diff --git a/app/Http/Controllers/Admin/AdminController.php b/app/Http/Controllers/Admin/AdminController.php
index bb2b4c6..688707c 100644
--- a/app/Http/Controllers/Admin/AdminController.php
+++ b/app/Http/Controllers/Admin/AdminController.php
@@ -6,6 +6,7 @@ use App\Http\Controllers\Controller;
 use App\Http\Requests\Admin\AdminStoreRequest;
 use App\Http\Requests\Admin\AdminUpdateRequest;
 use App\Models\Admin;
+use App\Models\Permission;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
@@ -60,7 +61,10 @@ class AdminController extends Controller
 
     public function create()
     {
-        return view('admin.admins.create');
+        $permissions = Permission::query()
+            ->orderBy('id')
+            ->get();
+        return view('admin.admins.create', compact('permissions'));
     }
 
     public function store(AdminStoreRequest $request)
@@ -148,5 +152,6 @@ class AdminController extends Controller
                 'success' => 'عملیات با موفقیت انجام شد'
             ]);
     }
+
 }
 
diff --git a/app/Models/Admin.php b/app/Models/Admin.php
index 7abeef2..b39ec3c 100644
--- a/app/Models/Admin.php
+++ b/app/Models/Admin.php
@@ -8,6 +8,7 @@ namespace App\Models;
 use App\Enums\AdminStatus;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Carbon\Carbon;
+use App\Models\Permission;
 use Illuminate\Database\Eloquent\Model;
 
 /**
@@ -53,4 +54,15 @@ class Admin extends Authenticatable
     {
         return $this->belongsTo(File::class, 'file_id');
     }
+
+
+    public function permissions()
+    {
+        return $this->belongsToMany(
+            Permission::class,
+            'admin_permission',
+            'admin_id',
+            'permission_id'
+        );
+    }
 }
diff --git a/bootstrap/app.php b/bootstrap/app.php
index f19ea8e..0a95f04 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Middleware\AdminPermissionMiddleware;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
@@ -17,6 +18,10 @@ return Application::configure(basePath: dirname(__DIR__))
     )
     ->withMiddleware(function (Middleware $middleware): void {
 
+        $middleware->alias([
+            'admin.permission' => AdminPermissionMiddleware::class,
+        ]);
+
         $middleware->redirectGuestsTo(function (Request $request) {
 
             if ($request->routeIs('admin.*')) {
diff --git a/routes/admin.php b/routes/admin.php
index 4c7d8f9..668e9e5 100644
--- a/routes/admin.php
+++ b/routes/admin.php
@@ -9,48 +9,64 @@ Route::prefix('admin')->name('admin.')->group(function () {
 
     Route::get('/', function () {
         return redirect()->route('admin.dashboard.index');
-
     })->name('index');
 
-    Route::prefix('auth')->name('auth.')->controller(AuthController::class)->group(function () {
+    Route::prefix('auth')
+        ->name('auth.')
+        ->controller(AuthController::class)
+        ->group(function () {
 
+            Route::prefix('login')
+                ->name('login.')
+                ->middleware('guest:admin')
+                ->group(function () {
 
-        Route::prefix('login')->name('login.')->middleware('guest:admin')->group(function () {
+                    Route::get('/', 'login')->name('index');
+                    Route::post('/', 'loginPost')->name('post');
 
-            Route::get('/', 'login')->name('index');
-            Route::post('/', 'loginPost')->name('post');
+                });
+
+            Route::get('logout', 'logout')
+                ->middleware('auth:admin')
+                ->name('logout');
         });
-
-        Route::get('logout', 'logout')->middleware('auth:admin')->name('logout');
-    });
     Route::middleware('auth:admin')->group(function () {
 
-        Route::get('dashboard', [DashboardController::class, 'index'])->name('dashboard.index');
+        Route::get(
+            'dashboard',
+            [DashboardController::class, 'index']
+        )->name('dashboard.index');
 
+        Route::prefix('admins')
+            ->name('admins.')
+            ->controller(AdminController::class)
+            ->group(function () {
 
+                Route::get('/', 'index')
+                    ->name('index')
+                    ->middleware('admin.permission:admins.index');
+                Route::get('create', 'create')
+                    ->name('create')
+                    ->middleware('admin.permission:admins.create');
 
+                Route::post('store', 'store')
+                    ->name('store')
+                    ->middleware('admin.permission:admins.create');
+                Route::prefix('{admin}')->group(function () {
+                    Route::get('edit', 'edit')
+                        ->name('edit')
+                        ->middleware('admin.permission:admins.edit');
+                    Route::put('update', 'update')
+                        ->name('update')
+                        ->middleware('admin.permission:admins.edit');
+                    Route::delete('destroy', 'destroy')
+                        ->name('destroy')
+                        ->middleware('admin.permission:admins.delete');
 
+                });
 
-});
+            });
 
-Route::prefix('admins')->name('admins.')->controller(AdminController::class)
-    ->group(function () {
-
-        Route::get('/', 'index')->name('index');
-
-        Route::get('create', 'create')->name('create');
-        Route::post('store', 'store')->name('store');
-
-        Route::prefix('{admin}')->group(function () {
-
-            Route::get('edit', 'edit')->name('edit');
-            Route::put('update', 'update')->name('update');
-
-            Route::delete('destroy', 'destroy')->name('destroy');
-        });
     });
+
 });
-
-
-
-