diff --git a/app/Http/Middleware/AdminPermissionMiddleware.php b/app/Http/Middleware/AdminPermissionMiddleware.php
new file mode 100644
index 0000000..2e44149
--- /dev/null
+++ b/app/Http/Middleware/AdminPermissionMiddleware.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class AdminPermissionMiddleware
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next , string $permission): Response
+    {
+        $admin = auth('admin')->user();
+
+        $adminPermission = $admin->permission;
+
+        if (!$adminPermission || !$adminPermission->{$permission}) {
+            abort(403, 'شما اجازه دسترسی به این بخش را ندارید.');
+        }
+
+        return $next($request);
+    }
+}
diff --git a/app/Models/Admin.php b/app/Models/Admin.php
index 24d290d..47babe5 100644
--- a/app/Models/Admin.php
+++ b/app/Models/Admin.php
@@ -26,4 +26,9 @@ class Admin extends Authenticatable
         'status' => AdminStatus::class,
         'last_login_at' => 'datetime',
     ];
+
+    public function permission()
+    {
+        return $this->hasOne(AdminPermission::class);
+    }
 }
diff --git a/app/Models/AdminPermission.php b/app/Models/AdminPermission.php
new file mode 100644
index 0000000..bcf2a9c
--- /dev/null
+++ b/app/Models/AdminPermission.php
@@ -0,0 +1,89 @@
+<?php
+
+/**
+ * Created by Reliese Model.
+ */
+
+namespace App\Models;
+
+use Carbon\Carbon;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * Class AdminPermission
+ * 
+ * @property int $id
+ * @property int $admin_id
+ * @property bool $flight_create
+ * @property bool $flight_edit
+ * @property bool $flight_delete
+ * @property bool $tour_create
+ * @property bool $tour_edit
+ * @property bool $tour_delete
+ * @property bool $booking_view
+ * @property bool $booking_edit
+ * @property bool $booking_delete
+ * @property bool $user_view
+ * @property bool $user_edit
+ * @property bool $user_delete
+ * @property Carbon|null $created_at
+ * @property Carbon|null $updated_at
+ * @property bool $admin_view
+ * @property bool $admin_create
+ * @property bool $admin_edit
+ * @property bool $admin_delete
+ * 
+ * @property Admin $admin
+ *
+ * @package App\Models
+ */
+class AdminPermission extends Model
+{
+	protected $table = 'admin_permissions';
+	public static $snakeAttributes = false;
+
+	protected $casts = [
+		'admin_id' => 'int',
+		'flight_create' => 'bool',
+		'flight_edit' => 'bool',
+		'flight_delete' => 'bool',
+		'tour_create' => 'bool',
+		'tour_edit' => 'bool',
+		'tour_delete' => 'bool',
+		'booking_view' => 'bool',
+		'booking_edit' => 'bool',
+		'booking_delete' => 'bool',
+		'user_view' => 'bool',
+		'user_edit' => 'bool',
+		'user_delete' => 'bool',
+		'admin_view' => 'bool',
+		'admin_create' => 'bool',
+		'admin_edit' => 'bool',
+		'admin_delete' => 'bool'
+	];
+
+	protected $fillable = [
+		'admin_id',
+		'flight_create',
+		'flight_edit',
+		'flight_delete',
+		'tour_create',
+		'tour_edit',
+		'tour_delete',
+		'booking_view',
+		'booking_edit',
+		'booking_delete',
+		'user_view',
+		'user_edit',
+		'user_delete',
+		'admin_view',
+		'admin_create',
+		'admin_edit',
+		'admin_delete'
+	];
+
+	public function admin()
+	{
+		return $this->belongsTo(Admin::class);
+	}
+}
diff --git a/routes/admin.php b/routes/admin.php
index c112d26..1301a11 100644
--- a/routes/admin.php
+++ b/routes/admin.php
@@ -4,6 +4,7 @@
 use App\Http\Controllers\Admin\AdminController;
 use App\Http\Controllers\Admin\AuthController;
 use App\Http\Controllers\Admin\DashboardController;
+use App\Http\Controllers\Admin\UserController;
 use Illuminate\Support\Facades\Route;
 
 Route::prefix('admin')->name('admin.')->group(function () {
@@ -31,13 +32,28 @@ Route::prefix('admin')->name('admin.')->group(function () {
 
         Route::prefix('admins')->name('admins.')->controller(AdminController::class)->group(function () {
 
-            Route::get('/', 'index')->name('index');
+            Route::get('/', 'index')->name('index')->middleware('admin.permission:admin_view');
 
-            Route::get('create', 'create')->name('create');
-            Route::post('store', 'store')->name('store');
+            Route::get('create', 'create')->name('create')->middleware('admin.permission:admin_create');
+
+            Route::post('store', 'store')->name('store')->middleware('admin.permission:admin_create');
 
             Route::prefix('{admin}')->group(function () {
 
+                Route::get('edit', 'edit')->name('edit')->middleware('admin.permission:admin_edit');
+
+                Route::put('update', 'update')->name('update')->middleware('admin.permission:admin_edit');
+
+                Route::delete('destroy', 'destroy')->name('destroy')->middleware('admin.permission:admin_delete');
+            });
+        });
+
+        Route::prefix('users')->name('users.')->controller(UserController::class)->group(function () {
+
+            Route::get('/', 'index')->name('index');
+
+            Route::prefix('{user}')->group(function () {
+
                 Route::get('edit', 'edit')->name('edit');
                 Route::put('update', 'update')->name('update');
 
@@ -46,5 +62,4 @@ Route::prefix('admin')->name('admin.')->group(function () {
 
         });
     });
-
 });