core/app/Policies/UserPolicy.php

<?php

namespace App\Policies;

use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;

class UserPolicy extends BasicPolicy
{
    use HandlesAuthorization;
    protected $entity = 'users';

    public function before(User $user, $ability)
    {
        if ($ability === 'view')
            return null;

        return parent::before($user, $ability);
    }

    /**
     * Can user see other users?
     *
     * @param User $currentUser
     * @param User $user
     *
     * @return bool
     */
    public function view(User $currentUser, User $user) {
        // user can se himself
        if ($currentUser->id == $user->id)
            return true;

        return $this->manage($currentUser);
    }

    /**
     * Can current user updates other users (or himself?)
     *
     * @param User $currentUser
     * @param User $user
     *
     * @return bool
     */
    public function update(User $currentUser, User $user)
    {
        return $currentUser->id == $user->id || $currentUser->hasAbility('update-users');
    }

    /**
     * Can user create other users?
     *
     * @param User $user
     *
     * @return bool
     */
    public function create(User $user) {
        return $user->hasAbility('create-users');
    }

    /**
     * Does current user has permissions for setting permissions to other users?
     *
     * @param User $currentUser
     * @param User $user
     *
     * @return bool
     */
    public function setPermissions(User $currentUser, User $user)
    {
        if ($currentUser->id == $user->id || $user->role == User::ROLE_VISITOR) {
            return false;
        }

        return $currentUser->hasAbility('set-permissions-users');
    }

    /**
     * Can logged user change status of other users?
     *
     * @param User $currentUser
     * @param User $user
     *
     * @return bool
     */
    public function changeStatus(User $currentUser, User $user)
    {
        if ($currentUser->id == $user->id) {
            return false;
        }

        return $currentUser->hasAbility('change-status-users');
    }

    /**
     * Can current user change role of other users?
     *
     * @param User $currentUser
     * @param User $user
     *
     * @return bool
     */
    public function changeRole(User $currentUser, User $user)
    {
        if ($currentUser->id == $user->id) {
            return false;
        }

        return $currentUser->hasAbility('change-role-users');
    }
}