app/Domain/Files/FileAccessPolicy.php

<?php

namespace App\Domain\Files;

use App\Domain\Identity\RbacService;

class FileAccessPolicy
{
    public function __construct(private readonly RbacService $rbac)
    {
    }

    public function canAccess(object $file, string $actorUserId): bool
    {
        return $file->owner_user_id === $actorUserId
            || $this->rbac->can($actorUserId, 'SYSTEM_CONFIGURE');
    }

    public function canManage(object $file, string $actorUserId): bool
    {
        return $this->canAccess($file, $actorUserId);
    }
}