPassword="false"
+                            step2ButtonText="Permanently Delete" />
+                    @else
+                        <x-forms.button type="submit">
+                            Update
+                        </x-forms.button>
+                        <x-forms.button wire:click='lock'>
+                            Lock
+                        </x-forms.button>
+                        <x-modal-confirmation title="Confirm Environment Variable Deletion?" isErrorButton
+                            buttonTitle="Delete" submitAction="delete" :actions="['The selected environment variable will be permanently deleted.']"
+                            confirmationText="{{ $key }}" buttonFullWidth="true"
+                            confirmationLabel="Please confirm the execution of the actions by entering the Environment Variable Name below"
+                            shortConfirmationLabel="Environment Variable Name" :confirmWithPassword="false"
+                            step2ButtonText="Permanently Delete" />
+                    @endif
+                </div>
+            @else
+                <div class="flex flex-col w-full gap-2 flex-wrap lg:flex-row">
+                    @if (!$is_redis_credential)
+                        @if ($type === 'service')
+                            <x-forms.checkbox disabled id="is_build_time"
+                                helper="If you are using Docker, remember to modify the file to be ready to receive the build time args. Ex.: for docker file, add `ARG name_of_the_variable`, or dockercompose add `- 'name_of_the_variable=${name_of_the_variable}'`"
+                                label="Is Build Variable?" />
+                            <x-forms.checkbox disabled id="is_multiline" label="Is Multiline?" />
+                            <x-forms.checkbox disabled id="is_literal"
+                                helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
+                                label="Is Literal?" />
+                        @else
+                            @if ($is_shared)
+                                <x-forms.checkbox disabled id="is_build_time"
+                                    helper="If you are using Docker, remember to modify the file to be ready to receive the build time args. Ex.: for docker file, add `ARG name_of_the_variable`, or dockercompose add `- 'name_of_the_variable=${name_of_the_variable}'`"
+                                    label="Is Build Variable?" />
+                                <x-forms.checkbox disabled id="is_literal"
+                                    helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
+                                    label="Is Literal?" />
+                            @else
+                                @if ($isSharedVariable)
+                                    <x-forms.checkbox disabled id="is_multiline" label="Is Multiline?" />
+                                @else
+                                    <x-forms.checkbox disabled id="is_build_time"
+                                        helper="If you are using Docker, remember to modify the file to be ready to receive the build time args. Ex.: for dockerfile, add `ARG name_of_the_variable`, or dockercompose add `- 'name_of_the_variable=${name_of_the_variable}'`"
+                                        label="Is Build Variable?" />
+                                    <x-forms.checkbox disabled id="is_multiline" label="Is Multiline?" />
+                                    @if ($is_multiline === false)
+                                        <x-forms.checkbox disabled id="is_literal"
+                                            helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
+                                            label="Is Literal?" />
+                                    @endif
+                                @endif
+                            @endif
+                        @endif
+                    @endif
+                    <div class="flex-1"></div>
+                </div>
+            @endcan
         @endif
 
     </form>
diff --git a/resources/views/livewire/project/shared/health-checks.blade.php b/resources/views/livewire/project/shared/health-checks.blade.php
index cb34f61ed..fb9f7f3bc 100644
--- a/resources/views/livewire/project/shared/health-checks.blade.php
+++ b/resources/views/livewire/project/shared/health-checks.blade.php
@@ -1,7 +1,7 @@
 <form wire:submit='submit' class="flex flex-col">
     <div class="flex items-center gap-2">
         <h2>Healthchecks</h2>
-        <x-forms.button type="submit">Save</x-forms.button>
+        <x-forms.button canGate="update" :canResource="$resource" type="submit">Save</x-forms.button>
     </div>
     <div class="pb-4">Define how your resource's health should be checked.</div>
     <div class="flex flex-col gap-4">
@@ -10,29 +10,29 @@
             </div>
         @endif
         <div class="w-32">
-            <x-forms.checkbox instantSave id="resource.health_check_enabled" label="Enabled" />
+            <x-forms.checkbox canGate="update" :canResource="$resource" instantSave id="resource.health_check_enabled" label="Enabled" />
         </div>
         <div class="flex gap-2">
-            <x-forms.input id="resource.health_check_method" placeholder="GET" label="Method" required />
-            <x-forms.input id="resource.health_check_scheme" placeholder="http" label="Scheme" required />
-            <x-forms.input id="resource.health_check_host" placeholder="localhost" label="Host" required />
-            <x-forms.input type="number" id="resource.health_check_port"
+            <x-forms.input canGate="update" :canResource="$resource" id="resource.health_check_method" placeholder="GET" label="Method" required />
+            <x-forms.input canGate="update" :canResource="$resource" id="resource.health_check_scheme" placeholder="http" label="Scheme" required />
+            <x-forms.input canGate="update" :canResource="$resource" id="resource.health_check_host" placeholder="localhost" label="Host" required />
+            <x-forms.input canGate="update" :canResource="$resource" type="number" id="resource.health_check_port"
                 helper="If no port is defined, the first exposed port will be used." placeholder="80" label="Port" />
-            <x-forms.input id="resource.health_check_path" placeholder="/health" label="Path" required />
+            <x-forms.input canGate="update" :canResource="$resource" id="resource.health_check_path" placeholder="/health" label="Path" required />
         </div>
         <div class="flex gap-2">
-            <x-forms.input type="number" id="resource.health_check_return_code" placeholder="200" label="Return Code"
+            <x-forms.input canGate="update" :canResource="$resource" type="number" id="resource.health_check_return_code" placeholder="200" label="Return Code"
                 required />
-            <x-forms.input id="resource.health_check_response_text" placeholder="OK" label="Response Text" />
+            <x-forms.input canGate="update" :canResource="$resource" id="resource.health_check_response_text" placeholder="OK" label="Response Text" />
         </div>
         <div class="flex gap-2">
-            <x-forms.input min="1" type="number" id="resource.health_check_interval" placeholder="30"
+            <x-forms.input canGate="update" :canResource="$resource" min="1" type="number" id="resource.health_check_interval" placeholder="30"
                 label="Interval (s)" required />
-            <x-forms.input type="number" id="resource.health_check_timeout" placeholder="30" label="Timeout (s)"
+            <x-forms.input canGate="update" :canResource="$resource" type="number" id="resource.health_check_timeout" placeholder="30" label="Timeout (s)"
                 required />
-            <x-forms.input type="number" id="resource.health_check_retries" placeholder="3" label="Retries" required />
-            <x-forms.input min=1 type="number" id="resource.health_check_start_period" placeholder="30"
+            <x-forms.input canGate="update" :canResource="$resource" type="number" id="resource.health_check_retries" placeholder="3" label="Retries" required />
+            <x-forms.input canGate="update" :canResource="$resource" min=1 type="number" id="resource.health_check_start_period" placeholder="30"
                 label="Start Period (s)" required />
         </div>
     </div>
-</form>
+</form>
\ No newline at end of file
diff --git a/resources/views/livewire/project/shared/resource-limits.blade.php b/resources/views/livewire/project/shared/resource-limits.blade.php
index 6c84335de..2aa2fd0af 100644
--- a/resources/views/livewire/project/shared/resource-limits.blade.php
+++ b/resources/views/livewire/project/shared/resource-limits.blade.php
@@ -2,40 +2,39 @@
     <form wire:submit='submit' class="flex flex-col">
         <div class="flex items-center gap-2 ">
             <h2>Resource Limits</h2>
-            <x-forms.button type='submit'>Save</x-forms.button>
+            <x-forms.button canGate="update" :canResource="$resource" type='submit'>Save</x-forms.button>
         </div>
         <div class="">Limit your container resources by CPU & memory.</div>
         <h3 class="pt-4">Limit CPUs</h3>
         <div class="flex gap-2">
-            <x-forms.input placeholder="1.5"
+            <x-forms.input canGate="update" :canResource="$resource" placeholder="1.5"
                 helper="0 means use all CPUs. Floating point number, like 0.002 or 1.5. More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/engine/reference/run/#cpu-share-constraint'>here</a>."
                 label="Number of CPUs" id="resource.limits_cpus" />
-            <x-forms.input placeholder="0-2"
+            <x-forms.input canGate="update" :canResource="$resource" placeholder="0-2"
                 helper="Empty means, use all CPU sets. 0-2 will use CPU 0, CPU 1 and CPU 2. More info <a class='underline dark:text-white'  target='_blank' href='https://docs.docker.com/engine/reference/run/#cpu-share-constraint'>here</a>."
                 label="CPU sets to use" id="resource.limits_cpuset" />
-            <x-forms.input placeholder="1024"
+            <x-forms.input canGate="update" :canResource="$resource" placeholder="1024"
                 helper="More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/engine/reference/run/#cpu-share-constraint'>here</a>."
                 label="CPU Weight" id="resource.limits_cpu_shares" />
         </div>
         <h3 class="pt-4">Limit Memory</h3>
         <div class="flex flex-col gap-2">
             <div class="flex gap-2">
-                <x-forms.input
+                <x-forms.input canGate="update" :canResource="$resource"
                     helper="Examples: 69b (byte) or 420k (kilobyte) or 1337m (megabyte) or 1g (gigabyte).<br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#mem_reservation'>here</a>."
                     label="Soft Memory Limit" id="resource.limits_memory_reservation" />
-                <x-forms.input
+                <x-forms.input canGate="update" :canResource="$resource"
                     helper="0-100.<br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#mem_swappiness'>here</a>."
                     type="number" min="0" max="100" label="Swappiness"
                     id="resource.limits_memory_swappiness" />
             </div>
             <div class="flex gap-2">
-                <x-forms.input
+                <x-forms.input canGate="update" :canResource="$resource"
                     helper="Examples: 69b (byte) or 420k (kilobyte) or 1337m (megabyte) or 1g (gigabyte).<br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#mem_limit'>here</a>."
                     label="Maximum Memory Limit" id="resource.limits_memory" />
-                <x-forms.input
+                <x-forms.input canGate="update" :canResource="$resource"
                     helper="Examples:69b (byte) or 420k (kilobyte) or 1337m (megabyte) or 1g (gigabyte).<br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#memswap_limit'>here</a>."
                     label="Maximum Swap Limit" id="resource.limits_memory_swap" />
-
             </div>
         </div>
     </form>
diff --git a/resources/views/livewire/project/shared/resource-operations.blade.php b/resources/views/livewire/project/shared/resource-operations.blade.php
index f23c6eb4e..aa8f536ce 100644
--- a/resources/views/livewire/project/shared/resource-operations.blade.php
+++ b/resources/views/livewire/project/shared/resource-operations.blade.php
@@ -1,30 +1,41 @@
 <div>
     <h2>Resource Operations</h2>
     <div>You can easily make different kind of operations on this resource.</div>
-    <h3>Clone</h3>
+    <h3 class="pt-4">Clone</h3>
     <div class="pb-4">To another project / environment on a different / same server.</div>
     <div class="pb-4">
         <div class="flex flex-col flex-wrap gap-2">
-            @foreach ($servers->sortBy('id') as $server)
-                <h5>Server: <span class="font-bold text-dark dark:text-white">{{ $server->name }}</span></h5>
-                @foreach ($server->destinations() as $destination)
-                    <x-modal-confirmation title="Clone Resource?" buttonTitle="Clone Resource"
-                        submitAction="cloneTo({{ data_get($destination, 'id') }})" :actions="[
-                            'All containers of this resource will be duplicated and cloned to the selected destination.',
-                        ]" :confirmWithText="false"
-                        :confirmWithPassword="false" step2ButtonText="Clone Resource" dispatchEvent="true" dispatchEventType="success"
-                        dispatchEventMessage="Resource cloned to {{ $destination->name }} destination.">
-                        <x:slot name="content">
-                            <div class="box group">
-                                <div class="flex flex-col">
-                                    <div class="box-title">Network</div>
-                                    <div class="box-description">{{ $destination->name }}</div>
+            @can('update', $resource)
+                @foreach ($servers->sortBy('id') as $server)
+                    <h5>Server: <span class="font-bold text-dark dark:text-white">{{ $server->name }}</span></h5>
+                    @foreach ($server->destinations() as $destination)
+                        <x-modal-confirmation title="Clone Resource?" buttonTitle="Clone Resource"
+                            submitAction="cloneTo({{ data_get($destination, 'id') }})" :actions="[
+                                'All containers of this resource will be duplicated and cloned to the selected destination.',
+                            ]" :confirmWithText="false"
+                            :confirmWithPassword="false" step2ButtonText="Clone Resource" dispatchEvent="true"
+                            dispatchEventType="success"
+                            dispatchEventMessage="Resource cloned to {{ $destination->name }} destination.">
+                            <x:slot name="content">
+                                <div class="box group">
+                                    <div class="flex flex-col">
+                                        <div class="box-title">Network</div>
+                                        <div class="box-description">{{ $destination->name }}</div>
+                                    </div>
                                 </div>
-                            </div>
-                        </x:slot>
-                    </x-modal-confirmation>
+                            </x:slot>
+                        </x-modal-confirmation>
+                    @endforeach
                 @endforeach
-            @endforeach
+            @else
+                <div
+                    class="p-4 bg-yellow-50 dark:bg-yellow-900/20 border border-yellow-200 dark:border-yellow-700 rounded-lg">
+                    <div class="text-yellow-800 dark:text-yellow-200">
+                        <strong>Access Restricted:</strong> You don't have permission to clone resources. Contact your team
+                        administrator to request access.
+                    </div>
+                </div>
+            @endcan
         </div>
     </div>
     <h3>Move</h3>
@@ -36,28 +47,38 @@ class="font-bold dark:text-warning">{{ $resource->environment->project->name }}
                 {{ $resource->environment->name }}</span> environment.
         </div>
         <div class="flex flex-col flex-wrap gap-2">
-            @forelse ($projects as $project)
-                <h5>Project: <span class="font-bold text-dark dark:text-white">{{ $project->name }}</span></h5>
+            @can('update', $resource)
+                @forelse ($projects as $project)
+                    <h5>Project: <span class="font-bold text-dark dark:text-white">{{ $project->name }}</span></h5>
 
-                @foreach ($project->environments as $environment)
-                    <x-modal-confirmation title="Move Resource?" buttonTitle="Move Resource"
-                        submitAction="moveTo({{ data_get($environment, 'id') }})" :actions="['All containers of this resource will be moved to the selected environment.']" :confirmWithText="false"
-                        :confirmWithPassword="false" step2ButtonText="Move Resource" dispatchEvent="true"
-                        dispatchEventType="success"
-                        dispatchEventMessage="Resource moved to {{ $environment->name }} environment.">
-                        <x:slot:content>
-                            <div class="box group">
-                                <div class="flex flex-col">
-                                    <div class="box-title">Environment</div>
-                                    <div class="box-description">{{ $environment->name }}</div>
+                    @foreach ($project->environments as $environment)
+                        <x-modal-confirmation title="Move Resource?" buttonTitle="Move Resource"
+                            submitAction="moveTo({{ data_get($environment, 'id') }})" :actions="['All containers of this resource will be moved to the selected environment.']" :confirmWithText="false"
+                            :confirmWithPassword="false" step2ButtonText="Move Resource" dispatchEvent="true"
+                            dispatchEventType="success"
+                            dispatchEventMessage="Resource moved to {{ $environment->name }} environment.">
+                            <x:slot:content>
+                                <div class="box group">
+                                    <div class="flex flex-col">
+                                        <div class="box-title">Environment</div>
+                                        <div class="box-description">{{ $environment->name }}</div>
+                                    </div>
                                 </div>
-                            </div>
-                            </x:slot>
-                    </x-modal-confirmation>
-                @endforeach
-            @empty
-                <div>No projects found to move to</div>
-            @endforelse
+                                </x:slot>
+                        </x-modal-confirmation>
+                    @endforeach
+                @empty
+                    <div>No projects found to move to</div>
+                @endforelse
+            @else
+                <div
+                    class="p-4 bg-yellow-50 dark:bg-yellow-900/20 border border-yellow-200 dark:border-yellow-700 rounded-lg">
+                    <div class="text-yellow-800 dark:text-yellow-200">
+                        <strong>Access Restricted:</strong> You don't have permission to move resources between projects or
+                        environments. Contact your team administrator to request access.
+                    </div>
+                </div>
+            @endcan
         </div>
     </div>
 </div>
diff --git a/resources/views/livewire/project/shared/scheduled-task/all.blade.php b/resources/views/livewire/project/shared/scheduled-task/all.blade.php
index 8a2ec4d7a..fb6985094 100644
--- a/resources/views/livewire/project/shared/scheduled-task/all.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/all.blade.php
@@ -1,13 +1,15 @@
 <div>
     <div class="flex gap-2">
         <h2>Scheduled Tasks</h2>
-        <x-modal-input buttonTitle="+ Add" title="New Scheduled Task" :closeOutside="false">
-            @if ($resource->type() == 'application')
-                <livewire:project.shared.scheduled-task.add :type="$resource->type()" :id="$resource->id" :containerNames="$containerNames" />
-            @elseif ($resource->type() == 'service')
-                <livewire:project.shared.scheduled-task.add :type="$resource->type()" :id="$resource->id" :containerNames="$containerNames" />
-            @endif
-        </x-modal-input>
+        @can('update', $resource)
+            <x-modal-input buttonTitle="+ Add" title="New Scheduled Task" :closeOutside="false">
+                @if ($resource->type() == 'application')
+                    <livewire:project.shared.scheduled-task.add :type="$resource->type()" :id="$resource->id" :containerNames="$containerNames" />
+                @elseif ($resource->type() == 'service')
+                    <livewire:project.shared.scheduled-task.add :type="$resource->type()" :id="$resource->id" :containerNames="$containerNames" />
+                @endif
+            </x-modal-input>
+        @endcan
     </div>
     <div class="flex flex-col flex-wrap gap-2 pt-4">
         @forelse($resource->scheduled_tasks as $task)
diff --git a/resources/views/livewire/project/shared/storages/all.blade.php b/resources/views/livewire/project/shared/storages/all.blade.php
index e357b4f94..f7bd7bdce 100644
--- a/resources/views/livewire/project/shared/storages/all.blade.php
+++ b/resources/views/livewire/project/shared/storages/all.blade.php
@@ -3,10 +3,10 @@
         @foreach ($resource->persistentStorages as $storage)
             @if ($resource->type() === 'service')
                 <livewire:project.shared.storages.show wire:key="storage-{{ $storage->id }}" :storage="$storage"
-                    :isFirst="$loop->first" isReadOnly='true' isService='true' />
+                    :resource="$resource" :isFirst="$loop->first" isReadOnly='true' isService='true' />
             @else
                 <livewire:project.shared.storages.show wire:key="storage-{{ $storage->id }}" :storage="$storage"
-                    isReadOnly="{{ data_get($storage, 'is_readonly') }}"
+                    :resource="$resource" isReadOnly="{{ data_get($storage, 'is_readonly') }}"
                     startedAt="{{ data_get($resource, 'started_at') }}" />
             @endif
         @endforeach
diff --git a/resources/views/livewire/project/shared/storages/show.blade.php b/resources/views/livewire/project/shared/storages/show.blade.php
index 4ad5636ec..569df0c4b 100644
--- a/resources/views/livewire/project/shared/storages/show.blade.php
+++ b/resources/views/livewire/project/shared/storages/show.blade.php
@@ -9,7 +9,7 @@
                         <x-forms.input id="storage.name" label="Volume Name" required readonly
                             helper="Warning: Changing the volume name after the initial start could cause problems. Only use it when you know what are you doing." />
                     @else
-                        <x-forms.input id="storage.name" label="Volume Name" required
+                        <x-forms.input id="storage.name" label="Volume Name" required readonly
                             helper="Warning: Changing the volume name after the initial start could cause problems. Only use it when you know what are you doing." />
                     @endif
                     @if ($isService || $startedAt)
@@ -19,13 +19,11 @@
                         <x-forms.input id="storage.mount_path" label="Destination Path"
                             helper="Directory inside the container." required readonly />
                     @else
-                        <x-forms.input id="storage.host_path" helper="Directory on the host system." label="Source Path"
+                        <x-forms.input id="storage.host_path" readonly helper="Directory on the host system."
+                            label="Source Path"
                             helper="Warning: Changing the source path after the initial start could cause problems. Only use it when you know what are you doing." />
                         <x-forms.input id="storage.mount_path" label="Destination Path"
                             helper="Directory inside the container." required readonly />
-                        <x-forms.button type="submit">
-                            Update
-                        </x-forms.button>
                     @endif
                 </div>
             @else
@@ -36,32 +34,50 @@
                 </div>
             @endif
         @else
-            @if ($isFirst)
-                <div class="flex gap-2 items-end w-full">
-                    <x-forms.input id="storage.name" label="Volume Name" required />
-                    <x-forms.input id="storage.host_path" helper="Directory on the host system." label="Source Path" />
-                    <x-forms.input id="storage.mount_path" label="Destination Path"
-                        helper="Directory inside the container." required />
+            @can('update', $resource)
+                @if ($isFirst)
+                    <div class="flex gap-2 items-end w-full">
+                        <x-forms.input id="storage.name" label="Volume Name" required />
+                        <x-forms.input id="storage.host_path" helper="Directory on the host system." label="Source Path" />
+                        <x-forms.input id="storage.mount_path" label="Destination Path"
+                            helper="Directory inside the container." required />
+                    </div>
+                @else
+                    <div class="flex gap-2 items-end w-full">
+                        <x-forms.input id="storage.name" required />
+                        <x-forms.input id="storage.host_path" />
+                        <x-forms.input id="storage.mount_path" required />
+                    </div>
+                @endif
+                <div class="flex gap-2">
+                    <x-forms.button type="submit">
+                        Update
+                    </x-forms.button>
+                    <x-modal-confirmation title="Confirm persistent storage deletion?" isErrorButton buttonTitle="Delete"
+                        submitAction="delete" :actions="[
+                            'The selected persistent storage/volume will be permanently deleted.',
+                            'If the persistent storage/volume is actvily used by a resource data will be lost.',
+                        ]" confirmationText="{{ $storage->name }}"
+                        confirmationLabel="Please confirm the execution of the actions by entering the Storage Name below"
+                        shortConfirmationLabel="Storage Name" />
                 </div>
             @else
-                <div class="flex gap-2 items-end w-full">
-                    <x-forms.input id="storage.name" required />
-                    <x-forms.input id="storage.host_path" />
-                    <x-forms.input id="storage.mount_path" required />
-                </div>
-            @endif
-            <div class="flex gap-2">
-                <x-forms.button type="submit">
-                    Update
-                </x-forms.button>
-                <x-modal-confirmation title="Confirm persistent storage deletion?" isErrorButton buttonTitle="Delete"
-                    submitAction="delete" :actions="[
-                        'The selected persistent storage/volume will be permanently deleted.',
-                        'If the persistent storage/volume is actvily used by a resource data will be lost.',
-                    ]" confirmationText="{{ $storage->name }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Storage Name below"
-                    shortConfirmationLabel="Storage Name" />
-            </div>
+                @if ($isFirst)
+                    <div class="flex gap-2 items-end w-full">
+                        <x-forms.input id="storage.name" label="Volume Name" required disabled />
+                        <x-forms.input id="storage.host_path" helper="Directory on the host system." label="Source Path"
+                            disabled />
+                        <x-forms.input id="storage.mount_path" label="Destination Path"
+                            helper="Directory inside the container." required disabled />
+                    </div>
+                @else
+                    <div class="flex gap-2 items-end w-full">
+                        <x-forms.input id="storage.name" required disabled />
+                        <x-forms.input id="storage.host_path" disabled />
+                        <x-forms.input id="storage.mount_path" required disabled />
+                    </div>
+                @endif
+            @endcan
         @endif
     </form>
 </div>
diff --git a/resources/views/livewire/project/shared/tags.blade.php b/resources/views/livewire/project/shared/tags.blade.php
index 4ceb475a6..2c75deab9 100644
--- a/resources/views/livewire/project/shared/tags.blade.php
+++ b/resources/views/livewire/project/shared/tags.blade.php
@@ -1,37 +1,50 @@
 <div>
     <h2>Tags</h2>
-    <form wire:submit='submit' class="flex items-end gap-2">
-        <div class="w-64">
-            <x-forms.input label="Create new or assign existing tags"
-                helper="You add more at once with space separated list: web api something<br><br>If the tag does not exists, it will be created."
-                wire:model="newTags" placeholder="example: prod app1 user" />
+    @can('update', $resource)
+        <form wire:submit='submit' class="flex items-end gap-2">
+            <div class="w-64">
+                <x-forms.input label="Create new or assign existing tags"
+                    helper="You add more at once with space separated list: web api something<br><br>If the tag does not exists, it will be created."
+                    wire:model="newTags" placeholder="example: prod app1 user" />
+            </div>
+            <x-forms.button type="submit">Add</x-forms.button>
+        </form>
+    @else
+        <div class="p-4 bg-yellow-50 dark:bg-yellow-900/20 border border-yellow-200 dark:border-yellow-700 rounded-lg mt-4">
+            <div class="text-yellow-800 dark:text-yellow-200">
+                <strong>Access Restricted:</strong> You don't have permission to manage tags. Contact your team
+                administrator to request access.
+            </div>
         </div>
-        <x-forms.button type="submit">Add</x-forms.button>
-    </form>
+    @endcan
     @if (data_get($this->resource, 'tags') && count(data_get($this->resource, 'tags')) > 0)
         <h3 class="pt-4">Assigned Tags</h3>
         <div class="flex flex-wrap gap-2 pt-4">
             @foreach (data_get($this->resource, 'tags') as $tagId => $tag)
                 <div class="button">
                     {{ $tag->name }}
-                    <svg wire:click="deleteTag('{{ $tag->id }}')" xmlns="http://www.w3.org/2000/svg" fill="none"
-                        viewBox="0 0 24 24"
-                        class="inline-block w-3 h-3 rounded-sm cursor-pointer stroke-current hover:bg-red-500">
-                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12">
-                        </path>
-                    </svg>
+                    @can('update', $resource)
+                        <svg wire:click="deleteTag('{{ $tag->id }}')" xmlns="http://www.w3.org/2000/svg" fill="none"
+                            viewBox="0 0 24 24"
+                            class="inline-block w-3 h-3 rounded-sm cursor-pointer stroke-current hover:bg-red-500">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12">
+                            </path>
+                        </svg>
+                    @endcan
                 </div>
             @endforeach
         </div>
     @endif
-    @if (count($filteredTags) > 0)
-        <h3 class="pt-4">Existing Tags</h3>
-        <div>Click to add quickly</div>
-        <div class="flex flex-wrap gap-2 pt-4">
-            @foreach ($filteredTags as $tag)
-                <x-forms.button wire:click="addTag('{{ $tag->id }}','{{ $tag->name }}')">
-                    {{ $tag->name }}</x-forms.button>
-            @endforeach
-        </div>
-    @endif
+    @can('update', $resource)
+        @if (count($filteredTags) > 0)
+            <h3 class="pt-4">Existing Tags</h3>
+            <div>Click to add quickly</div>
+            <div class="flex flex-wrap gap-2 pt-4">
+                @foreach ($filteredTags as $tag)
+                    <x-forms.button wire:click="addTag('{{ $tag->id }}','{{ $tag->name }}')">
+                        {{ $tag->name }}</x-forms.button>
+                @endforeach
+            </div>
+        @endif
+    @endcan
 </div>
diff --git a/resources/views/livewire/project/shared/webhooks.blade.php b/resources/views/livewire/project/shared/webhooks.blade.php
index 64a2ece51..f3403a402 100644
--- a/resources/views/livewire/project/shared/webhooks.blade.php
+++ b/resources/views/livewire/project/shared/webhooks.blade.php
@@ -17,10 +17,15 @@
                     <div class="flex items-end gap-2">
                         <x-forms.input helper="Content Type in GitHub configuration could be json or form-urlencoded."
                             readonly label="GitHub" id="githubManualWebhook"></x-forms.input>
-                        <x-forms.input type="password"
-                            helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitHub."
-                            label="GitHub Webhook Secret" id="githubManualWebhookSecret"></x-forms.input>
-
+                        @can('update', $resource)
+                            <x-forms.input type="password"
+                                helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitHub."
+                                label="GitHub Webhook Secret" id="githubManualWebhookSecret"></x-forms.input>
+                        @else
+                            <x-forms.input disabled type="password"
+                                helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitHub."
+                                label="GitHub Webhook Secret" id="githubManualWebhookSecret"></x-forms.input>
+                        @endcan
                     </div>
                     <a target="_blank" class="flex hover:no-underline" href="{{ $resource?->gitWebhook }}">
                         <x-forms.button>Webhook Configuration on GitHub
@@ -29,23 +34,43 @@
                     </a>
                     <div class="flex gap-2">
                         <x-forms.input readonly label="GitLab" id="gitlabManualWebhook"></x-forms.input>
-                        <x-forms.input type="password"
-                            helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitLab."
-                            label="GitLab Webhook Secret" id="gitlabManualWebhookSecret"></x-forms.input>
+                        @can('update', $resource)
+                            <x-forms.input type="password"
+                                helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitLab."
+                                label="GitLab Webhook Secret" id="gitlabManualWebhookSecret"></x-forms.input>
+                        @else
+                            <x-forms.input disabled type="password"
+                                helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitLab."
+                                label="GitLab Webhook Secret" id="gitlabManualWebhookSecret"></x-forms.input>
+                        @endcan
                     </div>
                     <div class="flex gap-2">
                         <x-forms.input readonly label="Bitbucket" id="bitbucketManualWebhook"></x-forms.input>
-                        <x-forms.input type="password"
-                            helper="Need to set a secret to be able to use this webhook. It should match with the secret in Bitbucket."
-                            label="Bitbucket Webhook Secret" id="bitbucketManualWebhookSecret"></x-forms.input>
+                        @can('update', $resource)
+                            <x-forms.input type="password"
+                                helper="Need to set a secret to be able to use this webhook. It should match with the secret in Bitbucket."
+                                label="Bitbucket Webhook Secret" id="bitbucketManualWebhookSecret"></x-forms.input>
+                        @else
+                            <x-forms.input disabled type="password"
+                                helper="Need to set a secret to be able to use this webhook. It should match with the secret in Bitbucket."
+                                label="Bitbucket Webhook Secret" id="bitbucketManualWebhookSecret"></x-forms.input>
+                        @endcan
                     </div>
                     <div class="flex gap-2">
                         <x-forms.input readonly label="Gitea" id="giteaManualWebhook"></x-forms.input>
-                        <x-forms.input type="password"
-                            helper="Need to set a secret to be able to use this webhook. It should match with the secret in Gitea."
-                            label="Gitea Webhook Secret" id="giteaManualWebhookSecret"></x-forms.input>
+                        @can('update', $resource)
+                            <x-forms.input type="password"
+                                helper="Need to set a secret to be able to use this webhook. It should match with the secret in Gitea."
+                                label="Gitea Webhook Secret" id="giteaManualWebhookSecret"></x-forms.input>
+                        @else
+                            <x-forms.input disabled type="password"
+                                helper="Need to set a secret to be able to use this webhook. It should match with the secret in Gitea."
+                                label="Gitea Webhook Secret" id="giteaManualWebhookSecret"></x-forms.input>
+                        @endcan
                     </div>
-                    <x-forms.button type="submit">Save</x-forms.button>
+                    @can('update', $resource)
+                        <x-forms.button type="submit">Save</x-forms.button>
+                    @endcan
                 </form>
             @else
                 You are using an official Git App. You do not need manual webhooks.
diff --git a/resources/views/livewire/project/show.blade.php b/resources/views/livewire/project/show.blade.php
index da653398b..3d034b8f3 100644
--- a/resources/views/livewire/project/show.blade.php
+++ b/resources/views/livewire/project/show.blade.php
@@ -4,21 +4,16 @@
     </x-slot>
     <div class="flex items-center gap-2">
         <h1>Environments</h1>
-        <x-modal-input buttonTitle="+ Add" title="New Environment">
-            <form class="flex flex-col w-full gap-2 rounded-sm" wire:submit='submit'>
-                <x-forms.input placeholder="production" id="name" label="Name" required />
-                @can('update', $project)
+        @can('update', $project)
+            <x-modal-input buttonTitle="+ Add" title="New Environment">
+                <form class="flex flex-col w-full gap-2 rounded-sm" wire:submit='submit'>
+                    <x-forms.input placeholder="production" id="name" label="Name" required />
                     <x-forms.button type="submit">
                         Save
                     </x-forms.button>
-                @else
-                    <x-forms.button type="submit" disabled
-                        title="You don't have permission to update this project. Contact your team administrator for access.">
-                        Save
-                    </x-forms.button>
-                @endcan
-            </form>
-        </x-modal-input>
+                </form>
+            </x-modal-input>
+        @endcan
         @can('delete', $project)
             <livewire:project.delete-project :disabled="!$project->isEmpty()" :project_id="$project->id" />
         @endcan
@@ -34,12 +29,14 @@
                         <div class="description">
                             {{ $environment->description }}</div>
                     </a>
-                    <div class="flex items-center justify-center gap-2 text-xs">
-                        <a class="font-bold hover:underline"
-                            href="{{ route('project.environment.edit', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}">
-                            Settings
-                        </a>
-                    </div>
+                    @can('update', $project)
+                        <div class="flex items-center justify-center gap-2 text-xs">
+                            <a class="font-bold hover:underline"
+                                href="{{ route('project.environment.edit', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid]) }}">
+                                Settings
+                            </a>
+                        </div>
+                    @endcan
                 </div>
             </div>
         @empty
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index eaf7a439d..bf6bcf76c 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -12,44 +12,58 @@
             <div>Tokens are created with the current team as scope.</div>
     </div>
     <h3>New Token</h3>
-    <form class="flex flex-col gap-2" wire:submit='addNewToken'>
-        <div class="flex gap-2 items-end w-96">
-            <x-forms.input required id="description" label="Description" />
-            <x-forms.button type="submit">Create</x-forms.button>
-        </div>
-        <div class="flex">
-            Permissions
-            <x-helper class="px-1" helper="These permissions will be granted to the token." /><span
-                class="pr-1">:</span>
-            <div class="flex gap-1 font-bold dark:text-white">
-                @if ($permissions)
-                    @foreach ($permissions as $permission)
-                        <div>{{ $permission }}</div>
-                    @endforeach
+    @can('create', App\Models\PersonalAccessToken::class)
+        <form class="flex flex-col gap-2" wire:submit='addNewToken'>
+            <div class="flex gap-2 items-end w-96">
+                <x-forms.input required id="description" label="Description" />
+                <x-forms.button type="submit">Create</x-forms.button>
+            </div>
+            <div class="flex">
+                Permissions
+                <x-helper class="px-1" helper="These permissions will be granted to the token." /><span
+                    class="pr-1">:</span>
+                <div class="flex gap-1 font-bold dark:text-white">
+                    @if ($permissions)
+                        @foreach ($permissions as $permission)
+                            <div>{{ $permission }}</div>
+                        @endforeach
+                    @endif
+                </div>
+            </div>
+
+            <h4>Token Permissions</h4>
+            <div class="w-64">
+                @if ($canUseRootPermissions)
+                    <x-forms.checkbox label="root" wire:model.live="permissions" domValue="root"
+                        helper="Root access, be careful!" :checked="in_array('root', $permissions)"></x-forms.checkbox>
+                @else
+                    <x-forms.checkbox label="root (admin/owner only)" disabled domValue="root"
+                        helper="Root access requires admin or owner role" :checked="false"></x-forms.checkbox>
+                @endif
+
+                @if (!in_array('root', $permissions))
+                    @if ($canUseWritePermissions)
+                        <x-forms.checkbox label="write" wire:model.live="permissions" domValue="write"
+                            helper="Write access to all resources." :checked="in_array('write', $permissions)"></x-forms.checkbox>
+                    @else
+                        <x-forms.checkbox label="write (admin/owner only)" disabled domValue="write"
+                            helper="Write access requires admin or owner role" :checked="false"></x-forms.checkbox>
+                    @endif
+
+                    <x-forms.checkbox label="deploy" wire:model.live="permissions" domValue="deploy"
+                        helper="Can trigger deploy webhooks." :checked="in_array('deploy', $permissions)"></x-forms.checkbox>
+                    <x-forms.checkbox label="read" domValue="read" wire:model.live="permissions" domValue="read"
+                        :checked="in_array('read', $permissions)"></x-forms.checkbox>
+                    <x-forms.checkbox label="read:sensitive" wire:model.live="permissions" domValue="read:sensitive"
+                        helper="Responses will include secrets, logs, passwords, and compose file contents."
+                        :checked="in_array('read:sensitive', $permissions)"></x-forms.checkbox>
                 @endif
             </div>
-        </div>
-
-        <h4>Token Permissions</h4>
-        <div class="w-64">
-            <x-forms.checkbox label="root" wire:model.live="permissions" domValue="root"
-                helper="Root access, be careful!" :checked="in_array('root', $permissions)"></x-forms.checkbox>
-            @if (!in_array('root', $permissions))
-                <x-forms.checkbox label="write" wire:model.live="permissions" domValue="write"
-                    helper="Write access to all resources." :checked="in_array('write', $permissions)"></x-forms.checkbox>
-                <x-forms.checkbox label="deploy" wire:model.live="permissions" domValue="deploy"
-                    helper="Can trigger deploy webhooks." :checked="in_array('deploy', $permissions)"></x-forms.checkbox>
-                <x-forms.checkbox label="read" domValue="read" wire:model.live="permissions" domValue="read"
-                    :checked="in_array('read', $permissions)"></x-forms.checkbox>
-                <x-forms.checkbox label="read:sensitive" wire:model.live="permissions" domValue="read:sensitive"
-                    helper="Responses will include secrets, logs, passwords, and compose file contents."
-                    :checked="in_array('read:sensitive', $permissions)"></x-forms.checkbox>
+            @if (in_array('root', $permissions))
+                <div class="font-bold dark:text-warning">Root access, be careful!</div>
             @endif
-        </div>
-        @if (in_array('root', $permissions))
-            <div class="font-bold dark:text-warning">Root access, be careful!</div>
-        @endif
-    </form>
+        </form>
+    @endcan
     @if (session()->has('token'))
         <div class="py-4 font-bold dark:text-warning">Please copy this token now. For your security, it won't be shown
             again.
@@ -72,15 +86,17 @@ class="flex flex-col gap-1 p-2 border dark:border-coolgray-200 hover:no-underlin
                     @endif
                 </div>
 
-                <x-modal-confirmation title="Confirm API Token Revocation?" isErrorButton buttonTitle="Revoke token"
-                    submitAction="revoke({{ data_get($token, 'id') }})" :actions="[
-                        'This API Token will be revoked and permanently deleted.',
-                        'Any API call made with this token will fail.',
-                    ]"
-                    confirmationText="{{ $token->name }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the API Token Description below"
-                    shortConfirmationLabel="API Token Description" :confirmWithPassword="false"
-                    step2ButtonText="Revoke API Token" />
+                @if (auth()->id() === $token->tokenable_id)
+                    <x-modal-confirmation title="Confirm API Token Revocation?" isErrorButton buttonTitle="Revoke token"
+                        submitAction="revoke({{ data_get($token, 'id') }})" :actions="[
+                            'This API Token will be revoked and permanently deleted.',
+                            'Any API call made with this token will fail.',
+                        ]"
+                        confirmationText="{{ $token->name }}"
+                        confirmationLabel="Please confirm the execution of the actions by entering the API Token Description below"
+                        shortConfirmationLabel="API Token Description" :confirmWithPassword="false"
+                        step2ButtonText="Revoke API Token" />
+                @endif
             </div>
         @empty
             <div>
diff --git a/resources/views/livewire/security/private-key/index.blade.php b/resources/views/livewire/security/private-key/index.blade.php
index f40b91f43..47cfc9b1e 100644
--- a/resources/views/livewire/security/private-key/index.blade.php
+++ b/resources/views/livewire/security/private-key/index.blade.php
@@ -2,11 +2,15 @@
     <x-security.navbar />
     <div class="flex gap-2">
         <h2 class="pb-4">Private Keys</h2>
-        <x-modal-input buttonTitle="+ Add" title="New Private Key">
-            <livewire:security.private-key.create />
-        </x-modal-input>
-        <x-modal-confirmation title="Confirm unused SSH Key Deletion?" buttonTitle="Delete unused SSH Keys" isErrorButton
-            submitAction="cleanupUnusedKeys" :actions="['All unused SSH keys (marked with unused) are permanently deleted.']" :confirmWithText="false" :confirmWithPassword="false" />
+        @can('create', App\Models\PrivateKey::class)
+            <x-modal-input buttonTitle="+ Add" title="New Private Key">
+                <livewire:security.private-key.create />
+            </x-modal-input>
+        @endcan
+        @can('create', App\Models\PrivateKey::class)
+            <x-modal-confirmation title="Confirm unused SSH Key Deletion?" buttonTitle="Delete unused SSH Keys" isErrorButton
+                submitAction="cleanupUnusedKeys" :actions="['All unused SSH keys (marked with unused) are permanently deleted.']" :confirmWithText="false" :confirmWithPassword="false" />
+        @endcan
     </div>
     <div class="grid gap-4 lg:grid-cols-2">
         @forelse ($privateKeys as $key)
diff --git a/resources/views/livewire/security/private-key/show.blade.php b/resources/views/livewire/security/private-key/show.blade.php
index c381b8f2a..8668cfd34 100644
--- a/resources/views/livewire/security/private-key/show.blade.php
+++ b/resources/views/livewire/security/private-key/show.blade.php
@@ -7,32 +7,34 @@
         <form class="flex flex-col" wire:submit='changePrivateKey'>
             <div class="flex items-start gap-2">
                 <h2 class="pb-4">Private Key</h2>
-                <x-forms.button type="submit">
+                <x-forms.button canGate="update" :canResource="$private_key" type="submit">
                     Save
                 </x-forms.button>
                 @if (data_get($private_key, 'id') > 0)
-                    <x-modal-confirmation title="Confirm Private Key Deletion?" isErrorButton buttonTitle="Delete"
-                        submitAction="delete({{ $private_key->id }})" :actions="[
-                            'This private key will be permanently deleted.',
-                            'All servers connected to this private key will stop working.',
-                            'Any git app using this private key will stop working.',
-                        ]"
-                        confirmationText="{{ $private_key->name }}"
-                        confirmationLabel="Please confirm the execution of the actions by entering the Private Key Name below"
-                        shortConfirmationLabel="Private Key Name" :confirmWithPassword="false"
-                        step2ButtonText="Delete Private Key" />
+                    @can('delete', $private_key)
+                        <x-modal-confirmation title="Confirm Private Key Deletion?" isErrorButton buttonTitle="Delete"
+                            submitAction="delete({{ $private_key->id }})" :actions="[
+                                'This private key will be permanently deleted.',
+                                'All servers connected to this private key will stop working.',
+                                'Any git app using this private key will stop working.',
+                            ]"
+                            confirmationText="{{ $private_key->name }}"
+                            confirmationLabel="Please confirm the execution of the actions by entering the Private Key Name below"
+                            shortConfirmationLabel="Private Key Name" :confirmWithPassword="false"
+                            step2ButtonText="Delete Private Key" />
+                    @endcan
                 @endif
             </div>
             <div class="flex flex-col gap-2">
                 <div class="flex gap-2">
-                    <x-forms.input id="private_key.name" label="Name" required />
-                    <x-forms.input id="private_key.description" label="Description" />
+                    <x-forms.input canGate="update" :canResource="$private_key" id="private_key.name" label="Name" required />
+                    <x-forms.input canGate="update" :canResource="$private_key" id="private_key.description" label="Description" />
                 </div>
                 <div>
                     <div class="flex items-end gap-2 py-2 ">
                         <div class="pl-1">Public Key</div>
                     </div>
-                    <x-forms.input readonly id="public_key" />
+                    <x-forms.input canGate="update" :canResource="$private_key" readonly id="public_key" />
                     <div class="flex items-end gap-2 py-2 ">
                         <div class="pl-1">Private Key <span class='text-helper'>*</span></div>
                         <div class="text-xs underline cursor-pointer dark:text-white" x-cloak x-show="!showPrivateKey"
@@ -50,11 +52,11 @@
                         </div>
                     @endif
                     <div x-cloak x-show="!showPrivateKey">
-                        <x-forms.input allowToPeak="false" type="password" rows="10" id="private_key.private_key"
+                        <x-forms.input canGate="update" :canResource="$private_key" allowToPeak="false" type="password" rows="10" id="private_key.private_key"
                             required disabled />
                     </div>
                     <div x-cloak x-show="showPrivateKey">
-                        <x-forms.textarea rows="10" id="private_key.private_key" required />
+                        <x-forms.textarea canGate="update" :canResource="$private_key" rows="10" id="private_key.private_key" required />
                     </div>
                 </div>
             </div>
diff --git a/resources/views/livewire/server/advanced.blade.php b/resources/views/livewire/server/advanced.blade.php
index 98ab15534..308a9eed2 100644
--- a/resources/views/livewire/server/advanced.blade.php
+++ b/resources/views/livewire/server/advanced.blade.php
@@ -9,7 +9,7 @@
             <div>
                 <div class="flex items-center gap-2">
                     <h2>Advanced</h2>
-                    <x-forms.button type="submit">Save</x-forms.button>
+                    <x-forms.button canGate="update" :canResource="$server" type="submit">Save</x-forms.button>
                 </div>
                 <div class="mb-4">Advanced configuration for your server.</div>
             </div>
@@ -59,10 +59,10 @@ class="px-2 py-1 text-xs font-semibold text-red-800 bg-red-100 rounded dark:text
             <div class="flex flex-col gap-6">
                 <div class="flex flex-col">
                     <div class="flex flex-wrap gap-2 sm:flex-nowrap pt-4">
-                        <x-forms.input placeholder="0 23 * * *" id="serverDiskUsageCheckFrequency"
-                            label="Disk usage check frequency" required
+                        <x-forms.input canGate="update" :canResource="$server" placeholder="0 23 * * *"
+                            id="serverDiskUsageCheckFrequency" label="Disk usage check frequency" required
                             helper="Cron expression for disk usage check frequency.<br>You can use every_minute, hourly, daily, weekly, monthly, yearly.<br><br>Default is every night at 11:00 PM." />
-                        <x-forms.input id="serverDiskUsageNotificationThreshold"
+                        <x-forms.input canGate="update" :canResource="$server" id="serverDiskUsageNotificationThreshold"
                             label="Server disk usage notification threshold (%)" required
                             helper="If the server disk usage exceeds this threshold, Coolify will send a notification to the team members." />
                     </div>
@@ -71,9 +71,11 @@ class="px-2 py-1 text-xs font-semibold text-red-800 bg-red-100 rounded dark:text
                 <div class="flex flex-col">
                     <h3>Builds</h3>
                     <div class="flex flex-wrap gap-2 sm:flex-nowrap pt-4">
-                        <x-forms.input id="concurrentBuilds" label="Number of concurrent builds" required
+                        <x-forms.input canGate="update" :canResource="$server" id="concurrentBuilds"
+                            label="Number of concurrent builds" required
                             helper="You can specify the number of simultaneous build processes/deployments that should run concurrently." />
-                        <x-forms.input id="dynamicTimeout" label="Deployment timeout (seconds)" required
+                        <x-forms.input canGate="update" :canResource="$server" id="dynamicTimeout"
+                            label="Deployment timeout (seconds)" required
                             helper="You can define the maximum duration for a deployment to run before timing it out." />
                     </div>
                 </div>
diff --git a/resources/views/livewire/server/ca-certificate/show.blade.php b/resources/views/livewire/server/ca-certificate/show.blade.php
index 66262614c..f11bd732e 100644
--- a/resources/views/livewire/server/ca-certificate/show.blade.php
+++ b/resources/views/livewire/server/ca-certificate/show.blade.php
@@ -8,28 +8,30 @@
         <div class="flex flex-col gap-4">
             <div class="flex items-center gap-2">
                 <h2>CA Certificate</h2>
-                <div class="flex gap-2">
-                    <x-modal-confirmation title="Confirm changing of CA Certificate?" buttonTitle="Save"
-                        submitAction="saveCaCertificate" :actions="[
-                            'This will overwrite the existing CA certificate at /data/coolify/ssl/coolify-ca.crt with your custom CA certificate.',
-                            'This will regenerate all SSL certificates for databases on this server and it will sign them with your custom CA.',
-                            'You must manually redeploy all your databases on this server so that they use the new SSL certificates singned with your new CA certificate.',
-                            'Because of caching, you probably also need to redeploy all your resources on this server that are using this CA certificate.',
-                        ]"
-                        confirmationText="/data/coolify/ssl/coolify-ca.crt" shortConfirmationLabel="CA Certificate Path"
-                        step3ButtonText="Save Certificate">
-                    </x-modal-confirmation>
-                    <x-modal-confirmation title="Confirm Regenerate Certificate?" buttonTitle="Regenerate "
-                        submitAction="regenerateCaCertificate" :actions="[
-                            'This will generate a new CA certificate at /data/coolify/ssl/coolify-ca.crt and replace the existing one.',
-                            'This will regenerate all SSL certificates for databases on this server and it will sign them with the new CA certificate.',
-                            'You must manually redeploy all your databases on this server so that they use the new SSL certificates singned with the new CA certificate.',
-                            'Because of caching, you probably also need to redeploy all your resources on this server that are using this CA certificate.',
-                        ]"
-                        confirmationText="/data/coolify/ssl/coolify-ca.crt" shortConfirmationLabel="CA Certificate Path"
-                        step3ButtonText="Regenerate Certificate">
-                    </x-modal-confirmation>
-                </div>
+                @can('update', $server)
+                    <div class="flex gap-2">
+                        <x-modal-confirmation title="Confirm changing of CA Certificate?" buttonTitle="Save"
+                            submitAction="saveCaCertificate" :actions="[
+                                'This will overwrite the existing CA certificate at /data/coolify/ssl/coolify-ca.crt with your custom CA certificate.',
+                                'This will regenerate all SSL certificates for databases on this server and it will sign them with your custom CA.',
+                                'You must manually redeploy all your databases on this server so that they use the new SSL certificates singned with your new CA certificate.',
+                                'Because of caching, you probably also need to redeploy all your resources on this server that are using this CA certificate.',
+                            ]"
+                            confirmationText="/data/coolify/ssl/coolify-ca.crt" shortConfirmationLabel="CA Certificate Path"
+                            step3ButtonText="Save Certificate">
+                        </x-modal-confirmation>
+                        <x-modal-confirmation title="Confirm Regenerate Certificate?" buttonTitle="Regenerate "
+                            submitAction="regenerateCaCertificate" :actions="[
+                                'This will generate a new CA certificate at /data/coolify/ssl/coolify-ca.crt and replace the existing one.',
+                                'This will regenerate all SSL certificates for databases on this server and it will sign them with the new CA certificate.',
+                                'You must manually redeploy all your databases on this server so that they use the new SSL certificates singned with the new CA certificate.',
+                                'Because of caching, you probably also need to redeploy all your resources on this server that are using this CA certificate.',
+                            ]"
+                            confirmationText="/data/coolify/ssl/coolify-ca.crt" shortConfirmationLabel="CA Certificate Path"
+                            step3ButtonText="Regenerate Certificate">
+                        </x-modal-confirmation>
+                    </div>
+                @endcan
             </div>
             <div class="space-y-4">
                 <div class="text-sm">
@@ -63,9 +65,11 @@
                             </span>
                         @endif
                     </div>
-                    <x-forms.button wire:click="toggleCertificate" type="button" class="py-1! px-2! text-sm">
-                        {{ $showCertificate ? 'Hide' : 'Show' }}
-                    </x-forms.button>
+                    @can('view', $server)
+                        <x-forms.button wire:click="toggleCertificate" type="button" class="py-1! px-2! text-sm">
+                            {{ $showCertificate ? 'Hide' : 'Show' }}
+                        </x-forms.button>
+                    @endcan
                 </div>
                 @if ($showCertificate)
                     <textarea class="w-full h-[370px] input" wire:model="certificateContent"
diff --git a/resources/views/livewire/server/cloudflare-tunnel.blade.php b/resources/views/livewire/server/cloudflare-tunnel.blade.php
index 05ba47204..ce1cb7e58 100644
--- a/resources/views/livewire/server/cloudflare-tunnel.blade.php
+++ b/resources/views/livewire/server/cloudflare-tunnel.blade.php
@@ -88,13 +88,20 @@ class="text-xs underline hover:text-yellow-600 dark:hover:text-yellow-200">Docs<
                                 <livewire:activity-monitor header="Logs" fullHeight />
                             </x-slot:content>
                         </x-slide-over>
-                        <form @submit.prevent="$wire.dispatch('automatedCloudflareConfig')"
-                            class="flex flex-col gap-2 w-full">
-                            <x-forms.input id="cloudflare_token" required label="Cloudflare Token" type="password" />
-                            <x-forms.input id="ssh_domain" label="Configured SSH Domain" required
-                                helper="The SSH domain you configured in Cloudflare. Make sure there is no protocol like http(s):// so you provide a FQDN not a URL. <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/cloudflare/tunnels/server-ssh' target='_blank'>Documentation</a>" />
-                            <x-forms.button type="submit" isHighlighted>Continue</x-forms.button>
-                        </form>
+                        @can('update', $server)
+                            <form @submit.prevent="$wire.dispatch('automatedCloudflareConfig')"
+                                class="flex flex-col gap-2 w-full">
+                                <x-forms.input id="cloudflare_token" required label="Cloudflare Token" type="password" />
+                                <x-forms.input id="ssh_domain" label="Configured SSH Domain" required
+                                    helper="The SSH domain you configured in Cloudflare. Make sure there is no protocol like http(s):// so you provide a FQDN not a URL. <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/cloudflare/tunnels/server-ssh' target='_blank'>Documentation</a>" />
+                                <x-forms.button type="submit" isHighlighted>Continue</x-forms.button>
+                            </form>
+                        @else
+                            <div
+                                class="p-4 mb-4 text-sm text-yellow-800 bg-yellow-100 rounded-sm dark:bg-yellow-900 dark:text-yellow-300">
+                                You don't have permission to configure Cloudflare Tunnel for this server.
+                            </div>
+                        @endcan
                     </div>
                     @script
                         <script>
@@ -111,14 +118,21 @@ class="flex flex-col gap-2 w-full">
             </div>
             <h3 class="pt-6 pb-2">Manual</h3>
             <div class="pl-2">
-                <x-modal-confirmation buttonFullWidth title="I manually configured Cloudflare Tunnel?"
-                    buttonTitle="I manually configured Cloudflare Tunnel" submitAction="manualCloudflareConfig"
-                    :actions="[
-                        'You set everything up manually, including in Cloudflare and on the server (cloudflared is running).',
-                        'If you missed something, the connection will not work.',
-                    ]" confirmationText="I manually configured Cloudflare Tunnel"
-                    confirmationLabel="Please type the confirmation text to confirm that you manually configured Cloudflare Tunnel."
-                    shortConfirmationLabel="Confirmation text" />
+                @can('update', $server)
+                    <x-modal-confirmation buttonFullWidth title="I manually configured Cloudflare Tunnel?"
+                        buttonTitle="I manually configured Cloudflare Tunnel" submitAction="manualCloudflareConfig"
+                        :actions="[
+                            'You set everything up manually, including in Cloudflare and on the server (cloudflared is running).',
+                            'If you missed something, the connection will not work.',
+                        ]" confirmationText="I manually configured Cloudflare Tunnel"
+                        confirmationLabel="Please type the confirmation text to confirm that you manually configured Cloudflare Tunnel."
+                        shortConfirmationLabel="Confirmation text" />
+                @else
+                    <div
+                        class="p-4 mb-4 text-sm text-yellow-800 bg-yellow-100 rounded-sm dark:bg-yellow-900 dark:text-yellow-300">
+                        You don't have permission to configure Cloudflare Tunnel for this server.
+                    </div>
+                @endcan
             </div>
             @endif
         </div>
diff --git a/resources/views/livewire/server/destinations.blade.php b/resources/views/livewire/server/destinations.blade.php
index d7d7e7641..86e0c7146 100644
--- a/resources/views/livewire/server/destinations.blade.php
+++ b/resources/views/livewire/server/destinations.blade.php
@@ -9,10 +9,12 @@
             @if ($server->isFunctional())
                 <div class="flex items-end gap-2">
                     <h2>Destinations</h2>
-                    <x-modal-input buttonTitle="+ Add" title="New Destination">
-                        <livewire:destination.new.docker :server_id="$server->id" />
-                    </x-modal-input>
-                    <x-forms.button isHighlighted wire:click='scan'>Scan for Destinations</x-forms.button>
+                    @can('update', $server)
+                        <x-modal-input buttonTitle="+ Add" title="New Destination">
+                            <livewire:destination.new.docker :server_id="$server->id" />
+                        </x-modal-input>
+                    @endcan
+                    <x-forms.button canGate="update" :canResource="$server" isHighlighted wire:click='scan'>Scan for Destinations</x-forms.button>
                 </div>
                 <div>Destinations are used to segregate resources by network.</div>
                 <h4 class="pt-4 pb-2">Available Destinations</h4>
@@ -34,7 +36,7 @@
                         <div class="flex flex-wrap gap-2 ">
                             @foreach ($networks as $network)
                                 <div class="min-w-fit">
-                                    <x-forms.button wire:click="add('{{ data_get($network, 'Name') }}')">Add
+                                    <x-forms.button canGate="update" :canResource="$server" wire:click="add('{{ data_get($network, 'Name') }}')">Add
                                         {{ data_get($network, 'Name') }}</x-forms.button>
                                 </div>
                             @endforeach
diff --git a/resources/views/livewire/server/docker-cleanup.blade.php b/resources/views/livewire/server/docker-cleanup.blade.php
index 2c000d327..04d133181 100644
--- a/resources/views/livewire/server/docker-cleanup.blade.php
+++ b/resources/views/livewire/server/docker-cleanup.blade.php
@@ -10,7 +10,7 @@
                 <div>
                     <div class="flex items-center gap-2">
                         <h2>Docker Cleanup</h2>
-                        <x-forms.button type="submit">Save</x-forms.button>
+                        <x-forms.button type="submit" canGate="update" :canResource="$server">Save</x-forms.button>
                     </div>
                     <div class="mt-3 mb-4">Configure Docker cleanup settings for your server.</div>
                 </div>
@@ -18,27 +18,30 @@
                 <div class="flex flex-col gap-2">
                     <div class="flex gap-4">
                         <h3>Docker Cleanup</h3>
-                        <x-modal-confirmation title="Confirm Docker Cleanup?" buttonTitle="Trigger Manual Cleanup"
-                            isHighlightedButton submitAction="manualCleanup" :actions="[
-                                'Permanently deletes all stopped containers managed by Coolify (as containers are non-persistent, no data will be lost)',
-                                'Permanently deletes all unused images',
-                                'Clears build cache',
-                                'Removes old versions of the Coolify helper image',
-                                'Optionally permanently deletes all unused volumes (if enabled in advanced options).',
-                                'Optionally permanently deletes all unused networks (if enabled in advanced options).',
-                            ]" :confirmWithText="false"
-                            :confirmWithPassword="false" step2ButtonText="Trigger Docker Cleanup" />
+                        @can('update', $server)
+                            <x-modal-confirmation title="Confirm Docker Cleanup?" buttonTitle="Trigger Manual Cleanup"
+                                isHighlightedButton submitAction="manualCleanup" :actions="[
+                                    'Permanently deletes all stopped containers managed by Coolify (as containers are non-persistent, no data will be lost)',
+                                    'Permanently deletes all unused images',
+                                    'Clears build cache',
+                                    'Removes old versions of the Coolify helper image',
+                                    'Optionally permanently deletes all unused volumes (if enabled in advanced options).',
+                                    'Optionally permanently deletes all unused networks (if enabled in advanced options).',
+                                ]" :confirmWithText="false"
+                                :confirmWithPassword="false" step2ButtonText="Trigger Docker Cleanup" />
+                        @endcan
                     </div>
                     <div class="flex flex-wrap items-center gap-4">
-                        <x-forms.input placeholder="*/10 * * * *" id="dockerCleanupFrequency"
-                            label="Docker cleanup frequency" required
+                        <x-forms.input canGate="update" :canResource="$server" placeholder="*/10 * * * *"
+                            id="dockerCleanupFrequency" label="Docker cleanup frequency" required
                             helper="Cron expression for Docker Cleanup.<br>You can use every_minute, hourly, daily, weekly, monthly, yearly.<br><br>Default is every night at midnight." />
                         @if (!$forceDockerCleanup)
-                            <x-forms.input id="dockerCleanupThreshold" label="Docker cleanup threshold (%)" required
+                            <x-forms.input canGate="update" :canResource="$server" id="dockerCleanupThreshold"
+                                label="Docker cleanup threshold (%)" required
                                 helper="The Docker cleanup tasks will run when the disk usage exceeds this threshold." />
                         @endif
                         <div class="w-96">
-                            <x-forms.checkbox
+                            <x-forms.checkbox canGate="update" :canResource="$server"
                                 helper="Enabling Force Docker Cleanup or manually triggering a cleanup will perform the following actions:
                         <ul class='list-disc pl-4 mt-2'>
                             <li>Removes stopped containers managed by Coolify (as containers are none persistent, no data will be lost).</li>
@@ -58,14 +61,16 @@
                         functional issues.
                     </p>
                     <div class="w-96">
-                        <x-forms.checkbox instantSave id="deleteUnusedVolumes" label="Delete Unused Volumes"
+                        <x-forms.checkbox canGate="update" :canResource="$server" instantSave id="deleteUnusedVolumes"
+                            label="Delete Unused Volumes"
                             helper="This option will remove all unused Docker volumes during cleanup.<br><br><strong>Warning: Data form stopped containers will be lost!</strong><br><br>Consequences include:<br>
                     <ul class='list-disc pl-4 mt-2'>
                     <li>Volumes not attached to running containers will be deleted and data will be permanently lost (stopped containers are affected).</li>
                     <li>Data from stopped containers volumes will be permanently lost.</li>
                     <li>No way to recover deleted volume data.</li>
                     </ul>" />
-                        <x-forms.checkbox instantSave id="deleteUnusedNetworks" label="Delete Unused Networks"
+                        <x-forms.checkbox canGate="update" :canResource="$server" instantSave id="deleteUnusedNetworks"
+                            label="Delete Unused Networks"
                             helper="This option will remove all unused Docker networks during cleanup.<br><br><strong>Warning: Functionality may be lost and containers may not be able to communicate with each other!</strong><br><br>Consequences include:<br>
                     <ul class='list-disc pl-4 mt-2'>
                     <li>Networks not attached to running containers will be permanently deleted (stopped containers are affected).</li>
diff --git a/resources/views/livewire/server/index.blade.php b/resources/views/livewire/server/index.blade.php
index 7a43256e3..c244b3d40 100644
--- a/resources/views/livewire/server/index.blade.php
+++ b/resources/views/livewire/server/index.blade.php
@@ -4,9 +4,11 @@
     </x-slot>
     <div class="flex items-center gap-2">
         <h1>Servers</h1>
-        <x-modal-input buttonTitle="+ Add" title="New Server" :closeOutside="false">
-            <livewire:server.create />
-        </x-modal-input>
+        @can('createAnyResource')
+            <x-modal-input buttonTitle="+ Add" title="New Server" :closeOutside="false">
+                <livewire:server.create />
+            </x-modal-input>
+        @endcan
     </div>
     <div class="subtitle">All your servers are here.</div>
     <div class="grid gap-4 lg:grid-cols-2">
diff --git a/resources/views/livewire/server/log-drains.blade.php b/resources/views/livewire/server/log-drains.blade.php
index 080c0928b..afc963c28 100644
--- a/resources/views/livewire/server/log-drains.blade.php
+++ b/resources/views/livewire/server/log-drains.blade.php
@@ -20,7 +20,8 @@
                                 @if ($isLogDrainAxiomEnabled || $isLogDrainCustomEnabled)
                                     <x-forms.checkbox disabled id="isLogDrainNewRelicEnabled" label="Enabled" />
                                 @else
-                                    <x-forms.checkbox instantSave id="isLogDrainNewRelicEnabled" label="Enabled" />
+                                    <x-forms.checkbox instantSave canGate="update" :canResource="$server"
+                                        id="isLogDrainNewRelicEnabled" label="Enabled" />
                                 @endif
                             </div>
                             <div class="flex flex-col gap-4">
@@ -33,9 +34,10 @@
                                             helper="For EU use: https://log-api.eu.newrelic.com/log/v1<br>For US use: https://log-api.newrelic.com/log/v1"
                                             label="Endpoint" />
                                     @else
-                                        <x-forms.input type="password" required id="logDrainNewRelicLicenseKey"
-                                            label="License Key" />
-                                        <x-forms.input required id="logDrainNewRelicBaseUri"
+                                        <x-forms.input canGate="update" :canResource="$server" type="password" required
+                                            id="logDrainNewRelicLicenseKey" label="License Key" />
+                                        <x-forms.input canGate="update" :canResource="$server" required
+                                            id="logDrainNewRelicBaseUri"
                                             placeholder="https://log-api.eu.newrelic.com/log/v1"
                                             helper="For EU use: https://log-api.eu.newrelic.com/log/v1<br>For US use: https://log-api.newrelic.com/log/v1"
                                             label="Endpoint" />
@@ -43,7 +45,7 @@
                                 </div>
                             </div>
                             <div class="flex justify-end gap-4 pt-6">
-                                <x-forms.button type="submit">
+                                <x-forms.button canGate="update" :canResource="$server" type="submit">
                                     Save
                                 </x-forms.button>
                             </div>
@@ -54,7 +56,8 @@
                             @if ($isLogDrainNewRelicEnabled || $isLogDrainCustomEnabled)
                                 <x-forms.checkbox disabled id="isLogDrainAxiomEnabled" label="Enabled" />
                             @else
-                                <x-forms.checkbox instantSave id="isLogDrainAxiomEnabled" label="Enabled" />
+                                <x-forms.checkbox instantSave canGate="update" :canResource="$server"
+                                    id="isLogDrainAxiomEnabled" label="Enabled" />
                             @endif
                         </div>
                         <form wire:submit='submit("axiom")' class="flex flex-col">
@@ -66,14 +69,15 @@
                                         <x-forms.input disabled required id="logDrainAxiomDatasetName"
                                             label="Dataset Name" />
                                     @else
-                                        <x-forms.input type="password" required id="logDrainAxiomApiKey"
-                                            label="API Key" />
-                                        <x-forms.input required id="logDrainAxiomDatasetName" label="Dataset Name" />
+                                        <x-forms.input canGate="update" :canResource="$server" type="password" required
+                                            id="logDrainAxiomApiKey" label="API Key" />
+                                        <x-forms.input canGate="update" :canResource="$server" required
+                                            id="logDrainAxiomDatasetName" label="Dataset Name" />
                                     @endif
                                 </div>
                             </div>
                             <div class="flex justify-end gap-4 pt-6">
-                                <x-forms.button type="submit">
+                                <x-forms.button canGate="update" :canResource="$server" type="submit">
                                     Save
                                 </x-forms.button>
                             </div>
@@ -83,7 +87,8 @@
                             @if ($isLogDrainNewRelicEnabled || $isLogDrainAxiomEnabled)
                                 <x-forms.checkbox disabled id="isLogDrainCustomEnabled" label="Enabled" />
                             @else
-                                <x-forms.checkbox instantSave id="isLogDrainCustomEnabled" label="Enabled" />
+                                <x-forms.checkbox instantSave canGate="update" :canResource="$server"
+                                    id="isLogDrainCustomEnabled" label="Enabled" />
                             @endif
                         </div>
                         <form wire:submit='submit("custom")' class="flex flex-col">
@@ -94,15 +99,15 @@
                                     <x-forms.textarea disabled id="logDrainCustomConfigParser"
                                         label="Custom Parser Configuration" />
                                 @else
-                                    <x-forms.textarea rows="6" required id="logDrainCustomConfig"
-                                        label="Custom FluentBit Configuration" />
-                                    <x-forms.textarea id="logDrainCustomConfigParser"
-                                        label="Custom Parser Configuration" />
+                                    <x-forms.textarea canGate="update" :canResource="$server" rows="6" required
+                                        id="logDrainCustomConfig" label="Custom FluentBit Configuration" />
+                                    <x-forms.textarea canGate="update" :canResource="$server"
+                                        id="logDrainCustomConfigParser" label="Custom Parser Configuration" />
                                 @endif
 
                             </div>
                             <div class="flex justify-end gap-4 pt-6">
-                                <x-forms.button type="submit">
+                                <x-forms.button canGate="update" :canResource="$server" type="submit">
                                     Save
                                 </x-forms.button>
                             </div>
diff --git a/resources/views/livewire/server/navbar.blade.php b/resources/views/livewire/server/navbar.blade.php
index 40d5d1c73..74d228fa5 100644
--- a/resources/views/livewire/server/navbar.blade.php
+++ b/resources/views/livewire/server/navbar.blade.php
@@ -77,18 +77,22 @@ class="flex items-center gap-6 overflow-x-scroll sm:overflow-x-hidden scrollbar
                 ]) }}">
                 Resources
             </a>
-            <a class="{{ request()->routeIs('server.command') ? 'dark:text-white' : '' }}"
-                href="{{ route('server.command', [
-                    'server_uuid' => data_get($server, 'uuid'),
-                ]) }}">
-                Terminal
-            </a>
-            <a class="{{ request()->routeIs('server.security.patches') ? 'dark:text-white' : '' }}"
-                href="{{ route('server.security.patches', [
-                    'server_uuid' => data_get($server, 'uuid'),
-                ]) }}">
-                Security
-            </a>
+            @can('canAccessTerminal')
+                <a class="{{ request()->routeIs('server.command') ? 'dark:text-white' : '' }}"
+                    href="{{ route('server.command', [
+                        'server_uuid' => data_get($server, 'uuid'),
+                    ]) }}">
+                    Terminal
+                </a>
+            @endcan
+            @can('update', $server)
+                <a class="{{ request()->routeIs('server.security.patches') ? 'dark:text-white' : '' }}"
+                    href="{{ route('server.security.patches', [
+                        'server_uuid' => data_get($server, 'uuid'),
+                    ]) }}">
+                    Security
+                </a>
+            @endcan
         </nav>
         <div class="order-first sm:order-last">
             <div>
diff --git a/resources/views/livewire/server/private-key/show.blade.php b/resources/views/livewire/server/private-key/show.blade.php
index f8022ccd9..1703e3bc9 100644
--- a/resources/views/livewire/server/private-key/show.blade.php
+++ b/resources/views/livewire/server/private-key/show.blade.php
@@ -8,10 +8,12 @@
         <div class="w-full">
             <div class="flex items-end gap-2">
                 <h2>Private Key</h2>
-                <x-modal-input buttonTitle="+ Add" title="New Private Key">
-                    <livewire:security.private-key.create />
-                </x-modal-input>
-                <x-forms.button isHighlighted wire:click.prevent='checkConnection'>
+                @can('createAnyResource')
+                    <x-modal-input buttonTitle="+ Add" title="New Private Key">
+                        <livewire:security.private-key.create />
+                    </x-modal-input>
+                @endcan
+                <x-forms.button canGate="update" :canResource="$server" isHighlighted wire:click.prevent='checkConnection'>
                     Check connection
                 </x-forms.button>
             </div>
@@ -25,7 +27,7 @@ class="box-without-bg justify-between dark:bg-coolgray-100 bg-white items-center
                             <div class="box-description">{{ $private_key->description }}</div>
                         </div>
                         @if (data_get($server, 'privateKey.uuid') !== $private_key->uuid)
-                            <x-forms.button class="w-full" wire:click='setPrivateKey({{ $private_key->id }})'>
+                            <x-forms.button canGate="update" :canResource="$server" class="w-full" wire:click='setPrivateKey({{ $private_key->id }})'>
                                 Use this key
                             </x-forms.button>
                         @else
diff --git a/resources/views/livewire/server/proxy.blade.php b/resources/views/livewire/server/proxy.blade.php
index 76fbd09b7..506b05e87 100644
--- a/resources/views/livewire/server/proxy.blade.php
+++ b/resources/views/livewire/server/proxy.blade.php
@@ -7,12 +7,11 @@
                     <div class="flex items-center gap-2">
                         <h2>Configuration</h2>
                         @if ($server->proxy->status === 'exited' || $server->proxy->status === 'removing')
-                            <x-forms.button wire:click.prevent="changeProxy">Switch Proxy</x-forms.button>
+                            <x-forms.button canGate="update" :canResource="$server" wire:click.prevent="changeProxy">Switch Proxy</x-forms.button>
                         @else
-                            <x-forms.button disabled wire:click.prevent="changeProxy">Switch Proxy</x-forms.button>
+                            <x-forms.button canGate="update" :canResource="$server" disabled wire:click.prevent="changeProxy">Switch Proxy</x-forms.button>
                         @endif
-                        <x-forms.button type="submit">Save</x-forms.button>
-
+                        <x-forms.button canGate="update" :canResource="$server" type="submit">Save</x-forms.button>
                     </div>
                     <div class="pb-4 "> <svg class="inline-flex w-6 h-6 mr-2 dark:text-warning" viewBox="0 0 256 256"
                             xmlns="http://www.w3.org/2000/svg">
@@ -23,16 +22,16 @@
                     </div>
                     <h3>Advanced</h3>
                     <div class="pb-4 w-96">
-                        <x-forms.checkbox
+                        <x-forms.checkbox canGate="update" :canResource="$server"
                             helper="If set, all resources will only have docker container labels for {{ str($server->proxyType())->title() }}.<br>For applications, labels needs to be regenerated manually. <br>Resources needs to be restarted."
                             id="server.settings.generate_exact_labels"
                             label="Generate labels only for {{ str($server->proxyType())->title() }}" instantSave />
-                        <x-forms.checkbox instantSave="instantSaveRedirect" id="redirect_enabled"
-                            label="Override default request handler"
+                        <x-forms.checkbox canGate="update" :canResource="$server" instantSave="instantSaveRedirect"
+                            id="redirect_enabled" label="Override default request handler"
                             helper="Requests to unknown hosts or stopped services will receive a 503 response or be redirected to the URL you set below (need to enable this first)." />
                         @if ($redirect_enabled)
-                            <x-forms.input placeholder="https://app.coolify.io" id="redirect_url"
-                                label="Redirect to (optional)" />
+                            <x-forms.input canGate="update" :canResource="$server" placeholder="https://app.coolify.io"
+                                id="redirect_url" label="Redirect to (optional)" />
                         @endif
                     </div>
                     @if ($server->proxyType() === ProxyTypes::TRAEFIK->value)
@@ -53,9 +52,11 @@
                     <div wire:loading.remove wire:target="loadProxyConfiguration">
                         @if ($proxy_settings)
                             <div class="flex flex-col gap-2 pt-4">
-                                <x-forms.textarea useMonacoEditor monacoEditorLanguage="yaml" label="Configuration file"
-                                    name="proxy_settings" id="proxy_settings" rows="30" />
-                                <x-forms.button wire:click.prevent="reset_proxy_configuration">
+                                <x-forms.textarea canGate="update" :canResource="$server" useMonacoEditor
+                                    monacoEditorLanguage="yaml" label="Configuration file" name="proxy_settings"
+                                    id="proxy_settings" rows="30" />
+                                <x-forms.button canGate="update" :canResource="$server"
+                                    wire:click.prevent="reset_proxy_configuration">
                                     Reset configuration to default
                                 </x-forms.button>
                             </div>
@@ -65,33 +66,44 @@
             @elseif($selectedProxy === 'NONE')
                 <div class="flex items-center gap-2">
                     <h2>Configuration</h2>
-                    <x-forms.button wire:click.prevent="changeProxy">Switch Proxy</x-forms.button>
+                    @can('update', $server)
+                        <x-forms.button wire:click.prevent="changeProxy">Switch Proxy</x-forms.button>
+                    @endcan
                 </div>
                 <div class="pt-2 pb-4">Custom (None) Proxy Selected</div>
             @else
                 <div class="flex items-center gap-2">
                     <h2>Configuration</h2>
-                    <x-forms.button wire:click.prevent="changeProxy">Switch Proxy</x-forms.button>
+                    @can('update', $server)
+                        <x-forms.button wire:click.prevent="changeProxy">Switch Proxy</x-forms.button>
+                    @endcan
                 </div>
             @endif
         @else
             <div>
                 <h2>Configuration</h2>
                 <div class="subtitle">Select a proxy you would like to use on this server.</div>
-                <div class="grid gap-4">
-                    <x-forms.button class="box" wire:click="selectProxy('NONE')">
-                        Custom (None)
-                    </x-forms.button>
-                    <x-forms.button class="box" wire:click="selectProxy('TRAEFIK')">
-                        Traefik
-                    </x-forms.button>
-                    <x-forms.button class="box" wire:click="selectProxy('CADDY')">
-                        Caddy
-                    </x-forms.button>
-                    {{-- <x-forms.button disabled class="box">
-                        Nginx
-                    </x-forms.button> --}}
-                </div>
+                @can('update', $server)
+                    <div class="grid gap-4">
+                        <x-forms.button class="box" wire:click="selectProxy('NONE')">
+                            Custom (None)
+                        </x-forms.button>
+                        <x-forms.button class="box" wire:click="selectProxy('TRAEFIK')">
+                            Traefik
+                        </x-forms.button>
+                        <x-forms.button class="box" wire:click="selectProxy('CADDY')">
+                            Caddy
+                        </x-forms.button>
+                        {{-- <x-forms.button disabled class="box">
+                            Nginx
+                        </x-forms.button> --}}
+                    </div>
+                @else
+                    <div
+                        class="p-4 mb-4 text-sm text-yellow-800 bg-yellow-100 rounded-sm dark:bg-yellow-900 dark:text-yellow-300">
+                        You don't have permission to configure proxy settings for this server.
+                    </div>
+                @endcan
             </div>
     @endif
 </div>
diff --git a/resources/views/livewire/server/proxy/dynamic-configuration-navbar.blade.php b/resources/views/livewire/server/proxy/dynamic-configuration-navbar.blade.php
index ab202dbec..101303716 100644
--- a/resources/views/livewire/server/proxy/dynamic-configuration-navbar.blade.php
+++ b/resources/views/livewire/server/proxy/dynamic-configuration-navbar.blade.php
@@ -1,10 +1,12 @@
 <div class="flex gap-2">
     <h3 class="dark:text-white">File: {{ str_replace('|', '.', $fileName) }}</h3>
-    <div class="flex gap-2">
-        <x-modal-input buttonTitle="Edit" title="Edit Configuration">
-            <livewire:server.proxy.new-dynamic-configuration :server_id="$server_id" :fileName="$fileName" :value="$value"
-                :newFile="$newFile" wire:key="{{ $fileName }}" />
-        </x-modal-input>
-    </div>
-    <x-forms.button isError wire:click="delete('{{ $fileName }}')">Delete</x-forms.button>
+    @can('update', $server)
+        <div class="flex gap-2">
+            <x-modal-input buttonTitle="Edit" title="Edit Configuration">
+                <livewire:server.proxy.new-dynamic-configuration :server_id="$server_id" :fileName="$fileName" :value="$value"
+                    :newFile="$newFile" wire:key="{{ $fileName }}" />
+            </x-modal-input>
+        </div>
+        <x-forms.button isError wire:click="delete('{{ $fileName }}')">Delete</x-forms.button>
+    @endcan
 </div>
diff --git a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
index 53ff99ff9..60e5ea710 100644
--- a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
+++ b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
@@ -12,9 +12,11 @@
                         <div class="flex gap-2">
                             <h2>Dynamic Configurations</h2>
                             <x-forms.button wire:click="loadDynamicConfigurations">Reload</x-forms.button>
-                            <x-modal-input buttonTitle="+ Add" title="New Dynamic Configuration">
-                                <livewire:server.proxy.new-dynamic-configuration :server_id="$server->id" />
-                            </x-modal-input>
+                            @can('update', $server)
+                                <x-modal-input buttonTitle="+ Add" title="New Dynamic Configuration">
+                                    <livewire:server.proxy.new-dynamic-configuration :server_id="$server->id" />
+                                </x-modal-input>
+                            @endcan
                         </div>
                         <div class='pb-4'>You can add dynamic proxy configurations here.</div>
                     </div>
@@ -38,7 +40,7 @@
                                         wire:model="contents.{{ $fileName }}" rows="5" />
                                 @else
                                     <livewire:server.proxy.dynamic-configuration-navbar :server_id="$server->id"
-                                        :fileName="$fileName" :value="$value ?? ''" :newFile="false"
+                                        :server="$server" :fileName="$fileName" :value="$value ?? ''" :newFile="false"
                                         wire:key="{{ $fileName }}-{{ $loop->index }}" />
                                     <x-forms.textarea disabled wire:model="contents.{{ $fileName }}"
                                         rows="10" />
diff --git a/resources/views/livewire/server/proxy/new-dynamic-configuration.blade.php b/resources/views/livewire/server/proxy/new-dynamic-configuration.blade.php
index 7f389278b..7f203f689 100644
--- a/resources/views/livewire/server/proxy/new-dynamic-configuration.blade.php
+++ b/resources/views/livewire/server/proxy/new-dynamic-configuration.blade.php
@@ -1,5 +1,6 @@
 <form wire:submit.prevent="addDynamicConfiguration" class="flex flex-col w-full gap-4">
-    <x-forms.input id="fileName" label="Filename" required />
-    <x-forms.textarea allowTab useMonacoEditor id="value" label="Configuration" required rows="20" />
-    <x-forms.button type="submit" @click="slideOverOpen=false">Save</x-forms.button>
+    <x-forms.input canGate="update" :canResource="$server" id="fileName" label="Filename" required />
+    <x-forms.textarea canGate="update" :canResource="$server" allowTab useMonacoEditor id="value" label="Configuration"
+        required rows="20" />
+    <x-forms.button canGate="update" :canResource="$server" type="submit" @click="slideOverOpen=false">Save</x-forms.button>
 </form>
diff --git a/resources/views/livewire/server/show.blade.php b/resources/views/livewire/server/show.blade.php
index de12b73f8..8d08f26da 100644
--- a/resources/views/livewire/server/show.blade.php
+++ b/resources/views/livewire/server/show.blade.php
@@ -14,9 +14,9 @@
                             submitAction="submit" :actions="[
                                 'If you misconfigure the server, you could lose a lot of functionalities of Coolify.',
                             ]" :confirmWithText="false" :confirmWithPassword="false"
-                            step2ButtonText="Save" />
+                            step2ButtonText="Save" canGate="update" :canResource="$server" />
                     @else
-                        <x-forms.button type="submit">Save</x-forms.button>
+                        <x-forms.button type="submit" canGate="update" :canResource="$server">Save</x-forms.button>
                         @if ($server->isFunctional())
                             <x-slide-over closeWithX fullScreen>
                                 <x-slot:title>Validate & configure</x-slot:title>
@@ -24,7 +24,7 @@
                                     <livewire:server.validate-and-install :server="$server" ask />
                                 </x-slot:content>
                                 <x-forms.button @click="slideOverOpen=true" wire:click.prevent='validateServer'
-                                    isHighlighted>
+                                    isHighlighted canGate="update" :canResource="$server">
                                     Revalidate server
                                 </x-forms.button>
                             </x-slide-over>
@@ -68,67 +68,86 @@ class="mt-8 mb-4 w-full font-bold box-without-bg bg-coollabs hover:bg-coollabs-1
                 @endif
                 <div class="flex flex-col gap-2 pt-4">
                     <div class="flex flex-col gap-2 w-full lg:flex-row">
-                        <x-forms.input id="name" label="Name" required />
-                        <x-forms.input id="description" label="Description" />
+                        <x-forms.input canGate="update" :canResource="$server" id="name" label="Name" required />
+                        <x-forms.input canGate="update" :canResource="$server" id="description" label="Description" />
                         @if (!$isSwarmWorker && !$isBuildServer)
-                            <x-forms.input placeholder="https://example.com" id="wildcardDomain" label="Wildcard Domain"
+                            <x-forms.input canGate="update" :canResource="$server" placeholder="https://example.com"
+                                id="wildcardDomain" label="Wildcard Domain"
                                 helper='A wildcard domain allows you to receive a randomly generated domain for your new applications. <br><br>For instance, if you set "https://example.com" as your wildcard domain, your applications will receive domains like "https://randomId.example.com".' />
                         @endif
 
                     </div>
                     <div class="flex flex-col gap-2 w-full lg:flex-row">
-                        <x-forms.input type="password" id="ip" label="IP Address/Domain"
+                        <x-forms.input canGate="update" :canResource="$server" type="password" id="ip"
+                            label="IP Address/Domain"
                             helper="An IP Address (127.0.0.1) or domain (example.com). Make sure there is no protocol like http(s):// so you provide a FQDN not a URL."
                             required />
                         <div class="flex gap-2">
-                            <x-forms.input id="user" label="User" required />
-                            <x-forms.input type="number" id="port" label="Port" required />
+                            <x-forms.input canGate="update" :canResource="$server" id="user" label="User" required />
+                            <x-forms.input canGate="update" :canResource="$server" type="number" id="port"
+                                label="Port" required />
                         </div>
                     </div>
-                    <div class="w-full" x-data="{
-                        open: false,
-                        search: '{{ $serverTimezone ?: '' }}',
-                        timezones: @js($this->timezones),
-                        placeholder: '{{ $serverTimezone ? 'Search timezone...' : 'Select Server Timezone' }}',
-                        init() {
-                            this.$watch('search', value => {
-                                if (value === '') {
-                                    this.open = true;
-                                }
-                            })
-                        }
-                    }">
+                    <div class="w-full">
                         <div class="flex items-center mb-1">
-                            <label for="serverTimezone">Server
-                                Timezone</label>
+                            <label for="serverTimezone">Server Timezone</label>
                             <x-helper class="ml-2"
                                 helper="Server's timezone. This is used for backups, cron jobs, etc." />
                         </div>
-                        <div class="relative">
-                            <div class="inline-flex relative items-center w-64">
-                                <input autocomplete="off"
-                                    wire:dirty.class.remove='dark:focus:ring-coolgray-300 dark:ring-coolgray-300'
-                                    wire:dirty.class="dark:focus:ring-warning dark:ring-warning" x-model="search"
-                                    @focus="open = true" @click.away="open = false" @input="open = true"
-                                    class="w-full input" :placeholder="placeholder" wire:model="serverTimezone">
-                                <svg class="absolute right-0 mr-2 w-4 h-4" xmlns="http://www.w3.org/2000/svg"
-                                    fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor"
-                                    @click="open = true">
-                                    <path stroke-linecap="round" stroke-linejoin="round"
-                                        d="M8.25 15L12 18.75 15.75 15m-7.5-6L12 5.25 15.75 9" />
-                                </svg>
+                        @can('update', $server)
+                            <div x-data="{
+                                open: false,
+                                search: '{{ $serverTimezone ?: '' }}',
+                                timezones: @js($this->timezones),
+                                placeholder: '{{ $serverTimezone ? 'Search timezone...' : 'Select Server Timezone' }}',
+                                init() {
+                                    this.$watch('search', value => {
+                                        if (value === '') {
+                                            this.open = true;
+                                        }
+                                    })
+                                }
+                            }">
+                                <div class="relative">
+                                    <div class="inline-flex relative items-center w-64">
+                                        <input autocomplete="off"
+                                            wire:dirty.class.remove='dark:focus:ring-coolgray-300 dark:ring-coolgray-300'
+                                            wire:dirty.class="dark:focus:ring-warning dark:ring-warning" x-model="search"
+                                            @focus="open = true" @click.away="open = false" @input="open = true"
+                                            class="w-full input" :placeholder="placeholder" wire:model="serverTimezone">
+                                        <svg class="absolute right-0 mr-2 w-4 h-4" xmlns="http://www.w3.org/2000/svg"
+                                            fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor"
+                                            @click="open = true">
+                                            <path stroke-linecap="round" stroke-linejoin="round"
+                                                d="M8.25 15L12 18.75 15.75 15m-7.5-6L12 5.25 15.75 9" />
+                                        </svg>
+                                    </div>
+                                    <div x-show="open"
+                                        class="overflow-auto overflow-x-hidden absolute z-50 mt-1 w-64 max-h-60 bg-white rounded-md border shadow-lg dark:bg-coolgray-100 dark:border-coolgray-200 scrollbar">
+                                        <template
+                                            x-for="timezone in timezones.filter(tz => tz.toLowerCase().includes(search.toLowerCase()))"
+                                            :key="timezone">
+                                            <div @click="search = timezone; open = false; $wire.set('serverTimezone', timezone); $wire.submit()"
+                                                class="px-4 py-2 text-gray-800 cursor-pointer hover:bg-gray-100 dark:hover:bg-coolgray-300 dark:text-gray-200"
+                                                x-text="timezone"></div>
+                                        </template>
+                                    </div>
+                                </div>
                             </div>
-                            <div x-show="open"
-                                class="overflow-auto overflow-x-hidden absolute z-50 mt-1 w-64 max-h-60 bg-white rounded-md border shadow-lg dark:bg-coolgray-100 dark:border-coolgray-200 scrollbar">
-                                <template
-                                    x-for="timezone in timezones.filter(tz => tz.toLowerCase().includes(search.toLowerCase()))"
-                                    :key="timezone">
-                                    <div @click="search = timezone; open = false; $wire.set('serverTimezone', timezone); $wire.submit()"
-                                        class="px-4 py-2 text-gray-800 cursor-pointer hover:bg-gray-100 dark:hover:bg-coolgray-300 dark:text-gray-200"
-                                        x-text="timezone"></div>
-                                </template>
+                        @else
+                            <div class="relative">
+                                <div class="inline-flex relative items-center w-64">
+                                    <input readonly disabled autocomplete="off"
+                                        class="w-full input opacity-50 cursor-not-allowed"
+                                        value="{{ $serverTimezone ?: 'No timezone set' }}" placeholder="Server Timezone">
+                                    <svg class="absolute right-0 mr-2 w-4 h-4 opacity-50" xmlns="http://www.w3.org/2000/svg"
+                                        fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor">
+                                        <path stroke-linecap="round" stroke-linejoin="round"
+                                            d="M8.25 15L12 18.75 15.75 15m-7.5-6L12 5.25 15.75 9" />
+                                    </svg>
+                                </div>
                             </div>
-                        </div>
+                        @endcan
                     </div>
 
                     <div class="w-full">
@@ -139,8 +158,8 @@ class="px-4 py-2 text-gray-800 cursor-pointer hover:bg-gray-100 dark:hover:bg-co
                                         helper="You can't use this server as a build server because it has defined resources."
                                         label="Use it as a build server?" />
                                 @else
-                                    <x-forms.checkbox instantSave id="isBuildServer"
-                                        label="Use it as a build server?" />
+                                    <x-forms.checkbox canGate="update" :canResource="$server" instantSave
+                                        id="isBuildServer" label="Use it as a build server?" />
                                 @endif
                             </div>
 
@@ -157,7 +176,8 @@ class="px-4 py-2 text-gray-800 cursor-pointer hover:bg-gray-100 dark:hover:bg-co
                                             helper="For more information, please read the documentation <a class='dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/swarm' target='_blank'>here</a>."
                                             label="Is it a Swarm Manager?" />
                                     @else
-                                        <x-forms.checkbox instantSave type="checkbox" id="isSwarmManager"
+                                        <x-forms.checkbox canGate="update" :canResource="$server" instantSave
+                                            type="checkbox" id="isSwarmManager"
                                             helper="For more information, please read the documentation <a class='dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/swarm' target='_blank'>here</a>."
                                             label="Is it a Swarm Manager?" />
                                     @endif
@@ -167,7 +187,8 @@ class="px-4 py-2 text-gray-800 cursor-pointer hover:bg-gray-100 dark:hover:bg-co
                                             helper="For more information, please read the documentation <a class='dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/swarm' target='_blank'>here</a>."
                                             label="Is it a Swarm Worker?" />
                                     @else
-                                        <x-forms.checkbox instantSave type="checkbox" id="isSwarmWorker"
+                                        <x-forms.checkbox canGate="update" :canResource="$server" instantSave
+                                            type="checkbox" id="isSwarmWorker"
                                             helper="For more information, please read the documentation <a class='dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/swarm' target='_blank'>here</a>."
                                             label="Is it a Swarm Worker?" />
                                     @endif
@@ -180,20 +201,23 @@ class="px-4 py-2 text-gray-800 cursor-pointer hover:bg-gray-100 dark:hover:bg-co
             @if ($server->isFunctional() && !$server->isSwarm() && !$server->isBuildServer())
                 <form wire:submit.prevent='submit'>
                     <div class="flex gap-2 items-center pt-4 pb-2">
-                        <h3>Sentinel
-                        </h3>
+                        <h3>Sentinel</h3>
                         <x-helper helper="Sentinel reports your server's & container's health and collects metrics." />
                         @if ($server->isSentinelEnabled())
                             <div class="flex gap-2 items-center">
                                 @if ($server->isSentinelLive())
                                     <x-status.running status="In sync" noLoading title="{{ $sentinelUpdatedAt }}" />
-                                    <x-forms.button type="submit">Save</x-forms.button>
-                                    <x-forms.button wire:click='restartSentinel'>Restart</x-forms.button>
+                                    <x-forms.button type="submit" canGate="update"
+                                        :canResource="$server">Save</x-forms.button>
+                                    <x-forms.button wire:click='restartSentinel' canGate="update"
+                                        :canResource="$server">Restart</x-forms.button>
                                 @else
                                     <x-status.stopped status="Out of sync" noLoading
                                         title="{{ $sentinelUpdatedAt }}" />
-                                    <x-forms.button type="submit">Save</x-forms.button>
-                                    <x-forms.button wire:click='restartSentinel'>Sync</x-forms.button>
+                                    <x-forms.button type="submit" canGate="update"
+                                        :canResource="$server">Save</x-forms.button>
+                                    <x-forms.button wire:click='restartSentinel' canGate="update"
+                                        :canResource="$server">Sync</x-forms.button>
                                 @endif
                             </div>
                         @endif
@@ -201,13 +225,15 @@ class="px-4 py-2 text-gray-800 cursor-pointer hover:bg-gray-100 dark:hover:bg-co
                     <div class="flex flex-col gap-2">
 
                         <div class="w-96">
-                            <x-forms.checkbox wire:model.live="isSentinelEnabled" label="Enable Sentinel" />
+                            <x-forms.checkbox canGate="update" :canResource="$server" wire:model.live="isSentinelEnabled"
+                                label="Enable Sentinel" />
                             @if ($server->isSentinelEnabled())
                                 @if (isDev())
-                                    <x-forms.checkbox id="isSentinelDebugEnabled" label="Enable Sentinel (with debug)"
-                                        instantSave />
+                                    <x-forms.checkbox canGate="update" :canResource="$server" id="isSentinelDebugEnabled"
+                                        label="Enable Sentinel (with debug)" instantSave />
                                 @endif
-                                <x-forms.checkbox instantSave id="isMetricsEnabled" label="Enable Metrics" />
+                                <x-forms.checkbox canGate="update" :canResource="$server" instantSave
+                                    id="isMetricsEnabled" label="Enable Metrics" />
                             @else
                                 @if (isDev())
                                     <x-forms.checkbox id="isSentinelDebugEnabled" label="Enable Sentinel (with debug)"
@@ -219,23 +245,27 @@ class="px-4 py-2 text-gray-800 cursor-pointer hover:bg-gray-100 dark:hover:bg-co
                         </div>
                         @if ($server->isSentinelEnabled())
                             <div class="flex flex-wrap gap-2 sm:flex-nowrap items-end">
-                                <x-forms.input type="password" id="sentinelToken" label="Sentinel token" required
-                                    helper="Token for Sentinel." />
-                                <x-forms.button wire:click="regenerateSentinelToken">Regenerate</x-forms.button>
+                                <x-forms.input canGate="update" :canResource="$server" type="password" id="sentinelToken"
+                                    label="Sentinel token" required helper="Token for Sentinel." />
+                                <x-forms.button canGate="update" :canResource="$server"
+                                    wire:click="regenerateSentinelToken">Regenerate</x-forms.button>
                             </div>
 
-                            <x-forms.input id="sentinelCustomUrl" required label="Coolify URL"
+                            <x-forms.input canGate="update" :canResource="$server" id="sentinelCustomUrl" required
+                                label="Coolify URL"
                                 helper="URL to your Coolify instance. If it is empty that means you do not have a FQDN set for your Coolify instance." />
 
                             <div class="flex flex-col gap-2">
                                 <div class="flex flex-wrap gap-2 sm:flex-nowrap">
-                                    <x-forms.input id="sentinelMetricsRefreshRateSeconds"
-                                        label="Metrics rate (seconds)" required
+                                    <x-forms.input canGate="update" :canResource="$server"
+                                        id="sentinelMetricsRefreshRateSeconds" label="Metrics rate (seconds)" required
                                         helper="Interval used for gathering metrics. Lower values result in more disk space usage." />
-                                    <x-forms.input id="sentinelMetricsHistoryDays" label="Metrics history (days)"
-                                        required helper="Number of days to retain metrics data for." />
-                                    <x-forms.input id="sentinelPushIntervalSeconds" label="Push interval (seconds)"
-                                        required helper="Interval at which metrics data is sent to the collector." />
+                                    <x-forms.input canGate="update" :canResource="$server" id="sentinelMetricsHistoryDays"
+                                        label="Metrics history (days)" required
+                                        helper="Number of days to retain metrics data for." />
+                                    <x-forms.input canGate="update" :canResource="$server"
+                                        id="sentinelPushIntervalSeconds" label="Push interval (seconds)" required
+                                        helper="Interval at which metrics data is sent to the collector." />
                                 </div>
                             </div>
                         @endif
diff --git a/resources/views/livewire/shared-variables/environment/index.blade.php b/resources/views/livewire/shared-variables/environment/index.blade.php
index 4831ed017..3f51435f3 100644
--- a/resources/views/livewire/shared-variables/environment/index.blade.php
+++ b/resources/views/livewire/shared-variables/environment/index.blade.php
@@ -8,7 +8,7 @@
     <div class="subtitle">List of your environments by projects.</div>
     <div class="flex flex-col gap-2">
         @forelse ($projects as $project)
-            <h2>{{ data_get($project, 'name') }}</h2>
+            <h2>Project: {{ data_get($project, 'name') }}</h2>
             <div class="pt-0 pb-3">{{ data_get($project, 'description') }}</div>
             @forelse ($project->environments as $environment)
                 <a class="box group"
@@ -23,7 +23,7 @@
                     </div>
                 </a>
             @empty
-                <p>No environments found.</p>
+                <p class="pb-4">No environments found.</p>
             @endforelse
         @empty
             <div>
diff --git a/resources/views/livewire/shared-variables/environment/show.blade.php b/resources/views/livewire/shared-variables/environment/show.blade.php
index f024d0978..0799a7422 100644
--- a/resources/views/livewire/shared-variables/environment/show.blade.php
+++ b/resources/views/livewire/shared-variables/environment/show.blade.php
@@ -4,9 +4,11 @@
     </x-slot>
     <div class="flex gap-2">
         <h1>Shared Variables for {{ $project->name }}/{{ $environment->name }}</h1>
-        <x-modal-input buttonTitle="+ Add" title="New Shared Variable">
-            <livewire:project.shared.environment-variable.add :shared="true" />
-        </x-modal-input>
+        @can('update', $environment)
+            <x-modal-input buttonTitle="+ Add" title="New Shared Variable">
+                <livewire:project.shared.environment-variable.add :shared="true" />
+            </x-modal-input>
+        @endcan
     </div>
     <div class="flex items-center gap-1 subtitle">You can use these variables anywhere with <span
             class="dark:text-warning text-coollabs">@{{ environment.VARIABLENAME }}</span><x-helper
diff --git a/resources/views/livewire/shared-variables/project/show.blade.php b/resources/views/livewire/shared-variables/project/show.blade.php
index 2d3824dc9..7db3b61a2 100644
--- a/resources/views/livewire/shared-variables/project/show.blade.php
+++ b/resources/views/livewire/shared-variables/project/show.blade.php
@@ -3,10 +3,12 @@
         Project Variable | Coolify
     </x-slot>
     <div class="flex gap-2 items-center">
-        <h1>Shared Variables for {{data_get($project,'name')}}</h1>
-        <x-modal-input buttonTitle="+ Add" title="New Shared Variable">
-            <livewire:project.shared.environment-variable.add :shared="true" />
-        </x-modal-input>
+        <h1>Shared Variables for {{ data_get($project, 'name') }}</h1>
+        @can('update', $project)
+            <x-modal-input buttonTitle="+ Add" title="New Shared Variable">
+                <livewire:project.shared.environment-variable.add :shared="true" />
+            </x-modal-input>
+        @endcan
     </div>
     <div class="flex flex-wrap gap-1 subtitle">
         <div>You can use these variables anywhere with</div>
diff --git a/resources/views/livewire/shared-variables/team/index.blade.php b/resources/views/livewire/shared-variables/team/index.blade.php
index 708618f89..1fbdfc2c5 100644
--- a/resources/views/livewire/shared-variables/team/index.blade.php
+++ b/resources/views/livewire/shared-variables/team/index.blade.php
@@ -4,9 +4,11 @@
     </x-slot>
     <div class="flex gap-2 items-center">
         <h1>Team Shared Variables</h1>
-        <x-modal-input buttonTitle="+ Add" title="New Shared Variable">
-            <livewire:project.shared.environment-variable.add :shared="true" />
-        </x-modal-input>
+        @can('create', App\Models\SharedEnvironmentVariable::class)
+            <x-modal-input buttonTitle="+ Add" title="New Shared Variable">
+                <livewire:project.shared.environment-variable.add :shared="true" />
+            </x-modal-input>
+        @endcan
     </div>
     <div class="flex items-center gap-1 subtitle">You can use these variables anywhere with <span
             class="dark:text-warning text-coollabs">@{{ team.VARIABLENAME }}</span> <x-helper
diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index f7e0fa454..ba610eacd 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -5,29 +5,24 @@
                 <h1>GitHub App</h1>
                 <div class="flex gap-2">
                     @if (data_get($github_app, 'installation_id'))
-                        <x-forms.button type="submit">Save</x-forms.button>
-                        <a href="{{ getInstallationPath($github_app) }}">
-                            <x-forms.button>
-                                Update Repositories
-                                <x-external-link />
-                            </x-forms.button>
-                        </a>
+                        <x-forms.button canGate="update" :canResource="$github_app" type="submit">Save</x-forms.button>
                     @endif
-                    @if ($applications->count() > 0)
-                        <x-modal-confirmation title="Confirm GitHub App Deletion?" isErrorButton buttonTitle="Delete"
-                            submitAction="delete" :actions="['The selected GitHub App will be permanently deleted.']" confirmationText="{{ data_get($github_app, 'name') }}"
-                            confirmationLabel="Please confirm the execution of the actions by entering the GitHub App Name below"
-                            shortConfirmationLabel="GitHub App Name" :confirmWithPassword="false"
-                            step2ButtonText="Permanently Delete" />
-                    @else
-                        <x-modal-confirmation title="Confirm GitHub App Deletion?" isErrorButton buttonTitle="Delete"
-                            submitAction="delete" :actions="['The selected GitHub App will be permanently deleted.']"
-                            confirmationLabel="Please confirm the execution of the actions by entering the GitHub App Name below"
-                            shortConfirmationLabel="GitHub App Name"
-                            confirmationText="{{ data_get($github_app, 'name') }}" :confirmWithPassword="false"
-                            step2ButtonText="Permanently Delete" />
-                    @endif
-
+                    @can('delete', $github_app)
+                        @if ($applications->count() > 0)
+                            <x-modal-confirmation title="Confirm GitHub App Deletion?" isErrorButton buttonTitle="Delete"
+                                submitAction="delete" :actions="['The selected GitHub App will be permanently deleted.']" confirmationText="{{ data_get($github_app, 'name') }}"
+                                confirmationLabel="Please confirm the execution of the actions by entering the GitHub App Name below"
+                                shortConfirmationLabel="GitHub App Name" :confirmWithPassword="false"
+                                step2ButtonText="Permanently Delete" />
+                        @else
+                            <x-modal-confirmation title="Confirm GitHub App Deletion?" isErrorButton buttonTitle="Delete"
+                                submitAction="delete" :actions="['The selected GitHub App will be permanently deleted.']"
+                                confirmationLabel="Please confirm the execution of the actions by entering the GitHub App Name below"
+                                shortConfirmationLabel="GitHub App Name"
+                                confirmationText="{{ data_get($github_app, 'name') }}" :confirmWithPassword="false"
+                                step2ButtonText="Permanently Delete" />
+                        @endif
+                    @endcan
                 </div>
             </div>
             <div class="subtitle">Your Private GitHub App for private repositories.</div>
@@ -47,47 +42,64 @@
                 <div class="flex flex-col gap-2">
                     <div class="flex gap-2">
                         <div class="flex items-end gap-2 w-full">
-                            <x-forms.input id="github_app.name" label="App Name" />
-                            <x-forms.button wire:click.prevent="updateGithubAppName" class="bg-coollabs">
+                            <x-forms.input canGate="update" :canResource="$github_app" id="github_app.name" label="App Name" />
+                            <x-forms.button canGate="update" :canResource="$github_app" wire:click.prevent="updateGithubAppName">
                                 Sync Name
                             </x-forms.button>
-                            <a href="{{ $this->getGithubAppNameUpdatePath() }}">
-                                <x-forms.button>
-                                    Rename
-                                    <x-external-link />
-                                </x-forms.button>
-                            </a>
+                            @can('update', $github_app)
+                                <a href="{{ $this->getGithubAppNameUpdatePath() }}">
+                                    <x-forms.button
+                                        class="bg-transparent border-transparent hover:bg-transparent hover:border-transparent hover:underline">
+                                        Rename
+                                        <x-external-link />
+                                    </x-forms.button>
+                                </a>
+                                <a href="{{ getInstallationPath($github_app) }}" class="w-fit">
+                                    <x-forms.button
+                                        class="bg-transparent border-transparent hover:bg-transparent hover:border-transparent hover:underline whitespace-nowrap">
+                                        Update Repositories
+                                        <x-external-link />
+                                    </x-forms.button>
+                                </a>
+                            @endcan
                         </div>
-                        <x-forms.input id="github_app.organization" label="Organization"
-                            placeholder="If empty, personal user will be used" />
                     </div>
+                    <x-forms.input canGate="update" :canResource="$github_app" id="github_app.organization" label="Organization"
+                        placeholder="If empty, personal user will be used" />
                     @if (!isCloud())
                         <div class="w-48">
-                            <x-forms.checkbox label="System Wide?"
+                            <x-forms.checkbox canGate="update" :canResource="$github_app" label="System Wide?"
                                 helper="If checked, this GitHub App will be available for everyone in this Coolify instance."
                                 instantSave id="github_app.is_system_wide" />
                         </div>
                     @endif
                     <div class="flex gap-2">
-                        <x-forms.input id="github_app.html_url" label="HTML Url" />
-                        <x-forms.input id="github_app.api_url" label="API Url" />
+                        <x-forms.input canGate="update" :canResource="$github_app" id="github_app.html_url" label="HTML Url" />
+                        <x-forms.input canGate="update" :canResource="$github_app" id="github_app.api_url" label="API Url" />
                     </div>
                     <div class="flex gap-2">
-                        <x-forms.input id="github_app.custom_user" label="User" required />
-                        <x-forms.input type="number" id="github_app.custom_port" label="Port" required />
-                    </div>
-                    <div class="flex gap-2">
-                        <x-forms.input type="number" id="github_app.app_id" label="App Id" required />
-                        <x-forms.input type="number" id="github_app.installation_id" label="Installation Id"
+                        <x-forms.input canGate="update" :canResource="$github_app" id="github_app.custom_user" label="User"
                             required />
+                        <x-forms.input canGate="update" :canResource="$github_app" type="number" id="github_app.custom_port"
+                            label="Port" required />
                     </div>
                     <div class="flex gap-2">
-                        <x-forms.input id="github_app.client_id" label="Client Id" type="password" required />
-                        <x-forms.input id="github_app.client_secret" label="Client Secret" type="password" required />
-                        <x-forms.input id="github_app.webhook_secret" label="Webhook Secret" type="password" required />
+                        <x-forms.input canGate="update" :canResource="$github_app" type="number" id="github_app.app_id"
+                            label="App Id" required />
+                        <x-forms.input canGate="update" :canResource="$github_app" type="number"
+                            id="github_app.installation_id" label="Installation Id" required />
                     </div>
                     <div class="flex gap-2">
-                        <x-forms.select id="github_app.private_key_id" label="Private Key" required>
+                        <x-forms.input canGate="update" :canResource="$github_app" id="github_app.client_id" label="Client Id"
+                            type="password" required />
+                        <x-forms.input canGate="update" :canResource="$github_app" id="github_app.client_secret"
+                            label="Client Secret" type="password" required />
+                        <x-forms.input canGate="update" :canResource="$github_app" id="github_app.webhook_secret"
+                            label="Webhook Secret" type="password" required />
+                    </div>
+                    <div class="flex gap-2">
+                        <x-forms.select canGate="update" :canResource="$github_app" id="github_app.private_key_id"
+                            label="Private Key" required>
                             @if (blank($github_app->private_key_id))
                                 <option value="0" selected>Select a private key</option>
                             @endif
@@ -98,13 +110,15 @@
                     </div>
                     <div class="flex items-end gap-2 ">
                         <h2 class="pt-4">Permissions</h2>
-                        <x-forms.button wire:click.prevent="checkPermissions">Refetch</x-forms.button>
-                        <a href="{{ getPermissionsPath($github_app) }}">
-                            <x-forms.button>
-                                Update
-                                <x-external-link />
-                            </x-forms.button>
-                        </a>
+                        @can('view', $github_app)
+                            <x-forms.button wire:click.prevent="checkPermissions">Refetch</x-forms.button>
+                            <a href="{{ getPermissionsPath($github_app) }}">
+                                <x-forms.button>
+                                    Update
+                                    <x-external-link />
+                                </x-forms.button>
+                            </a>
+                        @endcan
                     </div>
                     <div class="flex gap-2">
                         <x-forms.input id="github_app.contents" helper="read - mandatory." label="Content" readonly
@@ -182,72 +196,93 @@ class=""
         <div class="flex items-center gap-2 pb-4">
             <h1>GitHub App</h1>
             <div class="flex gap-2">
-                <x-modal-confirmation title="Confirm GitHub App Deletion?" isErrorButton buttonTitle="Delete"
-                    submitAction="delete" :actions="['The selected GitHub App will be permanently deleted.']" confirmationText="{{ data_get($github_app, 'name') }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the GitHub App Name below"
-                    shortConfirmationLabel="GitHub App Name" :confirmWithPassword="false" step2ButtonText="Permanently Delete" />
+                @can('delete', $github_app)
+                    <x-modal-confirmation title="Confirm GitHub App Deletion?" isErrorButton buttonTitle="Delete"
+                        submitAction="delete" :actions="['The selected GitHub App will be permanently deleted.']" confirmationText="{{ data_get($github_app, 'name') }}"
+                        confirmationLabel="Please confirm the execution of the actions by entering the GitHub App Name below"
+                        shortConfirmationLabel="GitHub App Name" :confirmWithPassword="false"
+                        step2ButtonText="Permanently Delete" />
+                @endcan
             </div>
         </div>
         <div class="flex flex-col gap-2">
-            <h3>Manual Installation</h3>
-            <div class="flex gap-2 items-center">
-                If you want to fill the form manually, you can continue below. Only for advanced users.
-                <x-forms.button wire:click.prevent="createGithubAppManually">
-                    Continue
-                </x-forms.button>
-            </div>
-            <h3>Automated Installation</h3>
-            <div class=" pb-5 rounded-sm alert-error">
-                <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6 stroke-current shrink-0" fill="none"
-                    viewBox="0 0 24 24">
-                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                        d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
-                </svg>
-                <span>You must complete this step before you can use this source!</span>
-            </div>
+            @can('create', $github_app)
+                <h3>Manual Installation</h3>
+                <div class="flex gap-2 items-center">
+                    If you want to fill the form manually, you can continue below. Only for advanced users.
+                    <x-forms.button wire:click.prevent="createGithubAppManually">
+                        Continue
+                    </x-forms.button>
+                </div>
+                <h3>Automated Installation</h3>
+                <div class=" pb-5 rounded-sm alert-error">
+                    <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6 stroke-current shrink-0" fill="none"
+                        viewBox="0 0 24 24">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+                            d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+                    </svg>
+                    <span>You must complete this step before you can use this source!</span>
+                </div>
+            @endcan
             <div class="flex flex-col">
                 <div class="pb-10">
-                    @if (!isCloud() || isDev())
-                        <div class="flex items-end gap-2">
-                            <x-forms.select wire:model.live='webhook_endpoint' label="Webhook Endpoint"
-                                helper="All Git webhooks will be sent to this endpoint. <br><br>If you would like to use domain instead of IP address, set your Coolify instance's FQDN in the Settings menu.">
-                                @if ($ipv4)
-                                    <option value="{{ $ipv4 }}">Use {{ $ipv4 }}</option>
-                                @endif
-                                @if ($ipv6)
-                                    <option value="{{ $ipv6 }}">Use {{ $ipv6 }}</option>
-                                @endif
-                                @if ($fqdn)
-                                    <option value="{{ $fqdn }}">Use {{ $fqdn }}</option>
-                                @endif
-                                @if (config('app.url'))
-                                    <option value="{{ config('app.url') }}">Use {{ config('app.url') }}</option>
-                                @endif
-                            </x-forms.select>
-                            <x-forms.button isHighlighted
-                                x-on:click.prevent="createGithubApp('{{ $webhook_endpoint }}','{{ $preview_deployment_permissions }}',{{ $administration }})">
-                                Register Now
-                            </x-forms.button>
+                    @can('create', $github_app)
+                        @if (!isCloud() || isDev())
+                            <div class="flex items-end gap-2">
+                                <x-forms.select wire:model.live='webhook_endpoint' label="Webhook Endpoint"
+                                    helper="All Git webhooks will be sent to this endpoint. <br><br>If you would like to use domain instead of IP address, set your Coolify instance's FQDN in the Settings menu.">
+                                    @if ($ipv4)
+                                        <option value="{{ $ipv4 }}">Use {{ $ipv4 }}</option>
+                                    @endif
+                                    @if ($ipv6)
+                                        <option value="{{ $ipv6 }}">Use {{ $ipv6 }}</option>
+                                    @endif
+                                    @if ($fqdn)
+                                        <option value="{{ $fqdn }}">Use {{ $fqdn }}</option>
+                                    @endif
+                                    @if (config('app.url'))
+                                        <option value="{{ config('app.url') }}">Use {{ config('app.url') }}</option>
+                                    @endif
+                                </x-forms.select>
+                                <x-forms.button isHighlighted
+                                    x-on:click.prevent="createGithubApp('{{ $webhook_endpoint }}','{{ $preview_deployment_permissions }}',{{ $administration }})">
+                                    Register Now
+                                </x-forms.button>
+                            </div>
+                        @else
+                            <div class="flex gap-2">
+                                <h2>Register a GitHub App</h2>
+                                <x-forms.button isHighlighted
+                                    x-on:click.prevent="createGithubApp('{{ $webhook_endpoint }}','{{ $preview_deployment_permissions }}',{{ $administration }})">
+                                    Register Now
+                                </x-forms.button>
+                            </div>
+                            <div>You need to register a GitHub App before using this source.</div>
+                        @endif
+
+                        <div class="flex flex-col gap-2 pt-4 w-96">
+                            <x-forms.checkbox disabled instantSave id="default_permissions" label="Mandatory"
+                                helper="Contents: read<br>Metadata: read<br>Email: read" />
+                            <x-forms.checkbox instantSave id="preview_deployment_permissions" label="Preview Deployments "
+                                helper="Necessary for updating pull requests with useful comments (deployment status, links, etc.)<br><br>Pull Request: read & write" />
+                            {{-- <x-forms.checkbox instantSave id="administration" label="Administration (for Github Runners)"
+                            helper="Necessary for adding Github Runners to repositories.<br><br>Administration: read & write" /> --}}
                         </div>
                     @else
-                        <div class="flex gap-2">
-                            <h2>Register a GitHub App</h2>
-                            <x-forms.button isHighlighted
-                                x-on:click.prevent="createGithubApp('{{ $webhook_endpoint }}','{{ $preview_deployment_permissions }}',{{ $administration }})">
-                                Register Now
-                            </x-forms.button>
+                        <div
+                            class="flex items-center gap-2 p-4 border border-red-500 rounded-lg bg-red-50 dark:bg-red-900/20">
+                            <svg class="w-5 h-5 text-red-500" fill="currentColor" viewBox="0 0 20 20">
+                                <path fill-rule="evenodd"
+                                    d="M10 18a8 8 0 100-16 8 8 0 000 16zM8.28 7.22a.75.75 0 00-1.06 1.06L8.94 10l-1.72 1.72a.75.75 0 101.06 1.06L10 11.06l1.72 1.72a.75.75 0 101.06-1.06L11.06 10l1.72-1.72a.75.75 0 00-1.06-1.06L10 8.94 8.28 7.22z"
+                                    clip-rule="evenodd"></path>
+                            </svg>
+                            <div>
+                                <div class="font-semibold text-red-700 dark:text-red-300">Insufficient Permissions</div>
+                                <div class="text-sm text-red-600 dark:text-red-400">You don't have permission to create
+                                    new GitHub Apps. Please contact your team administrator.</div>
+                            </div>
                         </div>
-                        <div>You need to register a GitHub App before using this source.</div>
-                    @endif
-
-                    <div class="flex flex-col gap-2 pt-4 w-96">
-                        <x-forms.checkbox disabled instantSave id="default_permissions" label="Mandatory"
-                            helper="Contents: read<br>Metadata: read<br>Email: read" />
-                        <x-forms.checkbox instantSave id="preview_deployment_permissions" label="Preview Deployments "
-                            helper="Necessary for updating pull requests with useful comments (deployment status, links, etc.)<br><br>Pull Request: read & write" />
-                        {{-- <x-forms.checkbox instantSave id="administration" label="Administration (for Github Runners)"
-                        helper="Necessary for adding Github Runners to repositories.<br><br>Administration: read & write" /> --}}
-                    </div>
+                    @endcan
                 </div>
             </div>
             <script>
diff --git a/resources/views/livewire/source/github/create.blade.php b/resources/views/livewire/source/github/create.blade.php
index 1f5107bec..154e93a27 100644
--- a/resources/views/livewire/source/github/create.blade.php
+++ b/resources/views/livewire/source/github/create.blade.php
@@ -1,52 +1,59 @@
-<form wire:submit='createGitHubApp' class="flex flex-col w-full gap-2">
-    <div class="pb-2">This is required, if you would like to get full integration (commit / pull request
-        deployments, etc)
-        with GitHub.</div>
-    <div class="flex gap-2">
-        <x-forms.input id="name" label="Name" required />
-        <x-forms.input helper="If empty, your GitHub user will be used."
-            placeholder="If empty, your GitHub user will be used." id="organization" label="Organization (on GitHub)" />
-    </div>
-    @if (!isCloud())
-        <div class="w-48">
-            <x-forms.checkbox id="is_system_wide" label="System Wide"
-                helper="If checked, this GitHub App will be available for everyone in this Coolify instance." />
+@can('createAnyResource')
+    <form wire:submit='createGitHubApp' class="flex flex-col w-full gap-2">
+        <div class="pb-2">This is required, if you would like to get full integration (commit / pull request
+            deployments, etc)
+            with GitHub.</div>
+        <div class="flex gap-2">
+            <x-forms.input id="name" label="Name" required />
+            <x-forms.input helper="If empty, your GitHub user will be used."
+                placeholder="If empty, your GitHub user will be used." id="organization" label="Organization (on GitHub)" />
         </div>
-    @endif
-    <div x-data="{
-        activeAccordion: '',
-        setActiveAccordion(id) {
-            this.activeAccordion = (this.activeAccordion == id) ? '' : id
-        }
-    }" class="relative w-full py-2 mx-auto overflow-hidden text-sm font-normal rounded-md">
-        <div x-data="{ id: $id('accordion') }" class="cursor-pointer">
-            <button @click="setActiveAccordion(id)"
-                class="flex items-center justify-between w-full px-1 py-2 text-left select-none dark:hover:text-white hover:bg-white/5"
-                type="button">
-                <h4>Self-hosted / Enterprise GitHub</h4>
-                <svg class="w-4 h-4 duration-200 ease-out" :class="{ 'rotate-180': activeAccordion == id }"
-                    viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" fill="none" stroke="currentColor"
-                    stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-                    <polyline points="6 9 12 15 18 9"></polyline>
-                </svg>
-            </button>
-            <div x-show="activeAccordion==id" x-collapse x-cloak class="px-2">
-                <div class="flex flex-col gap-2 pt-0 opacity-70">
-                    <div class="flex gap-2">
-                        <x-forms.input id="html_url" label="HTML Url" required />
-                        <x-forms.input id="api_url" label="API Url" required />
-                    </div>
-                    <div class="flex gap-2">
-                        <x-forms.input id="custom_user" label="Custom Git User" required />
-                        <x-forms.input id="custom_port" type="number" label="Custom Git Port" required />
+        @if (!isCloud())
+            <div class="w-48">
+                <x-forms.checkbox id="is_system_wide" label="System Wide"
+                    helper="If checked, this GitHub App will be available for everyone in this Coolify instance." />
+            </div>
+        @endif
+        <div x-data="{
+            activeAccordion: '',
+            setActiveAccordion(id) {
+                this.activeAccordion = (this.activeAccordion == id) ? '' : id
+            }
+        }" class="relative w-full py-2 mx-auto overflow-hidden text-sm font-normal rounded-md">
+            <div x-data="{ id: $id('accordion') }" class="cursor-pointer">
+                <button @click="setActiveAccordion(id)"
+                    class="flex items-center justify-between w-full px-1 py-2 text-left select-none dark:hover:text-white hover:bg-white/5"
+                    type="button">
+                    <h4>Self-hosted / Enterprise GitHub</h4>
+                    <svg class="w-4 h-4 duration-200 ease-out" :class="{ 'rotate-180': activeAccordion == id }"
+                        viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" fill="none" stroke="currentColor"
+                        stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                        <polyline points="6 9 12 15 18 9"></polyline>
+                    </svg>
+                </button>
+                <div x-show="activeAccordion==id" x-collapse x-cloak class="px-2">
+                    <div class="flex flex-col gap-2 pt-0 opacity-70">
+                        <div class="flex gap-2">
+                            <x-forms.input id="html_url" label="HTML Url" required />
+                            <x-forms.input id="api_url" label="API Url" required />
+                        </div>
+                        <div class="flex gap-2">
+                            <x-forms.input id="custom_user" label="Custom Git User" required />
+                            <x-forms.input id="custom_port" type="number" label="Custom Git Port" required />
+                        </div>
                     </div>
                 </div>
             </div>
         </div>
+
+
+        <x-forms.button class="mt-4" type="submit">
+            Continue
+        </x-forms.button>
+    </form>
+@else
+    <div class="text-gray-500 p-4 text-center">
+        <p>You don't have permission to create new GitHub Apps.</p>
+        <p class="text-sm">Please contact your team administrator for access.</p>
     </div>
-
-
-    <x-forms.button class="mt-4" type="submit">
-        Continue
-    </x-forms.button>
-</form>
+@endcan
diff --git a/resources/views/livewire/storage/create.blade.php b/resources/views/livewire/storage/create.blade.php
index 15fa31c9c..735e040eb 100644
--- a/resources/views/livewire/storage/create.blade.php
+++ b/resources/views/livewire/storage/create.blade.php
@@ -1,24 +1,31 @@
-<div class="w-full">
-    <div class="mb-4">For more details, please visit the <a class="underline dark:text-warning"
-            href="https://coolify.io/docs/knowledge-base/s3/introduction" target="_blank">Coolify Docs</a>.</div>
-    <form class="flex flex-col gap-2" wire:submit='submit'>
-        <div class="flex gap-2">
-            <x-forms.input required label="Name" id="name" />
-            <x-forms.input label="Description" id="description" />
-        </div>
-        <x-forms.input required type="url" label="Endpoint" wire:model.blur-sm="endpoint" />
-        <div class="flex gap-2">
-            <x-forms.input required label="Bucket" id="bucket" />
-            <x-forms.input required helper="Region only required for AWS. Leave it as-is for other providers."
-                label="Region" id="region" />
-        </div>
-        <div class="flex gap-2">
-            <x-forms.input required type="password" label="Access Key" id="key" />
-            <x-forms.input required type="password" label="Secret Key" id="secret" />
-        </div>
+@can('create', App\Models\S3Storage::class)
+    <div class="w-full">
+        <div class="mb-4">For more details, please visit the <a class="underline dark:text-warning"
+                href="https://coolify.io/docs/knowledge-base/s3/introduction" target="_blank">Coolify Docs</a>.</div>
+        <form class="flex flex-col gap-2" wire:submit='submit'>
+            <div class="flex gap-2">
+                <x-forms.input required label="Name" id="name" />
+                <x-forms.input label="Description" id="description" />
+            </div>
+            <x-forms.input required type="url" label="Endpoint" wire:model.blur-sm="endpoint" />
+            <div class="flex gap-2">
+                <x-forms.input required label="Bucket" id="bucket" />
+                <x-forms.input required helper="Region only required for AWS. Leave it as-is for other providers."
+                    label="Region" id="region" />
+            </div>
+            <div class="flex gap-2">
+                <x-forms.input required type="password" label="Access Key" id="key" />
+                <x-forms.input required type="password" label="Secret Key" id="secret" />
+            </div>
 
-        <x-forms.button class="mt-4" type="submit">
-            Validate Connection & Continue
-        </x-forms.button>
-    </form>
-</div>
+            <x-forms.button class="mt-4" type="submit">
+                Validate Connection & Continue
+            </x-forms.button>
+        </form>
+    </div>
+@else
+    <div class="text-gray-500 p-4 text-center">
+        <p>You don't have permission to create new S3 storage configurations.</p>
+        <p class="text-sm">Please contact your team administrator for access.</p>
+    </div>
+@endcan
diff --git a/resources/views/livewire/storage/form.blade.php b/resources/views/livewire/storage/form.blade.php
index 3968ba02d..23892ec01 100644
--- a/resources/views/livewire/storage/form.blade.php
+++ b/resources/views/livewire/storage/form.blade.php
@@ -19,33 +19,37 @@ class="px-2 py-1 text-xs font-semibold text-red-800 bg-red-100 rounded dark:text
                     @endif
                 </div>
             </div>
-            <x-forms.button type="submit">
-                Save
-            </x-forms.button>
+            <x-forms.button canGate="update" :canResource="$storage" type="submit">Save</x-forms.button>
 
-            <x-modal-confirmation title="Confirm Storage Deletion?" isErrorButton buttonTitle="Delete"
-                submitAction="delete({{ $storage->id }})" :actions="[
-                    'The selected storage location will be permanently deleted from Coolify.',
-                    'If the storage location is in use by any backup jobs those backup jobs will only store the backup locally on the server.',
-                ]" confirmationText="{{ $storage->name }}"
-                confirmationLabel="Please confirm the execution of the actions by entering the Storage Name below"
-                shortConfirmationLabel="Storage Name" :confirmWithPassword="false" step2ButtonText="Permanently Delete" />
+            @can('delete', $storage)
+                <x-modal-confirmation title="Confirm Storage Deletion?" isErrorButton buttonTitle="Delete"
+                    submitAction="delete({{ $storage->id }})" :actions="[
+                        'The selected storage location will be permanently deleted from Coolify.',
+                        'If the storage location is in use by any backup jobs those backup jobs will only store the backup locally on the server.',
+                    ]" confirmationText="{{ $storage->name }}"
+                    confirmationLabel="Please confirm the execution of the actions by entering the Storage Name below"
+                    shortConfirmationLabel="Storage Name" :confirmWithPassword="false" step2ButtonText="Permanently Delete" />
+            @endcan
         </div>
         <div class="flex gap-2">
-            <x-forms.input label="Name" id="storage.name" />
-            <x-forms.input label="Description" id="storage.description" />
+            <x-forms.input canGate="update" :canResource="$storage" label="Name" id="storage.name" />
+            <x-forms.input canGate="update" :canResource="$storage" label="Description" id="storage.description" />
         </div>
         <div class="flex gap-2">
-            <x-forms.input required label="Endpoint" id="storage.endpoint" />
-            <x-forms.input required label="Bucket" id="storage.bucket" />
-            <x-forms.input required label="Region" id="storage.region" />
+            <x-forms.input canGate="update" :canResource="$storage" required label="Endpoint" id="storage.endpoint" />
+            <x-forms.input canGate="update" :canResource="$storage" required label="Bucket" id="storage.bucket" />
+            <x-forms.input canGate="update" :canResource="$storage" required label="Region" id="storage.region" />
         </div>
         <div class="flex gap-2">
-            <x-forms.input required type="password" label="Access Key" id="storage.key" />
-            <x-forms.input required type="password" label="Secret Key" id="storage.secret" />
+            <x-forms.input canGate="update" :canResource="$storage" required type="password" label="Access Key"
+                id="storage.key" />
+            <x-forms.input canGate="update" :canResource="$storage" required type="password" label="Secret Key"
+                id="storage.secret" />
         </div>
-        <x-forms.button class="mt-4" isHighlighted wire:click="testConnection">
-            Validate Connection
-        </x-forms.button>
+        @can('validateConnection', $storage)
+            <x-forms.button class="mt-4" isHighlighted wire:click="testConnection">
+                Validate Connection
+            </x-forms.button>
+        @endcan
     </form>
 </div>
diff --git a/resources/views/livewire/storage/index.blade.php b/resources/views/livewire/storage/index.blade.php
index f426d3d71..4ef39c256 100644
--- a/resources/views/livewire/storage/index.blade.php
+++ b/resources/views/livewire/storage/index.blade.php
@@ -4,9 +4,11 @@
     </x-slot>
     <div class="flex items-center gap-2">
         <h1>S3 Storages</h1>
-        <x-modal-input buttonTitle="+ Add" title="New S3 Storage" :closeOutside="false">
-            <livewire:storage.create />
-        </x-modal-input>
+        @can('create', App\Models\S3Storage::class)
+            <x-modal-input buttonTitle="+ Add" title="New S3 Storage" :closeOutside="false">
+                <livewire:storage.create />
+            </x-modal-input>
+        @endcan
     </div>
     <div class="subtitle">S3 storages for backups.</div>
     <div class="grid gap-4 lg:grid-cols-2">
diff --git a/resources/views/livewire/team/index.blade.php b/resources/views/livewire/team/index.blade.php
index d318b5d66..21cd0b622 100644
--- a/resources/views/livewire/team/index.blade.php
+++ b/resources/views/livewire/team/index.blade.php
@@ -11,69 +11,73 @@
         </div>
 
         <div class="flex items-end gap-2 pb-6">
-            <x-forms.input id="team.name" label="Name" required />
-            <x-forms.input id="team.description" label="Description" />
-            <x-forms.button type="submit">
-                Save
-            </x-forms.button>
+            <x-forms.input id="team.name" label="Name" required canGate="update" :canResource="$team" />
+            <x-forms.input id="team.description" label="Description" canGate="update" :canResource="$team" />
+            @can('update', $team)
+                <x-forms.button type="submit">
+                    Save
+                </x-forms.button>
+            @endcan
         </div>
     </form>
 
-    <div>
-        <h2>Danger Zone</h2>
-        <div class="pb-4">Woah. I hope you know what are you doing.</div>
-        <h4 class="pb-4">Delete Team</h4>
-        @if (session('currentTeam.id') === 0)
-            <div>This is the default team. You can't delete it.</div>
-        @elseif(auth()->user()->teams()->get()->count() === 1 || auth()->user()->currentTeam()->personal_team)
-            <div>You can't delete your last / personal team.</div>
-        @elseif(currentTeam()->subscription)
-            <div>Please cancel your subscription <a class="underline dark:text-white"
-                    href="{{ route('subscription.show') }}">here</a> before deleting this team.</div>
-        @else
-            @if (currentTeam()->isEmpty())
-                <div class="pb-4">This will delete your team. Beware! There is no coming back!</div>
-                <x-modal-confirmation title="Confirm Team Deletion?" buttonTitle="Delete" isErrorButton
-                    submitAction="delete({{ currentTeam()->id }})" :actions="['The current team will be permanently deleted from Coolify and the database.']"
-                    confirmationText="{{ currentTeam()->name }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Team Name below"
-                    shortConfirmationLabel="Team Name" :confirmWithPassword="false" step2ButtonText="Permanently Delete" />
+    @can('delete', $team)
+        <div>
+            <h2>Danger Zone</h2>
+            <div class="pb-4">Woah. I hope you know what are you doing.</div>
+            <h4 class="pb-4">Delete Team</h4>
+            @if (session('currentTeam.id') === 0)
+                <div>This is the default team. You can't delete it.</div>
+            @elseif(auth()->user()->teams()->get()->count() === 1 || auth()->user()->currentTeam()->personal_team)
+                <div>You can't delete your last / personal team.</div>
+            @elseif(currentTeam()->subscription)
+                <div>Please cancel your subscription <a class="underline dark:text-white"
+                        href="{{ route('subscription.show') }}">here</a> before deleting this team.</div>
             @else
-                <div>
-                    <div class="pb-4">You need to delete the following resources to be able to delete the team:</div>
-                    @if (currentTeam()->projects()->count() > 0)
-                        <h4 class="pb-4">Projects:</h4>
-                        <ul class="pl-8 list-disc">
-                            @foreach (currentTeam()->projects as $resource)
-                                <li>{{ $resource->name }}</li>
-                            @endforeach
-                        </ul>
-                    @endif
-                    @if (currentTeam()->servers()->count() > 0)
-                        <h4 class="py-4">Servers:</h4>
-                        <ul class="pl-8 list-disc">
-                            @foreach (currentTeam()->servers as $resource)
-                                <li>{{ $resource->name }}</li>
-                            @endforeach
-                        </ul>
-                    @endif
-                    @if (currentTeam()->privateKeys()->count() > 0)
-                        <h4 class="py-4">Private Keys:</h4>
-                        <ul class="pl-8 list-disc">
-                            @foreach (currentTeam()->privateKeys as $resource)
-                                <li>{{ $resource->name }}</li>
-                            @endforeach
-                        </ul>
-                    @endif
-                    @if (currentTeam()->sources()->count() > 0)
-                        <h4 class="py-4">Sources:</h4>
-                        <ul class="pl-8 list-disc">
-                            @foreach (currentTeam()->sources() as $resource)
-                                <li>{{ $resource->name }}</li>
-                            @endforeach
-                        </ul>
-                    @endif
+                @if (currentTeam()->isEmpty())
+                    <div class="pb-4">This will delete your team. Beware! There is no coming back!</div>
+                    <x-modal-confirmation title="Confirm Team Deletion?" buttonTitle="Delete" isErrorButton
+                        submitAction="delete({{ currentTeam()->id }})" :actions="['The current team will be permanently deleted from Coolify and the database.']"
+                        confirmationText="{{ currentTeam()->name }}"
+                        confirmationLabel="Please confirm the execution of the actions by entering the Team Name below"
+                        shortConfirmationLabel="Team Name" :confirmWithPassword="false" step2ButtonText="Permanently Delete" />
+                @else
+                    <div>
+                        <div class="pb-4">You need to delete the following resources to be able to delete the team:</div>
+                        @if (currentTeam()->projects()->count() > 0)
+                            <h4 class="pb-4">Projects:</h4>
+                            <ul class="pl-8 list-disc">
+                                @foreach (currentTeam()->projects as $resource)
+                                    <li>{{ $resource->name }}</li>
+                                @endforeach
+                            </ul>
+                        @endif
+                        @if (currentTeam()->servers()->count() > 0)
+                            <h4 class="py-4">Servers:</h4>
+                            <ul class="pl-8 list-disc">
+                                @foreach (currentTeam()->servers as $resource)
+                                    <li>{{ $resource->name }}</li>
+                                @endforeach
+                            </ul>
+                        @endif
+                        @if (currentTeam()->privateKeys()->count() > 0)
+                            <h4 class="py-4">Private Keys:</h4>
+                            <ul class="pl-8 list-disc">
+                                @foreach (currentTeam()->privateKeys as $resource)
+                                    <li>{{ $resource->name }}</li>
+                                @endforeach
+                            </ul>
+                        @endif
+                        @if (currentTeam()->sources()->count() > 0)
+                            <h4 class="py-4">Sources:</h4>
+                            <ul class="pl-8 list-disc">
+                                @foreach (currentTeam()->sources() as $resource)
+                                    <li>{{ $resource->name }}</li>
+                                @endforeach
+                            </ul>
+                        @endif
+                @endif
             @endif
-        @endif
-    </div>
+        </div>
+    @endcan
 </div>
diff --git a/resources/views/livewire/team/invitations.blade.php b/resources/views/livewire/team/invitations.blade.php
index f318e4d61..f52d79491 100644
--- a/resources/views/livewire/team/invitations.blade.php
+++ b/resources/views/livewire/team/invitations.blade.php
@@ -1,64 +1,66 @@
-<div>
-    @if ($invitations->count() > 0)
-        <h2 class="pb-2">Pending Invitations</h2>
-        <div class="flex flex-col">
+@can('manageInvitations', currentTeam())
+    <div>
+        @if ($invitations->count() > 0)
+            <h2 class="pb-2">Pending Invitations</h2>
             <div class="flex flex-col">
-                <div class="overflow-x-auto">
-                    <div class="inline-block min-w-full">
-                        <div class="overflow-hidden">
-                            <table class="min-w-full">
-                                <thead>
-                                    <tr>
-                                        <th class="px-5 py-3 text-xs font-medium text-left uppercase">Email
-                                        </th>
-                                        <th class="px-5 py-3 text-xs font-medium text-left uppercase">
-                                            Via</th>
-                                        <th class="px-5 py-3 text-xs font-medium text-left uppercase">Role</th>
-                                        <th class="px-5 py-3 text-xs font-medium text-left uppercase">Invitation Link
-                                        </th>
-                                        <th class="px-5 py-3 text-xs font-medium text-left uppercase">Actions
-                                        </th>
-                                    </tr>
-                                </thead>
-                                <tbody>
-                                    @foreach ($invitations as $invite)
+                <div class="flex flex-col">
+                    <div class="overflow-x-auto">
+                        <div class="inline-block min-w-full">
+                            <div class="overflow-hidden">
+                                <table class="min-w-full">
+                                    <thead>
                                         <tr>
-                                            <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $invite->email }}</td>
-                                            <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $invite->via }}</td>
-                                            <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $invite->role }}</td>
-                                            <td class="px-5 py-4 text-sm whitespace-nowrap" x-data="checkProtocol">
-                                                <template x-if="isHttps">
-                                                    <div class="flex gap-2">
+                                            <th class="px-5 py-3 text-xs font-medium text-left uppercase">Email
+                                            </th>
+                                            <th class="px-5 py-3 text-xs font-medium text-left uppercase">
+                                                Via</th>
+                                            <th class="px-5 py-3 text-xs font-medium text-left uppercase">Role</th>
+                                            <th class="px-5 py-3 text-xs font-medium text-left uppercase">Invitation Link
+                                            </th>
+                                            <th class="px-5 py-3 text-xs font-medium text-left uppercase">Actions
+                                            </th>
+                                        </tr>
+                                    </thead>
+                                    <tbody>
+                                        @foreach ($invitations as $invite)
+                                            <tr>
+                                                <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $invite->email }}</td>
+                                                <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $invite->via }}</td>
+                                                <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $invite->role }}</td>
+                                                <td class="px-5 py-4 text-sm whitespace-nowrap" x-data="checkProtocol">
+                                                    <template x-if="isHttps">
+                                                        <div class="flex gap-2">
+                                                            <x-forms.input id="null" type="password"
+                                                                value="{{ $invite->link }}" />
+                                                            <x-forms.button
+                                                                x-on:click="copyToClipboard('{{ $invite->link }}')">Copy
+                                                                Invitation
+                                                                Link</x-forms.button>
+                                                        </div>
+                                                    </template>
+                                                    <template x-if="!isHttps">
                                                         <x-forms.input id="null" type="password"
                                                             value="{{ $invite->link }}" />
-                                                        <x-forms.button
-                                                            x-on:click="copyToClipboard('{{ $invite->link }}')">Copy
-                                                            Invitation
-                                                            Link</x-forms.button>
-                                                    </div>
-                                                </template>
-                                                <template x-if="!isHttps">
-                                                    <x-forms.input id="null" type="password"
-                                                        value="{{ $invite->link }}" />
-                                                </template>
-                                            </td>
-                                            <td class="px-5 py-4 text-sm whitespace-nowrap">
-                                                <x-forms.button
-                                                    wire:click.prevent='deleteInvitation({{ $invite->id }})'>Revoke
-                                                    Invitation
-                                                </x-forms.button>
-                                            </td>
-                                        </tr>
-                                    @endforeach
-                                </tbody>
-                            </table>
+                                                    </template>
+                                                </td>
+                                                <td class="px-5 py-4 text-sm whitespace-nowrap">
+                                                    <x-forms.button
+                                                        wire:click.prevent='deleteInvitation({{ $invite->id }})'>Revoke
+                                                        Invitation
+                                                    </x-forms.button>
+                                                </td>
+                                            </tr>
+                                        @endforeach
+                                    </tbody>
+                                </table>
+                            </div>
                         </div>
                     </div>
                 </div>
             </div>
-        </div>
-    @endif
-</div>
+        @endif
+    </div>
+@endcan
 
 @script
     <script>
diff --git a/resources/views/livewire/team/invite-link.blade.php b/resources/views/livewire/team/invite-link.blade.php
index eea1948b5..a6c2fb9ec 100644
--- a/resources/views/livewire/team/invite-link.blade.php
+++ b/resources/views/livewire/team/invite-link.blade.php
@@ -1,18 +1,20 @@
-<form wire:submit='viaLink' class="flex gap-2 flex-col lg:flex-row items-end">
-    <div class="flex flex-1 lg:w-fit w-full gap-2">
-        <x-forms.input id="email" type="email" label="Email" name="email" placeholder="Email" required />
-        <x-forms.select id="role" name="role" label="Role">
-            @if (auth()->user()->role() === 'owner')
-                <option value="owner">Owner</option>
+@can('manageInvitations', currentTeam())
+    <form wire:submit='viaLink' class="flex gap-2 flex-col lg:flex-row items-end">
+        <div class="flex flex-1 lg:w-fit w-full gap-2">
+            <x-forms.input id="email" type="email" label="Email" name="email" placeholder="Email" required />
+            <x-forms.select id="role" name="role" label="Role">
+                @if (auth()->user()->role() === 'owner')
+                    <option value="owner">Owner</option>
+                @endif
+                <option value="admin">Admin</option>
+                <option value="member">Member</option>
+            </x-forms.select>
+        </div>
+        <div class="flex gap-2 lg:w-fit w-full">
+            <x-forms.button type="submit">Generate Invitation Link</x-forms.button>
+            @if (is_transactional_emails_enabled())
+                <x-forms.button wire:click.prevent='viaEmail'>Send Invitation via Email</x-forms.button>
             @endif
-            <option value="admin">Admin</option>
-            <option value="member">Member</option>
-        </x-forms.select>
-    </div>
-    <div class="flex gap-2 lg:w-fit w-full">
-        <x-forms.button type="submit">Generate Invitation Link</x-forms.button>
-        @if (is_transactional_emails_enabled())
-            <x-forms.button wire:click.prevent='viaEmail'>Send Invitation via Email</x-forms.button>
-        @endif
-    </div>
-</form>
+        </div>
+    </form>
+@endcan
diff --git a/resources/views/livewire/team/member.blade.php b/resources/views/livewire/team/member.blade.php
index fac93e1c7..b076af33c 100644
--- a/resources/views/livewire/team/member.blade.php
+++ b/resources/views/livewire/team/member.blade.php
@@ -12,7 +12,7 @@
         {{ data_get($member, 'pivot.role') }}
     </td>
     <td class="flex gap-2 px-5 py-4 text-sm whitespace-nowrap">
-        @if (Auth::user()->isAdminFromSession())
+        @can('manageMembers', currentTeam())
             @if ($member->id !== Auth::id())
                 @if (Auth::user()->isOwner())
                     @if (data_get($member, 'pivot.role') === 'owner')
@@ -43,6 +43,10 @@
             @else
                 <div>(This is you)</div>
             @endif
-        @endif
+        @else
+            @if ($member->id === Auth::id())
+                <div>(This is you)</div>
+            @endif
+        @endcan
     </td>
 </tr>
diff --git a/resources/views/livewire/team/member/index.blade.php b/resources/views/livewire/team/member/index.blade.php
index f1ece8263..b5b4ab812 100644
--- a/resources/views/livewire/team/member/index.blade.php
+++ b/resources/views/livewire/team/member/index.blade.php
@@ -33,7 +33,7 @@
             </div>
         </div>
     </div>
-    @if (auth()->user()->isAdminFromSession())
+    @can('manageInvitations', currentTeam())
         <div class="py-4">
             @if (is_transactional_emails_enabled())
                 <h2 class="pb-4">Invite New Member</h2>
@@ -55,5 +55,5 @@
             <livewire:team.invite-link />
         </div>
         <livewire:team.invitations :invitations="$invitations" />
-    @endif
+    @endcan
 </div>
diff --git a/resources/views/source/all.blade.php b/resources/views/source/all.blade.php
index 3bee9e508..b37edba46 100644
--- a/resources/views/source/all.blade.php
+++ b/resources/views/source/all.blade.php
@@ -4,9 +4,11 @@
     </x-slot>
     <div class="flex items-center gap-2">
         <h1>Sources</h1>
-        <x-modal-input buttonTitle="+ Add" title="New GitHub App" :closeOutside="false">
-            <livewire:source.github.create />
-        </x-modal-input>
+        @can('createAnyResource')
+            <x-modal-input buttonTitle="+ Add" title="New GitHub App" :closeOutside="false">
+                <livewire:source.github.create />
+            </x-modal-input>
+        @endcan
     </div>
     <div class="subtitle">Git sources for your applications.</div>
     <div class="grid gap-4 lg:grid-cols-2">
@@ -27,18 +29,6 @@
                     </div>
                 </a>
             @endif
-            {{-- @if ($source->getMorphClass() === 'App\Models\GitlabApp')
-                <a class="flex gap-4 text-center hover:no-underline box group"
-                    href="{{ route('source.gitlab.show', ['gitlab_app_uuid' => data_get($source, 'uuid')]) }}">
-                    <x-git-icon class="dark:text-white w-8 h-8" git="{{ $source->getMorphClass() }}" />
-                    <div class="text-left dark:group-hover:text-white">
-                        <div>{{ $source->name }}</div>
-                        @if (is_null($source->app_id))
-                            <span class="text-error">Configuration is not finished</span>
-                        @endif
-                    </div>
-                </a>
-            @endif --}}
         @empty
             <div>
                 <div>No sources found.</div>
diff --git a/routes/web.php b/routes/web.php
index a8486defa..02b23cc37 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -74,10 +74,8 @@
 use App\Livewire\Team\Index as TeamIndex;
 use App\Livewire\Team\Member\Index as TeamMemberIndex;
 use App\Livewire\Terminal\Index as TerminalIndex;
-use App\Models\GitlabApp;
 use App\Models\ScheduledDatabaseBackupExecution;
 use App\Providers\RouteServiceProvider;
-use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
 use Illuminate\Support\Facades\Storage;
 use Symfony\Component\HttpFoundation\StreamedResponse;
@@ -147,7 +145,7 @@
         Route::get('/admin', TeamAdminView::class)->name('team.admin-view');
     });
 
-    Route::get('/terminal', TerminalIndex::class)->name('terminal');
+    Route::get('/terminal', TerminalIndex::class)->name('terminal')->middleware('can.access.terminal');
     Route::post('/terminal/auth', function () {
         if (auth()->check()) {
             return response()->json(['authenticated' => true], 200);
@@ -175,13 +173,13 @@
     Route::get('/projects', ProjectIndex::class)->name('project.index');
     Route::prefix('project/{project_uuid}')->group(function () {
         Route::get('/', ProjectShow::class)->name('project.show');
-        Route::get('/edit', ProjectEdit::class)->name('project.edit');
+        Route::get('/edit', ProjectEdit::class)->name('project.edit')->middleware('can.update.resource');
     });
     Route::prefix('project/{project_uuid}/environment/{environment_uuid}')->group(function () {
         Route::get('/', ResourceIndex::class)->name('project.resource.index');
         Route::get('/clone', ProjectCloneMe::class)->name('project.clone-me')->middleware('can.create.resources');
         Route::get('/new', ResourceCreate::class)->name('project.resource.create')->middleware('can.create.resources');
-        Route::get('/edit', EnvironmentEdit::class)->name('project.environment.edit');
+        Route::get('/edit', EnvironmentEdit::class)->name('project.environment.edit')->middleware('can.update.resource');
     });
     Route::prefix('project/{project_uuid}/environment/{environment_uuid}/application/{application_uuid}')->group(function () {
         Route::get('/', ApplicationConfiguration::class)->name('project.application.configuration');
@@ -205,14 +203,14 @@
         Route::get('/deployment', DeploymentIndex::class)->name('project.application.deployment.index');
         Route::get('/deployment/{deployment_uuid}', DeploymentShow::class)->name('project.application.deployment.show');
         Route::get('/logs', Logs::class)->name('project.application.logs');
-        Route::get('/terminal', ExecuteContainerCommand::class)->name('project.application.command');
+        Route::get('/terminal', ExecuteContainerCommand::class)->name('project.application.command')->middleware('can.access.terminal');
         Route::get('/tasks/{task_uuid}', ScheduledTaskShow::class)->name('project.application.scheduled-tasks');
     });
     Route::prefix('project/{project_uuid}/environment/{environment_uuid}/database/{database_uuid}')->group(function () {
         Route::get('/', DatabaseConfiguration::class)->name('project.database.configuration');
         Route::get('/environment-variables', DatabaseConfiguration::class)->name('project.database.environment-variables');
         Route::get('/servers', DatabaseConfiguration::class)->name('project.database.servers');
-        Route::get('/import-backups', DatabaseConfiguration::class)->name('project.database.import-backups');
+        Route::get('/import-backups', DatabaseConfiguration::class)->name('project.database.import-backups')->middleware('can.update.resource');
         Route::get('/persistent-storage', DatabaseConfiguration::class)->name('project.database.persistent-storage');
         Route::get('/webhooks', DatabaseConfiguration::class)->name('project.database.webhooks');
         Route::get('/resource-limits', DatabaseConfiguration::class)->name('project.database.resource-limits');
@@ -222,7 +220,7 @@
         Route::get('/danger', DatabaseConfiguration::class)->name('project.database.danger');
 
         Route::get('/logs', Logs::class)->name('project.database.logs');
-        Route::get('/terminal', ExecuteContainerCommand::class)->name('project.database.command');
+        Route::get('/terminal', ExecuteContainerCommand::class)->name('project.database.command')->middleware('can.access.terminal');
         Route::get('/backups', DatabaseBackupIndex::class)->name('project.database.backup.index');
         Route::get('/backups/{backup_uuid}', DatabaseBackupExecution::class)->name('project.database.backup.execution');
     });
@@ -236,7 +234,7 @@
         Route::get('/resource-operations', ServiceConfiguration::class)->name('project.service.resource-operations');
         Route::get('/tags', ServiceConfiguration::class)->name('project.service.tags');
         Route::get('/danger', ServiceConfiguration::class)->name('project.service.danger');
-        Route::get('/terminal', ExecuteContainerCommand::class)->name('project.service.command');
+        Route::get('/terminal', ExecuteContainerCommand::class)->name('project.service.command')->middleware('can.access.terminal');
         Route::get('/{stack_service_uuid}', ServiceIndex::class)->name('project.service.index');
         Route::get('/tasks/{task_uuid}', ScheduledTaskShow::class)->name('project.service.scheduled-tasks');
     });
@@ -258,10 +256,10 @@
         Route::get('/proxy', ProxyShow::class)->name('server.proxy');
         Route::get('/proxy/dynamic', ProxyDynamicConfigurations::class)->name('server.proxy.dynamic-confs');
         Route::get('/proxy/logs', ProxyLogs::class)->name('server.proxy.logs');
-        Route::get('/terminal', ExecuteContainerCommand::class)->name('server.command');
+        Route::get('/terminal', ExecuteContainerCommand::class)->name('server.command')->middleware('can.access.terminal');
         Route::get('/docker-cleanup', DockerCleanup::class)->name('server.docker-cleanup');
-        Route::get('/security', fn () => redirect(route('dashboard')))->name('server.security');
-        Route::get('/security/patches', Patches::class)->name('server.security.patches');
+        Route::get('/security', fn () => redirect(route('dashboard')))->name('server.security')->middleware('can.update.resource');
+        Route::get('/security/patches', Patches::class)->name('server.security.patches')->middleware('can.update.resource');
     });
     Route::get('/destinations', DestinationIndex::class)->name('destination.index');
     Route::get('/destination/{destination_uuid}', DestinationShow::class)->name('destination.show');
@@ -283,13 +281,6 @@
         ]);
     })->name('source.all');
     Route::get('/source/github/{github_app_uuid}', GitHubChange::class)->name('source.github.show');
-    Route::get('/source/gitlab/{gitlab_app_uuid}', function (Request $request) {
-        $gitlab_app = GitlabApp::ownedByCurrentTeam()->where('uuid', request()->gitlab_app_uuid)->firstOrFail();
-
-        return view('source.gitlab.show', [
-            'gitlab_app' => $gitlab_app,
-        ]);
-    })->name('source.gitlab.show');
 });
 
 Route::middleware(['auth'])->group(function () {