app/Domain/Applications/ApplicationWorkflowPolicy.php

<?php

namespace App\Domain\Applications;

use App\Domain\Identity\RbacService;

class ApplicationWorkflowPolicy
{
    public function __construct(private readonly RbacService $rbac)
    {
    }

    public function canAccess(object $application, string $actorUserId): bool
    {
        return $application->user_id === $actorUserId || $this->canManage($actorUserId);
    }

    public function canManage(string $actorUserId): bool
    {
        return $this->rbac->can($actorUserId, 'SYSTEM_CONFIGURE')
            || $this->rbac->can($actorUserId, 'SYSTEM_ADMIN_ACCESS');
    }
}