landing-api/app/Policies/RolePolicy.php

<?php

declare(strict_types=1);

namespace App\Policies;

use App\Models\User;
use App\Support\Permissions;
use Illuminate\Database\Eloquent\Model;

class RolePolicy extends ResourcePolicy
{
    protected function resource(): string
    {
        return 'roles';
    }

    /**
     * Only a super admin may touch the super_admin role itself — otherwise an
     * administrator could edit their way up to it.
     */
    public function update(User $user, Model $model): bool
    {
        if ($model->name === 'super_admin' && ! $user->hasRole('super_admin')) {
            return false;
        }

        return parent::update($user, $model);
    }

    /**
     * The bootstrapping roles (super_admin, and the role new logins receive)
     * are structural: deleting one would leave the app unable to onboard or
     * administer anyone.
     */
    public function delete(User $user, Model $model): bool
    {
        if (in_array($model->name, Permissions::protectedRoles(), true)) {
            return false;
        }

        return parent::delete($user, $model);
    }
}