diff --git a/Modules/Helpdesk/Livewire/KanbanBoard.php b/Modules/Helpdesk/Livewire/KanbanBoard.php
index b81eaee..6dff560 100644
--- a/Modules/Helpdesk/Livewire/KanbanBoard.php
+++ b/Modules/Helpdesk/Livewire/KanbanBoard.php
@@ -206,7 +206,9 @@ final class KanbanBoard extends Component
         }
 
         return Ticket::query()
-            ->with(['user:id,name,email', 'agent:id,name,email', 'status', 'priority', 'category', 'project', 'team', 'product', 'tags', 'checklistItems', 'board'])
+            ->leftJoin('users as helpdesk_agents', 'helpdesk_agents.id', '=', 'helpdesk_tickets.agent_id')
+            ->select('helpdesk_tickets.*', 'helpdesk_agents.name as agent_name')
+            ->with(['user:id,name,email', 'status', 'priority', 'category', 'project', 'team', 'product', 'tags', 'checklistItems', 'board'])
             ->visibleTo(Auth::user())
             ->where('board_id', $board->id)
             ->latest('last_activity_at')
diff --git a/Modules/UserManagement/Database/Migrations/2026_08_26_090000_create_user_management_roles_permissions.php b/Modules/UserManagement/Database/Migrations/2026_08_26_090000_create_user_management_roles_permissions.php
new file mode 100644
index 0000000..30848c0
--- /dev/null
+++ b/Modules/UserManagement/Database/Migrations/2026_08_26_090000_create_user_management_roles_permissions.php
@@ -0,0 +1,106 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('user_management_roles', function (Blueprint $table): void {
+            $table->id();
+            $table->string('name');
+            $table->string('slug')->unique();
+            $table->text('description')->nullable();
+            $table->boolean('is_system')->default(false);
+            $table->timestamps();
+        });
+
+        Schema::create('user_management_permissions', function (Blueprint $table): void {
+            $table->id();
+            $table->string('name');
+            $table->string('slug')->unique();
+            $table->text('description')->nullable();
+            $table->timestamps();
+        });
+
+        Schema::create('user_management_role_user', function (Blueprint $table): void {
+            $table->foreignId('role_id')->constrained('user_management_roles')->cascadeOnDelete();
+            $table->foreignId('user_id')->constrained('users')->cascadeOnDelete();
+            $table->primary(['role_id', 'user_id']);
+        });
+
+        Schema::create('user_management_permission_role', function (Blueprint $table): void {
+            $table->foreignId('permission_id')->constrained('user_management_permissions')->cascadeOnDelete();
+            $table->foreignId('role_id')->constrained('user_management_roles')->cascadeOnDelete();
+            $table->primary(['permission_id', 'role_id']);
+        });
+
+        $now = now();
+
+        $adminRole = DB::table('user_management_roles')->insertGetId([
+            'name' => 'Administrator',
+            'slug' => 'administrator',
+            'description' => 'Full application administration.',
+            'is_system' => true,
+            'created_at' => $now,
+            'updated_at' => $now,
+        ]);
+
+        $agentRole = DB::table('user_management_roles')->insertGetId([
+            'name' => 'Helpdesk Agent',
+            'slug' => 'helpdesk-agent',
+            'description' => 'Helpdesk workflow and ticket operations.',
+            'is_system' => true,
+            'created_at' => $now,
+            'updated_at' => $now,
+        ]);
+
+        foreach ([
+            ['Manage users', 'users.manage'],
+            ['Manage roles', 'roles.manage'],
+            ['Manage permissions', 'permissions.manage'],
+            ['Manage helpdesk', 'helpdesk.manage'],
+            ['Manage documentation', 'documentation.manage'],
+        ] as [$name, $slug]) {
+            $permissionId = DB::table('user_management_permissions')->insertGetId([
+                'name' => $name,
+                'slug' => $slug,
+                'created_at' => $now,
+                'updated_at' => $now,
+            ]);
+
+            DB::table('user_management_permission_role')->insert([
+                'permission_id' => $permissionId,
+                'role_id' => $adminRole,
+            ]);
+
+            if ($slug === 'helpdesk.manage') {
+                DB::table('user_management_permission_role')->insert([
+                    'permission_id' => $permissionId,
+                    'role_id' => $agentRole,
+                ]);
+            }
+        }
+
+        foreach (DB::table('users')->where('helpdesk_admin', true)->pluck('id') as $userId) {
+            DB::table('user_management_role_user')->insertOrIgnore(['role_id' => $adminRole, 'user_id' => $userId]);
+        }
+
+        foreach (DB::table('users')->where('helpdesk_agent', true)->where('helpdesk_admin', false)->pluck('id') as $userId) {
+            DB::table('user_management_role_user')->insertOrIgnore(['role_id' => $agentRole, 'user_id' => $userId]);
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('user_management_permission_role');
+        Schema::dropIfExists('user_management_role_user');
+        Schema::dropIfExists('user_management_permissions');
+        Schema::dropIfExists('user_management_roles');
+    }
+};
diff --git a/Modules/UserManagement/Http/Controllers/UserController.php b/Modules/UserManagement/Http/Controllers/UserController.php
index 254be62..8efccfd 100644
--- a/Modules/UserManagement/Http/Controllers/UserController.php
+++ b/Modules/UserManagement/Http/Controllers/UserController.php
@@ -10,7 +10,10 @@ use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
 use Illuminate\Validation\Rule;
+use Modules\UserManagement\Models\Permission;
+use Modules\UserManagement\Models\Role;
 
 final class UserController extends Controller
 {
@@ -19,11 +22,11 @@ final class UserController extends Controller
         $search = trim((string) $request->query('search', ''));
 
         $users = User::query()
+            ->with('roles')
             ->when($search !== '', static function ($query) use ($search): void {
-                $query->where(static function ($query) use ($search): void {
-                    $query->where('name', 'like', '%'.$search.'%')
-                        ->orWhere('email', 'like', '%'.$search.'%');
-                });
+                $query->where(fn ($query) => $query
+                    ->where('name', 'like', '%'.$search.'%')
+                    ->orWhere('email', 'like', '%'.$search.'%'));
             })
             ->orderBy('name')
             ->paginate(20)
@@ -34,18 +37,12 @@ final class UserController extends Controller
 
     public function create(): View
     {
-        return view('modules.user-management.create');
+        return view('modules.user-management.create', ['roles' => Role::query()->orderBy('name')->get()]);
     }
 
     public function store(Request $request): RedirectResponse
     {
-        $data = $request->validate([
-            'name' => ['required', 'string', 'max:255'],
-            'email' => ['required', 'email', 'max:255', 'unique:users,email'],
-            'password' => ['required', 'string', 'min:8', 'confirmed'],
-            'helpdesk_agent' => ['sometimes', 'boolean'],
-            'helpdesk_admin' => ['sometimes', 'boolean'],
-        ]);
+        $data = $this->validatedUser($request);
 
         $user = User::query()->create([
             'name' => $data['name'],
@@ -56,24 +53,24 @@ final class UserController extends Controller
             'helpdesk_admin' => $request->boolean('helpdesk_admin'),
         ]);
 
-        return redirect()->route('user-management.edit', $user)
-            ->with('status', 'User created successfully.');
+        $user->roles()->sync($request->input('roles', []));
+
+        return redirect()->route('user-management.edit', $user)->with('status', 'User created successfully.');
     }
 
     public function edit(User $user): View
     {
-        return view('modules.user-management.edit', compact('user'));
+        $user->load('roles');
+
+        return view('modules.user-management.edit', [
+            'user' => $user,
+            'roles' => Role::query()->orderBy('name')->get(),
+        ]);
     }
 
     public function update(Request $request, User $user): RedirectResponse
     {
-        $data = $request->validate([
-            'name' => ['required', 'string', 'max:255'],
-            'email' => ['required', 'email', 'max:255', Rule::unique('users', 'email')->ignore($user->id)],
-            'password' => ['nullable', 'string', 'min:8', 'confirmed'],
-            'helpdesk_agent' => ['sometimes', 'boolean'],
-            'helpdesk_admin' => ['sometimes', 'boolean'],
-        ]);
+        $data = $this->validatedUser($request, $user);
 
         $user->name = $data['name'];
         $user->email = $data['email'];
@@ -85,6 +82,7 @@ final class UserController extends Controller
         }
 
         $user->save();
+        $user->roles()->sync($request->input('roles', []));
 
         return back()->with('status', 'User updated successfully.');
     }
@@ -104,12 +102,128 @@ final class UserController extends Controller
 
     public function roles(): View
     {
-        $counts = [
-            'admins' => User::query()->where('helpdesk_admin', true)->count(),
-            'agents' => User::query()->where('helpdesk_agent', true)->count(),
-            'users' => User::query()->count(),
-        ];
+        return view('modules.user-management.roles', [
+            'roles' => Role::query()->withCount(['users', 'permissions'])->orderBy('name')->get(),
+            'permissions' => Permission::query()->withCount('roles')->orderBy('name')->get(),
+        ]);
+    }
 
-        return view('modules.user-management.roles', compact('counts'));
+    public function createRole(): View
+    {
+        return view('modules.user-management.role-form', [
+            'role' => new Role(),
+            'permissions' => Permission::query()->orderBy('name')->get(),
+        ]);
+    }
+
+    public function storeRole(Request $request): RedirectResponse
+    {
+        $data = $this->validatedRole($request);
+        $role = Role::query()->create($data);
+        $role->permissions()->sync($request->input('permissions', []));
+
+        return redirect()->route('user-management.roles')->with('status', 'Role created.');
+    }
+
+    public function editRole(Role $role): View
+    {
+        $role->load('permissions');
+
+        return view('modules.user-management.role-form', [
+            'role' => $role,
+            'permissions' => Permission::query()->orderBy('name')->get(),
+        ]);
+    }
+
+    public function updateRole(Request $request, Role $role): RedirectResponse
+    {
+        $role->update($this->validatedRole($request, $role));
+        $role->permissions()->sync($request->input('permissions', []));
+
+        return redirect()->route('user-management.roles')->with('status', 'Role updated.');
+    }
+
+    public function destroyRole(Role $role): RedirectResponse
+    {
+        if ($role->is_system) {
+            return back()->withErrors(['role' => 'System roles cannot be deleted.']);
+        }
+
+        $role->delete();
+
+        return back()->with('status', 'Role deleted.');
+    }
+
+    public function createPermission(): View
+    {
+        return view('modules.user-management.permission-form', ['permission' => new Permission()]);
+    }
+
+    public function storePermission(Request $request): RedirectResponse
+    {
+        Permission::query()->create($this->validatedPermission($request));
+
+        return redirect()->route('user-management.roles')->with('status', 'Permission created.');
+    }
+
+    public function editPermission(Permission $permission): View
+    {
+        return view('modules.user-management.permission-form', compact('permission'));
+    }
+
+    public function updatePermission(Request $request, Permission $permission): RedirectResponse
+    {
+        $permission->update($this->validatedPermission($request, $permission));
+
+        return redirect()->route('user-management.roles')->with('status', 'Permission updated.');
+    }
+
+    public function destroyPermission(Permission $permission): RedirectResponse
+    {
+        $permission->delete();
+
+        return back()->with('status', 'Permission deleted.');
+    }
+
+    private function validatedUser(Request $request, ?User $user = null): array
+    {
+        return $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'email' => ['required', 'email', 'max:255', Rule::unique('users', 'email')->ignore($user?->id)],
+            'password' => [$user ? 'nullable' : 'required', 'string', 'min:8', 'confirmed'],
+            'helpdesk_agent' => ['sometimes', 'boolean'],
+            'helpdesk_admin' => ['sometimes', 'boolean'],
+            'roles' => ['array'],
+            'roles.*' => ['integer', 'exists:user_management_roles,id'],
+        ]);
+    }
+
+    private function validatedRole(Request $request, ?Role $role = null): array
+    {
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'slug' => ['nullable', 'string', 'max:255', Rule::unique('user_management_roles', 'slug')->ignore($role?->id)],
+            'description' => ['nullable', 'string', 'max:2000'],
+            'permissions' => ['array'],
+            'permissions.*' => ['integer', 'exists:user_management_permissions,id'],
+        ]);
+
+        $data['slug'] = filled($data['slug'] ?? null) ? Str::slug($data['slug']) : Str::slug($data['name']);
+        unset($data['permissions']);
+
+        return $data;
+    }
+
+    private function validatedPermission(Request $request, ?Permission $permission = null): array
+    {
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'slug' => ['nullable', 'string', 'max:255', Rule::unique('user_management_permissions', 'slug')->ignore($permission?->id)],
+            'description' => ['nullable', 'string', 'max:2000'],
+        ]);
+
+        $data['slug'] = filled($data['slug'] ?? null) ? Str::slug($data['slug'], '.') : Str::slug($data['name'], '.');
+
+        return $data;
     }
 }
diff --git a/Modules/UserManagement/Models/Permission.php b/Modules/UserManagement/Models/Permission.php
new file mode 100644
index 0000000..95001b6
--- /dev/null
+++ b/Modules/UserManagement/Models/Permission.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Modules\UserManagement\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+
+final class Permission extends Model
+{
+    protected $table = 'user_management_permissions';
+
+    protected $fillable = ['name', 'slug', 'description'];
+
+    public function roles(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            Role::class,
+            'user_management_permission_role',
+            'permission_id',
+            'role_id'
+        );
+    }
+}
diff --git a/Modules/UserManagement/Models/Role.php b/Modules/UserManagement/Models/Role.php
new file mode 100644
index 0000000..3a6ea02
--- /dev/null
+++ b/Modules/UserManagement/Models/Role.php
@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Modules\UserManagement\Models;
+
+use App\Models\User;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+
+final class Role extends Model
+{
+    protected $table = 'user_management_roles';
+
+    protected $fillable = ['name', 'slug', 'description', 'is_system'];
+
+    protected $casts = ['is_system' => 'boolean'];
+
+    public function permissions(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            Permission::class,
+            'user_management_permission_role',
+            'role_id',
+            'permission_id'
+        );
+    }
+
+    public function users(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            User::class,
+            'user_management_role_user',
+            'role_id',
+            'user_id'
+        );
+    }
+}
diff --git a/Modules/UserManagement/Routes/web.php b/Modules/UserManagement/Routes/web.php
index 13ba516..29c2e65 100644
--- a/Modules/UserManagement/Routes/web.php
+++ b/Modules/UserManagement/Routes/web.php
@@ -8,7 +8,20 @@ use Modules\UserManagement\Http\Controllers\UserController;
 Route::get('/', [UserController::class, 'index'])->name('index');
 Route::get('/create', [UserController::class, 'create'])->name('create');
 Route::post('/', [UserController::class, 'store'])->name('store');
+
 Route::get('/roles', [UserController::class, 'roles'])->name('roles');
+Route::get('/roles/create', [UserController::class, 'createRole'])->name('roles.create');
+Route::post('/roles', [UserController::class, 'storeRole'])->name('roles.store');
+Route::get('/roles/{role}/edit', [UserController::class, 'editRole'])->name('roles.edit');
+Route::put('/roles/{role}', [UserController::class, 'updateRole'])->name('roles.update');
+Route::delete('/roles/{role}', [UserController::class, 'destroyRole'])->name('roles.destroy');
+
+Route::get('/permissions/create', [UserController::class, 'createPermission'])->name('permissions.create');
+Route::post('/permissions', [UserController::class, 'storePermission'])->name('permissions.store');
+Route::get('/permissions/{permission}/edit', [UserController::class, 'editPermission'])->name('permissions.edit');
+Route::put('/permissions/{permission}', [UserController::class, 'updatePermission'])->name('permissions.update');
+Route::delete('/permissions/{permission}', [UserController::class, 'destroyPermission'])->name('permissions.destroy');
+
 Route::get('/{user}/edit', [UserController::class, 'edit'])->name('edit');
 Route::put('/{user}', [UserController::class, 'update'])->name('update');
 Route::delete('/{user}', [UserController::class, 'destroy'])->name('destroy');
diff --git a/app/Models/User.php b/app/Models/User.php
index 0bfb92a..e2e6a48 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -13,6 +13,8 @@ use Illuminate\Support\Str;
 use Laravel\Fortify\Contracts\PasskeyUser;
 use Laravel\Fortify\PasskeyAuthenticatable;
 use Laravel\Fortify\TwoFactorAuthenticatable;
+use Modules\UserManagement\Models\Role;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 
 /**
  * @property int $id
@@ -48,6 +50,29 @@ class User extends Authenticatable implements PasskeyUser
             : $initials;
     }
 
+
+    public function roles(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            Role::class,
+            'user_management_role_user',
+            'user_id',
+            'role_id'
+        );
+    }
+
+    public function hasRole(string $role): bool
+    {
+        return $this->roles()->where('slug', $role)->exists();
+    }
+
+    public function hasPermission(string $permission): bool
+    {
+        return $this->roles()
+            ->whereHas('permissions', static fn ($query) => $query->where('slug', $permission))
+            ->exists();
+    }
+
     public function isHelpdeskAdmin(): bool
     {
         return (bool) $this->helpdesk_admin;
diff --git a/resources/themes/backend/views/modules/helpdesk/livewire/kanban-board.blade.php b/resources/themes/backend/views/modules/helpdesk/livewire/kanban-board.blade.php
index b10b0c3..56e67b4 100644
--- a/resources/themes/backend/views/modules/helpdesk/livewire/kanban-board.blade.php
+++ b/resources/themes/backend/views/modules/helpdesk/livewire/kanban-board.blade.php
@@ -138,7 +138,7 @@
                                         <div class="flex items-center gap-2"><i class="fa-solid fa-user w-3"
                                                 aria-hidden="true"></i> {{ $ticket->owner?->name ?? 'Unknown' }}</div>
                                         <div class="flex items-center gap-2"><i class="fa-solid fa-user-gear w-3"
-                                                aria-hidden="true"></i> {{ $ticket->agent?->name ?? 'Unassigned' }}
+                                                aria-hidden="true"></i> {{ $ticket->agent_name ?? 'Unassigned' }}
                                         </div>
                                         @if ($ticket->project)
                                             <div class="flex items-center gap-2"><i
diff --git a/resources/themes/backend/views/modules/user-management/create.blade.php b/resources/themes/backend/views/modules/user-management/create.blade.php
index eb52200..9f2e489 100644
--- a/resources/themes/backend/views/modules/user-management/create.blade.php
+++ b/resources/themes/backend/views/modules/user-management/create.blade.php
@@ -15,6 +15,19 @@
     <label><input type="checkbox" name="helpdesk_admin" value="1" @checked(old('helpdesk_admin', $user->helpdesk_admin ?? false))> <span><strong>Administrator</strong><small>Full Helpdesk, settings and user administration.</small></span></label>
 </div>
 
+<div>
+    <h2 class="mb-3 text-lg font-semibold">Custom roles</h2>
+    <div class="hd-role-options">
+        @foreach($roles as $roleOption)
+            <label>
+                <input type="checkbox" name="roles[]" value="{{ $roleOption->id }}"
+                    @checked(in_array($roleOption->id, old('roles', isset($user) ? $user->roles->pluck('id')->all() : [])))>
+                <span><strong>{{ $roleOption->name }}</strong><small>{{ $roleOption->description ?: $roleOption->slug }}</small></span>
+            </label>
+        @endforeach
+    </div>
+</div>
+
 <div class="flex justify-end"><button class="hd-action hd-action-green" type="submit"><i class="fa-solid fa-floppy-disk"></i> Create user</button></div></form>
 </div>
 </x-layouts::app>
diff --git a/resources/themes/backend/views/modules/user-management/edit.blade.php b/resources/themes/backend/views/modules/user-management/edit.blade.php
index 2108403..0b16db1 100644
--- a/resources/themes/backend/views/modules/user-management/edit.blade.php
+++ b/resources/themes/backend/views/modules/user-management/edit.blade.php
@@ -16,6 +16,19 @@
     <label><input type="checkbox" name="helpdesk_admin" value="1" @checked(old('helpdesk_admin', $user->helpdesk_admin ?? false))> <span><strong>Administrator</strong><small>Full Helpdesk, settings and user administration.</small></span></label>
 </div>
 
+<div>
+    <h2 class="mb-3 text-lg font-semibold">Custom roles</h2>
+    <div class="hd-role-options">
+        @foreach($roles as $roleOption)
+            <label>
+                <input type="checkbox" name="roles[]" value="{{ $roleOption->id }}"
+                    @checked(in_array($roleOption->id, old('roles', isset($user) ? $user->roles->pluck('id')->all() : [])))>
+                <span><strong>{{ $roleOption->name }}</strong><small>{{ $roleOption->description ?: $roleOption->slug }}</small></span>
+            </label>
+        @endforeach
+    </div>
+</div>
+
 <div class="flex flex-wrap justify-between gap-3"><div></div><button class="hd-action hd-action-blue" type="submit"><i class="fa-solid fa-floppy-disk"></i> Save changes</button></div></form>
 @if(auth()->id() !== $user->id)<form method="POST" action="{{ route('user-management.destroy', $user) }}" onsubmit="return confirm('Delete this user?')">@csrf @method('DELETE')<button class="hd-action hd-action-red" type="submit">Delete user</button></form>@endif
 </div>
diff --git a/resources/themes/backend/views/modules/user-management/permission-form.blade.php b/resources/themes/backend/views/modules/user-management/permission-form.blade.php
new file mode 100644
index 0000000..b551daa
--- /dev/null
+++ b/resources/themes/backend/views/modules/user-management/permission-form.blade.php
@@ -0,0 +1,15 @@
+<x-layouts::app :title="$permission->exists ? __('Edit Permission') : __('Create Permission')">
+<div class="hd-page-shell space-y-5">
+<section class="hd-page-hero"><div><div class="hd-eyebrow">Administration</div><h1>{{ $permission->exists ? 'Edit permission' : 'Create permission' }}</h1><p>Define a reusable permission for application roles.</p></div><a class="hd-action" href="{{ route('user-management.roles') }}">Back</a></section>
+@if($errors->any())<div class="hd-alert hd-alert-danger"><ul>@foreach($errors->all() as $error)<li>{{ $error }}</li>@endforeach</ul></div>@endif
+<form method="POST" action="{{ $permission->exists ? route('user-management.permissions.update', $permission) : route('user-management.permissions.store') }}" class="hd-panel p-6 space-y-6">
+@csrf @if($permission->exists) @method('PUT') @endif
+<div class="hd-form-grid">
+<label class="hd-field"><span>Name</span><input name="name" value="{{ old('name', $permission->name) }}" required></label>
+<label class="hd-field"><span>Slug</span><input name="slug" value="{{ old('slug', $permission->slug) }}" placeholder="e.g. helpdesk.manage"></label>
+</div>
+<label class="hd-field"><span>Description</span><textarea name="description">{{ old('description', $permission->description) }}</textarea></label>
+<div class="flex justify-end"><button class="hd-action hd-action-green" type="submit">Save permission</button></div>
+</form>
+</div>
+</x-layouts::app>
diff --git a/resources/themes/backend/views/modules/user-management/role-form.blade.php b/resources/themes/backend/views/modules/user-management/role-form.blade.php
new file mode 100644
index 0000000..373df90
--- /dev/null
+++ b/resources/themes/backend/views/modules/user-management/role-form.blade.php
@@ -0,0 +1,20 @@
+<x-layouts::app :title="$role->exists ? __('Edit Role') : __('Create Role')">
+<div class="hd-page-shell space-y-5">
+<section class="hd-page-hero"><div><div class="hd-eyebrow">Administration</div><h1>{{ $role->exists ? 'Edit role' : 'Create role' }}</h1><p>Define the role and the permissions it grants.</p></div><a class="hd-action" href="{{ route('user-management.roles') }}">Back</a></section>
+@if($errors->any())<div class="hd-alert hd-alert-danger"><ul>@foreach($errors->all() as $error)<li>{{ $error }}</li>@endforeach</ul></div>@endif
+<form method="POST" action="{{ $role->exists ? route('user-management.roles.update', $role) : route('user-management.roles.store') }}" class="hd-panel p-6 space-y-6">
+@csrf @if($role->exists) @method('PUT') @endif
+<div class="hd-form-grid">
+<label class="hd-field"><span>Name</span><input name="name" value="{{ old('name', $role->name) }}" required></label>
+<label class="hd-field"><span>Slug</span><input name="slug" value="{{ old('slug', $role->slug) }}" placeholder="auto-generated"></label>
+</div>
+<label class="hd-field"><span>Description</span><textarea name="description">{{ old('description', $role->description) }}</textarea></label>
+<div><h2 class="mb-3 text-lg font-semibold">Permissions</h2><div class="hd-role-options">
+@foreach($permissions as $permission)
+<label><input type="checkbox" name="permissions[]" value="{{ $permission->id }}" @checked(in_array($permission->id, old('permissions', $role->exists ? $role->permissions->pluck('id')->all() : [])))><span><strong>{{ $permission->name }}</strong><small>{{ $permission->slug }}</small></span></label>
+@endforeach
+</div></div>
+<div class="flex justify-end"><button class="hd-action hd-action-blue" type="submit">Save role</button></div>
+</form>
+</div>
+</x-layouts::app>
diff --git a/resources/themes/backend/views/modules/user-management/roles.blade.php b/resources/themes/backend/views/modules/user-management/roles.blade.php
index 1108b3c..3b40296 100644
--- a/resources/themes/backend/views/modules/user-management/roles.blade.php
+++ b/resources/themes/backend/views/modules/user-management/roles.blade.php
@@ -1,10 +1,69 @@
 <x-layouts::app :title="__('Roles & Permissions')">
 <div class="hd-page-shell space-y-5">
-<section class="hd-page-hero"><div><div class="hd-eyebrow">Administration</div><h1>Roles & permissions</h1><p>Helpdesk uses three clear access levels.</p></div></section>
-<div class="grid gap-4 lg:grid-cols-3">
-    <article class="hd-role-card hd-role-card-admin"><i class="fa-solid fa-shield-halved"></i><h2>Administrator</h2><strong>{{ $counts['admins'] }}</strong><p>Full tickets, settings, documentation and user management access.</p></article>
-    <article class="hd-role-card hd-role-card-agent"><i class="fa-solid fa-headset"></i><h2>Agent</h2><strong>{{ $counts['agents'] }}</strong><p>Can work tickets, Kanban workflow and support operations.</p></article>
-    <article class="hd-role-card"><i class="fa-solid fa-user"></i><h2>User</h2><strong>{{ $counts['users'] }}</strong><p>Standard authenticated requester access.</p></article>
-</div>
+    <section class="hd-page-hero">
+        <div>
+            <div class="hd-eyebrow">Administration</div>
+            <h1>Roles & permissions</h1>
+            <p>Create roles, define permissions and assign permissions to roles.</p>
+        </div>
+        <div class="flex flex-wrap gap-2">
+            <a class="hd-action hd-action-blue" href="{{ route('user-management.roles.create') }}"><i class="fa-solid fa-plus"></i> New role</a>
+            <a class="hd-action hd-action-green" href="{{ route('user-management.permissions.create') }}"><i class="fa-solid fa-key"></i> New permission</a>
+        </div>
+    </section>
+
+    @if(session('status'))<div class="hd-alert hd-alert-success">{{ session('status') }}</div>@endif
+    @if($errors->any())<div class="hd-alert hd-alert-danger"><ul>@foreach($errors->all() as $error)<li>{{ $error }}</li>@endforeach</ul></div>@endif
+
+    <section class="hd-panel overflow-x-auto">
+        <div class="p-5 border-b border-zinc-700"><h2 class="text-xl font-semibold">Roles</h2></div>
+        <table class="w-full min-w-[760px]">
+            <thead><tr><th>Name</th><th>Slug</th><th>Users</th><th>Permissions</th><th class="text-right">Actions</th></tr></thead>
+            <tbody>
+            @forelse($roles as $role)
+                <tr>
+                    <td><strong>{{ $role->name }}</strong>@if($role->is_system) <span class="hd-badge">System</span>@endif</td>
+                    <td><code>{{ $role->slug }}</code></td>
+                    <td>{{ $role->users_count }}</td>
+                    <td>{{ $role->permissions_count }}</td>
+                    <td><div class="flex justify-end gap-2">
+                        <a class="hd-action hd-action-blue" href="{{ route('user-management.roles.edit', $role) }}">Edit</a>
+                        @unless($role->is_system)
+                        <form method="POST" action="{{ route('user-management.roles.destroy', $role) }}" onsubmit="return confirm('Delete this role?')">@csrf @method('DELETE')
+                            <button class="hd-action hd-action-red" type="submit">Delete</button>
+                        </form>
+                        @endunless
+                    </div></td>
+                </tr>
+            @empty
+                <tr><td colspan="5" class="p-5">No roles created.</td></tr>
+            @endforelse
+            </tbody>
+        </table>
+    </section>
+
+    <section class="hd-panel overflow-x-auto">
+        <div class="p-5 border-b border-zinc-700"><h2 class="text-xl font-semibold">Permissions</h2></div>
+        <table class="w-full min-w-[760px]">
+            <thead><tr><th>Name</th><th>Slug</th><th>Roles</th><th class="text-right">Actions</th></tr></thead>
+            <tbody>
+            @forelse($permissions as $permission)
+                <tr>
+                    <td><strong>{{ $permission->name }}</strong></td>
+                    <td><code>{{ $permission->slug }}</code></td>
+                    <td>{{ $permission->roles_count }}</td>
+                    <td><div class="flex justify-end gap-2">
+                        <a class="hd-action hd-action-blue" href="{{ route('user-management.permissions.edit', $permission) }}">Edit</a>
+                        <form method="POST" action="{{ route('user-management.permissions.destroy', $permission) }}" onsubmit="return confirm('Delete this permission?')">@csrf @method('DELETE')
+                            <button class="hd-action hd-action-red" type="submit">Delete</button>
+                        </form>
+                    </div></td>
+                </tr>
+            @empty
+                <tr><td colspan="4" class="p-5">No permissions created.</td></tr>
+            @endforelse
+            </tbody>
+        </table>
+    </section>
 </div>
 </x-layouts::app>